fix(ci): build the musl @cipherstash/auth binary in Alpine, and check every binary's C library

The linux-x64-musl leg of _build-auth-artifacts.yml targeted
x86_64-unknown-linux-musl on the Ubuntu runner but named no musl linker,
so cargo linked the binary against the runner's glibc. Such a binary
fails to load on musl systems such as Alpine. auth-preflight's libc
check caught it: "linux-x64-musl links glibc — it is the gnu binary".
The suite's published @cipherstash/auth-linux-x64-musl 0.44.0 has the
same fault, because its workflow built musl the same way and never ran
such a check.

Build that leg inside node:22-alpine, pinned by digest: Alpine is a musl
system, so its compiler and runtime libraries are musl's own. The
container installs Rust at the version mise pins and pnpm at the root
packageManager version, installs only the auth package's dependencies,
and runs the same napi build, with -crt-static off so the binary links
musl at load time. Two other ways failed on 2 October 2026: Ubuntu's
musl-gcc cannot link a Rust shared library ("cannot find
libgcc_s.so.1"), and the musl.cc toolchain that _build-ffi-artifacts.yml
uses timed out from GitHub's runners.

Also check which C library each Linux binary links as it is built,
before the package is packed. Until now only auth-preflight.yml read it,
and nothing runs the preflight automatically, so a release could have
published a glibc-linked musl binary. The gnu binaries must need
libc.so.6, and the musl binary must not.

Tests in auth-build-artifacts.test.mjs cover the Alpine build, the
skipped host steps for the musl leg, and the C library check coming
before the pack.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

.github/workflows/_build-auth-artifacts.yml

@@ -65,13 +65,6 @@ jobs:
           ref: ${{ inputs.ref }}
           persist-credentials: false
 
-      - name: Install musl tools (linux-x64-musl)
-        if: ${{ matrix.platform == 'linux-x64-musl' }}
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y musl-tools
-
       # Rust 1.94.1 from the root mise.toml, the toolchain the crate is tested
       # with. `cache: false` is required here, not a default.
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
@@ -104,17 +97,56 @@ jobs:
         run: npm install -g node-gyp
 
       - name: Install dependencies
+        if: ${{ matrix.platform != 'linux-x64-musl' }}
         run: pnpm install --frozen-lockfile
 
       # `--js false` is load-bearing. With `--platform`, napi v2 also writes its
       # own `index.js` loader over the committed one, which is a published,
       # frozen file (release-gate.mjs FROZEN_ARTEFACT_DIGESTS).
       - name: Build the native binding
+        if: ${{ matrix.platform != 'linux-x64-musl' }}
         working-directory: languages/typescript/packages/auth
         env:
           TARGET: ${{ matrix.target }}
         run: mise x -- pnpm exec napi build --platform --release --target "$TARGET" --strip --dts native.d.ts --js false
 
+      # The musl binary is built inside Alpine Linux, a musl system, so the
+      # compiler and its runtime libraries are musl's own. Built on the Ubuntu
+      # runner, it linked the runner's glibc and failed to load on musl; the
+      # suite's 0.44.0 has that fault. Ubuntu's musl-gcc cannot link a Rust
+      # shared library (it has no musl libgcc_s), and the musl.cc toolchain
+      # that _build-ffi-artifacts.yml downloads timed out from GitHub's runners
+      # on 2 October 2026. The image is pinned by digest because its output is
+      # published with provenance. `-crt-static` keeps the binary linked
+      # against musl at load time, which a Node.js native module needs, and
+      # which the C library check below reads. The same napi flags as the host
+      # build, for the same reasons.
+      - name: Build the native binding in Alpine (linux-x64-musl)
+        if: ${{ matrix.platform == 'linux-x64-musl' }}
+        env:
+          TARGET: ${{ matrix.target }}
+          ALPINE_NODE_IMAGE: node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402
+        run: |
+          set -euo pipefail
+          rust_version=$(mise current rust)
+          pnpm_spec=$(node -p "require('./package.json').packageManager")
+          docker run --rm \
+            -v "$GITHUB_WORKSPACE:/build" -w /build \
+            -e TARGET -e RUST_VERSION="$rust_version" -e PNPM_SPEC="$pnpm_spec" \
+            -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
+            -e RUSTFLAGS="-C target-feature=-crt-static" \
+            "$ALPINE_NODE_IMAGE" sh -euc '
+              apk add --no-cache build-base cmake perl linux-headers git curl rustup
+              rustup-init -y --profile minimal --default-toolchain "$RUST_VERSION" --target "$TARGET"
+              . "$HOME/.cargo/env"
+              corepack enable
+              corepack prepare "$PNPM_SPEC" --activate
+              pnpm install --frozen-lockfile --ignore-scripts --filter "@cipherstash/auth..."
+              cd languages/typescript/packages/auth
+              pnpm exec napi build --platform --release --target "$TARGET" --strip --dts native.d.ts --js false
+              chown -R "$HOST_UID:$HOST_GID" /build
+            '
+
       # The build must leave the tracked tree alone: `native.d.ts` is
       # regenerated and has to equal the committed copy, and nothing else may
       # change.
@@ -130,6 +162,32 @@ jobs:
           mv "stack-auth-node.${PLATFORM}.node" "platforms/${PLATFORM}/"
           test -s "platforms/${PLATFORM}/stack-auth-node.${PLATFORM}.node"
 
+      # Every build checks which C library its binary links, so a release
+      # cannot publish a musl binary that links glibc even if nobody ran
+      # auth-preflight first. The same check as auth-preflight.yml's smoke test.
+      # Into a variable, never into `grep -q`, so readelf cannot die on EPIPE.
+      - name: Check which C library the binary links
+        if: ${{ runner.os == 'Linux' }}
+        working-directory: languages/typescript/packages/auth
+        env:
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          set -euo pipefail
+          dynamic=$(readelf -d "platforms/${PLATFORM}/stack-auth-node.${PLATFORM}.node")
+          case "$PLATFORM" in
+            linux-x64-gnu|linux-arm64-gnu)
+              grep -q 'NEEDED.*libc\.so\.6' <<< "$dynamic" || {
+                echo "::error::$PLATFORM does not link glibc"; exit 1; } ;;
+            linux-x64-musl)
+              if grep -q 'NEEDED.*libc\.so\.6' <<< "$dynamic" ; then
+                echo "::error::linux-x64-musl links glibc — it is the gnu binary"
+                exit 1
+              fi ;;
+            *)
+              echo "::error::no C library rule for $PLATFORM"; exit 1 ;;
+          esac
+          echo "$PLATFORM: links the expected C library"
+
       # `npm pack`, not `pnpm pack`: a platform package has no `workspace:`
       # dependency to rewrite. The wrapper does, and is packed with pnpm below.
       - name: Pack the platform package

scripts/__tests__/auth-build-artifacts.test.mjs

@@ -51,7 +51,8 @@ describe('_build-auth-artifacts.yml', () => {
 
   it('builds each binding without writing over the committed loader', () => {
     const build = runs(binaries).filter((run) => /\bnapi build\b/.test(run))
-    expect(build).toHaveLength(1)
+    // One host build, and one inside Alpine for the musl leg.
+    expect(build).toHaveLength(2)
     for (const flag of [
       '--platform',
       '--release',
@@ -60,7 +61,7 @@ describe('_build-auth-artifacts.yml', () => {
       '--dts native.d.ts',
       '--js false',
     ]) {
-      expect(build[0]).toContain(flag)
+      for (const run of build) expect(run).toContain(flag)
     }
   })
 
@@ -73,6 +74,45 @@ describe('_build-auth-artifacts.yml', () => {
     expect(check).toBeGreaterThan(build)
   })
 
+  it('builds the musl binding inside Alpine, from an image pinned by digest', () => {
+    // Built on the Ubuntu runner, the musl binary linked glibc and failed to
+    // load on musl. Alpine is a musl system, so its compiler links musl.
+    const steps = binaries?.steps ?? []
+    const musl = steps.filter((step) =>
+      String(step?.if ?? '').includes("== 'linux-x64-musl'"),
+    )
+    const run = musl.map((step) => String(step?.run ?? '')).join('\n')
+    const env = Object.assign({}, ...musl.map((step) => step?.env ?? {}))
+    expect(env.ALPINE_NODE_IMAGE).toMatch(/-alpine@sha256:[0-9a-f]{64}$/)
+    expect(run).toContain('docker run')
+    expect(run).toContain('RUSTFLAGS="-C target-feature=-crt-static"')
+    // The host build and the host dependency install skip the musl leg.
+    for (const name of ['Build the native binding', 'Install dependencies']) {
+      const step = steps.find((s) => s?.name === name)
+      expect(String(step?.if ?? '')).toContain("!= 'linux-x64-musl'")
+    }
+  })
+
+  it('checks the C library of every Linux binary before it is packed', () => {
+    // Without this, only a hand-run auth-preflight sees a glibc-linked musl
+    // binary, and a release would publish it.
+    const steps = binaries?.steps ?? []
+    const check = steps.findIndex((step) =>
+      String(step?.run ?? '').includes('readelf -d'),
+    )
+    const pack = steps.findIndex((step) =>
+      /\bnpm pack\b/.test(String(step?.run ?? '')),
+    )
+    expect(check).toBeGreaterThan(-1)
+    expect(check).toBeLessThan(pack)
+    const run = String(steps[check].run)
+    expect(String(steps[check].if)).toContain("runner.os == 'Linux'")
+    expect(run).toMatch(
+      /linux-x64-gnu\|linux-arm64-gnu\)[\s\S]*libc\\\.so\\\.6/,
+    )
+    expect(run).toContain('linux-x64-musl links glibc')
+  })
+
   it('packs the wrapper with pnpm, which rewrites its workspace peers', () => {
     const packs = runs(wrapper).filter((run) => /\bpack\b/.test(run))
     expect(packs.some((run) => /\bpnpm\b.*\bpack\b/.test(run))).toBe(true)