[DB] Build PostgreSQL engines with rustls

Author: kageiit

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - namespace-profile-gitar
+    - namespace-profile-gitar-macos

.github/workflows/rustls-compatibility.yml

@@ -0,0 +1,81 @@
+name: PostgreSQL rustls engines
+on:
+  push:
+    branches: [gitar-4.8-rustls]
+  workflow_dispatch:
+permissions:
+  contents: read
+env:
+  # Legacy engine crates deny compiler warnings that newer Rust versions add.
+  # Preserve those sources while retaining compiler errors and dependency guards.
+  RUSTFLAGS: --cap-lints=warn
+  ENGINE_FEATURES: query-engine/postgresql,migration-engine-cli/postgresql,introspection-core/postgresql
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: aarch64-apple-darwin
+            runner: namespace-profile-gitar-macos
+          - target: x86_64-unknown-linux-gnu
+            runner: namespace-profile-gitar
+          - target: aarch64-unknown-linux-gnu
+            runner: namespace-profile-gitar
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: namespacelabs/nscloud-checkout-action@v8
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: goto-bus-stop/setup-zig@v2
+        if: matrix.target != 'aarch64-apple-darwin'
+        with:
+          version: 0.13.0
+      - run: cargo install cargo-zigbuild --locked
+        if: matrix.target != 'aarch64-apple-darwin'
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: rustls-engines-${{ matrix.target }}
+      - name: Verify PostgreSQL engine dependencies
+        run: |
+          cargo tree --locked --target ${{ matrix.target }} -e normal,build --prefix none \
+            -p query-engine -p migration-engine-cli -p introspection-core -p prisma-fmt \
+            --no-default-features --features "$ENGINE_FEATURES" > engine-dependencies.txt
+          if grep -E '^(native-tls|tokio-native-tls|openssl|openssl-sys|hyper-tls|postgres-native-tls) v' engine-dependencies.txt; then
+            exit 1
+          fi
+      - name: Build macOS engines
+        if: matrix.target == 'aarch64-apple-darwin'
+        run: |
+          cargo build --locked --release --target ${{ matrix.target }} \
+            -p query-engine -p migration-engine-cli -p introspection-core -p prisma-fmt \
+            --no-default-features --features "$ENGINE_FEATURES"
+          for engine in query-engine migration-engine introspection-engine prisma-fmt; do
+            target/${{ matrix.target }}/release/$engine --version
+            otool -L target/${{ matrix.target }}/release/$engine
+          done
+      - name: Build portable Linux engines
+        if: matrix.target != 'aarch64-apple-darwin'
+        run: |
+          cargo zigbuild --locked --release --target ${{ matrix.target }}.2.28 \
+            -p query-engine -p migration-engine-cli -p introspection-core -p prisma-fmt \
+            --no-default-features --features "$ENGINE_FEATURES"
+          for engine in query-engine migration-engine introspection-engine prisma-fmt; do
+            readelf -d target/${{ matrix.target }}/release/$engine > /tmp/linkage.txt
+            cat /tmp/linkage.txt
+            if grep -E 'NEEDED.*lib(ssl|crypto)' /tmp/linkage.txt; then exit 1; fi
+          done
+      - name: Test PostgreSQL TLS and engine protocols
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        run: python3 tests/rustls/smoke.py target/${{ matrix.target }}/release
+      - name: Package immutable engine assets
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          python3 tests/rustls/package.py "$TARGET"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: engines-${{ matrix.target }}-${{ github.sha }}
+          path: artifacts/*
+          retention-days: 30