ci.yml

name: CI

permissions:
  contents: read

on:
  push:
    branches:
      - main
      - ulitebox
  pull_request:
  merge_group:
  workflow_dispatch:

# If a new commit is pushed to the branch before ongoing runs finish, cancel the ongoing runs
concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  NEXTEST_VERSION: 0.9.114

jobs:
  build_and_test:
    name: Build and Test
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: -Dwarnings
      RUSTDOCFLAGS: -Dwarnings
    steps:
      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Use Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
      - name: Set up Rust
        run: |
          rustup toolchain install $(awk -F'"' '/channel/{print $2}' rust-toolchain.toml) --profile minimal --no-self-update --component rustfmt,clippy --target x86_64-unknown-linux-gnu
      - name: Set up Nextest
        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
        with:
          tool: nextest@${{ env.NEXTEST_VERSION }}
      - name: Install iperf3
        run: |
          sudo apt install -y iperf3
      - name: Install diod
        run: |
          sudo apt install -y diod
      - name: Install AArch64 binutils
        run: |
          sudo apt install -y binutils-aarch64-linux-gnu
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - name: Cache custom out directories
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            target/*/build/litebox_runner_linux_userland-*/out
          key: custom-out-${{ runner.os }}-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }}-${{ hashFiles('**/litebox_syscall_rewriter/**/*.rs') }}
      - run: ./.github/tools/github_actions_run_cargo fmt
      - run: |
          ./.github/tools/github_actions_run_cargo clippy --all-targets --all-features --workspace --exclude litebox_runner_lvbs --exclude litebox_runner_snp --exclude litebox_runner_optee_on_linux_userland --exclude litebox_runner_linux_on_macos_userland
          ./.github/tools/github_actions_run_cargo clippy --all-targets --all-features -p litebox_runner_optee_on_linux_userland
          # We exclude `litebox_runner_lvbs` because it requires a custom target and nightly
          # features. `build_and_test_lvbs` covers it.
          # `litebox_runner_optee_on_linux_userland` conflicts with `litebox_runner_linux_userland` due to
          # feature unification (`optee_syscall` versus `linux_syscall`). Build it separately for now.
      - run: |
          ./.github/tools/github_actions_run_cargo build
          ./.github/tools/github_actions_run_cargo build -p litebox_runner_optee_on_linux_userland
      - run: |
          ./.github/tools/github_actions_run_cargo nextest
          ./.github/tools/github_actions_run_cargo nextest -p litebox_runner_optee_on_linux_userland
      - run: |
          ./.github/tools/github_actions_run_cargo test --doc
          # We need to run `cargo test --doc` separately because doc tests
          # aren't included in nextest at the moment. See relevant discussion at
          # https://github.com/nextest-rs/nextest/issues/16
      - name: Build documentation (fail on warnings)
        run: ./.github/tools/github_actions_run_cargo doc --no-deps --all-features --document-private-items --workspace --exclude litebox_runner_lvbs --exclude litebox_runner_snp --exclude litebox_runner_linux_on_macos_userland

  build_and_test_arm64:
    name: Build and Test (AArch64)
    runs-on: ubuntu-24.04-arm
    env:
      RUSTFLAGS: -Dwarnings
      # Crates that build and run on AArch64. Linux-on-Linux userland is the
      # only configuration AArch64 supports, so the other runners (LVBS, SNP)
      # and shims (Windows, OP-TEE) are left to the x86-64 job. This list grows
      # as each crate gains AArch64 support, so that the PR adding that support
      # is the PR this job starts covering it.
      AARCH64_CRATES: >-
        -p litebox
        -p litebox_broker_core
        -p litebox_broker_userland
        -p litebox_common_linux
        -p litebox_egress_proxy
        -p litebox_syscall_rewriter
        -p litebox_packager
        -p litebox_platform_linux_userland
        -p litebox_shim_linux
        -p litebox_runner_linux_userland
    steps:
      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Rust
        run: |
          rustup toolchain install $(awk -F'"' '/channel/{print $2}' rust-toolchain.toml) --profile minimal --no-self-update --component rustfmt,clippy
      - name: Set up Nextest
        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
        with:
          tool: nextest@${{ env.NEXTEST_VERSION }}
      - name: Install iperf3
        run: |
          sudo apt install -y iperf3
      - name: Install diod
        run: |
          sudo apt install -y diod
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - name: Cache custom out directories
        uses: actions/cache@v5
        with:
          path: |
            target/*/build/litebox_runner_linux_userland-*/out
          key: custom-out-${{ runner.os }}-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }}-${{ hashFiles('**/litebox_syscall_rewriter/**/*.rs') }}
      - run: ./.github/tools/github_actions_run_cargo fmt
      - run: |
          ./.github/tools/github_actions_run_cargo clippy --all-targets --all-features $AARCH64_CRATES
      - run: ./.github/tools/github_actions_run_cargo build $AARCH64_CRATES --features litebox_common_linux/aarch64_gate_recovery
      - run: ./.github/tools/github_actions_run_cargo nextest $AARCH64_CRATES --features litebox_common_linux/aarch64_gate_recovery
      - name: Test AArch64 x18 virtualization
        run: |
          ./.github/tools/github_actions_run_cargo nextest -p litebox_syscall_rewriter -p litebox_platform_linux_userland -p litebox_shim_linux --features litebox_platform_linux_userland/aarch64_virtualize_x18,litebox_shim_linux/aarch64_virtualize_x18
          ./.github/tools/github_actions_run_cargo nextest -p litebox_runner_linux_userland --features litebox_runner_linux_userland/aarch64_virtualize_x18 -E 'binary(run) or binary(rewritten_guests)'
      # Nextest does not run doctests.
      - run: |
          ./.github/tools/github_actions_run_cargo test --doc $AARCH64_CRATES --features litebox_common_linux/aarch64_gate_recovery
      - name: Build documentation (fail on warnings)
        env:
          RUSTDOCFLAGS: -Dwarnings
        run: ./.github/tools/github_actions_run_cargo doc --no-deps --all-features --document-private-items $AARCH64_CRATES

  build_and_test_macos_arm64:
    name: Build and Test (macOS AArch64)
    runs-on: macos-15
    env:
      RUSTFLAGS: -Dwarnings
      MACOS_AARCH64_CRATES: >-
        -p dev_tests
        -p litebox
        -p litebox_common_linux
        -p litebox_common_macos
        -p litebox_syscall_rewriter
        -p litebox_platform_macos_userland
        -p litebox_shim_linux
        -p litebox_shim_macos
        -p litebox_runner_linux_on_macos_userland
        -p litebox_runner_macos_userland
    steps:
      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Verify AArch64 host
        run: test "$(uname -m)" = arm64
      - name: Set up Rust
        run: |
          rustup toolchain install $(awk -F'"' '/channel/{print $2}' rust-toolchain.toml) --profile minimal --no-self-update --component rustfmt,clippy
      - name: Set up Nextest
        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
        with:
          tool: nextest@${{ env.NEXTEST_VERSION }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: ./.github/tools/github_actions_run_cargo fmt
      - run: ./.github/tools/github_actions_run_cargo clippy --all-targets --all-features $MACOS_AARCH64_CRATES
      - run: ./.github/tools/github_actions_run_cargo build $MACOS_AARCH64_CRATES
      - run: ./.github/tools/github_actions_run_cargo nextest $MACOS_AARCH64_CRATES
      - name: Test native macOS runner with in-process broker
        run: >-
          ./.github/tools/github_actions_run_cargo nextest
          -p litebox_runner_macos_userland --features test-broker
      - name: Check native macOS platform without subpage compatibility
        run: |
          ./.github/tools/github_actions_run_cargo clippy --all-targets --no-default-features -p litebox_platform_macos_userland
          ./.github/tools/github_actions_run_cargo nextest --no-default-features -p litebox_platform_macos_userland
      - run: ./.github/tools/github_actions_run_cargo test --doc $MACOS_AARCH64_CRATES
      - name: Build documentation (fail on warnings)
        env:
          RUSTDOCFLAGS: -Dwarnings
        run: ./.github/tools/github_actions_run_cargo doc --no-deps --all-features --document-private-items $MACOS_AARCH64_CRATES

  build_and_test_lvbs:
    name: Build and Test LVBS
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: -Dwarnings
    steps:
      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # LVBS requires a nightly toolchain because:
      # 1. It uses a custom target (x86_64_vtl1.json) for bare-metal VTL1 kernel development
      # 2. The custom target requires `-Z build-std` to build core/alloc from source
      # 3. build-std is needed to compile the standard library with SSE support, which is
      #    required by dependencies like `libm` (used by RSA/crypto for authenticode verification)
      # 4. The built-in x86_64-unknown-none target uses soft-float (no SSE), causing ABI
      #    incompatibility when SSE-using dependencies are linked against a soft-float stdlib
      #
      # Version alignment: The nightly version should match the stable version (e.g., stable
      # 1.91.x -> nightly 1.91.x). Use `rustc +nightly-YYYY-MM-DD --version` to find a date.
      - name: Set up Rust
        run: |
          RUST_CHANNEL=$(awk -F'"' '/channel/{print $2}' litebox_runner_lvbs/rust-toolchain.toml)
          rustup toolchain install ${RUST_CHANNEL} --profile minimal --no-self-update --component rustfmt,clippy --target x86_64-unknown-none
          rustup component add rust-src --toolchain ${RUST_CHANNEL}-x86_64-unknown-linux-gnu
          rustup default ${RUST_CHANNEL}
          rustup override set ${RUST_CHANNEL}
          rustup show
      - name: Set up Nextest
        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
        with:
          tool: nextest@${{ env.NEXTEST_VERSION }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - name: Cache custom out directories
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            target/*/build/litebox_runner_linux_userland-*/out
          key: custom-out-${{ runner.os }}-${{ github.job }}-${{ hashFiles('**/Cargo.lock') }}-${{ hashFiles('**/litebox_syscall_rewriter/**/*.rs') }}
      - run: |
          ./.github/tools/github_actions_run_cargo clippy --all-targets --all-features
          # Run clippy for lvbs with custom target (requires build-std)
          ./.github/tools/github_actions_run_cargo clippy -Z build-std-features=compiler-builtins-mem -Z build-std=core,alloc --manifest-path=litebox_runner_lvbs/Cargo.toml --target litebox_runner_lvbs/x86_64_vtl1.json --all-features
      - run: |
          ./.github/tools/github_actions_run_cargo build
          ./.github/tools/github_actions_run_cargo build -Z build-std-features=compiler-builtins-mem -Z build-std=core,alloc --manifest-path=litebox_runner_lvbs/Cargo.toml --target litebox_runner_lvbs/x86_64_vtl1.json
      - run: ./.github/tools/github_actions_run_cargo nextest -p litebox_platform_lvbs
      - run: |
          ./.github/tools/github_actions_run_cargo test --doc
          # We need to run `cargo test --doc` separately because doc tests
          # aren't included in nextest at the moment. See relevant discussion at
          # https://github.com/nextest-rs/nextest/issues/16
      - name: Build documentation (fail on warnings)
        run: ./.github/tools/github_actions_run_cargo doc --no-deps --all-features --document-private-items

  build_and_test_windows:
    name: Build and Test Windows
    runs-on: windows-latest
    env:
      RUSTFLAGS: -Dwarnings
      RUSTDOCFLAGS: -Dwarnings
      # Crates that build and run on Windows.
      WINDOWS_CRATES: >-
        -p litebox_common_linux
        -p litebox_common_windows
        -p litebox_egress_proxy
        -p litebox_syscall_rewriter
        -p litebox_packager
        -p litebox_broker_protocol
        -p litebox_broker_transport
        -p litebox_broker_local_userland
        -p litebox_broker_core
        -p litebox_broker_local
        -p litebox_broker_host
        -p litebox_broker_transport_windows_userland
        -p litebox_broker_platform_windows_userland
        -p litebox_platform_windows_userland
        -p litebox_shim_linux
        -p litebox_shim_windows
        -p litebox_runner_linux_on_windows_userland
        -p litebox_runner_windows_userland
    steps:
      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Rust
        run: |
          rustup toolchain install $(awk -F'"' '/channel/{print $2}' rust-toolchain.toml) --profile minimal --no-self-update --component rustfmt,clippy --target x86_64-pc-windows-msvc
      - name: Set up Nextest
        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
        with:
          tool: nextest@${{ env.NEXTEST_VERSION }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo clippy --locked --verbose --all-targets --all-features ($env:WINDOWS_CRATES -split ' ')
      - run: cargo build --locked --verbose ($env:WINDOWS_CRATES -split ' ')
      - run: cargo nextest run --locked --profile ci ($env:WINDOWS_CRATES -split ' ')
      - run: |
          cargo test --locked --verbose --doc ($env:WINDOWS_CRATES -split ' ')
          # We need to run `cargo test --doc` separately because doc tests
          # aren't included in nextest at the moment. See relevant discussion at
          # https://github.com/nextest-rs/nextest/issues/16
      - name: Build documentation (fail on warnings)
        run: cargo doc --locked --verbose --no-deps --all-features --document-private-items ($env:WINDOWS_CRATES -split ' ')

  build_and_test_snp:
    name: Build and Test SNP
    runs-on: ubuntu-latest
    env:
      RUSTFLAGS: -Dwarnings
    steps:
      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Rust
        run: |
          RUST_CHANNEL=$(awk -F'"' '/channel/{print $2}' litebox_runner_snp/rust-toolchain.toml)
          rustup toolchain install ${RUST_CHANNEL} --profile minimal --no-self-update --component rustfmt,clippy --target x86_64-unknown-none
          rustup component add rust-src --toolchain ${RUST_CHANNEL}-x86_64-unknown-linux-gnu
          rustup default ${RUST_CHANNEL}
          rustup override set ${RUST_CHANNEL}
          rustup show
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: ./.github/tools/github_actions_run_cargo clippy --all-features --target litebox_runner_snp/target.json --manifest-path=litebox_runner_snp/Cargo.toml -Zbuild-std=core,compiler_builtins,alloc
      - run: |
          ./.github/tools/github_actions_run_cargo build -Zbuild-std=core,compiler_builtins,alloc -Zbuild-std-features=compiler-builtins-mem --manifest-path=litebox_runner_snp/Cargo.toml --target litebox_runner_snp/target.json
      - name: Build documentation (fail on warnings)
        run: ./.github/tools/github_actions_run_cargo doc --no-deps --all-features --document-private-items

  confirm_no_std:
    name: Confirm no_std
    runs-on: ubuntu-latest
    steps:
      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Rust
        run: |
          rustup toolchain install $(awk -F'"' '/channel/{print $2}' rust-toolchain.toml) --profile minimal --no-self-update --target x86_64-unknown-none
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - name: Confirm that we haven't accidentally pulled in std into LiteBox
        run: |
          # Essentially, we run a build on a target that simply does NOT have
          # `std` support at all. If that build succeeds, then we know that the
          # litebox crate has not accidentally pulled in `std` from a dependency
          # that is not a `#[no_std]` crate.
          #
          # This build will fail if any of the dependencies of `litebox` pull in
          # `std`. Unfortunately, the error message is not very useful to point
          # out _which_ dependency pulled in `std`, but otoh, hopefully it
          # should be quite obvious by looking at the PR itself.
          #
          # The `find` invocation runs through every `Cargo.toml` in the
          # repository, and runs a build with `x86_64-unknown-none` target
          # (which does not support `std`), thereby catching any crate that
          # pulls in an std-crate accidentally. The `-not -path` lines are an
          # allow-list (i.e., crates that are allowed to have `std`).
          #
          # Reason for each item in allow-list:
          #
          # - `.` is itself special, since it would otherwise trigger a
          #   full-workspace check, which we don't want, thus we allow that one
          #   in particular to also have `std` in it.
          #
          # - `litebox_platform_linux_userland` is allowed to have `std` access,
          #   since it is a purely-userland implementation.
          #
          # - `litebox_platform_macos_userland` is allowed to have `std` access,
          #   since it is a purely-userland implementation.
          #
          # - `litebox_platform_windows_userland` is allowed to have `std` access,
          #   since it is a purely-userland implementation.
          #
          # - `litebox_broker_transport_linux_userland` is allowed to have
          #   `std` access, since it is the Linux-userland binding that owns
          #   both the local and the broker/host endpoints of the current
          #   Unix-domain-socket control channel.
          #
          # - `litebox_broker_local_userland` is allowed to have `std` access,
          #   since it binds the portable broker local endpoint to the hosted
          #   Linux or Windows userland transport.
          #
          # - `litebox_broker_transport_windows_userland` is allowed to have
          #   `std` access, since it is the Windows-userland binding for the
          #   broker control channel.
          #
          # - `litebox_broker_platform_linux_userland` is allowed to have
          #   `std` access, since it owns hosted Linux broker resources such as
          #   sockets and the epoll reactor.
          #
          # - `litebox_broker_platform_windows_userland` is allowed to have
          #   `std` access, since it owns hosted Windows broker resources.
          #
          # - `litebox_broker_userland` is allowed to have `std` access,
          #   since it is the hosted userland broker executable.
          #
          # - `litebox_egress_proxy` is allowed to have `std` access, since it
          #   is the hosted userland CONNECT proxy executable.
          #
          # - `litebox_platform_lvbs` has a custom target (`no_std`), so it does
          #   not work with the current no_std checker.
          #
          # - `litebox_runner_linux_on_macos_userland` is allowed to have `std`
          #   access since it loads files and runs LiteBox on a hosted platform.
          #
          # - `litebox_runner_macos_userland` is allowed to have `std` access,
          #   since it loads Mach-O files and launches guests on hosted macOS.
          #
          # - `litebox_runner_linux_on_windows_userland` is allowed to have `std`
          #   access since it is a hosted executable that connects to the broker
          #   and launches the LiteBox guest.
          #
          # - `litebox_runner_windows_on_linux_userland` is allowed to have `std`
          #   access since it needs to actually access the file-system, pull in
          #   relevant files, and then actually trigger LiteBox itself.
          #
          # - `litebox_runner_linux_userland` is allowed to have `std` access
          #   since it is a hosted executable that connects to the broker and
          #   launches the LiteBox guest.
          #
          # - `litebox_runner_windows_userland` is allowed to have `std` access
          #   since it needs to actually access the file-system, pull in
          #   relevant files, and then actually trigger LiteBox itself.
          #
          # - `litebox_runner_lvbs` has a custom target (`no_std`), so it does
          #   not work with the current no_std checker.
          #
          # - `litebox_runner_optee_on_linux_userland` is allowed to have `std`
          #   access since it needs to actually access the file-system, pull in
          #   relevant files, and then actually trigger LiteBox itself.
          #
          # - `litebox_shim_optee` is `no_std`, but the builtin
          #   `x86_64-unknown-none` target is soft-float, which its crypto
          #   dependencies cannot lower. The shipped target,
          #   `litebox_runner_lvbs/x86_64_vtl1.json`, satisfies that
          #   requirement.
          #
          # - `litebox_shim_windows` itself is `no_std` but depends on
          #   `litebox_platform_multiplex`.
          #
          # - `litebox_syscall_rewriter` is allowed to have `std` access since
          #   it is a helper binary that runs in userland to AOT "compile" ELFs.
          #
          # - `litebox_packager` is allowed to have `std` access since it is a
          #   userland CLI tool that packages ELF programs for LiteBox.
          #
          # - `litebox_runner_snp` is `no_std` but requires custom target to build
          # - `litebox_runner_snp` is temporarily disabled until SNP networking
          #   can use a kernel-mode broker
          #
          # - `litebox_service_heki` is excluded for the same reason as
          #   `litebox_shim_optee` above; it also pulls in crypto dependencies.
          #
          # - `dev_tests` is meant to only be used for tests, and thus can
          #   safely use std.
          #
          # - `dev_bench` is meant to only be used for benchmarking, and thus
          #   can safely use std.
          find . -type f -name 'Cargo.toml' \
            -not -path './Cargo.toml' \
            -not -path './litebox_broker_local_userland/Cargo.toml' \
            -not -path './litebox_broker_platform_linux_userland/Cargo.toml' \
            -not -path './litebox_broker_platform_windows_userland/Cargo.toml' \
            -not -path './litebox_broker_transport_linux_userland/Cargo.toml' \
            -not -path './litebox_broker_transport_windows_userland/Cargo.toml' \
            -not -path './litebox_broker_userland/Cargo.toml' \
            -not -path './litebox_egress_proxy/Cargo.toml' \
            -not -path './litebox_platform_linux_userland/Cargo.toml' \
            -not -path './litebox_platform_macos_userland/Cargo.toml' \
            -not -path './litebox_platform_windows_userland/Cargo.toml' \
            -not -path './litebox_runner_linux_on_macos_userland/Cargo.toml' \
            -not -path './litebox_runner_macos_userland/Cargo.toml' \
            -not -path './litebox_runner_linux_on_windows_userland/Cargo.toml' \
            -not -path './litebox_runner_windows_on_linux_userland/Cargo.toml' \
            -not -path './litebox_platform_lvbs/Cargo.toml' \
            -not -path './litebox_runner_linux_userland/Cargo.toml' \
            -not -path './litebox_runner_windows_userland/Cargo.toml' \
            -not -path './litebox_runner_lvbs/Cargo.toml' \
            -not -path './litebox_runner_optee_on_linux_userland/Cargo.toml' \
            -not -path './litebox_shim_optee/Cargo.toml' \
            -not -path './litebox_shim_windows/Cargo.toml' \
            -not -path './litebox_syscall_rewriter/Cargo.toml' \
            -not -path './litebox_packager/Cargo.toml' \
            -not -path './litebox_runner_snp/Cargo.toml' \
            -not -path './litebox_service_heki/Cargo.toml' \
            -not -path './dev_tests/Cargo.toml' \
            -not -path './dev_bench/Cargo.toml' \
            -print0 | \
              xargs -0 -I '{}' sh -c 'cd "$(dirname "{}")"; pwd; cargo build --locked --target x86_64-unknown-none || exit 1; echo; echo'