Build - fix(Session): prevent V8 JIT corruption during cleanup on Alpine Hold strong references to Session JS objects during DeleteAllSessions() cleanup. This prevents GC from destroying Sessions while we iterate, avoiding V8 JIT page corruption that manifested as SIGSEGV on Alpine/musl. The bug: When Sessions were GC'd during Jest cleanup, their ObjectReference destructors corrupted V8's JIT allocations. This only happened on Alpine because musl has different GC timing during process exit. The fix: T... #250
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Release | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "@photostructure/sqlite release: bump version (current = use package.json)" | |
| required: false | |
| type: choice | |
| default: "current" | |
| options: | |
| - current | |
| - patch | |
| - minor | |
| - major | |
| run-name: ${{ github.event_name == 'workflow_dispatch' && format('Release - {0}', github.event.inputs.version) || format('Build - {0}', github.event.head_commit.message || github.event.pull_request.title) }} | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 # Extend timeout to 30 minutes (default is 6 hours for a job) | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - run: sudo apt-get update | |
| - run: sudo apt-get install -y clang-tidy bear build-essential | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: 20 | |
| cache: "npm" | |
| - run: npm ci --ignore-scripts | |
| - run: npm run build:dist | |
| - run: npm run lint | |
| timeout-minutes: 20 # Give the lint step more time | |
| prebuild-mac-x64: | |
| runs-on: macos-15-intel # Intel x64 runner | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: 20 | |
| cache: "npm" | |
| - run: npm ci --ignore-scripts | |
| - run: npm run build:native | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: prebuilds-mac-x64 | |
| path: prebuilds/ | |
| prebuild-mac-arm64: | |
| runs-on: macos-14 # Apple Silicon ARM64 (macos-14+ are ARM64) | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: 20 | |
| cache: "npm" | |
| - run: npm ci --ignore-scripts | |
| - run: npm run build:native | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: prebuilds-mac-arm64 | |
| path: prebuilds/ | |
| prebuild-win-x64: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: 20 | |
| cache: "npm" | |
| - run: npm ci --ignore-scripts | |
| - run: npm run build:native | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: prebuilds-win-x64 | |
| path: prebuilds/ | |
| prebuild-win-arm64: | |
| runs-on: windows-11-arm # Native ARM64 runner (public repos only) | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: 20 | |
| cache: "npm" | |
| - run: npm ci --ignore-scripts | |
| - run: npm run build:native | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: prebuilds-win-arm64 | |
| path: prebuilds/ | |
| prebuild-linux-glibc: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: x64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - run: npm ci --ignore-scripts | |
| - run: TARGET_ARCH=${{ matrix.arch }} npm run build:native:linux | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: prebuilds-linux-${{ matrix.arch }}-glibc | |
| path: prebuilds/ | |
| prebuild-linux-musl: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: x64 | |
| runner: ubuntu-24.04 | |
| platform: linux/amd64 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| platform: linux/arm64 | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - run: | | |
| CONTAINER_NAME="node-sqlite-musl-build-$$" | |
| docker run -d --name "$CONTAINER_NAME" --platform ${{ matrix.platform }} node:20-alpine sleep 3600 | |
| docker cp . "$CONTAINER_NAME:/tmp/project" | |
| docker exec "$CONTAINER_NAME" sh -c "cd /tmp/project && apk add build-base git python3 py3-setuptools --update-cache && npm ci --ignore-scripts && npm run build:native && cd test/fixtures/test-extension && node build.js --force" | |
| docker cp "$CONTAINER_NAME:/tmp/project/prebuilds" . 2>/dev/null || true | |
| docker cp "$CONTAINER_NAME:/tmp/project/build" . 2>/dev/null || true | |
| docker cp "$CONTAINER_NAME:/tmp/project/test/fixtures/test-extension/test_extension.so" test/fixtures/test-extension/ 2>/dev/null || true | |
| docker rm -f "$CONTAINER_NAME" >/dev/null | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: prebuilds-linux-${{ matrix.arch }}-musl | |
| path: prebuilds/ | |
| - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: test-extension-linux-${{ matrix.arch }}-musl | |
| path: test/fixtures/test-extension/test_extension.so | |
| if-no-files-found: warn | |
| test-mac-win: | |
| needs: | |
| - prebuild-mac-x64 | |
| - prebuild-mac-arm64 | |
| - prebuild-win-x64 | |
| - prebuild-win-arm64 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [macos-15-intel, macos-14, windows-latest, windows-11-arm] | |
| node-version: [20, 22, 23, 24] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| path: ./prebuilds | |
| merge-multiple: true | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: "npm" | |
| - run: npm ci | |
| - run: npm run build:dist | |
| - run: npm test | |
| test-ubuntu: | |
| needs: | |
| - prebuild-linux-glibc | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-22.04, ubuntu-24.04] | |
| arch: [x64, arm64] | |
| node-version: [20, 22, 23, 24] | |
| runs-on: ${{ matrix.arch == 'arm64' && format('{0}-arm', matrix.os) || matrix.os }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| path: ./prebuilds | |
| merge-multiple: true | |
| - run: npm ci | |
| - run: npm run build:dist | |
| - run: npm test | |
| test-alpine: | |
| needs: | |
| - prebuild-linux-musl | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| arch: [x64, arm64] | |
| node-version: [20, 22, 23, 24] | |
| include: | |
| - arch: x64 | |
| runner: ubuntu-24.04 | |
| platform: linux/amd64 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| platform: linux/arm64 | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| path: ./prebuilds | |
| merge-multiple: true | |
| - name: Download test extension for this architecture | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: test-extension-linux-${{ matrix.arch }}-musl | |
| path: ./test/fixtures/test-extension | |
| continue-on-error: true | |
| - run: | | |
| docker run --rm -v $(pwd):/tmp/project --entrypoint /bin/sh --platform ${{ matrix.platform }} node:${{ matrix.node-version }}-alpine -c "\ | |
| apk add build-base git python3 py3-setuptools --update-cache && \ | |
| cd /tmp/project && \ | |
| npm ci && \ | |
| npm run build:dist && \ | |
| npm test" | |
| # Node.js compatibility tests require --experimental-sqlite flag and Node 22+ | |
| # We test only on Node 24 as the experimental SQLite API may change between versions | |
| test-api-compatibility: | |
| needs: | |
| - prebuild-mac-x64 | |
| - prebuild-mac-arm64 | |
| - prebuild-win-x64 | |
| - prebuild-win-arm64 | |
| - prebuild-linux-glibc | |
| strategy: | |
| fail-fast: false # Don't cancel other jobs if one fails | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| node-version: [24] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| path: ./prebuilds | |
| merge-multiple: true | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: "npm" | |
| - run: npm ci | |
| - run: npm run build:dist | |
| - name: Check API compatibility types (TypeScript compile-time validation) | |
| run: npm run lint:api | |
| - name: Run API type compatibility tests (ensures our TypeScript types match node:sqlite) | |
| run: npm run test:api | |
| - name: Run behavioral compatibility tests (validates runtime behavior matches node:sqlite) | |
| run: npm run test:node | |
| publish: | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| runs-on: ubuntu-24.04 | |
| needs: | |
| - lint | |
| - test-mac-win | |
| - test-ubuntu | |
| - test-alpine | |
| - test-api-compatibility | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write # Required for NPM Trusted Publishing (OIDC) | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| # Fetch full history for proper git operations | |
| fetch-depth: 0 | |
| - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| path: ./prebuilds | |
| merge-multiple: true | |
| - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: lts/* | |
| cache: "npm" | |
| registry-url: "https://registry.npmjs.org" | |
| - uses: photostructure/git-ssh-signing-action@fdd4b062a9ba41473f013258cc9c7eea1640f826 # v1.2.0 | |
| with: | |
| ssh-signing-key: ${{ secrets.SSH_SIGNING_KEY }} | |
| git-user-name: ${{ secrets.GIT_USER_NAME }} | |
| git-user-email: ${{ secrets.GIT_USER_EMAIL }} | |
| - run: ls -laR ./prebuilds | |
| - run: npm install -g npm@latest # Ensure latest npm for publishing | |
| - run: npm ci | |
| - run: npm run release:prepare | |
| - name: Version and tag release | |
| run: | | |
| # Handle version bump based on input | |
| if [ "${{ github.event.inputs.version }}" = "current" ]; then | |
| # Use the version from package.json, stripping any pre-release suffix | |
| RELEASE_VERSION=$(node -p "require('./package.json').version.replace(/-.*$/, '')") | |
| npm version $RELEASE_VERSION --message "release: %s" | |
| else | |
| # Normal version bump (patch, minor, major) | |
| npm version ${{ github.event.inputs.version }} --message "release: %s" | |
| fi | |
| # Get the new version for later use | |
| NEW_VERSION=$(node -p "require('./package.json').version") | |
| # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#environment-files | |
| echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV | |
| - name: Publish to npm | |
| # Uses OIDC token from id-token: write permission (no NPM_TOKEN secret needed) | |
| # Provenance generates signed attestation linking the package to this workflow | |
| # See: https://docs.npmjs.com/generating-provenance-statements | |
| run: npm publish --provenance --access public | |
| - name: Create GitHub Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Push the version commit and tag | |
| git push origin main --follow-tags | |
| # Create GitHub release | |
| gh release create "v$NEW_VERSION" \ | |
| --title "Release v$NEW_VERSION" \ | |
| --generate-notes \ | |
| --verify-tag |