[LinuxJedi]

The six Alpine jobs fail in the Setup Alpine Linux step before anything is built. jirutka/setup-alpine@v1 downloads the static apk.static binary from gitlab.alpinelinux.org, and that host times out (curl error 28 after 10 s). This hit master on 2026-10-22 and #265 on 2026-10-28, and it fails every PR while the host is down. dl-cdn.alpinelinux.org, where the action already gets its packages, stays reachable.

A new step downloads the apk-tools-static package from dl-cdn, extracts sbin/apk.static and serves it on 127.0.0.1:8099. The action gets that URL through its apk-tools-url input, which only accepts http:// and https:// URLs (not file://), and checks the file against the pinned SHA-256 before using it. The binary is the only thing the action fetches from gitlab: QEMU and the Alpine packages already come from dl-cdn. The build and test steps are unchanged.

The package is pinned to v3.22/main/x86_64/apk-tools-static-2.14.12-r0.apk. The action deliberately stays on apk-tools 2.14.x (its default is 2.14.10), while latest-stable now ships 3.0.8. x86_64 is the runner's arch; the static apk installs the target arch into the chroot as before. dl-cdn removes an old package file when Alpine updates it, so if the URL starts to 404 the URL and hash need updating, as the comment in the workflow says.

Testing:

• All six Alpine jobs pass on my fork, run from a test branch that adds itself to the workflow's push trigger: https://github.com/LinuxJedi/wolfPKCS11/actions/runs/40866944349. The x86 (without TPM) log shows Downloading http://127.0.0.1:8099/apk.static and apk: OK, has no gitlab requests, and make test passes (75 pass, 0 fail).
• actionlint is clean. The pre-commit hook make test passes.