ci: fix release build (native-arch per OS + node22)

[dp9u0]

Fix the first release run: pkg tried to build linux-arm64 from an x64 runner and cross-compiling failed in openssl. Now builds each OS natively (ubuntu/macos/windows), uploads artifacts, and a release job assembles them into one GitHub Release. Also bumps pkg targets to node22 and drops node20 from the ci matrix (runner deprecated). Validated with actionlint.

[Copilot]

🟡 Changes recommended

The release workflow still risks cross-target builds and non-portable checksum generation, which can break the release pipeline on macOS/Windows and/or reintroduce the original cross-compilation failure.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the GitHub Actions workflows to build release artifacts per OS runner (instead of attempting cross-target builds from a single runner) and updates packaging/CI Node versions to newer baselines.

Changes:

• Update pkg targets from Node 20 to Node 22.
• Split release workflow into a per-OS build matrix that uploads artifacts, plus a final job that creates the GitHub Release from downloaded artifacts.
• Drop Node 20 from the CI test matrix.

File summaries

File	Description
package.json	Bumps pkg build targets to Node 22.
.github/workflows/release.yml	Adds OS-matrix build job, artifact upload/download, and release assembly step.
.github/workflows/ci.yml	Removes Node 20 from the test matrix.

Review details

Suppressed comments (1)

.github/workflows/release.yml:40

• pnpm exec pkg . --out-path dist will use the pkg.targets list from package.json, which can trigger cross-compilation and defeats the "native arch" intent of this job. Use the per-job target from the matrix (or otherwise constrain targets) so each runner only builds one native binary.

      - name: build standalone binaries (native arch)
        run: pnpm exec pkg . --out-path dist

• Files reviewed: 3/3 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The release workflow and new CLI paths contain reliability issues (portable checksums, pkg target selection vs “native arch” intent, and unsafe calendar parsing/user access) that could break releases or crash the CLI.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (4)

test/commands/test_cache.js:91

• This test currently only asserts process.exitCode on refresh failure; if the intent is to preserve the existing cached problems list when refresh fails, add an assertion that the old cache remains available.

  it('should fail loudly if refresh fails', function(done) {
    cache.set('problems', [{fid: 1}]);
    cmd.__set__('core', {getProblems: (t, cb) => cb('refresh error')});

    cmd.handler({refresh: true, dontTranslate: true});

    const text = out.join('\n');
    assert.include(text, 'refresh error');
    assert.equal(process.exitCode, 1);
    done();
  });

test/commands/test_stat.js:90

• Same as above: the timeout isn't needed for this failure-path test when getCalendar is stubbed synchronously.

    cmd.handler({lock: true, cal: true});
    setTimeout(() => {
      const text = stripAnsi(out.join('\n'));
      assert.include(text, 'using local log');
      done();
    }, 10);
  });

.github/workflows/release.yml:47

• The checksum step uses sha256sum, which is not available by default on macOS runners (and can vary on Windows even under bash). Using Node's crypto makes this portable across all runners already in the matrix.

      - name: checksums
        shell: bash
        run: |
          cd dist
          for f in *; do sha256sum "$f" > "$f.sha256"; done

.github/workflows/release.yml:40

• pnpm exec pkg . --out-path dist will build all targets listed in package.json's pkg.targets. That includes cross-arch targets (e.g. linux-arm64 from ubuntu x64, macos-x64 from an arm64 macOS runner), which contradicts the 'native arch only' comment and can reintroduce the OpenSSL cross-compile failure you’re trying to avoid. Consider explicitly setting --targets per matrix entry (and/or adding native arm64/x64 runners) so each job builds only what its runner can build reliably.

      # pkg compiles node from source for any target without a cached
      # binary, which cannot be cross-compiled (arm64 from an x64 host
      # fails in openssl's arm_arch.h). Building the native arch only
      # avoids that: the host arch is inferred from the runner and pkg
      # picks the matching node* target from the config.
      - name: build standalone binaries (native arch)
        run: pnpm exec pkg . --out-path dist

• Files reviewed: 11/11 changed files
• Comments generated: 8
• Review effort level: Lite

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

🟡 Changes recommended

The updated release workflow has concrete correctness/portability issues (pkg target selection vs multi-target config, and non-portable checksum tooling) that can break releases/CI.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (4)

.github/workflows/release.yml:40

• The build job runs pnpm exec pkg . without --targets, but package.json defines a multi-target pkg.targets list (linux x64+arm64, macOS x64+arm64, win x64). pkg will attempt to build every configured target on each runner, reintroducing cross-arch builds (e.g. linux-arm64 on ubuntu-latest x64) despite the “native arch only” comment, and can fail when a target requires a from-source Node build.

      # pkg compiles node from source for any target without a cached
      # binary, which cannot be cross-compiled (arm64 from an x64 host
      # fails in openssl's arm_arch.h). Building the native arch only
      # avoids that: the host arch is inferred from the runner and pkg
      # picks the matching node* target from the config.
      - name: build standalone binaries (native arch)
        run: pnpm exec pkg . --out-path dist

.github/workflows/release.yml:47

• The checksum step uses sha256sum, which is available on Ubuntu but typically not present on macOS runners (and can vary on Windows even under bash). This can cause the build matrix to fail before artifacts are uploaded.

      - name: checksums
        shell: bash
        run: |
          cd dist
          for f in *; do sha256sum "$f" > "$f.sha256"; done

lib/plugins/leetcode.js:496

• getCalendar assumes session.getUser().name is always present and that body.data.matchedUser.userCalendar exists. If the username wasn't persisted (e.g. getUserInfo failed) or GraphQL returns {errors: ...} / an unexpected body shape, this will throw a TypeError instead of returning a helpful error to the caller.

  const opts = plugin.makeOpts(config.sys.urls.graphql);
  opts.headers.Origin = config.sys.urls.base;
  opts.headers.Referer = config.sys.urls.base;
  opts.json = true;
  opts.body = {
    query:     'query cal($username: String!) { matchedUser(username: $username) { userCalendar { submissionCalendar } } }',
    variables: {username: session.getUser().name}
  };

  const spin = h.spin('Retrieving submission calendar');
  request.post(opts, function(e, resp, body) {
    spin.stop();
    e = plugin.checkError(e, resp, 200);
    if (e) return cb(e);

    const cal = body.data.matchedUser.userCalendar;
    if (!cal) return cb('failed to load submission calendar!');
    try {

test/commands/test_stat.js:90

• These tests wait on a fixed setTimeout(..., 10) even though the stubbed getCalendar callback is invoked synchronously; this adds unnecessary delay and can introduce flakiness on slow CI. Prefer asserting immediately after cmd.handler(...) (or use setImmediate/process.nextTick if you want to model async).

• Files reviewed: 35/41 changed files
• Comments generated: 1
• Review effort level: Lite