ci: require musl in the musl binary, and load it inside Alpine

cipherstash-bot's review of #1018, verified:

- The linux-x64-musl rule only refused glibc, so a statically linked
  binary, with no libc entry at all, passed it. Node.js cannot load that
  as a native module, and no job loaded the musl binary: auth-preflight
  installs only the runner's own linux-x64-gnu package. Both the build
  and the preflight now require a NEEDED entry for musl's libc, and the
  preflight installs the wrapper and the musl package inside the pinned
  Alpine image and loads them. That step loads the fixed build, and
  fails on the suite's glibc-linked 0.44.0 with "Failed to load native
  binding".
- The container's chown ran last, so a failed build left root-owned
  files in the workspace. A trap now runs it on every exit.
- The musl leg no longer adds a host Rust target or installs node-gyp,
  which only the host build uses.

Tests now cover: the tracked-file check coming after both builds;
docker run using the pinned image variable, not a tag; the trap; musl
being required in the build and the preflight; every rejection exiting
1; a rule for every Linux platform in the matrix; and the Alpine load
step using the build's image. Each fails when its part is removed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

.github/workflows/_build-auth-artifacts.yml

@@ -79,6 +79,7 @@ jobs:
       # `macos-latest` is arm64, so without it `darwin-x64` ships an arm64
       # binary.
       - name: Add the Rust target
+        if: ${{ matrix.platform != 'linux-x64-musl' }}
         env:
           TARGET: ${{ matrix.target }}
         run: mise x -- rustup target add "$TARGET"
@@ -94,6 +95,7 @@ jobs:
           package-manager-cache: false
 
       - name: Install node-gyp
+        if: ${{ matrix.platform != 'linux-x64-musl' }}
         run: npm install -g node-gyp
 
       - name: Install dependencies
@@ -136,6 +138,7 @@ jobs:
             -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
             -e RUSTFLAGS="-C target-feature=-crt-static" \
             "$ALPINE_NODE_IMAGE" sh -euc '
+              trap "chown -R \"\$HOST_UID:\$HOST_GID\" /build" EXIT
               apk add --no-cache build-base cmake perl linux-headers git curl rustup
               rustup-init -y --profile minimal --default-toolchain "$RUST_VERSION" --target "$TARGET"
               . "$HOME/.cargo/env"
@@ -144,7 +147,6 @@ jobs:
               pnpm install --frozen-lockfile --ignore-scripts --filter "@cipherstash/auth..."
               cd languages/typescript/packages/auth
               pnpm exec napi build --platform --release --target "$TARGET" --strip --dts native.d.ts --js false
-              chown -R "$HOST_UID:$HOST_GID" /build
             '
 
       # The build must leave the tracked tree alone: `native.d.ts` is
@@ -182,7 +184,12 @@ jobs:
               if grep -q 'NEEDED.*libc\.so\.6' <<< "$dynamic" ; then
                 echo "::error::linux-x64-musl links glibc — it is the gnu binary"
                 exit 1
-              fi ;;
+              fi
+              # A static binary has no libc entry at all, and Node.js cannot
+              # load it as a native module, so musl must be named.
+              grep -q 'NEEDED.*libc\.musl-' <<< "$dynamic" || {
+                echo "::error::linux-x64-musl has no musl libc NEEDED entry — it is linked statically"
+                exit 1; } ;;
             *)
               echo "::error::no C library rule for $PLATFORM"; exit 1 ;;
           esac

.github/workflows/auth-preflight.yml

@@ -92,7 +92,10 @@ jobs:
                   echo "::error::linux-x64-musl links glibc — it is the gnu binary"
                   exit 1
                 fi
-                echo "linux-x64-musl: no glibc NEEDED entry" ;;
+                grep -q 'NEEDED.*libc\.musl-' <<< "$dynamic" || {
+                  echo "::error::linux-x64-musl has no musl libc NEEDED entry — it is linked statically"
+                  exit 1; }
+                echo "linux-x64-musl: links musl, not glibc" ;;
             esac
             checked=$((checked + 1))
           done
@@ -130,3 +133,28 @@ jobs:
           console.log('smoke OK')
           EOF
           node smoke.mjs
+
+      # The host step above installs only linux-x64-gnu, the runner's own
+      # platform. The musl binary loads only where musl is the C library, so it
+      # is installed and loaded inside Alpine, from the image the build uses.
+      - name: Smoke-test the musl artifact inside Alpine
+        env:
+          ALPINE_NODE_IMAGE: node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402
+        run: |
+          set -euo pipefail
+          wrapper=$(basename "$(ls "$GITHUB_WORKSPACE"/auth-dist/cipherstash-auth-[0-9]*.tgz)")
+          musl=$(basename "$(ls "$GITHUB_WORKSPACE"/auth-dist/cipherstash-auth-linux-x64-musl-*.tgz)")
+          docker run --rm -v "$GITHUB_WORKSPACE/auth-dist:/dist:ro" \
+            -e WRAPPER="$wrapper" -e MUSL="$musl" \
+            "$ALPINE_NODE_IMAGE" sh -euc '
+              mkdir -p /tmp/smoke && cd /tmp/smoke
+              echo "{\"name\":\"smoke\",\"version\":\"1.0.0\",\"private\":true}" > package.json
+              npm install --no-audit --no-fund "/dist/$WRAPPER" "/dist/$MUSL"
+              node -e "
+                const auth = require(\"@cipherstash/auth\")
+                for (const name of [\"AccessKeyStrategy\", \"AutoStrategy\", \"OidcFederationStrategy\"]) {
+                  if (typeof auth[name] !== \"function\") throw new Error(\"no \" + name)
+                }
+                console.log(\"musl smoke OK\")
+              "
+            '

scripts/__tests__/auth-build-artifacts.test.mjs

@@ -65,13 +65,16 @@ describe('_build-auth-artifacts.yml', () => {
     }
   })
 
-  it('fails the leg when the build changed a tracked file', () => {
+  it('fails the leg when either build changed a tracked file', () => {
     const all = runs(binaries)
-    const build = all.findIndex((run) => /\bnapi build\b/.test(run))
+    const builds = all
+      .map((_, index) => index)
+      .filter((index) => /\bnapi build\b/.test(all[index]))
     const check = all.findIndex((run) =>
       new RegExp(`git diff --exit-code\\b.*${AUTH_DIR}`).test(run),
     )
-    expect(check).toBeGreaterThan(build)
+    expect(builds).toHaveLength(2)
+    for (const build of builds) expect(check).toBeGreaterThan(build)
   })
 
   it('builds the musl binding inside Alpine, from an image pinned by digest', () => {
@@ -84,10 +87,19 @@ describe('_build-auth-artifacts.yml', () => {
     const run = musl.map((step) => String(step?.run ?? '')).join('\n')
     const env = Object.assign({}, ...musl.map((step) => step?.env ?? {}))
     expect(env.ALPINE_NODE_IMAGE).toMatch(/-alpine@sha256:[0-9a-f]{64}$/)
-    expect(run).toContain('docker run')
+    // The pinned image is the one that runs, not a mutable tag.
+    expect(run).toMatch(/docker run[\s\S]*"\$ALPINE_NODE_IMAGE"/)
+    expect(run).not.toMatch(/\bnode:\d+-alpine(?!@)/)
     expect(run).toContain('RUSTFLAGS="-C target-feature=-crt-static"')
-    // The host build and the host dependency install skip the musl leg.
-    for (const name of ['Build the native binding', 'Install dependencies']) {
+    // The container hands its files back even when the build fails.
+    expect(run).toMatch(/^\s*trap "chown -R .*\/build" EXIT$/m)
+    // The host steps that only the host build uses skip the musl leg.
+    for (const name of [
+      'Add the Rust target',
+      'Install node-gyp',
+      'Install dependencies',
+      'Build the native binding',
+    ]) {
       const step = steps.find((s) => s?.name === name)
       expect(String(step?.if ?? '')).toContain("!= 'linux-x64-musl'")
     }
@@ -111,6 +123,41 @@ describe('_build-auth-artifacts.yml', () => {
       /linux-x64-gnu\|linux-arm64-gnu\)[\s\S]*libc\\\.so\\\.6/,
     )
     expect(run).toContain('linux-x64-musl links glibc')
+    // A static binary has no libc entry, so musl must be named, not only
+    // glibc refused.
+    expect(run).toMatch(/linux-x64-musl\)[\s\S]*libc\\\.musl-/)
+    // Every rejection fails the job, so the binary is never packed.
+    const errors = run.match(/::error::/g) ?? []
+    expect(errors.length).toBeGreaterThan(0)
+    expect((run.match(/exit 1/g) ?? []).length).toBe(errors.length)
+    // Every Linux platform in the matrix has a rule.
+    const linux = (binaries?.strategy?.matrix?.include ?? [])
+      .filter((leg) => String(leg.os).startsWith('ubuntu'))
+      .map((leg) => leg.platform)
+    expect(linux.length).toBeGreaterThan(0)
+    for (const platform of linux) {
+      expect(run).toMatch(new RegExp(`(^|[|\\s])${platform}[|)]`, 'm'))
+    }
+  })
+
+  it('auth-preflight requires musl, and loads the musl artifact inside Alpine', () => {
+    const preflight = readWorkflow('.github/workflows/auth-preflight.yml')
+    const steps = preflight?.jobs?.smoke?.steps ?? []
+    const verify = steps.map((step) => String(step?.run ?? '')).join('\n')
+    expect(verify).toMatch(/linux-x64-musl\)[\s\S]*libc\\\.musl-/)
+    // The host smoke test installs only the runner's own platform, so without
+    // this step no job loads the musl binary.
+    const alpine = steps.find((step) =>
+      /\bdocker run\b/.test(String(step?.run ?? '')),
+    )
+    expect(alpine).toBeDefined()
+    expect(String(alpine.run)).toContain('linux-x64-musl')
+    expect(String(alpine.run)).toMatch(/docker run[\s\S]*"\$ALPINE_NODE_IMAGE"/)
+    // The same image as the build, so the load test matches the build.
+    const build = (binaries?.steps ?? []).find(
+      (step) => step?.env?.ALPINE_NODE_IMAGE,
+    )
+    expect(alpine.env?.ALPINE_NODE_IMAGE).toBe(build?.env?.ALPINE_NODE_IMAGE)
   })
 
   it('packs the wrapper with pnpm, which rewrites its workspace peers', () => {