fix(ci): link the musl @cipherstash/auth binary with musl

The linux-x64-musl leg of _build-auth-artifacts.yml targeted
x86_64-unknown-linux-musl but had no musl linker, so cargo linked the
binary against the runner's glibc. auth-preflight's libc check caught
it: "linux-x64-musl links glibc — it is the gnu binary". Such a binary
fails to load on musl systems such as Alpine. The suite's published
@cipherstash/auth-linux-x64-musl 0.44.0 has the same fault, because its
workflow built musl the same way.

Mirror _build-ffi-artifacts.yml, whose musl binary passes the same
check: fetch the musl.cc toolchain with its pinned digest, link with
x86_64-linux-musl-gcc, and turn off crt-static so the binary links musl
dynamically. Tests check the musl leg's setup, and that both workflows
pin the same toolchain digest.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

.github/workflows/_build-auth-artifacts.yml

@@ -65,12 +65,34 @@ jobs:
           ref: ${{ inputs.ref }}
           persist-credentials: false
 
-      - name: Install musl tools (linux-x64-musl)
+      # The musl leg must LINK with musl, not only target it. With musl-tools
+      # alone, cargo linked the binary against the runner's glibc, and the
+      # published linux-x64-musl package failed to load on musl systems; the
+      # suite's 0.44.0 has that fault. This mirrors _build-ffi-artifacts.yml,
+      # whose musl binary passes the same libc check in its preflight.
+      #
+      # The toolchain is fetched from musl.cc over plain HTTPS with no
+      # signature, and it links a binary published with provenance, so the
+      # digest is pinned: the same tarball and digest as _build-ffi-artifacts.yml.
+      # If musl.cc rebuilds it, this step fails; re-verify the new tarball and
+      # update both digests, do not delete the check.
+      - name: Install the musl toolchain (linux-x64-musl)
         if: ${{ matrix.platform == 'linux-x64-musl' }}
+        env:
+          MUSL_TOOLCHAIN_URL: https://musl.cc/x86_64-linux-musl-native.tgz
+          MUSL_TOOLCHAIN_SHA256: eb1db6f0f3c2bdbdbfb993d7ef7e2eeef82ac1259f6a6e1757c33a97dbcef3ad
         run: |
           set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y musl-tools
+          wget -4 -O musl-native.tgz "$MUSL_TOOLCHAIN_URL"
+          echo "${MUSL_TOOLCHAIN_SHA256}  musl-native.tgz" | sha256sum -c - || {
+            echo "::error::musl toolchain digest mismatch — got $(sha256sum musl-native.tgz | cut -d' ' -f1)"
+            exit 1; }
+          sudo tar zxf musl-native.tgz -C /opt/
+          echo "/opt/x86_64-linux-musl-native/bin" >> "$GITHUB_PATH"
+          echo "CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=x86_64-linux-musl-gcc" >> "$GITHUB_ENV"
+          # Keeps the binary dynamically linked against musl, which a shared
+          # library needs, and which auth-preflight.yml's libc check reads.
+          echo "RUSTFLAGS=-C target-feature=-crt-static" >> "$GITHUB_ENV"
 
       # Rust 1.94.1 from the root mise.toml, the toolchain the crate is tested
       # with. `cache: false` is required here, not a default.

scripts/__tests__/auth-build-artifacts.test.mjs

@@ -73,6 +73,34 @@ describe('_build-auth-artifacts.yml', () => {
     expect(check).toBeGreaterThan(build)
   })
 
+  it('links the musl binding with musl, from a pinned toolchain', () => {
+    // Targeting musl is not enough: without a musl linker, cargo links the
+    // binary against the runner's glibc, and it fails to load on musl.
+    const musl = (binaries?.steps ?? []).filter((step) =>
+      String(step?.if ?? '').includes("'linux-x64-musl'"),
+    )
+    const run = musl.map((step) => String(step?.run ?? '')).join('\n')
+    const env = Object.assign({}, ...musl.map((step) => step?.env ?? {}))
+    expect(env.MUSL_TOOLCHAIN_SHA256).toMatch(/^[0-9a-f]{64}$/)
+    expect(run).toContain('sha256sum -c')
+    expect(run).toContain(
+      'CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=x86_64-linux-musl-gcc',
+    )
+    expect(run).toContain('RUSTFLAGS=-C target-feature=-crt-static')
+  })
+
+  it('pins the same musl toolchain as the FFI build', () => {
+    const ffi = readFileSync(
+      join(REPO_ROOT, '.github/workflows/_build-ffi-artifacts.yml'),
+      'utf8',
+    )
+    const digest = (text) =>
+      text.match(/MUSL_TOOLCHAIN_SHA256: ([0-9a-f]{64})/)?.[1]
+    const auth = readFileSync(join(REPO_ROOT, WORKFLOW), 'utf8')
+    expect(digest(auth)).toBeDefined()
+    expect(digest(auth)).toBe(digest(ffi))
+  })
+
   it('packs the wrapper with pnpm, which rewrites its workspace peers', () => {
     const packs = runs(wrapper).filter((run) => /\bpack\b/.test(run))
     expect(packs.some((run) => /\bpnpm\b.*\bpack\b/.test(run))).toBe(true)