build-better-sqlite3-node.yml

name: Build Better-SQLite3 (Node)

# Builds better-sqlite3-multiple-ciphers Node prebuilds for a Node major that upstream no longer
# ships but our remote/server extension hosts still run. Verifies each binary loads, then opens a
# PR adding them to packages/better-sqlite3/ under the electron-v<abi> naming convention.

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'better-sqlite3-multiple-ciphers version (npm, e.g. 12.10.0)'
        required: true
        default: '12.10.0'
      node:
        description: 'Node major to build (e.g. 20)'
        required: true
        default: '20'

jobs:
  build-linux:
    # glibc builds run in a Debian container (glibc 2.31, <= the VS Code remote-server floor).
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: x64,   os: ubuntu-24.04 }
          - { arch: arm64, os: ubuntu-24.04-arm }
    runs-on: ${{ matrix.os }}
    container: ${{ format('node:{0}-bullseye', inputs.node) }}
    steps:
      - name: Install build deps
        run: |
          apt-get update
          apt-get install -y --no-install-recommends python3 make g++ curl ca-certificates git tar

      - name: Checkout (for verify script)
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Fetch and extract source
        env:
          VERSION: ${{ inputs.version }}
        run: |
          curl -sSL "https://registry.npmjs.org/better-sqlite3-multiple-ciphers/-/better-sqlite3-multiple-ciphers-${VERSION}.tgz" -o src.tgz
          tar xzf src.tgz   # extracts to ./package

      - name: Install tooling
        working-directory: package
        run: npm install --ignore-scripts --no-audit --no-fund

      - name: Build prebuild
        working-directory: package
        env:
          ARCH: ${{ matrix.arch }}
        run: |
          NODE_FULL=$(node -v | sed 's/^v//')
          npx prebuild -r node -t "$NODE_FULL" --arch "$ARCH" --include-regex 'better_sqlite3.node$'

      # Upload before verify so a green build always yields an artifact.
      - name: Upload prebuild artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bsmc-node-linux-glibc-${{ matrix.arch }}
          path: package/prebuilds/*.tar.gz
          if-no-files-found: error

      - name: Verify under Node
        working-directory: package
        run: |
          out=$(node ../.github/scripts/verify-bsmc-node.js "$PWD" 2>&1) || true
          echo "$out"
          echo "$out" | grep -q "VERIFY_OK" || { echo "verification failed"; exit 1; }

  build-musl:
    # musl builds: the JS actions (checkout/upload) run on the glibc host - GitHub cannot run JS
    # actions inside an Alpine container on arm64 - and the native compile + verify happen inside a
    # `docker run node:<major>-alpine` over a bind mount, so the prebuild lands back on the host.
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: x64,   os: ubuntu-24.04 }
          - { arch: arm64, os: ubuntu-24.04-arm }
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout (for verify script)
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Build and verify in Alpine
        env:
          VERSION: ${{ inputs.version }}
          NODE_MAJOR: ${{ inputs.node }}
          ARCH: ${{ matrix.arch }}
        run: |
          docker run --rm -e VERSION -e ARCH -v "$PWD":/work -w /work \
            "node:${NODE_MAJOR}-alpine" sh -e -c '
              apk add --no-cache python3 make g++ curl tar
              curl -sSL "https://registry.npmjs.org/better-sqlite3-multiple-ciphers/-/better-sqlite3-multiple-ciphers-${VERSION}.tgz" -o src.tgz
              tar xzf src.tgz
              cd package
              npm install --ignore-scripts --no-audit --no-fund
              NODE_FULL=$(node -v | sed "s/^v//")
              npx prebuild -r node -t "$NODE_FULL" --arch "$ARCH" --include-regex "better_sqlite3.node\$"
              out=$(node ../.github/scripts/verify-bsmc-node.js "$PWD" 2>&1) || true
              echo "$out"
              echo "$out" | grep -q "VERIFY_OK" || { echo "verification failed"; exit 1; }
            '

      - name: Upload prebuild artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bsmc-node-linuxmusl-${{ matrix.arch }}
          path: package/prebuilds/*.tar.gz
          if-no-files-found: error

  build-native:
    strategy:
      fail-fast: false
      matrix:
        include:
          - { platform: darwin, arch: x64,   os: macos-15-intel }
          - { platform: darwin, arch: arm64, os: macos-14 }
          - { platform: win32,  arch: x64,   os: windows-latest }
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout (for verify script)
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ inputs.node }}

      - name: Fetch and extract source
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: |
          curl -sSL "https://registry.npmjs.org/better-sqlite3-multiple-ciphers/-/better-sqlite3-multiple-ciphers-${VERSION}.tgz" -o src.tgz
          tar xzf src.tgz   # extracts to ./package

      - name: Install tooling
        shell: bash
        working-directory: package
        run: npm install --ignore-scripts --no-audit --no-fund

      - name: Build prebuild
        shell: bash
        working-directory: package
        env:
          ARCH: ${{ matrix.arch }}
        run: |
          NODE_FULL=$(node -v | sed 's/^v//')
          npx prebuild -r node -t "$NODE_FULL" --arch "$ARCH" --include-regex 'better_sqlite3.node$'

      - name: Upload prebuild artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bsmc-node-${{ matrix.platform }}-${{ matrix.arch }}
          path: package/prebuilds/*.tar.gz
          if-no-files-found: error

      - name: Verify under Node
        shell: bash
        working-directory: package
        run: |
          out=$(node ../.github/scripts/verify-bsmc-node.js "$PWD" 2>&1) || true
          echo "$out"
          echo "$out" | grep -q "VERIFY_OK" || { echo "verification failed"; exit 1; }

  collect:
    needs: [build-linux, build-musl, build-native]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Download all artifacts
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          path: artifacts

      - name: Stage prebuilds as electron-v*
        id: stage
        run: |
          mkdir -p packages/better-sqlite3
          added=""
          while IFS= read -r f; do
            base=$(basename "$f")
            dest="packages/better-sqlite3/${base/-node-v/-electron-v}"
            cp "$f" "$dest"
            added="$added
          - $(basename "$dest")"
          done < <(find artifacts -name '*-node-v*.tar.gz')
          {
            echo "added<<EOF"
            echo "$added"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Commit only the staged prebuilds, never the downloaded artifacts/ working dir.
          add-paths: packages/better-sqlite3
          commit-message: "Build Node ${{ inputs.node }} prebuilds for better-sqlite3-multiple-ciphers ${{ inputs.version }}"
          title: "Build Node ${{ inputs.node }} prebuilds for better-sqlite3-multiple-ciphers ${{ inputs.version }}"
          body: |
            Self-built Node ${{ inputs.node }} prebuilds (upstream no longer ships this ABI):
            ${{ steps.stage.outputs.added }}
          branch: build-node-prebuilds
          delete-branch: true