Make Linux native flags architecture-safe in CI

Author: yawkat

.github/workflows/build-all-and-publish.yml

@@ -17,7 +17,8 @@ jobs:
     name: Linux natives (${{ matrix.arch }})
     runs-on: ubuntu-latest
     env:
-      NATIVE_BASE_CFLAGS: -O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
+      NATIVE_BASE_CFLAGS: -O2 -fno-omit-frame-pointer -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security
+      NATIVE_X86_EXTRA_CFLAGS: -mno-omit-leaf-frame-pointer -fcf-protection
       NATIVE_XXHASH_EXTRA_CFLAGS: -fno-tree-vectorize
     strategy:
       fail-fast: false
@@ -26,26 +27,31 @@ jobs:
           - arch: amd64
             cc: gcc
             arch_cflags: ""
+            arch_x86_cflags: "${{ env.NATIVE_X86_EXTRA_CFLAGS }}"
             ldflags: ""
             apt: ""
           - arch: i386
             cc: gcc
             arch_cflags: "-m32"
-            ldflags: ""
+            arch_x86_cflags: "${{ env.NATIVE_X86_EXTRA_CFLAGS }}"
+            ldflags: "-m32"
             apt: "gcc-multilib libc6-dev-i386"
           - arch: aarch64
             cc: aarch64-linux-gnu-gcc
             arch_cflags: ""
+            arch_x86_cflags: ""
             ldflags: ""
             apt: "gcc-aarch64-linux-gnu"
           - arch: ppc64le
             cc: powerpc64le-linux-gnu-gcc
             arch_cflags: ""
+            arch_x86_cflags: ""
             ldflags: ""
             apt: "gcc-powerpc64le-linux-gnu"
           - arch: s390x
             cc: s390x-linux-gnu-gcc
             arch_cflags: ""
+            arch_x86_cflags: ""
             ldflags: ""
             apt: "gcc-s390x-linux-gnu"
 
@@ -79,8 +85,8 @@ jobs:
             ./mvnw -B -V -DskipTests \
               -Darch.id=${{ matrix.arch }} \
               -Dnative.cc=${{ matrix.cc }} \
-              "-Dnative.cflags=${{ env.NATIVE_BASE_CFLAGS }} ${{ matrix.arch_cflags }}" \
-              "-Dnative.xxhash.cflags=${{ env.NATIVE_BASE_CFLAGS }} ${{ matrix.arch_cflags }} ${{ env.NATIVE_XXHASH_EXTRA_CFLAGS }}" \
+              "-Dnative.cflags=${{ env.NATIVE_BASE_CFLAGS }} ${{ matrix.arch_x86_cflags }} ${{ matrix.arch_cflags }}" \
+              "-Dnative.xxhash.cflags=${{ env.NATIVE_BASE_CFLAGS }} ${{ matrix.arch_x86_cflags }} ${{ matrix.arch_cflags }} ${{ env.NATIVE_XXHASH_EXTRA_CFLAGS }}" \
               "-Dnative.ldflags=${{ matrix.ldflags }}" \
               package
 

pom.xml

@@ -389,7 +389,7 @@
         </os>
       </activation>
       <properties>
-        <native.cflags>-O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection</native.cflags>
+        <native.cflags>-O2 -fno-omit-frame-pointer -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security</native.cflags>
         <native.xxhash.cflags>${native.cflags} -fno-tree-vectorize</native.xxhash.cflags>
       </properties>
       <build>