node-smol.yml

name: SMOL 5. Node.js

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run (build only, no release)'
        type: boolean
        default: true
      force:
        description: 'Force rebuild (ignore cache)'
        type: boolean
        default: false
      build_mode:
        description: 'Build mode'
        type: choice
        options:
          - prod
          - dev
        default: prod
      debug:
        description: 'Debug (0|1|namespace[,...])'
        type: string
        default: '0'
  workflow_call:
    inputs:
      dry_run:
        type: boolean
        default: true
      force:
        type: boolean
        default: false
      build_mode:
        type: string
        default: prod
      debug:
        type: string
        default: '0'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    permissions:
      contents: read
      id-token: write # OIDC authentication for Depot.dev builds
    name: Build (${{ matrix.platform == 'win32' && 'win' || matrix.platform }}-${{ matrix.arch }}${{ matrix.libc == 'musl' && '-musl' || '' }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 210
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS builds use Depot.dev ARM64 runner (8 vCPU M2, 24GB RAM).
          # darwin-x64 is cross-compiled from ARM64 via --dest-cpu=x64.
          - runner: depot-macos-15
            platform: darwin
            arch: arm64
            os: macos
          - runner: depot-macos-15
            platform: darwin
            arch: x64
            os: macos
            cross_compile: true

          # Linux glibc builds
          - runner: ubuntu-24.04
            platform: linux
            arch: x64
            os: linux
            libc: glibc
          - runner: ubuntu-24.04-arm
            platform: linux
            arch: arm64
            os: linux
            libc: glibc

          # Linux musl builds (Alpine)
          - runner: ubuntu-24.04
            platform: linux
            arch: x64
            os: linux
            libc: musl
          - runner: ubuntu-24.04-arm
            platform: linux
            arch: arm64
            os: linux
            libc: musl

          # Windows builds
          - runner: windows-2022
            platform: win32
            arch: x64
            os: windows
          # Windows ARM64: Cross-compile on x64 runner (no ARM64 hosted runners available)
          - runner: windows-2022
            platform: win32
            arch: arm64
            os: windows
            cross_compile: true

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          # Don't clone all submodules - only needed ones are initialized below.
          submodules: false

      - name: Initialize submodules
        uses: ./.github/actions/init-submodules
        with:
          submodules: >-
            packages/node-smol-builder/upstream/node
            packages/bin-infra/upstream/zstd
            packages/binject/upstream/libdeflate
            packages/node-smol-builder/upstream/uSockets
            packages/node-smol-builder/upstream/uWebSockets

      - name: Initialize liburing submodule (Linux only)
        if: matrix.os == 'linux'
        uses: ./.github/actions/init-submodules
        with:
          submodules: packages/node-smol-builder/upstream/liburing

      - name: Validate Node.js submodule vendored files
        shell: bash
        run: |
          ACORN_FILE="packages/node-smol-builder/upstream/node/deps/acorn/acorn/dist/acorn.js"
          if [ ! -f "$ACORN_FILE" ]; then
            echo "ERROR: Required vendored file missing: $ACORN_FILE"
            echo "Listing contents of deps/acorn/acorn/dist/:"
            ls -la packages/node-smol-builder/upstream/node/deps/acorn/acorn/dist/ || echo "Directory does not exist"
            echo "Listing contents of deps/acorn/acorn/:"
            ls -la packages/node-smol-builder/upstream/node/deps/acorn/acorn/ || echo "Directory does not exist"
            echo "Git submodule status:"
            git submodule status packages/node-smol-builder/upstream/node
            exit 1
          fi
          echo "[OK] Verified acorn.js exists: $ACORN_FILE"
          ls -lh "$ACORN_FILE"

      - name: Get node submodule commit
        id: node-submodule
        shell: bash
        run: |
          NODE_SUBMODULE_REF=$(git -C packages/node-smol-builder/upstream/node rev-parse --short=7 HEAD)
          echo "ref=${NODE_SUBMODULE_REF}" >> $GITHUB_OUTPUT
          echo "Node submodule ref: ${NODE_SUBMODULE_REF}"

      - name: Enable debug logging
        uses: ./.github/actions/enable-debug-logging
        with:
          debug: ${{ inputs.debug }}

      - uses: SocketDev/socket-registry/.github/actions/setup@3362af95fadd1e325cb48e9ad6daff21c112bd72 # main

      - name: Load Node.js version
        id: node-version
        shell: bash
        run: |
          NODE_BUILD_VERSION=$(cat .node-version | tr -d '\n')
          echo "node-build-version=$NODE_BUILD_VERSION" >> $GITHUB_OUTPUT
          echo "node-version=$NODE_BUILD_VERSION" >> $GITHUB_OUTPUT
          echo "Loaded Node.js build version: $NODE_BUILD_VERSION"

      - uses: SocketDev/socket-registry/.github/actions/install@3362af95fadd1e325cb48e9ad6daff21c112bd72 # main

      - name: Load tool versions
        id: tool-versions
        shell: bash
        run: |
          # Load Python version from external-tools.json (single source of truth)
          PYTHON_VERSION=$(node packages/build-infra/scripts/get-tool-version.mts python version)
          echo "python-version=$PYTHON_VERSION" >> $GITHUB_OUTPUT
          echo "Python version: $PYTHON_VERSION"

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '${{ steps.tool-versions.outputs.python-version }}'

      - name: Install QEMU and Docker (Linux - for cross-compiled binary testing)
        if: matrix.os == 'linux' && matrix.runner == 'ubuntu-24.04' && (matrix.arch == 'arm64' || matrix.libc == 'musl')
        run: |
          sudo apt-get update

          # Install QEMU for ARM64 emulation (if ARM64 build)
          if [ "${{ matrix.arch }}" = "arm64" ]; then
            echo "Installing QEMU user-mode for ARM64 emulation..."
            sudo apt-get install -y qemu-user-static
            echo "[OK] QEMU installed"
          fi

          # Docker is pre-installed on GitHub Actions runners (for musl testing)
          if [ "${{ matrix.libc }}" = "musl" ]; then
            echo "Verifying Docker is available for musl testing..."
            docker --version || echo "⚠ Docker not available"
          fi

      - name: Set build mode
        id: build-mode
        uses: ./.github/actions/set-build-mode
        with:
          build-mode: ${{ inputs.build_mode }}

      - name: Set platform-arch
        id: platform-arch
        uses: ./.github/actions/set-platform-arch
        with:
          platform: ${{ matrix.platform }}
          arch: ${{ matrix.arch }}
          libc: ${{ matrix.libc }}

      # NOTE: GCC 13 is NOT installed here on the Ubuntu runner because:
      # - Node.js compilation happens inside Docker (Depot.dev runner) with AlmaLinux 8 + GCC Toolset 13
      # - Post-processing steps (strip, compress, finalize) only need standard tools (strip, objcopy)
      # - The ubuntu-toolchain-r PPA has unreliable network connectivity (Launchpad API timeouts)

      - name: Install musl toolchain (Linux musl)
        if: matrix.os == 'linux' && matrix.libc == 'musl' && (steps.checkpoint-cache.outputs.cache-hit != 'true' || steps.validate-cache.outputs.valid == 'false' || inputs.force)
        run: |
          # Install musl cross-compilation toolchain
          sudo apt-get install -y musl-tools

          # For ARM64, we need the cross-compiler
          if [ "${{ matrix.arch }}" = "arm64" ]; then
            sudo apt-get install -y gcc-aarch64-linux-gnu
          fi

      - name: Select Xcode (macOS)
        if: matrix.os == 'macos' && (steps.checkpoint-cache.outputs.cache-hit != 'true' || steps.validate-cache.outputs.valid == 'false' || inputs.force)
        uses: ./.github/actions/select-xcode

      - name: Setup Depot CLI
        if: matrix.os == 'linux'
        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
        with:
          oidc: true

      - name: Setup ccache (Unix)
        if: matrix.os != 'windows'
        uses: hendrikmuhs/ccache-action@1bbbcda0748b3e340dee71a314fa68ffcbd6df79 # v1.2.21
        with:
          key: ${{ matrix.os }}-${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.libc && format('-{0}', matrix.libc) || '' }}-${{ steps.build-mode.outputs.mode }}
          # macOS: Depot.dev has 24GB RAM - can afford larger ccache
          # Linux has less RAM, keep at 2GB
          max-size: ${{ matrix.os == 'macos' && '4G' || '2G' }}
          save: ${{ steps.checkpoint-cache.outputs.cache-hit != 'true' || steps.validate-cache.outputs.valid == 'false' || inputs.force }}

      - name: Setup ccache (Windows)
        if: matrix.os == 'windows'
        uses: hendrikmuhs/ccache-action@1bbbcda0748b3e340dee71a314fa68ffcbd6df79 # v1.2.21
        with:
          key: windows-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.build-mode.outputs.mode }}
          max-size: 2G
          variant: sccache
          save: ${{ steps.checkpoint-cache.outputs.cache-hit != 'true' || steps.validate-cache.outputs.valid == 'false' || inputs.force }}

      - name: Setup Windows build tools
        if: matrix.os == 'windows' && (steps.checkpoint-cache.outputs.cache-hit != 'true' || steps.validate-cache.outputs.valid == 'false' || inputs.force)
        shell: bash
        run: |
          # Install LLVM/Clang for MSVC-compatible builds
          # Using clang avoids MinGW runtime DLL dependencies
          choco install -y llvm
          clang --version

      # NOTE: Compression tools are now built automatically during the build process
      # The build script (build-compressed.mts) calls ensureCompressionToolsBuilt()
      # which checks if tools exist and builds them if needed. No manual step required.

      - name: Install compression tool dependencies (Linux)
        if: matrix.os == 'linux' && (steps.checkpoint-cache.outputs.cache-hit != 'true' || steps.validate-cache.outputs.valid == 'false' || inputs.force)
        shell: bash
        run: |
          # Install OpenSSL development headers for Linux builds
          sudo apt-get update
          sudo apt-get install -y libssl-dev

      - name: Load cache version from centralized config
        id: cache-version
        shell: bash
        run: |
          CACHE_VERSION=$(jq -r '.versions["node-smol"]' .github/cache-versions.json)
          if [ -z "$CACHE_VERSION" ] || [ "$CACHE_VERSION" = "null" ]; then
            echo "× Error: Cache version not found for node-smol in .github/cache-versions.json"
            exit 1
          fi
          echo "version=$CACHE_VERSION" >> $GITHUB_OUTPUT
          echo "Cache version: $CACHE_VERSION"

      - name: Generate smol build cache key
        id: smol-cache-key
        shell: bash
        env:
          BUILD_MODE: ${{ steps.build-mode.outputs.mode }}
          CACHE_VERSION: ${{ steps.cache-version.outputs.version }}
          MATRIX_PLATFORM: ${{ matrix.platform }}
          MATRIX_ARCH: ${{ matrix.arch }}
        run: |
          # Cross-platform hash function
          if command -v shasum &> /dev/null; then
            hash_cmd="shasum -a 256"
          elif command -v sha256sum &> /dev/null; then
            hash_cmd="sha256sum"
          elif command -v certutil &> /dev/null; then
            # Windows fallback using certutil
            echo "Warning: Using certutil for hashing (Windows fallback)"
            hash_cmd="certutil -hashfile"
          else
            echo "Error: No SHA-256 command found (tried shasum, sha256sum, certutil)"
            exit 1
          fi

          # Helper function to hash files, returns empty string if no files found
          # Callers must pass -type f and optionally -name "*.mts" to filter appropriately
          hash_files() {
            local files=$(find "$@" 2>/dev/null)
            if [ -n "$files" ]; then
              echo "$files" | sort | xargs $hash_cmd 2>/dev/null | $hash_cmd | cut -d' ' -f1
            else
              echo ""
            fi
          }

          # Helper function to get hierarchical paths for a category/phase/platform/arch
          # Returns: shared/, platform/shared/, platform/arch/
          get_hierarchical_paths() {
            local category=$1    # scripts, patches, additions
            local phase=$2       # binary-released, binary-stripped, binary-compressed, finalized
            local platform=$3    # darwin, linux, linux-musl, win32
            local arch=$4        # arm64, x64

            local base="packages/node-smol-builder/${category}/${phase}"

            echo "${base}/shared ${base}/${platform}/shared ${base}/${platform}/${arch}"
          }

          # Get platform and arch from matrix
          PLATFORM="${MATRIX_PLATFORM}"
          ARCH="${MATRIX_ARCH}"

          # Phase-specific hashing for granular cache invalidation
          # Each phase includes its dependencies (cumulative hashing)
          # Now with hierarchical paths: shared/ → platform/shared/ → platform/arch/

          # Get cache version for inclusion in hash

          # Common scripts (used by all phases) - hierarchical
          # Each checkpoint now has its own paths.mts that re-exports from scripts/paths.mts
          # This makes dependencies explicit and ensures changes to paths.mts are tracked per-checkpoint
          COMMON_PATHS=$(get_hierarchical_paths scripts common "$PLATFORM" "$ARCH")
          COMMON_SCRIPTS=$(hash_files $COMMON_PATHS -type f -name "*.mts")

          # source-copied phase: cache-version + common + patches/source-copied + additions/source-copied + scripts/source-copied
          SOURCE_COPIED_PATCH_PATHS=$(get_hierarchical_paths patches source-copied "$PLATFORM" "$ARCH")
          SOURCE_COPIED_ADDITION_PATHS=$(get_hierarchical_paths additions source-copied "$PLATFORM" "$ARCH")
          SOURCE_COPIED_SCRIPT_PATHS=$(get_hierarchical_paths scripts source-copied "$PLATFORM" "$ARCH")
          SOURCE_COPIED_PATCHES=$(hash_files $SOURCE_COPIED_PATCH_PATHS -type f)
          SOURCE_COPIED_ADDITIONS=$(hash_files $SOURCE_COPIED_ADDITION_PATHS -type f)
          SOURCE_COPIED_SCRIPTS=$(hash_files $SOURCE_COPIED_SCRIPT_PATHS -type f -name "*.mts")
          SOURCE_COPIED_KEY=$(echo "${CACHE_VERSION}${COMMON_SCRIPTS}${SOURCE_COPIED_PATCHES}${SOURCE_COPIED_ADDITIONS}${SOURCE_COPIED_SCRIPTS}" | $hash_cmd | cut -d' ' -f1)

          # source-patched phase: source-copied + patches/source-patched + additions/source-patched + scripts/source-patched
          SOURCE_PATCHED_PATCH_PATHS=$(get_hierarchical_paths patches source-patched "$PLATFORM" "$ARCH")
          SOURCE_PATCHED_ADDITION_PATHS=$(get_hierarchical_paths additions source-patched "$PLATFORM" "$ARCH")
          SOURCE_PATCHED_SCRIPT_PATHS=$(get_hierarchical_paths scripts source-patched "$PLATFORM" "$ARCH")
          SOURCE_PATCHED_PATCHES=$(hash_files $SOURCE_COPIED_PATCH_PATHS $SOURCE_PATCHED_PATCH_PATHS -type f)
          SOURCE_PATCHED_ADDITIONS=$(hash_files $SOURCE_COPIED_ADDITION_PATHS $SOURCE_PATCHED_ADDITION_PATHS -type f)
          SOURCE_PATCHED_SCRIPTS=$(hash_files $SOURCE_COPIED_SCRIPT_PATHS $SOURCE_PATCHED_SCRIPT_PATHS -type f -name "*.mts")
          SOURCE_PATCHED_KEY=$(echo "${COMMON_SCRIPTS}${SOURCE_PATCHED_PATCHES}${SOURCE_PATCHED_ADDITIONS}${SOURCE_PATCHED_SCRIPTS}" | $hash_cmd | cut -d' ' -f1)

          # Binary-release phase: source-patched + patches/binary-released + additions/binary-released + scripts/binary-released
          BINARY_RELEASED_PATCH_PATHS=$(get_hierarchical_paths patches binary-released "$PLATFORM" "$ARCH")
          BINARY_RELEASED_ADDITION_PATHS=$(get_hierarchical_paths additions binary-released "$PLATFORM" "$ARCH")
          BINARY_RELEASED_SCRIPT_PATHS=$(get_hierarchical_paths scripts binary-released "$PLATFORM" "$ARCH")
          BINARY_RELEASED_PATCHES=$(hash_files $SOURCE_COPIED_PATCH_PATHS $SOURCE_PATCHED_PATCH_PATHS $BINARY_RELEASED_PATCH_PATHS -type f)
          BINARY_RELEASED_ADDITIONS=$(hash_files $SOURCE_COPIED_ADDITION_PATHS $SOURCE_PATCHED_ADDITION_PATHS $BINARY_RELEASED_ADDITION_PATHS -type f)
          BINARY_RELEASED_SCRIPTS=$(hash_files $SOURCE_COPIED_SCRIPT_PATHS $SOURCE_PATCHED_SCRIPT_PATHS $BINARY_RELEASED_SCRIPT_PATHS -type f -name "*.mts")
          BINARY_RELEASED_KEY=$(echo "${COMMON_SCRIPTS}${BINARY_RELEASED_PATCHES}${BINARY_RELEASED_ADDITIONS}${BINARY_RELEASED_SCRIPTS}" | $hash_cmd | cut -d' ' -f1)

          # Binary-stripped phase: binary-released + patches/binary-stripped + additions/binary-stripped + scripts/binary-stripped
          BINARY_STRIPPED_PATCH_PATHS=$(get_hierarchical_paths patches binary-stripped "$PLATFORM" "$ARCH")
          BINARY_STRIPPED_ADDITION_PATHS=$(get_hierarchical_paths additions binary-stripped "$PLATFORM" "$ARCH")
          BINARY_STRIPPED_SCRIPT_PATHS=$(get_hierarchical_paths scripts binary-stripped "$PLATFORM" "$ARCH")
          BINARY_STRIPPED_PATCHES=$(hash_files $BINARY_RELEASED_PATCH_PATHS $BINARY_STRIPPED_PATCH_PATHS -type f)
          BINARY_STRIPPED_ADDITIONS=$(hash_files $BINARY_RELEASED_ADDITION_PATHS $BINARY_STRIPPED_ADDITION_PATHS -type f)
          BINARY_STRIPPED_SCRIPTS=$(hash_files $BINARY_RELEASED_SCRIPT_PATHS $BINARY_STRIPPED_SCRIPT_PATHS -type f -name "*.mts")
          BINARY_STRIPPED_KEY=$(echo "${COMMON_SCRIPTS}${BINARY_STRIPPED_PATCHES}${BINARY_STRIPPED_ADDITIONS}${BINARY_STRIPPED_SCRIPTS}" | $hash_cmd | cut -d' ' -f1)

          # Binary-compressed phase: binary-released + binary-stripped + patches/binary-compressed + additions/binary-compressed + scripts/binary-compressed
          BINARY_COMPRESSED_PATCH_PATHS=$(get_hierarchical_paths patches binary-compressed "$PLATFORM" "$ARCH")
          BINARY_COMPRESSED_ADDITION_PATHS=$(get_hierarchical_paths additions binary-compressed "$PLATFORM" "$ARCH")
          BINARY_COMPRESSED_SCRIPT_PATHS=$(get_hierarchical_paths scripts binary-compressed "$PLATFORM" "$ARCH")
          BINARY_COMPRESSED_PATCHES=$(hash_files $BINARY_RELEASED_PATCH_PATHS $BINARY_STRIPPED_PATCH_PATHS $BINARY_COMPRESSED_PATCH_PATHS -type f)
          BINARY_COMPRESSED_ADDITIONS=$(hash_files $BINARY_RELEASED_ADDITION_PATHS $BINARY_STRIPPED_ADDITION_PATHS $BINARY_COMPRESSED_ADDITION_PATHS -type f)
          BINARY_COMPRESSED_SCRIPTS=$(hash_files $BINARY_RELEASED_SCRIPT_PATHS $BINARY_STRIPPED_SCRIPT_PATHS $BINARY_COMPRESSED_SCRIPT_PATHS -type f -name "*.mts")
          BINARY_COMPRESSED_KEY=$(echo "${COMMON_SCRIPTS}${BINARY_COMPRESSED_PATCHES}${BINARY_COMPRESSED_ADDITIONS}${BINARY_COMPRESSED_SCRIPTS}" | $hash_cmd | cut -d' ' -f1)

          # Finalized phase: binary-released + binary-stripped + binary-compressed + patches/finalized + additions/finalized + scripts/finalized
          FINAL_PATCH_PATHS=$(get_hierarchical_paths patches finalized "$PLATFORM" "$ARCH")
          FINAL_ADDITION_PATHS=$(get_hierarchical_paths additions finalized "$PLATFORM" "$ARCH")
          FINAL_SCRIPT_PATHS=$(get_hierarchical_paths scripts finalized "$PLATFORM" "$ARCH")
          FINAL_PATCHES=$(hash_files $BINARY_RELEASED_PATCH_PATHS $BINARY_STRIPPED_PATCH_PATHS $BINARY_COMPRESSED_PATCH_PATHS $FINAL_PATCH_PATHS -type f)
          FINAL_ADDITIONS=$(hash_files $BINARY_RELEASED_ADDITION_PATHS $BINARY_STRIPPED_ADDITION_PATHS $BINARY_COMPRESSED_ADDITION_PATHS $FINAL_ADDITION_PATHS -type f)
          FINAL_SCRIPTS=$(hash_files $BINARY_RELEASED_SCRIPT_PATHS $BINARY_STRIPPED_SCRIPT_PATHS $BINARY_COMPRESSED_SCRIPT_PATHS $FINAL_SCRIPT_PATHS -type f -name "*.mts")

          # Hash canonical source packages (source of truth - additions/ syncs FROM these)
          BUILD_INFRA_SRC=$(hash_files packages/build-infra/src/socketsecurity/build-infra -type f)
          BIN_INFRA_SRC=$(hash_files packages/bin-infra/src/socketsecurity/bin-infra -type f)
          BINJECT_SRC=$(hash_files packages/binject/src/socketsecurity/binject -type f)

          FINAL_KEY=$(echo "${COMMON_SCRIPTS}${FINAL_PATCHES}${FINAL_ADDITIONS}${FINAL_SCRIPTS}${BUILD_INFRA_SRC}${BIN_INFRA_SRC}${BINJECT_SRC}" | $hash_cmd | cut -d' ' -f1)

          echo "source_copied_hash=${SOURCE_COPIED_KEY}" >> $GITHUB_OUTPUT
          echo "source_patched_hash=${SOURCE_PATCHED_KEY}" >> $GITHUB_OUTPUT
          echo "binary_released_hash=${BINARY_RELEASED_KEY}" >> $GITHUB_OUTPUT
          echo "binary_stripped_hash=${BINARY_STRIPPED_KEY}" >> $GITHUB_OUTPUT
          echo "binary_compressed_hash=${BINARY_COMPRESSED_KEY}" >> $GITHUB_OUTPUT
          echo "final_hash=${FINAL_KEY}" >> $GITHUB_OUTPUT
          echo "build_mode=${BUILD_MODE}" >> $GITHUB_OUTPUT

      - name: Restore checkpoint cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: checkpoint-cache
        if: ${{ !inputs.force }}
        with:
          path: |
            packages/node-smol-builder/build/shared/checkpoints
            packages/node-smol-builder/build/${{ steps.smol-cache-key.outputs.build_mode }}/${{ steps.platform-arch.outputs.platform_arch }}/checkpoints
          key: node-checkpoints-${{ steps.cache-version.outputs.version }}-${{ steps.node-version.outputs.node-build-version }}-${{ steps.node-submodule.outputs.ref }}-${{ steps.platform-arch.outputs.platform_arch }}-${{ steps.smol-cache-key.outputs.build_mode }}-${{ steps.smol-cache-key.outputs.final_hash }}

      - name: Get checkpoint chain
        id: checkpoint-chain
        shell: bash
        env:
          BUILD_MODE: ${{ steps.smol-cache-key.outputs.build_mode }}
        run: |
          # Get checkpoint chain from build script (single source of truth)
          CHAIN=$(node packages/node-smol-builder/scripts/get-checkpoint-chain.mts --$BUILD_MODE)
          echo "checkpoint_chain=$CHAIN" >> $GITHUB_OUTPUT
          # Convert comma-separated to space-separated for validation
          CHECKPOINTS=$(echo "$CHAIN" | tr ',' ' ')
          echo "checkpoints=$CHECKPOINTS" >> $GITHUB_OUTPUT
          echo "Checkpoint chain for $BUILD_MODE mode: $CHAIN"

      - name: Validate checkpoint cache integrity
        id: validate-cache
        if: steps.checkpoint-cache.outputs.cache-hit == 'true'
        uses: ./.github/actions/validate-checkpoints
        with:
          checkpoint-dirs: packages/node-smol-builder/build/shared/checkpoints:packages/node-smol-builder/build/${{ steps.smol-cache-key.outputs.build_mode }}/${{ steps.platform-arch.outputs.platform_arch }}/checkpoints
          checkpoints: ${{ steps.checkpoint-chain.outputs.checkpoints }}
          package-name: node-smol-builder

      - name: Determine build parallelism
        id: build-parallelism
        shell: bash
        run: |
          # Set step output using GitHub Actions file-based approach
          # Usage: echo "key=value" >> $GITHUB_OUTPUT
          # Reference later as: steps.STEP_ID.outputs.key
          #
          # Limit parallelism to prevent memory exhaustion during V8 compilation
          # V8 compilation with -O3 uses ~4-6GB RAM per job

          # Linux ARM64: 3 jobs (8GB RAM, 4 vCPU) - increased for timeout concerns
          if [[ "${{ matrix.platform }}" == "linux" ]] && [[ "${{ matrix.arch }}" == "arm64" ]]; then
            echo "jobs=3" >> $GITHUB_OUTPUT  # → steps.build-parallelism.outputs.jobs = "3"

          # macOS Depot.dev: 4 jobs (24GB RAM, 8 vCPU M2)
          # 24GB / 4GB per job = 6 max, use 4 for safety margin
          elif [[ "${{ matrix.os }}" == "macos" ]]; then
            echo "jobs=4" >> $GITHUB_OUTPUT  # → steps.build-parallelism.outputs.jobs = "4"

          # Linux x64: Auto-calculate based on RAM (typically 3-4 jobs)
          else
            echo "jobs=" >> $GITHUB_OUTPUT   # → steps.build-parallelism.outputs.jobs = "" (triggers adaptive calculation in build script)
          fi

      - name: Restore build output from checkpoint chain
        id: restore-checkpoint
        uses: ./.github/actions/restore-checkpoint
        with:
          package-name: 'node-smol-builder'
          build-mode: ${{ steps.smol-cache-key.outputs.build_mode }}
          checkpoint-chain: ${{ steps.checkpoint-chain.outputs.checkpoint_chain }}
          cache-hit: ${{ steps.checkpoint-cache.outputs.cache-hit }}
          cache-valid: ${{ steps.validate-cache.outputs.valid }}
          platform-arch: ${{ steps.platform-arch.outputs.platform_arch }}

      - name: Build Node.js smol with Depot.dev runner (Linux - Release binary only, no checkpoint)
        if: matrix.os == 'linux' && steps.restore-checkpoint.outputs.build-required != 'false'
        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
        with:
          project: 8fpj9495vw
          platforms: linux/${{ matrix.arch == 'x64' && 'amd64' || matrix.arch }}
          build-args: |
            BUILD_MODE=${{ steps.build-mode.outputs.mode }}
            MATRIX_PLATFORM=${{ matrix.platform }}
            MATRIX_ARCH=${{ matrix.arch }}
            MATRIX_LIBC=${{ matrix.libc }}
            PLATFORM_ARCH=${{ steps.platform-arch.outputs.platform_arch }}
            CACHE_BUSTER=${{ github.sha }}
          secrets: |
            GITHUB_TOKEN=${{ github.token }}
          no-cache: ${{ inputs.force == true }}
          file: packages/node-smol-builder/docker/Dockerfile.${{ matrix.libc || 'glibc' }}-released
          target: export
          outputs: type=local,dest=packages/node-smol-builder/build
          context: .

      - name: Verify Depot.dev release output (Linux)
        if: success() && matrix.os == 'linux' && steps.restore-checkpoint.outputs.build-required != 'false'
        shell: bash
        env:
          BUILD_MODE: ${{ steps.build-mode.outputs.mode }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          echo "Verifying Depot.dev build output (Release binary)..."
          ls -lah packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/

          # Check if Release node binary exists.
          if [ ! -f "packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/Release/node/node" ]; then
            echo "× Release node binary not found!"
            echo "Contents of output directory:"
            find packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/ -type f 2>/dev/null || echo "No files found"
            exit 1
          fi
          echo "✅ Release node binary found"
          ls -lh packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/Release/node/node

      - name: Continue build from Released checkpoint (Linux - strip, compress, finalize)
        if: |
          matrix.os == 'linux' &&
          ((steps.checkpoint-cache.outputs.cache-hit != 'true' || steps.validate-cache.outputs.valid == 'false') ||
          steps.restore-checkpoint.outputs.build-required == 'true')
        shell: bash
        env:
          BUILD_MODE: ${{ steps.build-mode.outputs.mode }}
          MATRIX_PLATFORM: ${{ matrix.platform }}
          MATRIX_ARCH: ${{ matrix.arch }}
          MATRIX_LIBC: ${{ matrix.libc }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          # Cross-platform timestamp function (GNU date/BusyBox fallback)
          get_timestamp() {
            date +%s 2>/dev/null || python3 -c 'import time; print(int(time.time()))'
          }

          echo "⏱️ Continuing build from Released checkpoint at $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
          BUILD_START=$(get_timestamp)

          # Continue build from binary-released checkpoint (strip → compress → finalize)
          # This runs natively in GHA where smoke tests work correctly
          LIBC_FLAG=""
          if [ "$MATRIX_LIBC" = "musl" ]; then
            LIBC_FLAG="--libc=musl"
          fi

          if [ "$BUILD_MODE" = "prod" ]; then
            pnpm --filter node-smol-builder build --prod --platform="${MATRIX_PLATFORM}" --arch="${MATRIX_ARCH}" ${LIBC_FLAG} --platform-arch="${PLATFORM_ARCH}" --from-checkpoint=binary-released
          else
            pnpm --filter node-smol-builder build --dev --platform="${MATRIX_PLATFORM}" --arch="${MATRIX_ARCH}" ${LIBC_FLAG} --platform-arch="${PLATFORM_ARCH}" --from-checkpoint=binary-released
          fi

          BUILD_END=$(get_timestamp)
          BUILD_DURATION=$((BUILD_END - BUILD_START))
          MINUTES=$((BUILD_DURATION / 60))
          SECONDS=$((BUILD_DURATION % 60))
          printf "⏱️ Post-processing completed in %ds (%02d:%02d)\n" "$BUILD_DURATION" "$MINUTES" "$SECONDS"

      - name: Verify compressed binary exists (Linux)
        if: matrix.os == 'linux'
        shell: bash
        env:
          BUILD_MODE: ${{ steps.build-mode.outputs.mode }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          echo "Verifying final build output structure..."
          ls -lah packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/

          # Check if Final node binary exists.
          if [ ! -f "packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/Final/node/node" ]; then
            echo "× Final node binary not found!"
            echo "Contents of output directory:"
            find packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/ -type f
            exit 1
          fi
          echo "✅ Final node binary found"
          ls -lh packages/node-smol-builder/build/$BUILD_MODE/$PLATFORM_ARCH/out/Final/node/node

      # Note: Depot.dev builds use --build-only which skips checkpoint creation.
      # Checkpoints are created after the build by GHA (strip, compress, finalize).

      - name: Build Node.js smol with GitHub runner (macOS/Windows)
        shell: bash
        env:
          BUILD_MODE: ${{ steps.build-mode.outputs.mode }}
          MATRIX_PLATFORM: ${{ matrix.platform }}
          MATRIX_ARCH: ${{ matrix.arch }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
          BUILD_JOBS: ${{ steps.build-parallelism.outputs.jobs }}
          GITHUB_TOKEN: ${{ github.token }}
          MATRIX_OS: ${{ matrix.os }}
        run: |
          # Linux builds use Depot.dev Docker — skip this step.
          if [ "$MATRIX_OS" = "linux" ]; then
            echo "Skipping: Linux builds use Depot.dev"
            exit 0
          fi
          echo "Building for $MATRIX_PLATFORM-$MATRIX_ARCH (mode: $BUILD_MODE)"

          # Cross-platform timestamp function (GNU date/BusyBox fallback)
          get_timestamp() {
            date +%s 2>/dev/null || python3 -c 'import time; print(int(time.time()))'
          }

          echo "⏱️ Build started at $(date -u +"%Y-%m-%d %H:%M:%S UTC")"
          BUILD_START=$(get_timestamp)

          # Cross-compilation compiler flags
          if [ "${{ matrix.platform }}" = "win32" ]; then
            # Windows builds: use clang with MSVC target
            export CC="clang"
            export CXX="clang++"
            if [ "${{ matrix.arch }}" = "arm64" ]; then
              export CFLAGS="--target=aarch64-pc-windows-msvc"
              export CXXFLAGS="--target=aarch64-pc-windows-msvc"
              export LDFLAGS="--target=aarch64-pc-windows-msvc"
            else
              # x64 uses default MSVC target
              export CFLAGS="-m64"
              export CXXFLAGS="-m64"
              export LDFLAGS="-m64"
            fi
          elif [ "${{ matrix.platform }}" = "darwin" ] && [ "${{ matrix.cross_compile }}" = "true" ]; then
            # macOS cross-compilation: ARM64 host building for x64
            export CC="clang -arch x86_64"
            export CXX="clang++ -arch x86_64"
          fi

          CROSS_FLAG=""
          if [ "${{ matrix.cross_compile }}" = "true" ]; then
            CROSS_FLAG="--allow-cross"
          fi

          if [ "$BUILD_MODE" = "prod" ]; then
            pnpm --filter node-smol-builder build --prod --platform="${MATRIX_PLATFORM}" --arch="${MATRIX_ARCH}" --platform-arch="${PLATFORM_ARCH}" $CROSS_FLAG
          else
            pnpm --filter node-smol-builder build --dev --platform="${MATRIX_PLATFORM}" --arch="${MATRIX_ARCH}" --platform-arch="${PLATFORM_ARCH}" $CROSS_FLAG
          fi

          BUILD_END=$(get_timestamp)
          BUILD_DURATION=$((BUILD_END - BUILD_START))
          # Note: date +%s requires GNU date (available on GitHub Actions runners: ubuntu, macos, windows)
          # Not portable to busybox (Alpine) or pure BSD systems without GNU coreutils
          # Time formatting uses pure POSIX arithmetic for maximum portability
          HOURS=$((BUILD_DURATION / 3600))
          MINUTES=$(((BUILD_DURATION % 3600) / 60))
          SECONDS=$((BUILD_DURATION % 60))
          printf "⏱️ Build completed in %ds (%02d:%02d:%02d)\n" "$BUILD_DURATION" "$HOURS" "$MINUTES" "$SECONDS"

      - name: Verify binary structure and dependencies
        if: success() && steps.restore-checkpoint.outputs.build-required != 'false'
        shell: bash
        env:
          BUILD_MODE: ${{ steps.smol-cache-key.outputs.build_mode }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          BUILD_MODE="${BUILD_MODE:-prod}"
          FINAL_DIR="packages/node-smol-builder/build/${BUILD_MODE}/${PLATFORM_ARCH}/out/Final"

          if [ "${{ matrix.os }}" = "windows" ]; then
            BINARY="${FINAL_DIR}/node/node.exe"
          else
            BINARY="${FINAL_DIR}/node/node"
          fi

          # Check binary exists
          if [ ! -f "$BINARY" ]; then
            echo "× Binary not found: $BINARY"
            exit 1
          fi

          echo "✅ Binary exists: $BINARY"

          # Show binary info
          if [ "${{ matrix.os }}" = "macos" ]; then
            file "$BINARY"
            otool -L "$BINARY" || true
          elif [ "${{ matrix.os }}" = "linux" ]; then
            file "$BINARY"
            ldd "$BINARY" || true
          elif [ "${{ matrix.os }}" = "windows" ]; then
            file "$BINARY" || true
          fi

      - name: Smoke test binary (execute and verify)
        if: success() && steps.restore-checkpoint.outputs.build-required != 'false'
        shell: bash
        env:
          BUILD_MODE: ${{ steps.smol-cache-key.outputs.build_mode }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          BUILD_MODE="${BUILD_MODE:-prod}"
          FINAL_DIR="packages/node-smol-builder/build/${BUILD_MODE}/${PLATFORM_ARCH}/out/Final"

          if [ "${{ matrix.os }}" = "windows" ]; then
            BINARY="${FINAL_DIR}/node/node.exe"
          else
            BINARY="${FINAL_DIR}/node/node"
          fi

          # Prepare smoke test options.
          SMOKE_TEST_ARGS="$BINARY"
          if [ "${{ matrix.arch }}" = "arm64" ]; then
            SMOKE_TEST_ARGS="$SMOKE_TEST_ARGS --arch arm64"
          fi
          if [ "${{ matrix.libc }}" = "musl" ]; then
            SMOKE_TEST_ARGS="$SMOKE_TEST_ARGS --musl"
          fi

          echo "Running smoke test: node packages/build-infra/scripts/smoke-test-binary.mts $SMOKE_TEST_ARGS"
          node packages/build-infra/scripts/smoke-test-binary.mts $SMOKE_TEST_ARGS

      - name: Collect build metrics
        if: always()
        shell: bash
        run: |
          BUILD_MODE="${BUILD_MODE:-prod}"
          FINAL_DIR="packages/node-smol-builder/build/${BUILD_MODE}/${PLATFORM_ARCH}/out/Final"

          if [ "${{ matrix.os }}" = "windows" ]; then
            BINARY="${FINAL_DIR}/node/node.exe"
          else
            BINARY="${FINAL_DIR}/node/node"
          fi

          if [ -f "${BINARY}" ]; then
            if [ "${{ matrix.os }}" = "windows" ]; then
              # Convert Unix path to Windows format for PowerShell
              BINARY_SIZE_MB=$(powershell -Command "\$winPath = '${BINARY}' -replace '/', '\\'; [math]::Round((Get-Item \$winPath).Length / 1MB, 2)")
            else
              # Use platform-specific stat command (BSD/macOS vs GNU/Linux)
              if [ "$(uname)" = "Darwin" ]; then
                BINARY_SIZE=$(stat -f%z "${BINARY}")
              else
                BINARY_SIZE=$(stat -c%s "${BINARY}")
              fi
              BINARY_SIZE_MB=$(echo "scale=2; $BINARY_SIZE / 1024 / 1024" | bc 2>/dev/null || awk "BEGIN {printf \"%.2f\", $BINARY_SIZE / 1024 / 1024}")
            fi
            echo "✅ Binary size: ${BINARY_SIZE_MB} MB"
            echo "binary_size_mb=${BINARY_SIZE_MB}" >> $GITHUB_OUTPUT
          else
            echo "× Binary not found: ${BINARY}"
          fi
        env:
          BUILD_MODE: ${{ steps.smol-cache-key.outputs.build_mode }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}

      - name: Set artifact name
        shell: bash
        env:
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}
        run: |
          # Use platform-arch output (win32→win conversion already done).
          ARTIFACT_NAME="node-smol-${PLATFORM_ARCH}"
          echo "ARTIFACT_NAME=${ARTIFACT_NAME}" >> $GITHUB_ENV

      - name: Upload Node.js smol artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: packages/node-smol-builder/build/${{ steps.smol-cache-key.outputs.build_mode }}/${{ steps.platform-arch.outputs.platform_arch }}/out/Final/node/node${{ matrix.os == 'windows' && '.exe' || '' }}
          retention-days: 30
          if-no-files-found: error

      - name: Cleanup before cache save
        if: always()
        shell: bash
        run: |
          BUILD_MODE="${BUILD_MODE:-prod}"
          OUT_DIR="packages/node-smol-builder/build/${BUILD_MODE}/${PLATFORM_ARCH}/source/out"
          if [ -d "$OUT_DIR" ]; then
            echo "Removing build artifacts from source before cache save..."
            rm -rf "$OUT_DIR"
            echo "✅ Cleaned $OUT_DIR (prevents caching ~4GB of build artifacts)"
          fi
        env:
          BUILD_MODE: ${{ steps.smol-cache-key.outputs.build_mode }}
          PLATFORM_ARCH: ${{ steps.platform-arch.outputs.platform_arch }}

  release:
    name: Release Node.js smol
    needs: build
    if: github.event_name == 'workflow_dispatch' && !inputs.dry_run
    environment: release
    runs-on: ubuntu-24.04
    permissions:
      contents: write # Required to create GitHub releases

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
            .node-version
            .github/scripts/generate-version.sh
          sparse-checkout-cone-mode: false

      - name: Load Node.js version from .node-version
        id: tool-versions
        run: |
          NODE_VERSION=$(cat .node-version | tr -d '\n')
          echo "node-version=$NODE_VERSION" >> $GITHUB_OUTPUT
          echo "Loaded Node.js: $NODE_VERSION"

      - name: Download all artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: artifacts/
          pattern: node-smol-*

      - name: Validate artifact count
        run: |
          # Expected artifacts: 8 (darwin-arm64, darwin-x64, linux-x64, linux-arm64, linux-x64-musl, linux-arm64-musl, win-x64, win-arm64)
          EXPECTED_COUNT=8
          ACTUAL_COUNT=$(find artifacts -mindepth 1 -maxdepth 1 -type d | wc -l)
          if [ "$ACTUAL_COUNT" -ne "$EXPECTED_COUNT" ]; then
            echo "Error: Expected $EXPECTED_COUNT artifacts, found $ACTUAL_COUNT"
            echo "Downloaded artifacts:"
            ls -la artifacts/
            exit 1
          fi
          echo "✓ All $EXPECTED_COUNT artifacts downloaded successfully"

      - name: Organize release assets
        run: |
          mkdir -p packages/node-smol-builder/dist

          # Darwin ARM64
          mv artifacts/node-smol-darwin-arm64/node packages/node-smol-builder/dist/node-darwin-arm64

          # Darwin x64
          mv artifacts/node-smol-darwin-x64/node packages/node-smol-builder/dist/node-darwin-x64

          # Linux x64
          mv artifacts/node-smol-linux-x64/node packages/node-smol-builder/dist/node-linux-x64

          # Linux ARM64
          mv artifacts/node-smol-linux-arm64/node packages/node-smol-builder/dist/node-linux-arm64

          # Linux musl x64
          mv artifacts/node-smol-linux-x64-musl/node packages/node-smol-builder/dist/node-linux-x64-musl

          # Linux musl ARM64
          mv artifacts/node-smol-linux-arm64-musl/node packages/node-smol-builder/dist/node-linux-arm64-musl

          # Windows x64
          mv artifacts/node-smol-win-x64/node.exe packages/node-smol-builder/dist/node-win-x64.exe

          # Windows ARM64 (cross-compiled)
          mv artifacts/node-smol-win-arm64/node.exe packages/node-smol-builder/dist/node-win-arm64.exe

          # Make Unix binaries executable
          chmod +x packages/node-smol-builder/dist/node-*[!.exe]

      - name: Validate all platform binaries exist
        shell: bash
        run: |
          REQUIRED_FILES=(
            "node-darwin-arm64"
            "node-darwin-x64"
            "node-linux-x64"
            "node-linux-arm64"
            "node-linux-x64-musl"
            "node-linux-arm64-musl"
            "node-win-x64.exe"
            "node-win-arm64.exe"
          )

          MISSING=()
          for file in "${REQUIRED_FILES[@]}"; do
            if [ ! -f "packages/node-smol-builder/dist/$file" ]; then
              MISSING+=("$file")
            fi
          done

          if [ ${#MISSING[@]} -ne 0 ]; then
            echo "× Missing required binaries:"
            printf '%s\n' "${MISSING[@]}"
            exit 1
          fi

          echo "✅ All platform binaries present"
          ls -lh packages/node-smol-builder/dist/

      - name: Generate version
        id: version
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Validate script exists before sourcing
          if [ ! -f .github/scripts/generate-version.sh ]; then
            echo "Error: generate-version.sh not found"
            exit 1
          fi
          source .github/scripts/generate-version.sh
          # Validate VERSION was set by the script
          if [ -z "$VERSION" ]; then
            echo "Error: VERSION not set by generate-version.sh"
            exit 1
          fi
          RELEASE_NAME="node-smol"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "release_name=$RELEASE_NAME" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"
          echo "Release: $RELEASE_NAME"
          TAG="${RELEASE_NAME}-${VERSION}"
          if gh release view "$TAG" &>/dev/null; then
            echo "Release $TAG already exists, skipping."
            echo "skip=true" >> $GITHUB_OUTPUT
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi

      - name: Generate checksums
        if: steps.version.outputs.skip != 'true'
        shell: bash
        run: |
          cd packages/node-smol-builder/dist

          # Use sha256sum on Windows/Linux, shasum on macOS
          if command -v shasum &> /dev/null; then
            shasum -a 256 node-* > checksums.txt
          elif command -v sha256sum &> /dev/null; then
            sha256sum node-* > checksums.txt
          else
            echo "Error: No SHA-256 command found"
            exit 1
          fi

          cat checksums.txt

      - name: Create GitHub Release
        if: steps.version.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
          STEPS_VERSION_OUTPUTS_RELEASE_NAME: ${{ steps.version.outputs.release_name }}
          STEPS_NODE_VERSION_OUTPUTS_NODE_VERSION: ${{ steps.tool-versions.outputs.node-version }}
        run: |
          VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
          RELEASE_NAME="${STEPS_VERSION_OUTPUTS_RELEASE_NAME}"
          NODE_VERSION="${STEPS_NODE_VERSION_OUTPUTS_NODE_VERSION}"
          TAG="${RELEASE_NAME}-${VERSION}"

          echo "Creating new release $TAG..."
          gh release create "$TAG" \
            --title "${RELEASE_NAME} ${VERSION}" \
            --notes "Node.js v${NODE_VERSION} minimal binaries for all platforms.

          ## Platforms
          - darwin-arm64
          - darwin-x64
          - linux-arm64
          - linux-x64
          - linux-arm64-musl
          - linux-x64-musl
          - win-arm64
          - win-x64

          ## Files
          - \`node-darwin-arm64\` - macOS Apple Silicon
          - \`node-darwin-x64\` - macOS Intel
          - \`node-linux-arm64\` - Linux ARM64 (glibc)
          - \`node-linux-x64\` - Linux x64 (glibc)
          - \`node-linux-arm64-musl\` - Linux ARM64 (musl/Alpine)
          - \`node-linux-x64-musl\` - Linux x64 (musl/Alpine)
          - \`node-win-arm64.exe\` - Windows ARM64
          - \`node-win-x64.exe\` - Windows x64
          - \`checksums.txt\` - SHA256 checksums

          ## Usage
          Download the appropriate binary for your platform and run it:
          \`\`\`bash
          ./node-darwin-arm64 script.js
          \`\`\`" \
            packages/node-smol-builder/dist/node-* \
            packages/node-smol-builder/dist/checksums.txt

  update-checksums:
    needs: release
    if: github.event_name == 'workflow_dispatch' && !inputs.dry_run
    permissions:
      contents: write
    uses: ./.github/workflows/update-checksums.yml
    secrets:
      BOT_GPG_PRIVATE_KEY: ${{ secrets.BOT_GPG_PRIVATE_KEY }}