build-sqlite-static.yml

name: Build static sqlite3 (glibc + musl)

# Builds two fully-static sqlite3 CLI binaries from the upstream amalgamation:
#   glibc — compiled on UBI 8 (glibc 2.28 floor); runs on any glibc distro
#           (RHEL/Rocky/Debian/Ubuntu/SUSE/Arch/Fedora)
#   musl  — compiled on Alpine; runs on Alpine and any musl host
# Together they let sqlite install on every distro with no package manager,
# which is the two-family model. Uploads both as artifacts for staging.
#
# Fast (~2 min). Run whenever the sqlite VERSION changes.

# Least-privilege default; jobs override this where they need more.
permissions:
  contents: read

on:
  workflow_dispatch:
    inputs:
      sqlite_version:
        description: 'SQLite version (matches VERSION in tools/dev-tools/sqlite/setup.sh)'
        required: true
        default: '3.53.3'
      amalgamation_num:
        description: 'Amalgamation number, e.g. 3530300 for 3.53.3'
        required: true
        default: '3530300'
      amalgamation_year:
        description: 'sqlite.org year folder for the amalgamation zip'
        required: true
        default: '2026'

jobs:
  build:
    name: Build sqlite3 (${{ matrix.family }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - { family: "glibc", image: "registry.access.redhat.com/ubi8/ubi:8.10" }
          - { family: "musl",  image: "alpine:3.21" }
    env:
      SQLITE_VERSION: ${{ inputs.sqlite_version }}
      AMALG_NUM: ${{ inputs.amalgamation_num }}
      AMALG_YEAR: ${{ inputs.amalgamation_year }}
      FAMILY: ${{ matrix.family }}
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
    steps:
      - name: Build static sqlite3 in ${{ matrix.family }} container
        run: |
          mkdir -p /tmp/out
          docker run --rm \
            -e SQLITE_VERSION -e AMALG_NUM -e AMALG_YEAR -e FAMILY \
            -v /tmp/out:/out \
            ${{ matrix.image }} \
            sh -euo pipefail -c '
              if [ "$FAMILY" = musl ]; then
                apk add --no-cache build-base curl unzip
              else
                dnf install -y --nodocs --allowerasing gcc make curl unzip
              fi
              echo "==> cc: $(cc --version 2>/dev/null | head -1 || gcc --version | head -1)"

              cd /tmp
              curl -fL --retry 3 \
                "https://sqlite.org/${AMALG_YEAR}/sqlite-amalgamation-${AMALG_NUM}.zip" \
                -o amalg.zip
              unzip -q amalg.zip
              cd "sqlite-amalgamation-${AMALG_NUM}"

              # musl: fully static (-static) -> runs on any host with zero deps.
              # glibc: dynamic against the UBI8 glibc-2.28 floor -> runs on every
              # glibc distro at or above 2.28 (fully-static glibc is avoided;
              # libc.a/libm.a are not in the UBI8 base repos). Omit load_extension
              # so neither binary needs a runtime dlopen.
              STATIC=""
              [ "$FAMILY" = musl ] && STATIC="-static"
              cc -O2 $STATIC \
                -DSQLITE_OMIT_LOAD_EXTENSION=1 \
                -DSQLITE_THREADSAFE=1 \
                -DSQLITE_ENABLE_FTS5 \
                -DSQLITE_ENABLE_JSON1 \
                -o sqlite3 shell.c sqlite3.c -lm -lpthread
              strip sqlite3 || true
              ./sqlite3 --version
              file sqlite3 2>/dev/null || true
              cp sqlite3 "/out/sqlite3-${SQLITE_VERSION}-linux-x64-${FAMILY}"
              ls -lh "/out/sqlite3-${SQLITE_VERSION}-linux-x64-${FAMILY}"
            '

      - name: Upload sqlite3 binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: sqlite3-${{ matrix.family }}-${{ inputs.sqlite_version }}
          path: /tmp/out/sqlite3-${{ inputs.sqlite_version }}-linux-x64-${{ matrix.family }}
          retention-days: 3