Add CI job to compile git-crypt for 4 platform targets

Matrix: darwin-arm64, darwin-x64, linux-x64, linux-arm64.
macOS builds statically link OpenSSL. Linux builds are fully static
via Alpine/musl. Binaries uploaded as workflow artifacts.

Author: j-256

.github/workflows/ci.yml

@@ -20,6 +20,78 @@ jobs:
       - run: npm run build
       - run: npm test
 
+  build-git-crypt:
+    if: startsWith(github.ref, 'refs/tags/v')
+    strategy:
+      matrix:
+        include:
+          - target: darwin-arm64
+            os: macos-14
+          - target: darwin-x64
+            os: macos-13
+          - target: linux-x64
+            os: ubuntu-latest
+            platform: linux/amd64
+          - target: linux-arm64
+            os: ubuntu-latest
+            platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Read git-crypt version
+        id: version
+        run: |
+          echo "version=$(sed -n '1p' git-crypt-version.txt)" >> "$GITHUB_OUTPUT"
+          echo "checksum=$(sed -n '2p' git-crypt-version.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Download and verify git-crypt source
+        run: |
+          curl -fsSL "https://github.com/AGWA/git-crypt/archive/${{ steps.version.outputs.version }}.tar.gz" -o git-crypt-src.tar.gz
+          echo "${{ steps.version.outputs.checksum }}  git-crypt-src.tar.gz" | shasum -a 256 -c
+          tar xzf git-crypt-src.tar.gz
+
+      - name: Build (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          brew install openssl@3
+          OPENSSL_DIR="$(brew --prefix openssl@3)"
+          cd "git-crypt-${{ steps.version.outputs.version }}"
+          make CXXFLAGS="-O2 -Wall -I${OPENSSL_DIR}/include" LDLIBS="${OPENSSL_DIR}/lib/libcrypto.a"
+          strip git-crypt
+          mkdir -p ../bin
+          cp git-crypt ../bin/
+
+      - name: Set up QEMU
+        if: matrix.platform == 'linux/arm64'
+        uses: docker/setup-qemu-action@v3
+
+      - name: Build (Linux static)
+        if: runner.os == 'Linux'
+        run: |
+          docker run --rm --platform "${{ matrix.platform }}" \
+            -v "$PWD:/build" -w /build alpine sh -c "
+              apk add g++ make musl-dev openssl-dev file &&
+              cd git-crypt-${{ steps.version.outputs.version }} &&
+              LDFLAGS='-static' make &&
+              strip git-crypt &&
+              ./git-crypt --version &&
+              file git-crypt &&
+              mkdir -p ../bin &&
+              cp git-crypt ../bin/
+            "
+
+      - name: Smoke test
+        if: runner.os == 'macOS'
+        run: |
+          ./bin/git-crypt --version
+          file ./bin/git-crypt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: git-crypt-${{ matrix.target }}
+          path: bin/git-crypt
+
   publish:
     needs: test
     if: startsWith(github.ref, 'refs/tags/v')