ci(ffi): check the C library of each Linux protect-ffi binary before packing

Only ffi-preflight.yml checked which C library the Linux protect-ffi
binaries link, and nothing runs that dry run automatically. release.yml
builds through _build-ffi-artifacts.yml, so a release could publish a
musl binary that links glibc. The suite published a glibc-linked
@cipherstash/auth-linux-x64-musl 0.44.0 that way.

Each Linux leg now runs scripts/check-c-library.sh on its binary after
placing it and before packing it, as _build-auth-artifacts.yml does
since #1018. scripts/__tests__/ffi-build-artifacts.test.mjs pins the
step's place, its Linux condition and the binary it reads.

Refs: CIP-4282

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

.github/workflows/_build-ffi-artifacts.yml

@@ -269,6 +269,16 @@ jobs:
             -o "platforms/${PLATFORM}/index.node" < "${BUILD_LOG}"
           test -s "platforms/${PLATFORM}/index.node"
 
+      # Every build checks which C library its binary links, so a release
+      # cannot publish a musl binary that links glibc even if nobody ran
+      # ffi-preflight first. The rules are in scripts/check-c-library.sh, which
+      # every workflow that checks a Linux binary runs.
+      - name: Check which C library the binary links
+        if: ${{ runner.os == 'Linux' }}
+        env:
+          PLATFORM: ${{ matrix.cfg.platform }}
+        run: scripts/check-c-library.sh "$PLATFORM" "languages/typescript/packages/protect-ffi/platforms/${PLATFORM}/index.node"
+
       # `pnpm pack` writes into the packed package's own directory by default,
       # and `--pack-destination` resolves relative to `--dir` rather than to the
       # CWD (verified). Packing to the default location and moving the result

scripts/__tests__/check-c-library.test.mjs

@@ -297,6 +297,7 @@ describe.skipIf(!hasReadelf && !process.env.CI)('check-c-library.sh', () => {
 describe('the workflows that check a Linux binary', () => {
   const CALLERS = [
     '.github/workflows/_build-auth-artifacts.yml',
+    '.github/workflows/_build-ffi-artifacts.yml',
     '.github/workflows/auth-preflight.yml',
     '.github/workflows/ffi-preflight.yml',
   ]

scripts/__tests__/ffi-build-artifacts.test.mjs

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import { readWorkflow } from './lib/workflows.mjs'
+
+/**
+ * `_build-ffi-artifacts.yml` builds the seven `@cipherstash/protect-ffi`
+ * tarballs that `release.yml`'s `publish-ffi` uploads. Every Linux binary's C
+ * library is checked before it is packed. Without the check, only a hand-run
+ * ffi-preflight sees a glibc-linked musl binary, which fails to load on musl
+ * systems such as Alpine Linux, and a release would publish it.
+ */
+
+const workflow = readWorkflow('.github/workflows/_build-ffi-artifacts.yml')
+const steps = workflow?.jobs?.binaries?.steps ?? []
+const runOf = (step) => String(step?.run ?? '')
+const named = (name) => steps.findIndex((step) => step?.name === name)
+
+/** A GitHub Actions expression, as the parsed workflow holds it. */
+const gha = (expression) => `\${{ ${expression} }}`
+
+describe('_build-ffi-artifacts.yml', () => {
+  it('checks the C library of every Linux binary before it is packed', () => {
+    const check = steps.findIndex((step) =>
+      runOf(step).includes('scripts/check-c-library.sh'),
+    )
+    const place = named('Place the binding in its platform package')
+    const pack = named('Pack the platform package')
+    expect(place).toBeGreaterThan(-1)
+    expect(check).toBeGreaterThan(place)
+    expect(check).toBeLessThan(pack)
+    expect(String(steps[check].if)).toContain("runner.os == 'Linux'")
+    // The binary that is packed, under the leg's own platform name.
+    expect(steps[check].env?.PLATFORM).toBe(gha('matrix.cfg.platform'))
+    expect(runOf(steps[check])).toMatch(
+      /check-c-library\.sh "\$PLATFORM" "languages\/typescript\/packages\/protect-ffi\/platforms\/\$\{PLATFORM\}\/index\.node"/,
+    )
+  })
+})