ci(chapel): bump Chapel toolchain 2.3.0 -> 2.8.0 (closes #181)

Sibling estate repos `proven` (#141, admin-merged 2026-05-31) and
`panic-attack` (#85, the chapel-ci pilot) both moved to Chapel 2.8.0;
echidna was the lone laggard on 2.3.0. This bump closes the cross-repo
toolchain seam called out in #181.

Pattern reused verbatim from proven#141:
  * `CHAPEL_DEB_URL` -> ubuntu22 .deb at 2.8.0 (installs cleanly on the
    ubuntu24 runner image). SHA-256 verified out-of-band against the
    GitHub Releases asset
    (944a454b8a791f344312fcd261b562871159b74f5ef41d81e11833eb21d85f60).
  * `libunwind-dev` preinstall on every chapel-installing job - without
    it the chapel-built smoke binary fails to run with
    `libunwind.so.8: cannot open shared object`.
  * Top-level `env:` block hoists the version pin so all three install
    sites stay in sync; `chpl --version` echoed on each install to make
    the log self-describing.
  * No `CHPL_TARGET_*` overrides needed (sibling pattern: the 2.3.0-era
    runtime-tuple mismatch is gone on 2.8.0).

Sources audited for the four documented 2.8.0 keyword gotchas
(`out`/`label` reserved-as-locals, single-quoted char literals, Justfile
`env(...) + str` paren rule) - echidna's .chpl already uses 2.x APIs
(`createCopyingBuffer`, `sendPosixSignal`, `compareAndSwap`) and trips
NONE of them. The only source-side touch is updating one comment in
`chapel_ffi_exports.chpl` to reference the new .deb filename.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/chapel-ci.yml

@@ -27,6 +27,17 @@ concurrency:
 
 permissions: read-all
 
+# Pinned Chapel deb (Ubuntu 22.04 amd64; installs cleanly on the
+# ubuntu24 runner). SHA-256 verified against the GitHub Releases asset;
+# mismatch fails the install step. Bumped 2.3.0 -> 2.8.0 (issue #181)
+# to track sibling estate repos proven (#141) and panic-attack (#85),
+# both of which validated this URL+SHA combo against the same
+# `ubuntu-latest` runner image we use here.
+env:
+  CHAPEL_VERSION: '2.8.0'
+  CHAPEL_DEB_URL: 'https://github.com/chapel-lang/chapel/releases/download/2.8.0/chapel-2.8.0-1.ubuntu22.amd64.deb'
+  CHAPEL_DEB_SHA256: '944a454b8a791f344312fcd261b562871159b74f5ef41d81e11833eb21d85f60'
+
 jobs:
   # Job 1: Compile Chapel .chpl files into a static library.
   #
@@ -35,13 +46,14 @@ jobs:
   # compiling, the workflow fails.
   #
   # Why --static and not --dynamic:
-  #   The official apt deb (chapel-2.3.0-1.ubuntu24.amd64.deb) ships only
-  #   the CHPL_LIB_PIC=none runtime variant. Building a shared library
-  #   requires CHPL_LIB_PIC=pic runtime objects which are not in the
-  #   package; the linker rejects the non-PIC `libchpl.a` with
+  #   The official apt deb (chapel-${CHAPEL_VERSION}-1.ubuntu22.amd64.deb)
+  #   ships only the CHPL_LIB_PIC=none runtime variant. Building a shared
+  #   library requires CHPL_LIB_PIC=pic runtime objects which are not in
+  #   the package; the linker rejects the non-PIC `libchpl.a` with
   #   `relocation R_X86_64_TPOFF32 ... can not be used when making a
   #   shared object`. Until the CI image ships a PIC-enabled runtime
-  #   (or we adopt a from-source Chapel build), the metalayer is
+  #   (or we adopt a from-source Chapel build via the
+  #   `chapel-pic-from-source` Justfile recipe), the metalayer is
   #   distributed as `libechidna_chapel.a` and the Zig FFI links it
   #   statically.
   chapel-build:
@@ -50,14 +62,18 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install Chapel
+      - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
-          # Install Chapel from official apt repository.
-          # SHA256 of the deb is pinned for supply-chain integrity; bump
-          # alongside the version tag when upgrading.
-          curl -fsSL --max-time 300 \
-            https://github.com/chapel-lang/chapel/releases/download/2.3.0/chapel-2.3.0-1.ubuntu24.amd64.deb \
-            -o /tmp/chapel.deb
+          set -euo pipefail
+          # libunwind-dev is a runtime link-time dep for chpl-built binaries
+          # on the ubuntu .deb path; sibling estate repo panic-attack (#85)
+          # established this preinstall as the working pattern, reused by
+          # proven (#141). Without it the chapel-build smoke link fails with
+          # `error while loading shared libraries: libunwind.so.8`.
+          sudo apt-get update -qq
+          sudo apt-get install -y libunwind-dev
+          curl -fsSL --max-time 300 --retry 3 -o /tmp/chapel.deb "$CHAPEL_DEB_URL"
+          echo "$CHAPEL_DEB_SHA256  /tmp/chapel.deb" | sha256sum --check
           sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y
           chpl --version
 
@@ -165,11 +181,13 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install Chapel
+      - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
-          curl -fsSL --max-time 300 \
-            https://github.com/chapel-lang/chapel/releases/download/2.3.0/chapel-2.3.0-1.ubuntu24.amd64.deb \
-            -o /tmp/chapel.deb
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y libunwind-dev
+          curl -fsSL --max-time 300 --retry 3 -o /tmp/chapel.deb "$CHAPEL_DEB_URL"
+          echo "$CHAPEL_DEB_SHA256  /tmp/chapel.deb" | sha256sum --check
           sudo dpkg -i /tmp/chapel.deb || sudo apt-get install -f -y
           chpl --version
 

src/chapel/chapel_ffi_exports.chpl

@@ -44,7 +44,7 @@ extern record CProofResult {
 
 // (Was originally `extern "C" { ... }`, but Chapel's extern-blocks feature
 // requires a Chapel install built with LLVM + clang headers; the official
-// `chapel-2.3.0-1.ubuntu24.amd64.deb` used in `chapel-ci.yml` is not. The
+// `chapel-2.8.0-1.ubuntu22.amd64.deb` used in `chapel-ci.yml` is not. The
 // canonical C-visible copy lives in `src/zig_ffi/chapel_ffi_exports.h`
 // (`#define PROVER_AGDA 0`…), which is what every non-Chapel consumer
 // reads; the constants below only need module-level scope inside Chapel.