ci: check each Linux auth binary's C library as it is built

Only auth-preflight.yml read which C library each Linux binary links,
and nothing runs it automatically. release.yml's publish-auth job
builds through _build-auth-artifacts.yml and publishes, so a musl
binary that links glibc would have published unless someone ran the
preflight first. That is how the suite shipped its broken one.

Run the same readelf check in _build-auth-artifacts.yml, after each
Linux build and before the package is packed: the gnu binaries must
need libc.so.6, and the musl binary must not. A test checks the step
comes before the pack and covers both rules.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

.github/workflows/_build-auth-artifacts.yml

@@ -152,6 +152,32 @@ jobs:
           mv "stack-auth-node.${PLATFORM}.node" "platforms/${PLATFORM}/"
           test -s "platforms/${PLATFORM}/stack-auth-node.${PLATFORM}.node"
 
+      # Every build checks which C library its binary links, so a release
+      # cannot publish a musl binary that links glibc even if nobody ran
+      # auth-preflight first. The same check as auth-preflight.yml's smoke test.
+      # Into a variable, never into `grep -q`, so readelf cannot die on EPIPE.
+      - name: Check which C library the binary links
+        if: ${{ runner.os == 'Linux' }}
+        working-directory: languages/typescript/packages/auth
+        env:
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          set -euo pipefail
+          dynamic=$(readelf -d "platforms/${PLATFORM}/stack-auth-node.${PLATFORM}.node")
+          case "$PLATFORM" in
+            linux-x64-gnu|linux-arm64-gnu)
+              grep -q 'NEEDED.*libc\.so\.6' <<< "$dynamic" || {
+                echo "::error::$PLATFORM does not link glibc"; exit 1; } ;;
+            linux-x64-musl)
+              if grep -q 'NEEDED.*libc\.so\.6' <<< "$dynamic" ; then
+                echo "::error::linux-x64-musl links glibc — it is the gnu binary"
+                exit 1
+              fi ;;
+            *)
+              echo "::error::no C library rule for $PLATFORM"; exit 1 ;;
+          esac
+          echo "$PLATFORM: links the expected C library"
+
       # `npm pack`, not `pnpm pack`: a platform package has no `workspace:`
       # dependency to rewrite. The wrapper does, and is packed with pnpm below.
       - name: Pack the platform package

scripts/__tests__/auth-build-artifacts.test.mjs

@@ -89,6 +89,26 @@ describe('_build-auth-artifacts.yml', () => {
     expect(run).toContain('RUSTFLAGS=-C target-feature=-crt-static')
   })
 
+  it('checks the C library of every Linux binary before it is packed', () => {
+    // Without this, only a hand-run auth-preflight sees a glibc-linked musl
+    // binary, and a release would publish it.
+    const steps = binaries?.steps ?? []
+    const check = steps.findIndex((step) =>
+      String(step?.run ?? '').includes('readelf -d'),
+    )
+    const pack = steps.findIndex((step) =>
+      /\bnpm pack\b/.test(String(step?.run ?? '')),
+    )
+    expect(check).toBeGreaterThan(-1)
+    expect(check).toBeLessThan(pack)
+    const run = String(steps[check].run)
+    expect(String(steps[check].if)).toContain("runner.os == 'Linux'")
+    expect(run).toMatch(
+      /linux-x64-gnu\|linux-arm64-gnu\)[\s\S]*libc\\\.so\\\.6/,
+    )
+    expect(run).toContain('linux-x64-musl links glibc')
+  })
+
   it('pins the same musl toolchain as the FFI build', () => {
     const ffi = readFileSync(
       join(REPO_ROOT, '.github/workflows/_build-ffi-artifacts.yml'),