Repository navigation
feat: single executable - #34
Merged
Merged
Conversation
A SEA needs two things the npm bundle cannot give it: a CommonJS entry, because node's embedder runs the main script as CJS, and the runtime dependencies inlined, because there is no node_modules beside it. Hence a second vite config writing `dist/sea/entry.cjs` rather than a format added to the existing one. `scripts/sea-build.ts` writes the blob, injects it with postject, and re-signs on darwin — injecting bytes invalidates the signature the node binary shipped with, and macOS then refuses to run it. It runs `--version` out of the finished binary before packaging, which is what catches a bad injection: both failure modes segfault rather than error. The embedded runtime is the node that ran the script, so the artifact carries the version CI resolved from `.nvmrc`.
Walking up to a package.json cannot work inside a SEA — the runtime, the bundle and the templates are all in the one file being run — so a downloaded binary reported `unknown / no package.json found above the binary`, which reads like a defect rather than the most ordinary install there is. `isSea()` answers it directly. The branch is covered by swapping `node:sea` in the test: `isSea()` is false under the runner by construction. The real artifact is checked by the build script, which runs `--version` out of the binary.
One job per platform, because there is nothing to cross-compile from: a single executable is the target platform's own node binary with a blob in it. Each job uploads its archive and a `.sha256` straight to the release release-please just cut, so no artifact handoff is needed. Stable releases only. A prerelease publishes to npm without cutting a GitHub release, so there would be nothing to attach to.
Covers the install path for a machine with no Node on it, including the checksum step, and says what `info` reports so a downloaded binary is not mistaken for an installed package.
A pathname keeps %20 in a path with spaces.
A chunk split off the entry would be missing inside the binary, so the build refuses one. list now runs out of the binary next to --version, and a stable archive name lets releases/latest/download resolve.
One workflow for both callers: pull requests touching the build run it on all four platforms and install the archive the way the README does, and the release calls it with the tag to attach the archives.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flags a movable tag on a third-party action. GitHub-owned actions stay on major tags.
Member
|
Thanks! Retargeted to |
TitusKirch
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add static binary using Node SEA.
Type of change
Checklist
Related issues
Closes #33