From 7f91a2a68ec02bb12c4947098a25e2516dbb2358 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@local>
Date: Fri, 8 May 2026 13:43:24 +0000
Subject: [PATCH] feat: add jq static build

---
 .gitea/workflows/jq.yml | 72 +++++++++++++++++++++++++++++++++++++++++
 README.md               |  1 +
 scripts/build_jq.sh     | 49 ++++++++++++++++++++++++++++
 versions/jq.version     |  1 +
 4 files changed, 123 insertions(+)
 create mode 100644 .gitea/workflows/jq.yml
 create mode 100755 scripts/build_jq.sh
 create mode 100644 versions/jq.version

diff --git a/.gitea/workflows/jq.yml b/.gitea/workflows/jq.yml
new file mode 100644
index 0000000..eb9bbfe
--- /dev/null
+++ b/.gitea/workflows/jq.yml
@@ -0,0 +1,72 @@
+name: jq static musl build
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .gitea/workflows/jq.yml
+      - scripts/build_jq.sh
+      - scripts/publish_release.py
+      - versions/jq.version
+      - README.md
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-release:
+    runs-on: alpine-latest
+
+    steps:
+      - name: Bootstrap workspace
+        shell: sh
+        env:
+          REPO_URL: ${{ gitea.server_url }}
+          REPO_NAME: ${{ gitea.repository }}
+          GIT_SHA: ${{ gitea.sha }}
+        run: |
+          apk add --no-cache git
+          workdir="$(pwd)"
+          tmpdir="$(mktemp -d)"
+          git clone --depth 1 "$REPO_URL/$REPO_NAME.git" "$tmpdir/repo"
+          git -C "$tmpdir/repo" fetch --depth 1 origin "$GIT_SHA"
+          git -C "$tmpdir/repo" checkout "$GIT_SHA"
+          find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+          cp -a "$tmpdir/repo"/. "$workdir"/
+
+      - name: Read version
+        id: meta
+        shell: sh
+        working-directory: ${{ gitea.workspace }}
+        run: |
+          version="$(tr -d ' \n\r' < versions/jq.version)"
+          artifact="jq-${version}-linux-amd64-musl-static"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "artifact=${artifact}" >> "$GITHUB_OUTPUT"
+
+      - name: Build static jq
+        shell: sh
+        working-directory: ${{ gitea.workspace }}
+        run: |
+          chmod +x scripts/build_jq.sh
+          ./scripts/build_jq.sh "${{ steps.meta.outputs.version }}" "$PWD/dist"
+
+      - name: Publish release assets
+        shell: sh
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_API_URL: ${{ gitea.api_url }}
+          REPO_OWNER: ${{ gitea.repository_owner }}
+          REPO_NAME: static-musl-builds
+          TOOL: jq
+          VERSION: ${{ steps.meta.outputs.version }}
+          TARGET_SHA: ${{ gitea.sha }}
+        working-directory: ${{ gitea.workspace }}
+        run: |
+          apk add --no-cache python3
+          python3 scripts/publish_release.py \
+            "dist/${{ steps.meta.outputs.artifact }}" \
+            "dist/${{ steps.meta.outputs.artifact }}.tar.gz" \
+            "dist/${{ steps.meta.outputs.artifact }}.sha256"
diff --git a/README.md b/README.md
index 5efde73..741619b 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,7 @@ Automated static `musl` builds for portable Linux binaries.
 - `speedtest-go`
 - `doggo`
 - `busybox`
+- `jq`
 
 Each release publishes:
 - the raw binary
diff --git a/scripts/build_jq.sh b/scripts/build_jq.sh
new file mode 100755
index 0000000..b9a084b
--- /dev/null
+++ b/scripts/build_jq.sh
@@ -0,0 +1,49 @@
+#!/bin/sh
+set -eu
+
+VERSION="${1:?usage: build_jq.sh <version> [output_dir]}"
+OUTPUT_DIR="${2:-$PWD/dist}"
+VERSION="${VERSION#v}"
+PREFIX_NAME="jq-${VERSION}-linux-amd64-musl-static"
+
+mkdir -p "$OUTPUT_DIR"
+
+apk add --no-cache \
+  build-base \
+  curl \
+  file \
+  tar \
+  xz
+
+SRCDIR="${TMPDIR:-/tmp}/jq-src-${VERSION}"
+rm -rf "$SRCDIR"
+mkdir -p "$SRCDIR"
+
+curl -fsSL "https://github.com/jqlang/jq/releases/download/jq-${VERSION}/jq-${VERSION}.tar.gz" \
+  | tar -xz -C "$SRCDIR" --strip-components=1
+
+cd "$SRCDIR"
+./configure \
+  --disable-docs \
+  --with-oniguruma=builtin \
+  --enable-all-static \
+  CFLAGS='-O2 -pipe'
+make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 2)"
+cp jq "$OUTPUT_DIR/$PREFIX_NAME"
+strip "$OUTPUT_DIR/$PREFIX_NAME" 2>/dev/null || true
+
+(
+  cd "$OUTPUT_DIR"
+  tar -czf "${PREFIX_NAME}.tar.gz" "$PREFIX_NAME"
+  sha256sum "$PREFIX_NAME" "${PREFIX_NAME}.tar.gz" > "${PREFIX_NAME}.sha256"
+)
+
+file "$OUTPUT_DIR/$PREFIX_NAME"
+ldd "$OUTPUT_DIR/$PREFIX_NAME" || true
+
+if file "$OUTPUT_DIR/$PREFIX_NAME" | grep -qi 'dynamically linked'; then
+  echo "error: output binary is still dynamically linked" >&2
+  exit 1
+fi
+
+echo "build OK: $OUTPUT_DIR/$PREFIX_NAME"
diff --git a/versions/jq.version b/versions/jq.version
new file mode 100644
index 0000000..a8fdfda
--- /dev/null
+++ b/versions/jq.version
@@ -0,0 +1 @@
+1.8.1