alpine.yml

name: alpine
on:
  workflow_dispatch:
env:
  FORCE_COLOR: 1
concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
jobs:
  build-qemu:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node:
          - 24
        target:
          - linux/arm64
          - linux/amd64
          - linux/ppc64le
          - linux/s390x
          - linux/386
          - linux/arm/v6
          - linux/arm/v7
        variant:
          - alpine
    name: ${{ matrix.variant }} (node=${{ matrix.node }}, target=${{ matrix.target }})
    steps:
      - uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Add env vars
        id: vars
        shell: bash
        run: |
          echo "V=1" >> $GITHUB_ENV
          
          if [[ "${{ matrix.target }}" = "linux/arm/v6" ]]; then
            TARGET=arm
            TARGET_VARIANT=armv6
          elif [[ "${{ matrix.target }}" = "linux/arm/v7" ]]; then
            TARGET=arm
            TARGET_VARIANT=armv7
          elif [ "${{ matrix.target }}" = "linux/arm64" ]; then
            TARGET=arm64
          elif [ "${{ matrix.target }}" = "linux/amd64" ]; then
            TARGET=x64
          elif [ "${{ matrix.target }}" = "linux/ppc64le" ]; then
            TARGET=ppc64
          elif [ "${{ matrix.target }}" = "linux/s390x" ]; then
            TARGET=s390x
          elif [ "${{ matrix.target }}" = "linux/386" ]; then
            TARGET=ia32
          fi
          TARGET_VARIANT=${TARGET_VARIANT:-$TARGET}
          echo "TARGET=$TARGET" >> $GITHUB_ENV
          echo "artifact_name=prebuilt-binaries-alpine-$TARGET_VARIANT" >> $GITHUB_OUTPUT

          cat $GITHUB_ENV

      - name: Build binaries and test
        run: |
          docker buildx build \
            --file ./tools/BinaryBuilder-alpine.Dockerfile \
            --load \
            --tag sqlite-builder \
            --platform ${{ matrix.target }} \
            --no-cache \
            --build-arg VARIANT=${{ matrix.variant }} \
            --build-arg TARGET=${{ env.TARGET }} \
            --build-arg NODE_VERSION=${{ matrix.node }} \
            .
          CONTAINER_ID=$(docker create -it sqlite-builder)
          docker cp $CONTAINER_ID:/usr/src/build/build/ ./build

      - name: Test database I/O with default seccomp
        run: |
          docker run --rm \
            sqlite-builder \
            node node_modules/mocha/bin/mocha --timeout 480000 \
            test/io_compat.test.js test/musl_legacy_io.test.js

      - name: Test database I/O with pwritev2 denied by seccomp
        run: |
          docker run --rm \
            --security-opt "seccomp=${{ github.workspace }}/.github/seccomp/deny-pwritev2.json" \
            sqlite-builder \
            node node_modules/mocha/bin/mocha --timeout 480000 \
            test/io_compat.test.js test/musl_legacy_io.test.js

      - name: Verify Alpine binary does not import pwrite
        run: |
          docker run --rm sqlite-builder sh -c '
            ! nm -u lib/binding/*/node_sqlite3.node | grep -E "[[:space:]]pwrite(64)?$" &&
            readelf -d lib/binding/*/node_sqlite3.node | grep -q SYMBOLIC
          '

      - name: Upload binaries to commit artifacts
        uses: actions/upload-artifact@v7
        if: matrix.node == 24
        with:
          name: ${{ steps.vars.outputs.artifact_name }}
          path: build/stage/*/*
          retention-days: 7

      - uses: actions/setup-node@v6
        if: matrix.target != 'linux/arm/v7'
        with:
          node-version: 24

      - name: Upload binaries to GitHub Release
        run: npm ci --ignore-scripts && node tools/publish-prebuild.js
        if: matrix.node == 24 && matrix.target != 'linux/arm/v7'
        env:
          NODE_PRE_GYP_GITHUB_TOKEN: ${{ secrets.API_TOKEN }}