Provide pre-built binaries for Alpine on ARM

[jviotti]

See: #757
Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}

[augmentcode]

🤖 Augment PR Summary

Summary: Adds Alpine (musl) ARM64 coverage so the project can publish and consume pre-built binaries on that platform.

Changes:

• Extends CI/CD workflows to build/test in an Alpine container on ARM runners
• Updates release-fetch tooling and the npm launcher to recognize and use the new linux-arm64-musl binary

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

cmake/fetch-github-releases.cmake:16 — Adding linux-arm64-musl means cmake -P cmake/fetch-github-releases.cmake (used by make npm-pack in CI) will now hard-fail if the v${VERSION} GitHub release doesn’t already contain jsonschema-${VERSION}-linux-arm64-musl.zip (current VERSION is 15.6.2). This can break PR CI until that asset is published for the referenced version.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

npm/main.js:25 — This assumes musl ARM64 releases/binaries are named with arm64 (matching Node’s os.arch()), but other installers that rely on uname -m often report aarch64 and may still try to fetch the wrong artifact. It’d be good to ensure all distribution paths normalize ARM64 consistently so Alpine ARM users don’t remain unsupported.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[cubic-dev-ai]

2 issues found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/package.yml">

<violation number="1" location=".github/workflows/package.yml:84">
P1: Pin this third-party action to a full commit SHA instead of a mutable `@v1` tag to prevent silent supply-chain drift.</violation>
</file>

<file name=".github/workflows/test.yml">

<violation number="1" location=".github/workflows/test.yml:78">
P2: Pin this third-party GitHub Action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in CI.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Pin this third-party action to a full commit SHA instead of a mutable @v1 tag to prevent silent supply-chain drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/package.yml, line 84:

<comment>Pin this third-party action to a full commit SHA instead of a mutable `@v1` tag to prevent silent supply-chain drift.</comment>

<file context>
@@ -78,6 +78,12 @@ jobs:
+      # See https://github.com/laverdet/alpine-arm64
+      # Required for JavaScript-based actions to work inside Alpine containers
+      # on ARM64 runners
+      - uses: laverdet/alpine-arm64@v1
+        if: matrix.platform.type == 'container' && runner.arch == 'ARM64'
+
</file context>

[cubic-dev-ai]

P2: Pin this third-party GitHub Action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in CI.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/test.yml, line 78:

<comment>Pin this third-party GitHub Action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in CI.</comment>

<file context>
@@ -72,6 +72,12 @@ jobs:
+      # See https://github.com/laverdet/alpine-arm64
+      # Required for JavaScript-based actions to work inside Alpine containers
+      # on ARM64 runners
+      - uses: laverdet/alpine-arm64@v1
+        if: matrix.platform.type == 'container' && runner.arch == 'ARM64'
+
</file context>