feat: V8 process isolation (part 1)

.github/workflows/release.yml

@@ -44,25 +44,31 @@ jobs:
           registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --no-frozen-lockfile
 
       - name: Type check
         run: pnpm turbo check-types
 
       - name: Build
         run: pnpm turbo build
 
+      - name: Build linux-x64 binary via Docker
+        run: |
+          cd crates/v8-runtime
+          docker build -f docker/Dockerfile.linux-x64-gnu -o type=local,dest=npm/linux-x64-gnu .
+
       - name: Publish to npm
         run: |
           FAILURES=""
+
+          # Publish workspace packages
           for dir in $(pnpm -r ls --json --depth -1 | jq -r '.[] | select(.private != true) | .path'); do
             # Skip the root package
             if [ "$dir" = "$(pwd)" ]; then
               continue
             fi
             NAME=$(jq -r .name "$dir/package.json")
             VERSION="${{ inputs.version }}"
-            # Skip if already published
             if npm view "${NAME}@${VERSION}" version >/dev/null 2>&1; then
               echo "⏭ ${NAME}@${VERSION} already published, skipping."
               continue
@@ -72,6 +78,24 @@ jobs:
               FAILURES="${FAILURES} ${NAME}"
             fi
           done
+
+          # Publish v8 platform packages (not in pnpm workspace)
+          for dir in crates/v8-runtime/npm/*/; do
+            if [ ! -f "$dir/package.json" ]; then
+              continue
+            fi
+            NAME=$(jq -r .name "$dir/package.json")
+            VERSION="${{ inputs.version }}"
+            if npm view "${NAME}@${VERSION}" version >/dev/null 2>&1; then
+              echo "⏭ ${NAME}@${VERSION} already published, skipping."
+              continue
+            fi
+            echo "Publishing ${NAME}@${VERSION}..."
+            if ! (cd "$dir" && npm publish --access public --tag ${{ inputs.npm-tag }}); then
+              FAILURES="${FAILURES} ${NAME}"
+            fi
+          done
+
           if [ -n "$FAILURES" ]; then
             echo "::error::Failed to publish:${FAILURES}"
             exit 1

.github/workflows/rust.yml

@@ -0,0 +1,100 @@
+name: Rust
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "crates/v8-runtime/**"
+      - ".github/workflows/rust.yml"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "crates/v8-runtime/**"
+      - ".github/workflows/rust.yml"
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+            npm-dir: linux-x64-gnu
+            binary: secure-exec-v8
+            test: true
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-latest
+            npm-dir: linux-arm64-gnu
+            binary: secure-exec-v8
+            cross: true
+          - target: x86_64-apple-darwin
+            os: macos-13
+            npm-dir: darwin-x64
+            binary: secure-exec-v8
+            test: true
+          - target: aarch64-apple-darwin
+            os: macos-latest
+            npm-dir: darwin-arm64
+            binary: secure-exec-v8
+            test: true
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            npm-dir: win32-x64
+            binary: secure-exec-v8.exe
+            test: true
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.85.0"
+          targets: ${{ matrix.target }}
+
+      - name: Cache Rust build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            crates/v8-runtime/target
+          key: rust-${{ matrix.target }}-${{ hashFiles('crates/v8-runtime/Cargo.lock') }}
+          restore-keys: |
+            rust-${{ matrix.target }}-
+
+      # Cross-compilation toolchain for linux-arm64
+      - name: Install cross-compilation tools
+        if: matrix.cross
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+
+      - name: Configure cross-compilation linker
+        if: matrix.cross
+        working-directory: crates/v8-runtime
+        run: |
+          mkdir -p .cargo
+          cat > .cargo/config.toml <<'EOF'
+          [target.aarch64-unknown-linux-gnu]
+          linker = "aarch64-linux-gnu-gcc"
+          EOF
+
+      - name: Build
+        working-directory: crates/v8-runtime
+        run: cargo build --release --target ${{ matrix.target }}
+
+      - name: Run tests
+        if: matrix.test
+        working-directory: crates/v8-runtime
+        run: cargo test --release --target ${{ matrix.target }}
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: v8-${{ matrix.npm-dir }}
+          path: crates/v8-runtime/target/${{ matrix.target }}/release/${{ matrix.binary }}