fix(aws): harden CloudFormation BYOC releases

.github/workflows/e2e-cloud.yml

@@ -650,7 +650,8 @@ jobs:
     runs-on: depot-ubuntu-24.04-arm
     timeout-minutes: 15
     outputs:
-      base_image: ghcr.io/alienplatform/alien-base:${{ github.sha }}
+      base_image: ghcr.io/alienplatform/alien-base@${{ steps.publish_base.outputs.digest }}
+      typescript_base_image: ${{ steps.publish_typescript_base.outputs.digest && format('ghcr.io/alienplatform/alien-worker-typescript@{0}', steps.publish_typescript_base.outputs.digest) || '' }}
     steps:
       - uses: actions/checkout@v5
 
@@ -666,6 +667,18 @@ jobs:
           name: alien-worker-runtime-aarch64
           path: target/aarch64-unknown-linux-musl/release/
 
+      - uses: actions/download-artifact@v7
+        if: needs.compute-matrix.outputs.needs_bindings_x86_64 == 'true'
+        with:
+          name: alien-bindings-node-linux-x64-gnu
+          path: crates/alien-bindings-node/
+
+      - uses: actions/download-artifact@v7
+        if: needs.compute-matrix.outputs.needs_bindings_aarch64 == 'true'
+        with:
+          name: alien-bindings-node-linux-arm64-gnu
+          path: crates/alien-bindings-node/
+
       - name: Ensure binary dirs exist and make executable
         run: |
           # Create placeholder dirs for skipped architectures so Dockerfile COPY doesn't fail
@@ -675,6 +688,11 @@ jobs:
           [ ! -f target/aarch64-unknown-linux-musl/release/alien-worker-runtime ] && touch target/aarch64-unknown-linux-musl/release/alien-worker-runtime
           chmod +x target/*/release/alien-worker-runtime
 
+      - name: Ensure Worker addon paths exist
+        run: |
+          touch crates/alien-bindings-node/alien-bindings-node.linux-x64-gnu.node
+          touch crates/alien-bindings-node/alien-bindings-node.linux-arm64-gnu.node
+
       - name: Compute Docker platforms
         id: platforms
         run: |
@@ -697,6 +715,7 @@ jobs:
       - uses: depot/setup-action@v1
 
       - name: Build and push alien-base
+        id: publish_base
         uses: depot/build-push-action@v1
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
@@ -707,6 +726,23 @@ jobs:
           tags: ghcr.io/alienplatform/alien-base:${{ github.sha }}
           provenance: false
 
+      - name: Build and push alien-worker-typescript
+        id: publish_typescript_base
+        if: |
+          needs.compute-matrix.outputs.needs_bindings_x86_64 == 'true' ||
+          needs.compute-matrix.outputs.needs_bindings_aarch64 == 'true'
+        uses: depot/build-push-action@v1
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: docker/Dockerfile.alien-worker-typescript
+          build-args: |
+            ALIEN_WORKER_BASE=ghcr.io/alienplatform/alien-base@${{ steps.publish_base.outputs.digest }}
+          platforms: ${{ steps.platforms.outputs.platforms }}
+          push: true
+          tags: ghcr.io/alienplatform/alien-worker-typescript:${{ github.sha }}
+          provenance: false
+
       - name: Verify alien-base runtime entrypoint
         env:
           BASE_IMAGE: ghcr.io/alienplatform/alien-base:${{ github.sha }}
@@ -1230,6 +1266,7 @@ jobs:
           DOCKER_USERNAME: ${{ (needs.compute-matrix.outputs.build_base_image == 'true' || startsWith(inputs.base_image_override, 'ghcr.io/alienplatform/alien-base:')) && github.actor || '' }}
           DOCKER_PASSWORD: ${{ (needs.compute-matrix.outputs.build_base_image == 'true' || startsWith(inputs.base_image_override, 'ghcr.io/alienplatform/alien-base:')) && secrets.GITHUB_TOKEN || '' }}
           ALIEN_OVERRIDE_BASE_IMAGE: ${{ inputs.base_image_override || (needs.compute-matrix.outputs.build_base_image == 'true' && needs.build-base-image.outputs.base_image || '') }}
+          ALIEN_OVERRIDE_TYPESCRIPT_WORKER_BASE: ${{ needs.compute-matrix.outputs.build_base_image == 'true' && needs.build-base-image.outputs.typescript_base_image || '' }}
           ALIEN_E2E_NETWORK_MODE: ${{ needs.compute-matrix.outputs.network_mode }}
         run: |
           set -a && source .env.test && set +a
@@ -1332,6 +1369,7 @@ jobs:
           DOCKER_USERNAME: ${{ (needs.compute-matrix.outputs.build_base_image == 'true' || startsWith(inputs.base_image_override, 'ghcr.io/alienplatform/alien-base:')) && github.actor || '' }}
           DOCKER_PASSWORD: ${{ (needs.compute-matrix.outputs.build_base_image == 'true' || startsWith(inputs.base_image_override, 'ghcr.io/alienplatform/alien-base:')) && secrets.GITHUB_TOKEN || '' }}
           ALIEN_OVERRIDE_BASE_IMAGE: ${{ inputs.base_image_override || (needs.compute-matrix.outputs.build_base_image == 'true' && needs.build-base-image.outputs.base_image || '') }}
+          ALIEN_OVERRIDE_TYPESCRIPT_WORKER_BASE: ${{ needs.compute-matrix.outputs.build_base_image == 'true' && needs.build-base-image.outputs.typescript_base_image || '' }}
           ALIEN_E2E_NETWORK_MODE: ${{ needs.compute-matrix.outputs.network_mode }}
         run: |
           set -a && source .env.test && set +a
@@ -1533,6 +1571,7 @@ jobs:
           DOCKER_USERNAME: ${{ (needs.compute-matrix.outputs.build_base_image == 'true' || startsWith(inputs.base_image_override, 'ghcr.io/alienplatform/alien-base:')) && github.actor || '' }}
           DOCKER_PASSWORD: ${{ (needs.compute-matrix.outputs.build_base_image == 'true' || startsWith(inputs.base_image_override, 'ghcr.io/alienplatform/alien-base:')) && secrets.GITHUB_TOKEN || '' }}
           ALIEN_OVERRIDE_BASE_IMAGE: ${{ inputs.base_image_override || (needs.compute-matrix.outputs.build_base_image == 'true' && needs.build-base-image.outputs.base_image || '') }}
+          ALIEN_OVERRIDE_TYPESCRIPT_WORKER_BASE: ${{ needs.compute-matrix.outputs.build_base_image == 'true' && needs.build-base-image.outputs.typescript_base_image || '' }}
           ALIEN_TEST_OVERRIDE_OPERATOR_IMAGE: ${{ inputs.operator_image_override || (needs.compute-matrix.outputs.build_operator_image == 'true' && needs.build-operator-image.outputs.operator_image || '') }}
           ALIEN_E2E_NETWORK_MODE: ${{ needs.compute-matrix.outputs.network_mode }}
           ALIEN_TEST_GHCR_USERNAME: ${{ github.actor }}

.github/workflows/release.yml

@@ -1027,7 +1027,7 @@ jobs:
   # ─── Docker images + Helm chart ─────────────────────────────────────
 
   publish-images:
-    needs: [prepare, build-binaries-linux-x86_64, build-binaries-linux-aarch64, build-binaries-darwin, build-binaries-windows]
+    needs: [prepare, build-addon, build-binaries-linux-x86_64, build-binaries-linux-aarch64, build-binaries-darwin, build-binaries-windows]
     if: ${{ inputs.mode == 'stable' && !inputs.dry_run }}
     runs-on: depot-ubuntu-24.04-arm-16
     timeout-minutes: 30
@@ -1053,6 +1053,20 @@ jobs:
             done
           done
 
+      - name: Download Linux Worker addons
+        uses: actions/download-artifact@v7
+        with:
+          pattern: addon-linux-*-gnu
+          path: ./linux-addons
+          merge-multiple: true
+
+      - name: Place Worker addons in Docker build context
+        run: |
+          cp ./linux-addons/alien-bindings-node.linux-x64-gnu.node \
+            crates/alien-bindings-node/alien-bindings-node.linux-x64-gnu.node
+          cp ./linux-addons/alien-bindings-node.linux-arm64-gnu.node \
+            crates/alien-bindings-node/alien-bindings-node.linux-arm64-gnu.node
+
       - name: Login to GHCR
         uses: docker/login-action@v3
         with:
@@ -1073,6 +1087,7 @@ jobs:
             type=raw,value=v${{ needs.prepare.outputs.version }}
 
       - name: Publish alien-base
+        id: publish_base
         uses: depot/build-push-action@v1
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
@@ -1085,6 +1100,41 @@ jobs:
           provenance: true
           sbom: true
 
+      - name: Metadata (alien-worker-typescript)
+        id: meta_worker_typescript
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/alienplatform/alien-worker-typescript
+          tags: |
+            type=raw,value=latest
+            type=raw,value=v${{ needs.prepare.outputs.version }}
+
+      - name: Publish alien-worker-typescript
+        id: publish_worker_typescript
+        uses: depot/build-push-action@v1
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: docker/Dockerfile.alien-worker-typescript
+          build-args: |
+            ALIEN_WORKER_BASE=ghcr.io/alienplatform/alien-base@${{ steps.publish_base.outputs.digest }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta_worker_typescript.outputs.tags }}
+          labels: ${{ steps.meta_worker_typescript.outputs.labels }}
+          provenance: true
+          sbom: true
+
+      - name: Smoke-test Worker base images
+        env:
+          GENERIC_BASE: ghcr.io/alienplatform/alien-base@${{ steps.publish_base.outputs.digest }}
+          TYPESCRIPT_BASE: ghcr.io/alienplatform/alien-worker-typescript@${{ steps.publish_worker_typescript.outputs.digest }}
+        run: |
+          docker run --rm --platform linux/arm64 --entrypoint /bin/sh "$GENERIC_BASE" \
+            -c 'test ! -e /usr/local/bin/bun && test -x /app/alien-worker-runtime'
+          docker run --rm --platform linux/arm64 --entrypoint /usr/local/bin/bun "$TYPESCRIPT_BASE" \
+            -e 'const a=require("/app/alien-bindings.node"); if (!a.version()) throw new Error("native version() returned empty")'
+
       - name: Metadata (alien-builder)
         id: meta_builder
         uses: docker/metadata-action@v5