[2kai2kai2]

Summary by CodeRabbit

• New Features

  • Added automated builds for CFFI engine libraries across supported platforms.
  • CFFI libraries and checksums are now published with releases and included in generated package manifests.
  • Added compatibility metadata for describing CFFI artifacts.

• Bug Fixes

  • Release publishing now avoids overwriting existing assets and verifies matching contents.

• Tests

  • Added cross-platform smoke tests to verify library loading and version reporting.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
beps	Ready	Preview, Comment	Jul 15, 2026 6:00pm
promptfiddle	Ready	Preview, Comment	Jul 15, 2026 6:00pm
promptfiddle2	Ready	Preview, Comment	Jul 15, 2026 6:00pm

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a reusable matrix workflow for building and validating bridge_cffi libraries, publishes those assets with release artifacts, and extends toolchain manifests with per-target CFFI URLs and checksums.

Changes

CFFI release flow

Layer / File(s)	Summary
Build and validate CFFI libraries .github/workflows/build2-bridge-cffi.reusable.yaml, baml_language/Cargo.toml, scripts/smoke-bridge-cffi.py	Builds target-specific cdylibs with unwind panic handling, renames and checksums outputs, smoke-tests selected targets, and uploads artifacts.
Represent and collect CFFI artifacts baml_language/crates/baml_release/src/manifest.rs, scripts/baml-release-manifests	Adds optional validated CFFI manifest entries and collects matching libraries with release URLs and SHA256 hashes.
Publish assets and generate manifests .github/workflows/release-baml-language.yml	Builds and gates CFFI assets, publishes them without differing overwrites, and includes them in normal and dry-run manifests.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant BuildWorkflow
  participant Cargo
  participant GitHubRelease
  participant ManifestGenerator
  ReleaseWorkflow->>BuildWorkflow: Invoke matrix CFFI build
  BuildWorkflow->>Cargo: Build bridge_cffi for target
  Cargo-->>BuildWorkflow: Return cdylib
  BuildWorkflow->>ReleaseWorkflow: Upload library and checksum artifact
  ReleaseWorkflow->>GitHubRelease: Publish or verify release assets
  ReleaseWorkflow->>ManifestGenerator: Generate manifest with CFFI directory
  ManifestGenerator-->>ReleaseWorkflow: Return CFFI URLs and SHA256 values

Loading

Possibly related PRs

• BoundaryML/baml#3783: Updates the related embedded bridge panic configuration.
• BoundaryML/baml#4033: Introduces related Rust bridge and CFFI release workflows.

Suggested reviewers: rossirpaulo, sxlijin

Poem

I’m a rabbit with libraries tucked in my burrow,
Checksums sparkle where release wheels once furrowed.
Rust builds hop across targets bright,
Smoke tests nibble versions just right.
Manifests bloom with CFFI in sight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding a CFFI dylib release pipeline.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch kai/cffi-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏭️ Performance benchmarks were skipped

Perf benchmarks (CodSpeed) are opt-in on pull requests — they no longer run on every push. They always run automatically after merge to canary/main.

To run them on this PR, do any of the following, then push a commit (or re-run CI):

• Add RUN_CODSPEED=1 to the PR description, or
• Include run-perf or /perf in the PR title or any commit message.

[github-actions]

Binary size checks passed

✅ 7 passed

	Artifact	Platform	File	Gzip	Gated on	Baseline	Delta	Status
✅	baml-cli	Linux	🔒 22.8 MB	9.7 MB	file	22.8 MB	+54.9 KB (+0.2%)	OK
✅	packed-program	Linux	🔒 16.3 MB	6.8 MB	file	16.3 MB	+20.5 KB (+0.1%)	OK
✅	baml-cli	macOS	🔒 17.6 MB	8.5 MB	file	17.5 MB	+49.7 KB (+0.3%)	OK
✅	packed-program	macOS	🔒 12.6 MB	6.0 MB	file	12.6 MB	+16 B (+0.0%)	OK
✅	baml-cli	Windows	🔒 19.1 MB	8.7 MB	file	18.7 MB	+412.2 KB (+2.2%)	OK
✅	packed-program	Windows	🔒 13.5 MB	6.1 MB	file	13.5 MB	+4.1 KB (+0.0%)	OK
✅	bridge_wasm	WASM	15.2 MB	🔒 4.3 MB	gzip	4.3 MB	+3.6 KB (+0.1%)	OK

🔒 = the size this artifact is GATED on (ceiling + delta). Binaries gate on file size (installed binary); WASM gates on gzip (download size). The other size is shown for information only.

---

Generated by cargo size-gate · workflow run

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/build2-bridge-cffi.reusable.yaml (1)

212-224: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Avoid direct ${{ }} step-output interpolation in run: (zizmor: template-injection).

steps.artifact.outputs.dir/.asset are expanded directly into the shell command. They're currently derived only from the hardcoded matrix target literal, so this isn't exploitable today, but it's the pattern static analysis flags as risky if these outputs ever become less trusted. Pass them through env: instead so they're shell-quoted as variables rather than expanded into the script text.

🛡️ Proposed fix

       - name: Smoke test the built library
         if: matrix._.smoke
         working-directory: baml_language
+        env:
+          ARTIFACT_DIR: ${{ steps.artifact.outputs.dir }}
+          ARTIFACT_ASSET: ${{ steps.artifact.outputs.asset }}
         run: |
           set -euo pipefail
           expected="$(jq -r .canonical_version ../release-plan.json)"
           python3 ../scripts/smoke-bridge-cffi.py \
-            "${{ steps.artifact.outputs.dir }}/${{ steps.artifact.outputs.asset }}" \
+            "${ARTIFACT_DIR}/${ARTIFACT_ASSET}" \
             "$expected"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build2-bridge-cffi.reusable.yaml around lines 212 - 224,
Update the “Smoke test the built library” step to pass
steps.artifact.outputs.dir and steps.artifact.outputs.asset through the step’s
env configuration, then reference those environment variables in the python3
command instead of direct GitHub expression interpolation inside run:. Preserve
the existing smoke-test arguments and behavior.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/build2-bridge-cffi.reusable.yaml:
- Around line 212-224: Update the “Smoke test the built library” step to pass
steps.artifact.outputs.dir and steps.artifact.outputs.asset through the step’s
env configuration, then reference those environment variables in the python3
command instead of direct GitHub expression interpolation inside run:. Preserve
the existing smoke-test arguments and behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 405345e9-28b7-4a67-a3f8-18e01f4748a9

📥 Commits

Reviewing files that changed from the base of the PR and between 2660b8b and 9acb629.

📒 Files selected for processing (6)

• .github/workflows/build2-bridge-cffi.reusable.yaml
• .github/workflows/release-baml-language.yml
• baml_language/Cargo.toml
• baml_language/crates/baml_release/src/manifest.rs
• scripts/baml-release-manifests
• scripts/smoke-bridge-cffi.py