Distribute native binaries via npm using prebuildify (drop node-pre-gyp/S3)

.circleci/config.yml

@@ -1,6 +1,8 @@
 version: 2
 
-dockerbuild: &dockerbuild
+# The addon is compiled from source with prebuildify and loaded via
+# node-gyp-build; there is no prebuilt download step in CI.
+build_and_test: &build_and_test
   steps:
     - checkout
     - setup_remote_docker:
@@ -13,32 +15,11 @@ dockerbuild: &dockerbuild
           git submodule update
     - run:
         name: Install dependencies
-        command: |
-          npm install
-        when: on_success
-    - run:
-        name: Test
-        command: npm run test
+        command: npm ci
         when: on_success
-
-# Forces a compile through node-gyp instead of downloading the prebuilt
-# binary from S3, so the native build toolchain (node-gyp / node-pre-gyp)
-# stays covered even when prebuilts already exist.
-sourcebuild: &sourcebuild
-  steps:
-    - checkout
-    - setup_remote_docker:
-        docker_layer_caching: true
-    - run:
-        name: "Pull submodules"
-        command: |
-          git submodule init
-          git submodule sync
-          git submodule update
     - run:
-        name: Install dependencies (build from source)
-        command: |
-          npm install --build-from-source
+        name: Build addon (prebuildify)
+        command: JOBS=max npm run build
         when: on_success
     - run:
         name: Test
@@ -47,27 +28,15 @@ sourcebuild: &sourcebuild
 
 jobs:
   "node-20":
-    <<: *dockerbuild
+    <<: *build_and_test
     docker:
       - image: node:20
   "node-22":
-    <<: *dockerbuild
+    <<: *build_and_test
     docker:
       - image: node:22
   "node-24":
-    <<: *dockerbuild
-    docker:
-      - image: node:24
-  "node-20-source":
-    <<: *sourcebuild
-    docker:
-      - image: node:20
-  "node-22-source":
-    <<: *sourcebuild
-    docker:
-      - image: node:22
-  "node-24-source":
-    <<: *sourcebuild
+    <<: *build_and_test
     docker:
       - image: node:24
 
@@ -78,7 +47,3 @@ workflows:
       - "node-20"
       - "node-22"
       - "node-24"
-      - "node-20-source"
-      - "node-22-source"
-      - "node-24-source"
-

.github/workflows/release.yml

@@ -0,0 +1,79 @@
+name: release
+
+# Publishes @radarlabs/s2 to npm with the native prebuilds bundled in the
+# tarball. Trigger by publishing a GitHub Release whose tag matches the
+# version already set in package.json (e.g. v0.0.7).
+on:
+  release:
+    types: [published]
+
+jobs:
+  # Build one N-API prebuild per platform/arch. N-API is ABI-stable across
+  # Node versions, so a single build per platform serves Node 20/22/24.
+  prebuild:
+    name: prebuild (${{ matrix.name }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          # Pin the runner images: stable, and building on the oldest supported
+          # Ubuntu keeps the prebuilt binaries' glibc floor low so they run on
+          # more consumer systems.
+          - { os: ubuntu-22.04,     name: linux-x64 }
+          - { os: ubuntu-22.04-arm, name: linux-arm64 }
+          - { os: macos-14,         name: darwin-arm64 }
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm ci
+      - run: JOBS=max npm run build
+      - name: Smoke test the prebuild
+        run: npm test
+      - uses: actions/upload-artifact@v4
+        with:
+          name: prebuild-${{ matrix.name }}
+          path: prebuilds/
+          if-no-files-found: error
+
+  stage-publish:
+    name: stage publish to npm
+    needs: prebuild
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # mint the OIDC token for npm trusted publishing + provenance
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22 # trusted publishing requires Node >= 22.14
+          registry-url: "https://registry.npmjs.org"
+      - name: Upgrade npm (trusted publishing needs >= 11.5.1)
+        run: npm install -g npm@latest
+      - name: Download all prebuilds
+        uses: actions/download-artifact@v4
+        with:
+          pattern: prebuild-*
+          path: artifacts
+      - name: Assemble prebuilds/
+        run: |
+          mkdir -p prebuilds
+          cp -R artifacts/*/. prebuilds/
+          ls -R prebuilds
+      # Stages the release via OIDC (no token). The package does NOT go public
+      # here. One-time setup on npmjs.com: configure a Trusted Publisher for
+      # this package pointing at radarlabs/s2 + .github/workflows/release.yml
+      # with STAGE-ONLY permissions. Provenance is attached automatically.
+      - name: Stage publish
+        run: npm stage publish --access public
+      - name: How to approve
+        run: |
+          echo "Release staged — NOT yet public. A maintainer must approve with 2FA:"
+          echo "  npm stage list"
+          echo "  npm stage view @radarlabs/s2"
+          echo "  npm stage approve @radarlabs/s2   # (or approve/reject on npmjs.com)"

.gitignore

@@ -6,3 +6,4 @@ radarlabs-s2-0.0.1.tgz
 *.txt
 lib
 *.swp
+prebuilds/

binding.gyp

@@ -1,8 +1,8 @@
 {
-  # NOTE: 'module_name' and 'module_path' come from the 'binary' property in package.json
-  # node-pre-gyp handles passing them down to node-gyp when you build from source
+  # The built addon is collected into ./prebuilds by prebuildify and loaded at
+  # runtime by node-gyp-build; there is no node-pre-gyp copy step.
   "targets": [{
-    "target_name": "<(module_name)",
+    "target_name": "s2",
 
     "sources": [
       "./src/s2.cc",
@@ -153,17 +153,6 @@
 
       }]
     ]
-  },
-    {
-      "target_name": "action_after_build",
-      "type": "none",
-      "dependencies": [ "<(module_name)" ],
-      "copies": [
-        {
-          "files": [ "<(PRODUCT_DIR)/<(module_name).node" ],
-          "destination": "<(module_path)"
-        }
-      ]
-    }
+  }
 ]
 }

docker/Dockerfile.node20.test

@@ -4,5 +4,5 @@ WORKDIR /app
 COPY . /app
 
 RUN npm ci
-RUN JOBS=max npx --no-install node-pre-gyp rebuild
+RUN JOBS=max npm run build
 CMD npm run test

docker/Dockerfile.node22.test

@@ -4,5 +4,5 @@ WORKDIR /app
 COPY . /app
 
 RUN npm ci
-RUN JOBS=max npx --no-install node-pre-gyp rebuild
+RUN JOBS=max npm run build
 CMD npm run test

docker/Dockerfile.node24.test

@@ -4,5 +4,5 @@ WORKDIR /app
 COPY . /app
 
 RUN npm ci
-RUN JOBS=max npx --no-install node-pre-gyp rebuild
+RUN JOBS=max npm run build
 CMD npm run test

index.js

@@ -1,6 +1,3 @@
-// magic incantation from step 3 @ https://github.com/mapbox/node-pre-gyp#readme
-const binary = require('@mapbox/node-pre-gyp');
-const path = require('path');
-var binding_path = binary.find(path.resolve(path.join(__dirname,'./package.json')));
-const s2 = require(binding_path);
-module.exports = s2;
+// Loads the prebuilt N-API addon shipped in ./prebuilds (built by prebuildify),
+// falling back to a local ./build compile for unsupported platforms.
+module.exports = require('node-gyp-build')(__dirname);