diff --git a/.github/actions/linux/action.yml b/.github/actions/linux/action.yml
new file mode 100644
index 00000000000..9911b3a1296
--- /dev/null
+++ b/.github/actions/linux/action.yml
@@ -0,0 +1,35 @@
+name: build-linux
+runs:
+  using: composite
+  steps:
+    - name: build-image
+      shell: bash
+      run: |
+        pushd "$(mktemp -d)"
+        curl -f -L --retry 5 https://github.com/tweag/rust-alpine-mimalloc/archive/refs/heads/master.tar.gz | tar xz --strip-components=1
+        podman build \
+          --network host \
+          --pull \
+          --squash-all \
+          --tag rust:alpine-mimalloc \
+          .
+        popd
+
+    - name: build & test
+      shell: bash
+      run: |
+        podman run \
+          --env GITHUB_REF_NAME=$GITHUB_REF_NAME \
+          --init \
+          --network host \
+          --rm \
+          --volume $PWD:/workspace \
+          --workdir /workspace \
+          rust:alpine-mimalloc \
+          /workspace/build-static.sh
+
+    - name: upload-artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: binaryen-${{ matrix.arch }}-linux-static
+        path: binaryen-*-${{ matrix.arch }}-linux-static.tar.gz
diff --git a/.github/codecov.yml b/.github/codecov.yml
deleted file mode 100644
index 838ba91f5c9..00000000000
--- a/.github/codecov.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-coverage:
-  status:
-    patch: false
-    project:
-      default:
-        informational: true
-
-github_checks:
-    annotations: false
-
-comment: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 01b125a7a17..00000000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,392 +0,0 @@
-name: CI
-
-on:
-  # If we run CI on all branches then we end up doing duplicate work for
-  # branches which are also PRs.
-  push:
-    branches:
-      - main
-      - kripken/*
-  pull_request:
-
-jobs:
-
-  lint:
-    name: lint
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    env:
-      # Keep this in sync with clang-format-diff.sh
-      LLVM_VERSION: 17
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-        fetch-depth: 0
-    - name: install tools
-      run: |
-        sudo pip3 install -r requirements-dev.txt
-        sudo apt install lsb-release wget software-properties-common gnupg
-        wget https://apt.llvm.org/llvm.sh
-        sudo chmod +x llvm.sh
-        sudo ./llvm.sh ${LLVM_VERSION}
-        sudo apt-get install clang-format clang-format-${LLVM_VERSION} clang-tidy-${LLVM_VERSION}
-    - run: flake8
-    - run: ./scripts/clang-format-diff.sh
-    - name: clang-tidy
-      run: |
-        # clang-tidy requires compile_commands.json generated by cmake
-        cmake . -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
-        ./scripts/clang-tidy-diff.sh
-
-  build:
-    name: build
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-
-    - name: install Python dev dependencies
-      run: pip3 install -r requirements-dev.txt
-
-    - name: gen-s-parser
-      run: ./scripts/gen-s-parser.py | diff src/gen-s-parser.inc -
-      if: matrix.os == 'ubuntu-latest'
-
-    - name: install ninja (linux)
-      run: sudo apt-get install ninja-build
-      if: matrix.os == 'ubuntu-latest'
-
-    - name: install ninja (macos)
-      run: brew install ninja
-      if: matrix.os == 'macos-latest'
-
-    - name: install ninja (win)
-      run: choco install ninja
-      if: matrix.os == 'windows-latest'
-
-    - name: mkdir
-      run: mkdir -p out
-
-    - name: cmake (linux)
-      run: cmake -S . -B out -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=out/install
-      if: matrix.os == 'ubuntu-latest'
-
-    - name: cmake (macos)
-      run: cmake -S . -B out -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=out/install '-DCMAKE_OSX_ARCHITECTURES=x86_64;arm64'
-      if: matrix.os == 'macos-latest'
-
-    - name: cmake (win)
-      # -G "Visual Studio 15 2017"
-      run: cmake -S . -B out -DCMAKE_INSTALL_PREFIX=out/install
-      if: matrix.os == 'windows-latest'
-
-    - name: build
-      run: cmake --build out --config Release -v
-
-    - name: install
-      run: cmake --install out --config Release
-
-    - name: strip
-      run: find out/install/ -type f -perm -u=x -exec strip -x {} +
-      if: matrix.os != 'windows-latest'
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: build-${{ matrix.os }}
-        path: out/install
-
-    - name: test binaryen-lit
-      run: python out/bin/binaryen-lit -vv test/lit/parse-error.wast
-
-    - name: test
-      run: python check.py --binaryen-bin=out/bin
-
-  build-clang:
-    name: clang (LTO)
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: install Python dev dependencies
-      run: pip3 install -r requirements-dev.txt
-    - name: cmake
-      run: |
-        mkdir -p out
-        cmake -S . -B out -G Ninja -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DBYN_ENABLE_LTO=ON
-    - name: build
-      run: cmake --build out -v
-    - name: test binaryen-lit
-      run: python out/bin/binaryen-lit -vv test/lit/parse-error.wast
-    - name: test
-      run: python check.py --binaryen-bin=out/bin
-
-  # TODO(sbc): Find a way to reduce the duplicate between these sanitizer jobs
-  build-asan:
-    name: asan
-    runs-on: ubuntu-latest
-    env:
-      ASAN_OPTIONS: "symbolize=1"
-      COMPILER_FLAGS: "-fsanitize=address"
-      CC: "clang-18"
-      CXX: "clang++-18"
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: install clang 18
-      run: |
-        wget https://apt.llvm.org/llvm.sh
-        chmod +x llvm.sh
-        sudo ./llvm.sh 18
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: install Python dev dependencies
-      run: pip3 install -r requirements-dev.txt
-    - name: cmake
-      run: |
-        mkdir -p out
-        cmake -S . -B out -G Ninja -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_C_COMPILER=clang-18 -DCMAKE_CXX_COMPILER=clang++-18 -DCMAKE_C_FLAGS="$COMPILER_FLAGS" -DCMAKE_CXX_FLAGS="$COMPILER_FLAGS"
-    - name: build
-      run: cmake --build out
-    - name: test
-      run: python check.py --binaryen-bin=out/bin
-
-  # Build with gcc 6.3 and run tests on Alpine Linux (inside chroot).
-  # Note: Alpine uses musl libc.
-  # Keep in sync with build_release.yml
-  build-alpine:
-    name: alpine
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: start docker
-      run: |
-        docker run -w /src -dit --name alpine -v $PWD:/src node:lts-alpine
-        echo 'docker exec alpine "$@";' > ./alpine.sh
-        chmod +x ./alpine.sh
-
-    - name: install packages
-      run: |
-        ./alpine.sh apk update
-        ./alpine.sh apk add build-base cmake git python3 py3-pip clang ninja
-
-    - name: install python dev dependencies
-      run: ./alpine.sh pip3 install --break-system-packages -r requirements-dev.txt
-
-    - name: cmake
-      run: |
-        ./alpine.sh cmake . -G Ninja -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_CXX_FLAGS="-static" -DCMAKE_C_FLAGS="-static" -DCMAKE_BUILD_TYPE=Release -DBUILD_STATIC_LIB=ON -DCMAKE_INSTALL_PREFIX=install
-
-    - name: build
-      run: |
-        ./alpine.sh ninja install
-
-    - name: test
-      run: ./alpine.sh python3 ./check.py
-
-  # Duplicates build-asan.  Please keep in sync
-  build-ubsan:
-    name: ubsan
-    runs-on: ubuntu-latest
-    env:
-      COMPILER_FLAGS: "-fsanitize=undefined -fno-sanitize-recover=all"
-      CC: "clang"
-      CXX: "clang++"
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: install Python dev dependencies
-      run: pip3 install -r requirements-dev.txt
-    - name: cmake
-      run: |
-        mkdir -p out
-        cmake -S . -B out -G Ninja -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_C_FLAGS="$COMPILER_FLAGS" -DCMAKE_CXX_FLAGS="$COMPILER_FLAGS -fsanitize-blacklist=$PWD/ubsan.blacklist"
-    - name: build
-      run: cmake --build out
-    - name: test
-      run: python check.py --binaryen-bin=out/bin
-
-  # Duplicates build-asan.  Please keep in sync
-  build-tsan:
-    name: tsan
-    runs-on: ubuntu-latest
-    env:
-      COMPILER_FLAGS: "-fsanitize=thread"
-      LINKER_FLAGS: "-fsanitize=thread"
-      CC: "clang-18"
-      CXX: "clang++-18"
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: install clang 18
-      run: |
-        wget https://apt.llvm.org/llvm.sh
-        chmod +x llvm.sh
-        sudo ./llvm.sh 18
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: install Python dev dependencies
-      run: pip3 install -r requirements-dev.txt
-    - name: cmake
-      run: |
-        mkdir -p out
-        cmake -S . -B out -G Ninja -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_C_COMPILER=clang-18 -DCMAKE_CXX_COMPILER=clang++-18 -DCMAKE_C_FLAGS="$COMPILER_FLAGS" -DCMAKE_CXX_FLAGS="$COMPILER_FLAGS" -DCMAKE_EXE_LINKER_FLAGS="$LINKER_FLAGS"
-    - name: build
-      run: cmake --build out
-    - name: test
-      run: python check.py --binaryen-bin=out/bin
-
-  # Build the .js outputs using emcc
-  build-emscripten:
-    name: emscripten
-    runs-on: ubuntu-latest
-    env:
-      # Set this environment variable to test a specific Emscripten branch.
-      # Format: https://github.com/<fork>/emscripten/tree/<refspec>
-      EMSCRIPTEN_REPO: ""
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: emsdk install
-      run: |
-        mkdir $HOME/emsdk
-        git clone --depth 1 https://github.com/emscripten-core/emsdk.git $HOME/emsdk
-        $HOME/emsdk/emsdk update-tags
-        $HOME/emsdk/emsdk install tot
-        $HOME/emsdk/emsdk activate tot
-    - name: override emscripten repository
-      if: ${{ env.EMSCRIPTEN_REPO != '' }}
-      run: |
-        $HOME/emsdk/emsdk install emscripten-main-64bit \
-          --override-repository emscripten-main-64bit@$EMSCRIPTEN_REPO
-        $HOME/emsdk/emsdk activate emscripten-main-64bit
-    - name: update path
-      run:  echo "PATH=$PATH:$HOME/emsdk" >> $GITHUB_ENV
-    - name: emcc-tests
-      run: |
-        source $HOME/emsdk/emsdk_env.sh
-        ./scripts/emcc-tests.sh
-
-  # Windows + gcc needs work before the tests will run, so just test the compile
-  build-mingw:
-    name: mingw
-    runs-on: windows-latest
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: cmake
-      run: |
-        mkdir -p out
-        cmake -S . -B out -G "MSYS Makefiles"
-    - name: build
-      run: cmake --build out
-
-  # Duplicates build-asan.  Please keep in sync
-  build-gcov:
-    name: coverage
-    runs-on: ubuntu-latest
-    env:
-      COMPILER_FLAGS: "-fprofile-arcs -ftest-coverage"
-      CC: "gcc"
-      CXX: "g++"
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: install Python dev dependencies
-      run: pip3 install -r requirements-dev.txt
-    - name: cmake
-      run: |
-        mkdir -p out
-        cmake -S . -B out -G Ninja -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_C_COMPILER="$CC" -DCMAKE_CXX_COMPILER="$CXX" -DCMAKE_C_FLAGS="$COMPILER_FLAGS" -DCMAKE_CXX_FLAGS="$COMPILER_FLAGS -DCMAKE_BUILD_TYPE=Debug"
-    - name: build
-      run: cmake --build out
-    - name: test
-      run: |
-        python check.py --binaryen-bin=out/bin lit
-        python check.py --binaryen-bin=out/bin gtest
-    - name: upload coverage
-      uses: codecov/codecov-action@v3
-      with:
-        gcov: true
-
-  # Duplicates build-asan.  Please keep in sync
-  build-cxx20:
-    name: c++20
-    # Make sure we can still build on older Ubuntu
-    runs-on: ubuntu-20.04
-    env:
-      CC: "gcc"
-      CXX: "g++"
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v4
-      with:
-        submodules: true
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: install Python dev dependencies
-      run: pip3 install -r requirements-dev.txt
-    - name: cmake
-      run: |
-        mkdir -p out
-        cmake -S . -B out -G Ninja -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_C_COMPILER="$CC" -DCMAKE_CXX_COMPILER="$CXX" -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_STANDARD=20
-    - name: build
-      run: cmake --build out
-    - name: test
-      run: |
-        python check.py --binaryen-bin=out/bin lit
-        python check.py --binaryen-bin=out/bin gtest
diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
deleted file mode 100644
index a5d1f459e56..00000000000
--- a/.github/workflows/create_release.yml
+++ /dev/null
@@ -1,236 +0,0 @@
-name: Create Release
-
-# Trigger whenever a tag is created/updated
-
-on:
-  push:
-    tags:
-      - "*"
-
-permissions:
-  contents: write
-
-jobs:
-  build:
-    name: build
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [macos-latest, windows-latest]
-    defaults:
-      run:
-        shell: bash
-    steps:
-    - uses: actions/checkout@v1
-      with:
-        submodules: true
-
-    - name: install ninja (macos)
-      run: brew install ninja
-      if: matrix.os == 'macos-latest'
-
-    - name: install ninja (win)
-      run: choco install ninja
-      if: matrix.os == 'windows-latest'
-
-    - name: mkdir
-      run: mkdir -p out
-
-    - name: cmake (macos)
-      run: |
-        cmake -S . -B out -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=out/install -DCMAKE_OSX_ARCHITECTURES=x86_64
-        cmake -S . -B out-arm64 -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=out-arm64/install -DCMAKE_OSX_ARCHITECTURES=arm64
-      if: matrix.os == 'macos-latest'
-
-    - name: cmake (win)
-      # -G "Visual Studio 15 2017"
-      run: cmake -S . -B out -DCMAKE_INSTALL_PREFIX=out/install
-      if: matrix.os == 'windows-latest'
-
-    - name: build
-      run: cmake --build out -v --config Release --target install
-
-    - name: build-arm64
-      run: cmake --build out-arm64 -v --config Release --target install
-      if: matrix.os == 'macos-latest'
-
-    - name: strip
-      run: find out*/install/ -type f -perm -u=x -exec strip -x {} +
-      if: matrix.os != 'windows-latest'
-
-    - name: archive
-      id: archive
-      run: |
-        OSNAME=$(echo ${{ matrix.os }} | sed 's/-latest//')
-        VERSION=$GITHUB_REF_NAME
-        PKGNAME="binaryen-$VERSION-x86_64-$OSNAME"
-        TARBALL=$PKGNAME.tar.gz
-        SHASUM=$PKGNAME.tar.gz.sha256
-        rm -rf binaryen-$VERSION
-        mv out/install binaryen-$VERSION
-        tar -czf $TARBALL binaryen-$VERSION
-        # on Windows, MSYS2 will strip the carriage return from CMake output
-        cmake -E sha256sum $TARBALL > $SHASUM
-        echo "::set-output name=tarball::$TARBALL"
-        echo "::set-output name=shasum::$SHASUM"
-
-    - name: archive-arm64
-      id: archive-arm64
-      run: |
-        OSNAME=$(echo ${{ matrix.os }} | sed 's/-latest//')
-        VERSION=$GITHUB_REF_NAME
-        PKGNAME="binaryen-$VERSION-arm64-$OSNAME"
-        TARBALL=$PKGNAME.tar.gz
-        SHASUM=$PKGNAME.tar.gz.sha256
-        rm -rf binaryen-$VERSION
-        mv out-arm64/install binaryen-$VERSION
-        tar -czf $TARBALL binaryen-$VERSION
-        # on Windows, MSYS2 will strip the carriage return from CMake output
-        cmake -E sha256sum $TARBALL > $SHASUM
-        echo "::set-output name=tarball::$TARBALL"
-        echo "::set-output name=shasum::$SHASUM"
-      if: matrix.os == 'macos-latest'
-
-    - name: upload tarball
-      uses: softprops/action-gh-release@v1
-      with:
-        draft: true
-        files: |
-          ${{ steps.archive.outputs.tarball }}
-          ${{ steps.archive.outputs.shasum }}
-          ${{ steps.archive-arm64.outputs.tarball }}
-          ${{ steps.archive-arm64.outputs.shasum }}
-
-  # Build with gcc 6.3 and run tests on Alpine Linux (inside chroot).
-  # Note: Alpine uses musl libc.
-  build-alpine:
-    name: alpine
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        docker_platform: [amd64, arm64]
-    steps:
-    - uses: actions/setup-python@v1
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v1
-      with:
-        submodules: true
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-      if: matrix.docker_platform != 'amd64'
-
-    - name: start docker
-      run: |
-        docker run -w /src -dit --platform=linux/${{ matrix.docker_platform }} --name alpine -v $PWD:/src node:lts-alpine
-        echo 'docker exec alpine "$@";' > ./alpine.sh
-        chmod +x ./alpine.sh
-
-
-    - name: install packages
-      run: |
-        ./alpine.sh apk update
-        ./alpine.sh apk add build-base cmake git python3 clang ninja py3-pip
-
-    - name: install python dev dependencies
-      run: ./alpine.sh pip3 install --break-system-packages -r requirements-dev.txt
-
-    - name: cmake
-      run: |
-        ./alpine.sh cmake . -G Ninja -DCMAKE_CXX_FLAGS="-static" -DCMAKE_C_FLAGS="-static" -DCMAKE_BUILD_TYPE=Release -DBUILD_STATIC_LIB=ON -DCMAKE_INSTALL_PREFIX=install
-
-    - name: build
-      run: |
-        ./alpine.sh ninja install
-
-    - name: test
-      run: ./alpine.sh python3 ./check.py
-
-    - name: archive
-      id: archive
-      run: |
-        VERSION=$GITHUB_REF_NAME
-        ARCH=$(./alpine.sh uname -m)
-        PKGNAME="binaryen-$VERSION-$ARCH-linux"
-        TARBALL=$PKGNAME.tar.gz
-        SHASUM=$PKGNAME.tar.gz.sha256
-        ./alpine.sh find install/ -type f -perm -u=x -exec strip {} +
-        mv install binaryen-$VERSION
-        tar -czf $TARBALL binaryen-$VERSION
-        cmake -E sha256sum $TARBALL > $SHASUM
-        echo "::set-output name=tarball::$TARBALL"
-        echo "::set-output name=shasum::$SHASUM"
-
-    - name: upload tarball
-      uses: softprops/action-gh-release@v1
-      with:
-        draft: true
-        files: |
-          ${{ steps.archive.outputs.tarball }}
-          ${{ steps.archive.outputs.shasum }}
-
-  # Build using Emscripten to JavaScript+WebAssembly.
-  build-node:
-    name: node
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    steps:
-    - uses: actions/setup-python@v1
-      with:
-        python-version: '3.x'
-    - uses: actions/checkout@v1
-      with:
-        submodules: true
-    - name: install ninja
-      run: sudo apt-get install ninja-build
-    - name: emsdk install
-      run: |
-        mkdir $HOME/emsdk
-        git clone --depth 1 https://github.com/emscripten-core/emsdk.git $HOME/emsdk
-        $HOME/emsdk/emsdk update-tags
-        $HOME/emsdk/emsdk install tot
-        $HOME/emsdk/emsdk activate tot
-    - name: update path
-      run:  echo "PATH=$PATH:$HOME/emsdk" >> $GITHUB_ENV
-
-    # Configure with wasm EH and pthreads for maximal performance.
-    - name: cmake
-      run: |
-        source $HOME/emsdk/emsdk_env.sh
-        emcmake cmake -S . -B out -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=out/install -DEMSCRIPTEN_ENABLE_WASM_EH=ON -DEMSCRIPTEN_ENABLE_PTHREADS=ON
-
-    # Build wasm-opt for now TODO add other tools as desired
-    - name: build
-      run: ninja -C out wasm-opt
-
-    # Minimal smoke test: roundtrip a file.
-    # TODO: Add more testing here, but the full test suite is overkill as there
-    #       is a 0.5 second cost to each run of wasm-opt.js
-    - name: test
-      run: |
-        node out/bin/wasm-opt.js test/hello_world.wat --print > out/t.wat
-        diff test/hello_world.wat out/t.wat
-
-    - name: archive
-      id: archive
-      run: |
-        VERSION=$GITHUB_REF_NAME
-        PKGNAME="binaryen-$VERSION-node"
-        TARBALL=$PKGNAME.tar.gz
-        SHASUM=$PKGNAME.tar.gz.sha256
-        mkdir binaryen-$VERSION
-        cp out/bin/wasm-opt* binaryen-$VERSION/
-        tar -czf $TARBALL binaryen-$VERSION
-        cmake -E sha256sum $TARBALL > $SHASUM
-        echo "::set-output name=tarball::$TARBALL"
-        echo "::set-output name=shasum::$SHASUM"
-
-    - name: upload tarball
-      uses: softprops/action-gh-release@v1
-      with:
-        draft: true
-        files: |
-          ${{ steps.archive.outputs.tarball }}
-          ${{ steps.archive.outputs.shasum }}
diff --git a/.github/workflows/release-static.yml b/.github/workflows/release-static.yml
new file mode 100644
index 00000000000..3c9a9cd18f5
--- /dev/null
+++ b/.github/workflows/release-static.yml
@@ -0,0 +1,49 @@
+name: release-static
+
+on:
+  push:
+    tags:
+      - "*"
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  release-x86_64-linux-static:
+    name: release-x86_64-linux-static
+    runs-on:
+      - X64
+      - Linux
+      - podman
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - x86_64
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: build-linux
+        uses: ./.github/actions/linux
+
+  release-aarch64-linux-static:
+    name: release-aarch64-linux-static
+    runs-on:
+      - ARM64
+      - Linux
+      - podman
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - aarch64
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: build-linux
+        uses: ./.github/actions/linux
diff --git a/CMakeLists.txt b/CMakeLists.txt
index ed6af9394dd..49c6ee1321b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -283,7 +283,6 @@ else()
   add_compile_flag("-Wextra")
   add_compile_flag("-Wno-unused-parameter")
   add_compile_flag("-Wno-dangling-pointer") # false positive in gcc
-  add_compile_flag("-fno-omit-frame-pointer")
   add_compile_flag("-fno-rtti")
   # TODO(https://github.com/WebAssembly/binaryen/pull/2314): Remove these two
   # flags once we resolve the issue.
@@ -310,7 +309,7 @@ else()
     else()
       add_link_flag("-Wl,--stack,8388608")
     endif()
-  elseif(NOT EMSCRIPTEN)
+  elseif((NOT EMSCRIPTEN) AND (NOT BUILD_STATIC_LIB))
     add_compile_flag("-fPIC")
   endif()
   add_debug_compile_flag("-g3")
diff --git a/build-static.sh b/build-static.sh
new file mode 100755
index 00000000000..ea0561fdf16
--- /dev/null
+++ b/build-static.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+
+set -eu
+
+apk upgrade
+apk add \
+  alpine-sdk \
+  cmake \
+  coreutils \
+  git \
+  lld \
+  llvm \
+  ninja-is-really-ninja \
+  nodejs \
+  py3-pip \
+  zstd
+
+VENV="$(mktemp -d)"
+
+python3 -m venv "$VENV"
+
+. "$VENV/bin/activate"
+
+pip3 install -r requirements-dev.txt
+
+cmake \
+  -Bbuild \
+  -G Ninja \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DCMAKE_INSTALL_PREFIX="/tmp/binaryen-$GITHUB_REF_NAME" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld -s -static" \
+  -DBUILD_STATIC_LIB=ON \
+  -DENABLE_WERROR=OFF \
+  -DINSTALL_LIBS=OFF
+
+cmake --build build --target install -- -v
+
+COMPILER_FLAGS="-fuse-ld=lld -s -static" ./check.py --binaryen-bin build/bin --binaryen-lib build/lib
+
+tar \
+  --sort=name \
+  --owner=0 \
+  --group=0 \
+  --numeric-owner \
+  --use-compress-program="gzip -9" \
+  -cf "binaryen-$GITHUB_REF_NAME-$(uname -m)-linux-static.tar.gz" \
+  -C /tmp \
+  "binaryen-$GITHUB_REF_NAME"
diff --git a/check.py b/check.py
index 66493dd3c6f..8daf07bbd3a 100755
--- a/check.py
+++ b/check.py
@@ -372,7 +372,7 @@ def run():
 # Run all the tests
 def main():
     all_suites = TEST_SUITES.keys()
-    skip_by_default = ['binaryenjs', 'binaryenjs_wasm']
+    skip_by_default = ['binaryenjs', 'binaryenjs_wasm', 'wasm2js']
 
     if shared.options.list_suites:
         for suite in all_suites: