From 1e8b2209074debf73457edb0445355661867ce97 Mon Sep 17 00:00:00 2001
From: Matthew Gribben <matt.gribben@gmail.com>
Date: Thu, 6 Aug 2026 18:43:24 +1000
Subject: [PATCH] Exclude AOT debug sidecars from release packages

StripSymbols leaves macOS .dSYM, Linux .dbg, and Windows .pdb next to the
native binary. Copying the full publish tree shipped that bloat into GitHub
archives, npm platform packages, and PyPI wheels. Drop the sidecars when
packaging, with npm/wheel extract filters as defense in depth.
---
 .github/workflows/release.yml | 22 ++++++++++++++++++++++
 python/scripts/build_wheel.py |  7 ++++++-
 src/Hypa.Cli/Hypa.Cli.csproj  |  2 ++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4f0284..f9d68ae 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -171,6 +171,23 @@ jobs:
 
           New-Item -ItemType Directory -Force -Path $packageRoot, $distDir | Out-Null
           Copy-Item (Join-Path $publishDir "*") -Destination $packageRoot -Recurse
+
+          # StripSymbols=true moves AOT debug info out of the binary into
+          # platform sidecars (macOS .dSYM, Linux .dbg, Windows .pdb). Those are
+          # not needed at runtime and bloat GitHub releases, npm platform
+          # packages, and PyPI wheels — remove them before archiving.
+          Get-ChildItem -Path $packageRoot -Directory -Filter '*.dSYM' -Recurse -Force -ErrorAction SilentlyContinue |
+            ForEach-Object {
+              Write-Host "Excluding debug artifact: $($_.FullName)"
+              Remove-Item -LiteralPath $_.FullName -Recurse -Force
+            }
+          Get-ChildItem -Path $packageRoot -File -Recurse -Force -ErrorAction SilentlyContinue |
+            Where-Object { $_.Extension -in '.pdb', '.dbg' } |
+            ForEach-Object {
+              Write-Host "Excluding debug artifact: $($_.FullName)"
+              Remove-Item -LiteralPath $_.FullName -Force
+            }
+
           if ($archive -eq "tar.gz") {
             chmod +x (Join-Path $packageRoot $executable)
             tar -czf (Join-Path $distDir "hypa-$rid.tar.gz") -C "artifacts/package" "hypa-$rid"
@@ -329,6 +346,11 @@ jobs:
               unzip -j "dist-artifacts/hypa-${RID}.zip" "hypa-${RID}/*" -d "${STAGE}/bin"
             fi
 
+            # Defense in depth: drop AOT debug sidecars if an older archive still
+            # contains them (macOS .dSYM bundles, Windows .pdb, Linux .dbg).
+            find "${STAGE}/bin" -depth -name '*.dSYM' -type d -exec rm -rf {} +
+            find "${STAGE}/bin" \( -name '*.pdb' -o -name '*.dbg' \) -type f -delete
+
             jq \
               --arg name "@hypabolic/hypa-${NPM}" \
               --arg version "${VERSION}" \
diff --git a/python/scripts/build_wheel.py b/python/scripts/build_wheel.py
index bc096ad..4d90d7f 100644
--- a/python/scripts/build_wheel.py
+++ b/python/scripts/build_wheel.py
@@ -70,7 +70,12 @@ def main():
                 parts = member.name.split("/", 1)
                 if len(parts) < 2 or not parts[1]:
                     continue
-                member.name = parts[1]
+                # Skip AOT debug sidecars (macOS .dSYM, Linux .dbg, Windows .pdb)
+                # so wheels stay runtime-only even if an archive still has them.
+                rel = parts[1]
+                if ".dSYM/" in rel or rel.endswith(".dSYM") or rel.endswith((".pdb", ".dbg")):
+                    continue
+                member.name = rel
                 tf.extract(member, bin_dir)
 
         # 4. Build a generic wheel
diff --git a/src/Hypa.Cli/Hypa.Cli.csproj b/src/Hypa.Cli/Hypa.Cli.csproj
index 1e585dc..1051a00 100644
--- a/src/Hypa.Cli/Hypa.Cli.csproj
+++ b/src/Hypa.Cli/Hypa.Cli.csproj
@@ -8,6 +8,8 @@
     <Nullable>enable</Nullable>
     <PublishAot>true</PublishAot>
     <PublishSingleFile>true</PublishSingleFile>
+    <!-- Keep the native binary small; release packaging must not ship the
+         resulting .dSYM / .dbg / .pdb sidecars (see .github/workflows/release.yml). -->
     <StripSymbols>true</StripSymbols>
     <InvariantGlobalization>true</InvariantGlobalization>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>