release: ship the Linux Rust binaries as static musl builds (#12284)

* ci: share the musl Rust target setup as a composite action

Three container workflows carried the same toolchain, musl-tools and
aws-lc-sys link shim block verbatim.

* release: ship weed-worker as a static musl binary

The gnu build inherits the runner's glibc, 2.39 since the move to
ubuntu-24.04, so the released worker failed to start on Ubuntu 22.04
with 'GLIBC_2.38 not found'. The container images already build it
against musl with the same recipe.

* release: ship the Linux weed-volume as a static musl binary

Same glibc trap as the worker. The arm64 job also installed libssl,
which nothing in the volume links.

* ci: resolve the manual latest build's actions from master

Its checkout is an arbitrary source ref that may predate a local
action; the workflow itself always runs from master.

.github/workflows/rust_binaries_release.yml

@@ -19,37 +19,20 @@ jobs:
     strategy:
       matrix:
         include:
-          - target: x86_64-unknown-linux-gnu
+          # Static musl, as the container images ship: a glibc build only
+          # starts on distributions at least as new as the runner's.
+          - target: x86_64-unknown-linux-musl
             asset_suffix: linux_amd64
-          - target: aarch64-unknown-linux-gnu
+          - target: aarch64-unknown-linux-musl
             asset_suffix: linux_arm64
-            cross: true
 
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+      - name: Set up the musl target
+        uses: ./.github/actions/rust-musl-target
         with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools
-        if: matrix.cross
-        run: |
-          sudo dpkg --add-architecture arm64
-          # noble keeps apt sources in deb822 ubuntu.sources, not sources.list —
-          # pin them to amd64 so apt does not probe arm64 indexes on
-          # archive/security.ubuntu.com (they 404).
-          sudo sed -i '/^Types: deb$/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
-          for suite in noble noble-updates noble-security; do
-            echo "deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports $suite main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
-          done
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu libssl-dev:arm64
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
-          echo "OPENSSL_DIR=/usr" >> "$GITHUB_ENV"
-          echo "OPENSSL_INCLUDE_DIR=/usr/include" >> "$GITHUB_ENV"
-          echo "OPENSSL_LIB_DIR=/usr/lib/aarch64-linux-gnu" >> "$GITHUB_ENV"
+          target: ${{ matrix.target }}
 
       - name: Cache cargo registry and target
         if: runner.environment == 'github-hosted'
@@ -128,11 +111,12 @@ jobs:
     strategy:
       matrix:
         include:
-          - target: x86_64-unknown-linux-gnu
+          # Static musl, as the container images ship: a glibc build only
+          # starts on distributions at least as new as the runner's.
+          - target: x86_64-unknown-linux-musl
             asset_suffix: linux_amd64
-          - target: aarch64-unknown-linux-gnu
+          - target: aarch64-unknown-linux-musl
             asset_suffix: linux_arm64
-            cross: true
 
     steps:
       - uses: actions/checkout@v7
@@ -141,25 +125,10 @@ jobs:
           # should not find another one sitting in the checkout's git config.
           persist-credentials: false
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+      - name: Set up the musl target
+        uses: ./.github/actions/rust-musl-target
         with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools
-        if: matrix.cross
-        run: |
-          sudo dpkg --add-architecture arm64
-          # noble keeps apt sources in deb822 ubuntu.sources, not sources.list —
-          # pin them to amd64 so apt does not probe arm64 indexes on
-          # archive/security.ubuntu.com (they 404).
-          sudo sed -i '/^Types: deb$/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
-          for suite in noble noble-updates noble-security; do
-            echo "deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports $suite main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
-          done
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
+          target: ${{ matrix.target }}
 
       - name: Cache cargo registry and target
         if: runner.environment == 'github-hosted'