Switch from full LTO to ThinLTO

[dylan-conway]

Switches all -flto=full call sites to -flto=thin so we can evaluate ThinLTO for Bun's release builds.

Why

• ThinLTO runs the optimization/codegen phase in parallel per-module instead of one giant serial link, which should cut LTO build wall-time substantially on the CI runners.
• ThinLTO emits per-module summary bitcode that's incrementally cacheable, so local bun build.ts lto rebuilds should get much faster after the first build.
• -fwhole-program-vtables / -fforce-emit-vtables are kept — clang supports whole-program devirtualization under ThinLTO via the summary index, so we shouldn't lose the vtable opts.

What changed

• .github/workflows/build-reusable.yml — all 6 *-lto matrix entries (linux glibc + musl, amd64/arm64/baseline)
• Dockerfile / Dockerfile.musl — default LTO_FLAG arg
• build.ts — lto config for local builds (Windows + Unix paths)

Not touched

• macOS / Windows / FreeBSD / Android CI jobs don't currently build an LTO variant, so nothing to change there.
• Source/cmake/WebKitCompilerFlags.cmake already parameterizes on LTO_MODE and isn't used by our build path.

Opening this so the preview-build workflow produces autobuild-preview-pr-* artifacts we can pull into Bun and benchmark against the current full-LTO release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 70732c1c-d3db-4ba1-a3d9-2d90715934f7

📥 Commits

Reviewing files that changed from the base of the PR and between fa6115c and 21dedaa.

📒 Files selected for processing (2)

• Dockerfile
• Dockerfile.musl

---

Walkthrough

Replaces full LTO (-flto=full) with thin LTO (-flto=thin) in CI workflow matrix entries, Dockerfile and Dockerfile.musl ARG defaults, and CMake flags in build.ts. No other build logic or exported APIs were changed.

Changes

LTO flag migration

Layer / File(s)	Summary
CI workflow matrix .github/workflows/build-reusable.yml	LTO matrix entries updated: -flto=full → -flto=thin for standard Linux and musl Linux build jobs; other LTO-related flags preserved.
Docker build ARGs Dockerfile, Dockerfile.musl	ARG LTO_FLAG default changed from "-flto=full -fwhole-program-vtables -fforce-emit-vtables " to "-flto=thin -fwhole-program-vtables -fforce-emit-vtables ". The flag flows to ENV/build stages unchanged.
CMake / build script build.ts	CMake compiler flags updated to use -flto=thin instead of -flto=full for CMAKE_C_FLAGS and CMAKE_CXX_FLAGS in both Windows and non-Windows branches.

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The PR description is comprehensive, explaining the rationale, detailing all files changed, noting what was not touched, and clarifying the purpose; however, it does not follow the required Bugzilla template with bug ID or Reviewed-by attribution.	Include a Bugzilla bug ID link and 'Reviewed by' attribution as required by the repository's pull request template, or clarify if this repository uses a different submission process.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Switch from full LTO to ThinLTO' clearly and concisely summarizes the main change across all modified files, accurately reflecting the primary objective of the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Review rate limit: 4/5 reviews remaining, refill in 12 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Dockerfile`:
- Around line 62-63: The PPA GPG key is being installed into
/etc/apt/trusted.gpg.d (global trust); change it to a dedicated keyring and
reference it with signed-by on the deb line: download the key from the same URL
and dearmor it into a dedicated file like
/usr/share/keyrings/ubuntu-toolchain-r-archive-keyring.gpg, then update the deb
line that currently writes to /etc/apt/sources.list.d/ubuntu-toolchain-r.list to
include "signed-by=/usr/share/keyrings/ubuntu-toolchain-r-archive-keyring.gpg"
so the key is scoped only to the ubuntu-toolchain-r/test source.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e723a527-2be6-4def-ab1d-b28d23cad360

📥 Commits

Reviewing files that changed from the base of the PR and between 83aff7a and fa6115c.

📒 Files selected for processing (1)

• Dockerfile

[github-actions]

Preview Builds

Commit	Release	Date
21dedaaa	autobuild-preview-pr-208-21dedaaa	2026-05-02 21:43:19 UTC