fix(ci): use docker run for musl builds (Alpine container JS bug on arm64)

GitHub Actions JS actions (checkout, upload-artifact) don't work inside
Alpine containers on arm64 runners. Use docker run instead of container:
to keep the runner native while building inside Alpine.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: fentas

.github/workflows/ci.yaml

@@ -70,7 +70,6 @@ jobs:
   rust-musl:
     name: Rust (musl-${{ matrix.arch }})
     runs-on: ${{ matrix.runner }}
-    container: alpine:latest
     strategy:
       matrix:
         include:
@@ -80,10 +79,12 @@ jobs:
             runner: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v6
-      - name: Install build tools
-        run: apk add --no-cache rust cargo musl-dev
-      - name: Build (musl)
-        run: cargo build --release
+      - name: Build in Alpine container
+        run: |
+          docker run --rm -v "$PWD:/src" -w /src alpine:latest sh -c '
+            apk add --no-cache rust cargo musl-dev
+            cargo build --release
+          '
       - name: Upload .so
         uses: actions/upload-artifact@v7
         with:

.github/workflows/publish.yaml

@@ -46,64 +46,66 @@ jobs:
     name: Build ${{ matrix.variant }}-${{ matrix.arch }}
     runs-on: ${{ matrix.runner }}
     needs: [meta]
-    container: ${{ matrix.container || '' }}
     strategy:
       matrix:
         include:
           - arch: amd64
             runner: ubuntu-latest
             target: x86_64-unknown-linux-gnu
             variant: linux
+            musl: false
           - arch: arm64
             runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
             variant: linux
+            musl: false
           - arch: amd64
             runner: ubuntu-latest
             variant: linux-musl
-            container: alpine:latest
+            musl: true
           - arch: arm64
             runner: ubuntu-24.04-arm
             variant: linux-musl
-            container: alpine:latest
+            musl: true
     steps:
       - uses: actions/checkout@v6
       - name: Check if lib has a builtin
         id: check
         run: |
           lib="${{ needs.meta.outputs.lib }}"
-          if [ -d "${lib}-builtin" ]; then
+          if [[ -d "${lib}-builtin" ]]; then
             echo "has_builtin=true" >> "${GITHUB_OUTPUT}"
           else
             echo "has_builtin=false" >> "${GITHUB_OUTPUT}"
           fi
       # glibc builds
       - uses: dtolnay/rust-toolchain@stable
-        if: steps.check.outputs.has_builtin == 'true' && !matrix.container
+        if: steps.check.outputs.has_builtin == 'true' && !matrix.musl
         with:
           targets: ${{ matrix.target }}
       - uses: Swatinem/rust-cache@v2
-        if: steps.check.outputs.has_builtin == 'true' && !matrix.container
+        if: steps.check.outputs.has_builtin == 'true' && !matrix.musl
         with:
           shared-key: publish-${{ matrix.variant }}-${{ matrix.arch }}
       - name: Build (glibc)
-        if: steps.check.outputs.has_builtin == 'true' && !matrix.container
+        if: steps.check.outputs.has_builtin == 'true' && !matrix.musl
         run: cargo build --release --target ${{ matrix.target }}
       - name: Rename .so (glibc)
-        if: steps.check.outputs.has_builtin == 'true' && !matrix.container
+        if: steps.check.outputs.has_builtin == 'true' && !matrix.musl
         run: |
           lib="${{ needs.meta.outputs.lib }}"
           cp "target/${{ matrix.target }}/release/lib${lib}.so" \
              "${lib}-${{ matrix.variant }}-${{ matrix.arch }}.so"
-      # musl builds (Alpine container)
-      - name: Install build tools (musl)
-        if: steps.check.outputs.has_builtin == 'true' && matrix.container
-        run: apk add --no-cache rust cargo musl-dev
+      # musl builds (docker run Alpine — avoids container: alpine JS action bug on arm64)
       - name: Build (musl)
-        if: steps.check.outputs.has_builtin == 'true' && matrix.container
-        run: cargo build --release
+        if: steps.check.outputs.has_builtin == 'true' && matrix.musl
+        run: |
+          docker run --rm -v "$PWD:/src" -w /src alpine:latest sh -c '
+            apk add --no-cache rust cargo musl-dev
+            cargo build --release
+          '
       - name: Rename .so (musl)
-        if: steps.check.outputs.has_builtin == 'true' && matrix.container
+        if: steps.check.outputs.has_builtin == 'true' && matrix.musl
         run: |
           lib="${{ needs.meta.outputs.lib }}"
           cp "target/release/lib${lib}.so" \