ci: switch riscv64 to cross-compilation from x86_64

Native Node.js compilation on ubuntu-24.04-riscv exceeds 8 hours even with
ninja + no-inspector + no-intl. Cross-compiling from x86_64 with
gcc-riscv64-linux-gnu produces an equivalent fully-static riscv64 binary in
roughly the same time as other native matrix entries (~2h).

The build runs on ubuntu-latest, extracts the binary, then repackages it as
a linux/riscv64 Docker image via buildx so platform metadata is correct.
The test uses QEMU via docker/setup-qemu-action to run the riscv64 binary
in CI.

Also reduces timeout-minutes from 480 to 120 (native builds finish well
under 2h; cross-compile is similarly bounded).

Author: gounthar

.github/workflows/build-static-node.yml

@@ -3,14 +3,14 @@ name: Build Static Node.js Container
 on:
   pull_request:
     paths:
-      - '.github/workflows/build-static-node.yml'
-      - 'staticnode/**'
+      - ".github/workflows/build-static-node.yml"
+      - "staticnode/**"
   push:
     branches:
       - main
     paths:
-      - '.github/workflows/build-static-node.yml'
-      - 'staticnode/**'
+      - ".github/workflows/build-static-node.yml"
+      - "staticnode/**"
 
 jobs:
   load-node-versions:
@@ -24,43 +24,102 @@ jobs:
       - name: Load Node.js versions
         id: load-versions
         run: |
-          echo "versions=$(cat staticnode/node-versions.json | jq -c '.')" >> $GITHUB_OUTPUT
+          echo "versions=$(cat staticnode/node-versions.json | jq -c ".")" >> $GITHUB_OUTPUT
 
   build:
     runs-on: ${{ matrix.IMAGE.RUNNER }}
     needs: load-node-versions
-    timeout-minutes: 480
+    timeout-minutes: 120
     permissions:
       contents: read
       packages: write
     strategy:
       fail-fast: false
       matrix:
         IMAGE:
-          - {RUNNER: "ubuntu-latest", MANYLINUX_IMAGE: "quay.io/pypa/manylinux2014_x86_64"}
-          - {RUNNER: "ubuntu-24.04-arm", MANYLINUX_IMAGE: "quay.io/pypa/manylinux2014_aarch64"}
-          - {RUNNER: "ubuntu-24.04-ppc64le", MANYLINUX_IMAGE: "quay.io/pypa/manylinux2014_ppc64le"}
-          - {RUNNER: "ubuntu-24.04-riscv", MANYLINUX_IMAGE: "quay.io/pypa/manylinux_2_39_riscv64"}
+          - {RUNNER: "ubuntu-latest", ARCH: "", MANYLINUX_IMAGE: "quay.io/pypa/manylinux2014_x86_64"}
+          - {RUNNER: "ubuntu-24.04-arm", ARCH: "", MANYLINUX_IMAGE: "quay.io/pypa/manylinux2014_aarch64"}
+          - {RUNNER: "ubuntu-24.04-ppc64le", ARCH: "", MANYLINUX_IMAGE: "quay.io/pypa/manylinux2014_ppc64le"}
+          - {RUNNER: "ubuntu-latest", ARCH: "riscv64", MANYLINUX_IMAGE: "quay.io/pypa/manylinux_2_39_riscv64"}
         NODE_CONFIG: ${{ fromJson(needs.load-node-versions.outputs.versions) }}
     steps:
     - uses: actions/checkout@v6.0.1
       with:
         persist-credentials: false
+    - name: Set up QEMU for riscv64 test
+      if: matrix.IMAGE.ARCH == 'riscv64'
+      uses: docker/setup-qemu-action@v3
+      with:
+        platforms: linux/riscv64
+    - name: Set up Docker Buildx
+      if: matrix.IMAGE.ARCH == 'riscv64'
+      uses: docker/setup-buildx-action@v3
     - name: Set Node.js version
       run: |
         echo "NODE_VERSION=${{ matrix.NODE_CONFIG.version }}" >> $GITHUB_ENV
         echo "NODE_SHA256SUM=${{ matrix.NODE_CONFIG.sha256sum }}" >> $GITHUB_ENV
-        arch=$(echo "${{ runner.arch }}" | tr '[:upper:]' '[:lower:]')
-        echo "NODE_ARCH=$arch" >> $GITHUB_ENV
-    - name: Build the Docker image
+        if [ -n "${{ matrix.IMAGE.ARCH }}" ]; then
+          echo "NODE_ARCH=${{ matrix.IMAGE.ARCH }}" >> $GITHUB_ENV
+        else
+          arch=$(echo "${{ runner.arch }}" | tr '[:upper:]' '[:lower:]')
+          echo "NODE_ARCH=$arch" >> $GITHUB_ENV
+        fi
+    - name: Build the Docker image (native)
+      if: matrix.IMAGE.ARCH != 'riscv64'
+      run: |
+        echo building node.js $NODE_VERSION for $NODE_ARCH
+        docker build --tag ghcr.io/pyca/static-nodejs-$NODE_ARCH:$NODE_VERSION \
+          --build-arg VERSION=$NODE_VERSION \
+          --build-arg ARCH=$NODE_ARCH \
+          --build-arg SHA256SUM=$NODE_SHA256SUM \
+          staticnode
+    - name: Cross-compile Node.js for riscv64 on x86_64
+      if: matrix.IMAGE.ARCH == 'riscv64'
       run: |
-        echo building node.js $NODE_VERSION
-        docker build --tag ghcr.io/pyca/static-nodejs-$NODE_ARCH:$NODE_VERSION --build-arg VERSION=$NODE_VERSION --build-arg ARCH=$NODE_ARCH --build-arg SHA256SUM=$NODE_SHA256SUM staticnode
-    - name: Test static node.js
+        echo cross-compiling node.js $NODE_VERSION for riscv64
+        docker build \
+          --tag cross-builder-node \
+          --build-arg VERSION=$NODE_VERSION \
+          --build-arg SHA256SUM=$NODE_SHA256SUM \
+          --file staticnode/Dockerfile.riscv64-cross \
+          staticnode
+        mkdir -p /tmp/node-riscv64/bin
+        docker create --name node-cross cross-builder-node
+        docker cp node-cross:/out/bin/node /tmp/node-riscv64/bin/node
+        docker cp node-cross:/out/LICENSE /tmp/node-riscv64/LICENSE
+        docker rm node-cross
+        printf 'FROM scratch
+COPY bin/node /out/bin/node
+COPY LICENSE /out/LICENSE
+' \
+          > /tmp/Dockerfile.inject
+        docker buildx build \
+          --platform linux/riscv64 \
+          --tag ghcr.io/pyca/static-nodejs-riscv64:$NODE_VERSION \
+          --file /tmp/Dockerfile.inject \
+          --load \
+          /tmp/node-riscv64
+    - name: Test static node.js (native)
+      if: matrix.IMAGE.ARCH != 'riscv64'
       run: |
         cd staticnode
-        docker build -f Dockerfile-test -t test-node --build-arg MANYLINUX_IMAGE=${{ matrix.IMAGE.MANYLINUX_IMAGE }} --build-arg CONTAINER_NAME=ghcr.io/pyca/static-nodejs-$NODE_ARCH:$NODE_VERSION .
+        docker build -f Dockerfile-test -t test-node \
+          --build-arg MANYLINUX_IMAGE=${{ matrix.IMAGE.MANYLINUX_IMAGE }} \
+          --build-arg CONTAINER_NAME=ghcr.io/pyca/static-nodejs-$NODE_ARCH:$NODE_VERSION .
         docker run test-node /staticnode/bin/node -e "console.log('hello world'); console.log(process.version)"
+    - name: Test static node.js (riscv64 via QEMU)
+      if: matrix.IMAGE.ARCH == 'riscv64'
+      run: |
+        cd staticnode
+        docker buildx build \
+          --platform linux/riscv64 \
+          -f Dockerfile-test -t test-node \
+          --build-arg MANYLINUX_IMAGE=${{ matrix.IMAGE.MANYLINUX_IMAGE }} \
+          --build-arg CONTAINER_NAME=ghcr.io/pyca/static-nodejs-riscv64:$NODE_VERSION \
+          --load \
+          .
+        docker run --platform linux/riscv64 test-node \
+          /staticnode/bin/node -e "console.log('hello world'); console.log(process.version)"
     - name: Login to docker
       run: 'docker login -u "$DOCKER_USERNAME" -p "$DOCKER_PASSWORD" ghcr.io'
       env: