feat(c)!: ship the generated C API as the moq-c package

.github/workflows/alert.yml

@@ -22,6 +22,7 @@ on:
       - moq.sh
       - Nightly
       - release-brew
+      - Release C
       - Release Cpp
       - Release Dart
       - Release Dart FFI

.github/workflows/c.yml

@@ -0,0 +1,45 @@
+name: C
+
+# Builds and tests the moq C package (c/moq) with clang, outside Nix.
+# platform.yml covers MSVC. `just check` already runs `just c check` with the
+# dev shell's gcc; the dev shell has no clang, and adding one would change which
+# compiler every other recipe gets as `cc`.
+#
+# Outside Nix the generator comes from `cargo install` at the tag flake.nix
+# pins; see the comment there for every other place that names it.
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+
+concurrency:
+  group: c-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  clang:
+    name: C (clang)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      - uses: ./.github/actions/just
+
+      - name: Install uniffi-bindgen-cpp
+        run: cargo install uniffi-bindgen-cpp --locked --git https://github.com/kixelated/uniffi-bindgen-cpp --tag v0.11.0-kixelated.7+v0.32.2
+
+      - name: Check
+        run: just c check
+        env:
+          CC: clang
+          CXX: clang++

.github/workflows/nightly.yml

@@ -28,7 +28,7 @@ name: Nightly
 # release PRs on them.
 #
 # Main PRs run no cloud CI beyond the merge queue's Check, so every
-# path-filtered gate (Android, C++, WASM, X11, the audio replays, the OSS
+# path-filtered gate (Android, C, C++, WASM, X11, the audio replays, the OSS
 # Scanner image, platform.yml and the release dry-runs) runs here on main too,
 # and release-gate.yml runs them on release PRs.
 #
@@ -72,6 +72,9 @@ jobs:
   android:
     uses: ./.github/workflows/android.yml
 
+  c:
+    uses: ./.github/workflows/c.yml
+
   cpp:
     uses: ./.github/workflows/cpp.yml
 
@@ -579,6 +582,16 @@ jobs:
     permissions:
       contents: write
 
+  release-c:
+    name: Release C
+    needs: [release-shared-ffi]
+    if: ${{ always() && !cancelled() }}
+    uses: ./.github/workflows/release-c.yml
+    with:
+      reuse-native: true
+    permissions:
+      contents: write
+
   release-moq-relay:
     name: moq-relay
     uses: ./.github/workflows/moq-relay.yml

.github/workflows/platform.yml

@@ -10,6 +10,7 @@ on:
     branches: [release]
     paths:
       - "rs/**"
+      - "c/**"
       - "cpp/**"
       - "swift/**"
       - "infra/moq-sh/**"
@@ -53,6 +54,7 @@ jobs:
       needed: ${{ steps.scope.outputs.needed }}
       rs: ${{ steps.scope.outputs.rs }}
       swift: ${{ steps.scope.outputs.swift }}
+      c: ${{ steps.scope.outputs.c }}
       cpp: ${{ steps.scope.outputs.cpp }}
       obs: ${{ steps.scope.outputs.obs_compile }}
       moq_sh: ${{ steps.scope.outputs.moq_sh }}
@@ -71,7 +73,7 @@ jobs:
   windows:
     name: Windows
     needs: scope
-    if: needs.scope.outputs.rs == 'true' || needs.scope.outputs.cpp == 'true' || needs.scope.outputs.obs == 'true'
+    if: needs.scope.outputs.rs == 'true' || needs.scope.outputs.c == 'true' || needs.scope.outputs.cpp == 'true' || needs.scope.outputs.obs == 'true'
     # OBS uses the Visual Studio 17 2022 CMake generator.
     runs-on: windows-2022
     # `main` and its merge queue write the Rust cache; see .github/actions/rust-cache.
@@ -103,7 +105,7 @@ jobs:
           access-key-id: ${{ secrets.MBX_R2_ACCESS_KEY_ID }}
           secret-access-key: ${{ secrets.MBX_R2_SECRET_ACCESS_KEY }}
       - name: Install uniffi-bindgen-cpp
-        if: needs.scope.outputs.cpp == 'true' || needs.scope.outputs.obs == 'true'
+        if: needs.scope.outputs.c == 'true' || needs.scope.outputs.cpp == 'true' || needs.scope.outputs.obs == 'true'
         shell: bash
         run: cargo install uniffi-bindgen-cpp --locked --git https://github.com/kixelated/uniffi-bindgen-cpp --tag v0.11.0-kixelated.7+v0.32.2
       - name: Rust compile and tests
@@ -114,6 +116,10 @@ jobs:
         run: |
           just rs windows "$CI_BASE"
           just rs windows-test
+      - name: C
+        if: needs.scope.outputs.c == 'true'
+        shell: bash
+        run: just c check
       - name: C++
         if: needs.scope.outputs.cpp == 'true'
         shell: bash

.github/workflows/release-c.yml

@@ -0,0 +1,169 @@
+name: Release C
+
+# Builds the moq C package (c/moq) for every target and publishes one archive per target to a
+# c-v<version> GitHub release. moq-c-v* tags belong to the hand-written rs/moq-c crate until it
+# retires.
+
+on:
+  push:
+    tags:
+      - "c-v*"
+  # Dry-run: build everything, publish nothing. Nightly calls every release
+  # workflow this way so a broken build surfaces before the tag is cut.
+  workflow_call:
+    inputs:
+      reuse-native:
+        description: "Use this run's native input after its installed-consumer gate succeeds"
+        type: boolean
+        default: false
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-24.04-arm
+          - target: aarch64-apple-darwin
+            os: macos-latest
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/just
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      # aws-lc-rs assembles its x86_64 crypto with NASM on Windows.
+      - name: Install NASM
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          choco install nasm -y --no-progress
+          "C:\Program Files\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+      # The tag flake.nix pins; see the comment there.
+      - name: Install uniffi-bindgen-cpp
+        shell: bash
+        run: cargo install uniffi-bindgen-cpp --locked --git https://github.com/kixelated/uniffi-bindgen-cpp --tag v0.11.0-kixelated.7+v0.32.2
+
+      # The package version lives in c/moq/VERSION; a tag that disagrees is a mistake.
+      - name: Check version
+        if: github.ref_type == 'tag'
+        shell: bash
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          version=$(tr -d '[:space:]' < c/moq/VERSION)
+          if [[ "$TAG" != "c-v$version" ]]; then
+            echo "::error::tag $TAG does not match c/moq/VERSION ($version)"
+            exit 1
+          fi
+
+      - name: Refuse same-run input for a release tag
+        if: inputs.reuse-native && github.ref_type == 'tag'
+        run: |
+          echo "::error::c-v releases must use their immutable FFI_VERSION pin"
+          exit 1
+
+      # release-shared-ffi.yml stages and checks one default-feature input for both packages.
+      - name: Download validated same-run input
+        if: inputs.reuse-native
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: cpp-native-${{ matrix.target }}
+          path: native-archive
+
+      - name: Parse prebuilt FFI version
+        if: inputs.reuse-native
+        id: ffi-version
+        run: just gh release parse-version moq-ffi
+
+      - name: Verify and extract validated input
+        if: inputs.reuse-native
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+          VERSION: ${{ steps.ffi-version.outputs.version }}
+        run: just cpp ffi extract --version "$VERSION" --target "$TARGET" --directory native-archive --output native-input
+
+      - name: Build and package
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+          PREBUILT_INPUT: ${{ inputs.reuse-native }}
+        run: |
+          args=(--target "$TARGET" --output dist)
+          if [[ "$PREBUILT_INPUT" == true ]]; then
+            args+=(--ffi-dir "$GITHUB_WORKSPACE/native-input")
+          fi
+          just c package "${args[@]}"
+
+      - name: Check packaged archive
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          version=$(tr -d '[:space:]' < c/moq/VERSION)
+          extension=tar.gz
+          [[ "$TARGET" == *-windows-* ]] && extension=zip
+          just c check --archive "dist/moq-c-$version-$TARGET.$extension"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: moq-c-generated-${{ matrix.target }}
+          path: dist/*
+
+  release:
+    name: Release
+    needs: build
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: ./.github/actions/just
+
+      - name: Parse version
+        id: parse
+        run: just gh release parse-version c
+
+      - name: Find previous tag
+        id: prev_tag
+        run: just gh release prev-tag c
+
+      - name: Download artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Create or update release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+          RELEASE_TITLE: "moq-c v${{ steps.parse.outputs.version }}"
+          RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
+        run: just gh release create artifacts

.github/workflows/release-gate.yml

@@ -32,6 +32,7 @@ jobs:
       android: ${{ steps.filter.outputs.android }}
       api-diff: ${{ steps.filter.outputs.api-diff }}
       audio-quality: ${{ steps.filter.outputs.audio-quality }}
+      c: ${{ steps.filter.outputs.c }}
       cpp: ${{ steps.filter.outputs.cpp }}
       interop: ${{ steps.filter.outputs.interop }}
       moq-sh: ${{ steps.filter.outputs.moq-sh }}
@@ -108,6 +109,14 @@ jobs:
               - "test/lib/**"
               - "test/justfile"
               - ".github/workflows/audio-quality.yml"
+            c:
+              - "c/**"
+              - "rs/moq-ffi/**"
+              - "sh/c/**"
+              - "rs/moq-c/native-libs/**"
+              - "cpp/moq/cmake/moq-ffi.cmake"
+              - "Cargo.lock"
+              - ".github/workflows/c.yml"
             cpp:
               - "cpp/moq/**"
               - "cpp/justfile"
@@ -346,6 +355,12 @@ jobs:
     if: needs.scope.outputs.audio-quality == 'true'
     uses: ./.github/workflows/audio-quality.yml
 
+  c:
+    name: C
+    needs: scope
+    if: needs.scope.outputs.c == 'true'
+    uses: ./.github/workflows/c.yml
+
   cpp:
     name: C++
     needs: scope
@@ -493,6 +508,7 @@ jobs:
       - android
       - api-diff
       - audio-quality
+      - c
       - cpp
       - interop
       - moq-sh

AGENTS.md

@@ -108,7 +108,7 @@ The `quest` binary comes from the kixelated/quest flake input and serves the que
 
 | Change in | Also update |
 |---|---|
-| `rs/moq-ffi` | `rs/moq-c`, `{py,swift,kt,dart}/`, `go/wrapper/` (the `go/ffi` and `dart/moq_ffi` bindings regenerate automatically, but a new method needs a hand-written wrapper too, like `py/moq-rs` or `dart/moq`), `cpp/moq`, `cpp/obs/src`, `doc/lib/{py,swift,kt,go,dart,c,cpp}`, `doc/bin/obs.md` |
+| `rs/moq-ffi` | `rs/moq-c`, `c/moq`, `{py,swift,kt,dart}/`, `go/wrapper/` (the `go/ffi` and `dart/moq_ffi` bindings regenerate automatically, but a new method needs a hand-written wrapper too, like `py/moq-rs` or `dart/moq`), `cpp/moq`, `cpp/obs/src`, `doc/lib/{py,swift,kt,go,dart,c,cpp}`, `doc/bin/obs.md` |
 | `rs/moq-net` wire/API | `js/net`, `doc/concept`, `drafts/draft-lcurley-moq-lite.md` (if the wire spec changes) |
 | `rs/hang` catalog/container (the `m2ts` section is Rust-only) | `js/hang`, `doc/concept`, `drafts/draft-lcurley-moq-hang.md` (if the format spec changes) |
 | `rs/moq-auth` | `js/auth`, `doc/bin/relay/auth.md` |

c/justfile

@@ -0,0 +1,27 @@
+#!/usr/bin/env just --justfile
+#
+# The moq C package over rs/moq-ffi. Invoked from the repo root as `just c <recipe>` via the
+# `mod c` import.
+
+set working-directory := '.'
+
+default: check
+
+# Build the package, or check an archive, and run its installed consumers.
+[no-cd]
+[positional-arguments]
+check *args:
+    {{ quote(justfile_directory() / "sh/c/check.sh") }} "$@"
+
+# Runs in the caller's directory, so a relative `--output` means what it would
+# to the script itself.
+
+# Build and package the C package for release.
+[no-cd]
+[positional-arguments]
+package *args:
+    {{ quote(justfile_directory() / "c/moq/build.sh") }} "$@"
+
+# Remove the package builds.
+clean:
+    rm -rf moq/build

c/moq/.gitignore

@@ -0,0 +1,2 @@
+# `just c check` builds, installs, and tests here.
+/build/