fix(release): build the Linux x64 Node addon against glibc 2.17 (#1670)

[DecisionNerd]

Closes #1670.

What

.github/workflows/binding-release-candidate.yml:

• The Linux x64 Node lane now builds with --use-napi-cross, the prebuilt gcc toolchain that links against glibc 2.17, as the aarch64 lane already does. That toolchain's unpacker (@napi-rs/lzma) needs Node ≥ 22, so the lane builds on node_version: "22". It then switches back with a second actions/setup-node step to runtime_node_version: "20", the engines.node floor, and checks the major version before the native smoke and parity contract runs. The executing lane therefore still proves Node 20.
• New fail-closed step, "Require the declared glibc floor", for every lane with a glibc_floor, which covers both *-unknown-linux-gnu lanes. It reads the addon's highest GLIBC_ version with readelf --dyn-syms --wide, which works on any ELF architecture and so also checks the cross-built aarch64 addon on the x64 host. It refuses anything above 2.17, and runs before the addon is executed.

scripts/ci/test-binding-release-candidate.py: the assertion "only the ARM lane pins a Node version" described the old layout, not a requirement. It now checks the property itself:

• every --use-napi-cross lane pins a Node ≥ 22 build host;
• every lane that executes its addon, and pins a build Node, runs the addon on Node 20;
• runtime_node_version appears only on native lanes that pin a build Node;
• every Linux glibc lane declares glibc_floor: "2.17", and no other lane declares one;
• the floor step exists, uses readelf, runs under set -euo pipefail, contains no ||, exits 1 on violation, and comes before the native contract.

Evidence

• Local build of this exact command (pnpm --filter @curatelabs/graphforge exec napi build --platform --release --target x86_64-unknown-linux-gnu --use-napi-cross, Node 22.22.1, napi CLI 3.10.4):
  • the addon's highest glibc symbol is GLIBC_2.16, and version() returns 0.5.2;
  • test:smoke passed 8/8, and non-cypher-release-parity + async-errors + export-surface passed 9/9.
• The floor step script, extracted verbatim from the workflow:
  • on that addon, glibc_required=2.16 floor=2.17, exit 0;
  • on the current Bazel-era RC addon (run 36658527263, graphforge.linux-x64-gnu.node), "needs glibc 2.39, above the declared floor 2.17", exit 1.
• Mutations of the workflow each fail test-binding-release-candidate.py:
  • drop the x64 runtime_node_version;
  • drop the x64 glibc_floor;
  • drop the x64 Node 22 build pin;
  • prefix the readelf line with true ||;
  • remove set -euo pipefail from the floor step.
• Other checks: python3 scripts/ci/test-binding-release-candidate.py, test-ci-storage-policy.py, workflow_policy.py, scripts/check-workflows.sh (actionlint) and make pre-push-fast all pass. ruff format and ruff check are clean.

Only provable after merge

Binding RC only runs on the current main SHA, so acceptance criterion 1 needs a dispatch on the merge commit: a Binding RC run whose Linux x64 addon is ≤ 2.17 and passes the lane's native contract on Node 20. I'll dispatch it after merge and post the result on #1670.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: CurateLabs/graphforge/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 669016c2-a1e2-4d0e-b4d3-7720a595eaa9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}