Distribute native binaries via npm using prebuildify (drop node-pre-gyp/S3)

[mohamed-rdr]

Summary

Switches @radarlabs/s2 from node-pre-gyp + S3 binary distribution to prebuildify + node-gyp-build, so the compiled N-API addon ships inside the npm tarball instead of being downloaded from node-s2-binaries.s3.amazonaws.com at install time.

This is the follow-up to the SER-97 tar/node-pre-gyp hardening (#82): rather than keep patching the node-pre-gyp/S3 toolchain, it removes that machinery entirely.

Why

• No S3 / AWS in the release path. Publishing becomes just npm publish — no bucket to manage, no AWS credentials, no install-time network fetch that can 404 and silently fall back to a source compile.
• Smaller consumer footprint. The whole compile toolchain (node-gyp, node-addon-api, and previously @mapbox/node-pre-gyp) moves to devDependencies, so it no longer appears in radarlabs/server's dependency tree or npm audit. node-gyp-build is the only runtime dependency.
• N-API is ABI-stable across Node versions, so one prebuild per platform/arch serves Node 20/22/24 — 4 binaries instead of 12.

Changes

• index.js: load via require('node-gyp-build')(__dirname).
• package.json: drop @mapbox/node-pre-gyp, aws-sdk, bindings and the binary block; add node-gyp-build (dep) + prebuildify (devDep); build → prebuildify --napi --strip; add a files allowlist so the tarball ships only index.js / index.d.ts / prebuilds/ / README / LICENSE (previously it shipped .circleci, docker/, src/, jest config, publish scripts).
• binding.gyp: literal target name, remove the node-pre-gyp copy target.
• tests: load the package via require('..') instead of the node-pre-gyp.find() incantation.
• .circleci/config.yml + docker/*.test: build the addon with prebuildify before testing.
• New .github/workflows/release.yml: on a published GitHub Release, build the prebuild matrix (linux x64/arm64 + macOS arm64) on native runners, smoke-test each, then stage-publish the bundled package. Intel macOS (darwin-x64) is not shipped — Apple Silicon only for macOS.
• Remove publish-linux.sh / publish-osx.sh (superseded by the release workflow).

Tarball before → after

npm pack --dry-run now yields 6 files (LICENSE, README.md, index.d.ts, index.js, package.json, prebuilds/…) instead of shipping CI/docker/source cruft.

Verification (local, darwin-arm64)

• npm run build produces prebuilds/darwin-arm64/@radalabs+s2.node.
• With build/ removed, require('./index.js') loads the prebuild and returns correct tokens (new s2.CellId(new s2.LatLng(...)).token() / .parent(10)).
• All 8 suites / 45 tests pass.
• CircleCI (this PR) builds + tests from source across Node 20/22/24.

Release / rollout notes

• No secrets required. Publishing uses npm OIDC trusted publishing — no NPM_TOKEN, no AWS. One-time setup: on npmjs.com, add a Trusted Publisher for @radarlabs/s2 pointing at radarlabs/s2 + .github/workflows/release.yml, and set it to stage-only permissions (optionally disallow tokens). The job runs with id-token: write and npm attaches a provenance attestation automatically.
• Staged publishing + 2FA gate. CI runs npm stage publish, so a release is staged, not public. A maintainer must approve it with 2FA — npm stage approve @radarlabs/s2 (or approve on npmjs.com) — before it goes live. The approve/reject actions can't use OIDC (they require proof-of-presence), so the human 2FA gate is enforced by npm itself.
• To cut a release: bump version in package.json, then publish a GitHub Release with the matching tag (e.g. v0.0.7); the workflow builds all prebuilds and stages the publish. A maintainer then approves with 2FA to make it public.
• Requirements handled by the job: npm >= 11.5.1 and Node >= 22.14 (the publish job upgrades npm and uses Node 22).
• The GitHub-hosted ubuntu-24.04-arm + macos-13/14 runners are free for public repos.
• One transitive high (semver ReDoS) remains inside node-gyp, now a devDependency, so it does not reach consumers.

[jkao]

we might not need this right?

[mohamed-rdr]

Keeping this one: it's the Apple Silicon prebuild, and the tarball has no source fallback, so without it npm install hard-fails on Macs. Production is linux-only, so it only affects local dev — leaving the thread open in case you'd rather drop macOS support entirely.

🤖 Addressed by Claude Code