From c402031c45e823fcf5870cc054ddfe33460fb469 Mon Sep 17 00:00:00 2001 From: freelw Date: Thu, 3 Sep 2026 15:45:01 +0800 Subject: [PATCH] build: publish static Linux x64 webfetch CLI --- .github/workflows/ci.yml | 23 +++++++++++++++++++++-- .github/workflows/release.yml | 31 ++++++++++++++++++++++++++++++- README.md | 8 ++++---- 3 files changed, 55 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1741d7c..116c4b0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: - run: cargo clippy --all-targets --locked -- -D warnings - name: Verify release target contract run: | - ! grep -q 'x86_64-unknown-linux' .github/workflows/release.yml + grep -q 'x86_64-unknown-linux-musl' .github/workflows/release.yml ! grep -q 'x86_64-apple-darwin' .github/workflows/release.yml grep -q 'aarch64-apple-darwin' .github/workflows/release.yml grep -q 'x86_64-pc-windows-msvc' .github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: grep -q './scripts/sign_and_notarize_macos.sh' .github/workflows/release.yml grep -q 'environment: cos-release' .github/workflows/release.yml grep -q './scripts/upload-release-to-cos.sh cos-upload webfetch-cli' .github/workflows/release.yml - grep -q 'needs: \[build-macos, build-windows\]' .github/workflows/release.yml + grep -q 'needs: \[build-linux, build-macos, build-windows\]' .github/workflows/release.yml ! grep -q 'skills/lexmount-webfetch/bin/' .github/workflows/release.yml - run: bash -n scripts/sign_and_notarize_macos.sh scripts/upload-release-to-cos.sh - run: sh -n scripts/package-skill.sh skills/lexmount-webfetch/scripts/bootstrap.sh skills/lexmount-webfetch/scripts/doctor.sh @@ -93,6 +93,25 @@ jobs: & .\skills\lexmount-webfetch\scripts\bootstrap.ps1 & (Join-Path $env:LEXMOUNT_WEBFETCH_CLI_INSTALL_DIR "webfetch-cli.exe") version + linux-release: + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@v5 + - uses: dtolnay/rust-toolchain@stable + with: + targets: x86_64-unknown-linux-musl + - run: sudo apt-get update && sudo apt-get install --yes musl-tools + - name: Build static Linux binary + run: cargo build --release --locked --target x86_64-unknown-linux-musl + - name: Verify standalone Linux executable + run: | + binary="target/x86_64-unknown-linux-musl/release/webfetch-cli" + if readelf --program-headers --wide "$binary" | grep -F 'Requesting program interpreter'; then + echo 'Linux release binary is dynamically linked' >&2 + exit 1 + fi + "$binary" version + windows-release: runs-on: windows-latest steps: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c250171..1b65902 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,6 +37,34 @@ jobs: name: release-aarch64-apple-darwin path: webfetch-cli-v*-aarch64-apple-darwin* + build-linux: + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@v5 + - uses: dtolnay/rust-toolchain@stable + with: + targets: x86_64-unknown-linux-musl + - run: sudo apt-get update && sudo apt-get install --yes musl-tools + - run: cargo test --locked + - name: Build static Linux binary + run: cargo build --release --locked --target x86_64-unknown-linux-musl + - name: Package + run: | + version="${GITHUB_REF_NAME#v}" + asset="webfetch-cli-v${version}-x86_64-unknown-linux-musl" + cp target/x86_64-unknown-linux-musl/release/webfetch-cli "$asset" + chmod 755 "$asset" + if readelf --program-headers --wide "$asset" | grep -F 'Requesting program interpreter'; then + echo 'Linux release binary is dynamically linked' >&2 + exit 1 + fi + "./$asset" version + sha256sum "$asset" > "$asset.sha256" + - uses: actions/upload-artifact@v4 + with: + name: release-x86_64-unknown-linux-musl + path: webfetch-cli-v*-x86_64-unknown-linux-musl* + build-windows: runs-on: windows-latest steps: @@ -59,7 +87,7 @@ jobs: path: webfetch-cli-v*-x86_64-pc-windows-msvc* publish: - needs: [build-macos, build-windows] + needs: [build-linux, build-macos, build-windows] runs-on: ubuntu-latest timeout-minutes: 30 environment: cos-release @@ -89,6 +117,7 @@ jobs: mkdir cos-upload cp \ "webfetch-cli-v${version}-aarch64-apple-darwin" \ + "webfetch-cli-v${version}-x86_64-unknown-linux-musl" \ "webfetch-cli-v${version}-x86_64-pc-windows-msvc.exe" \ cos-upload/ (cd cos-upload && sha256sum webfetch-cli-v* | sort -k2 > SHA256SUMS) diff --git a/README.md b/README.md index 797b70e..5c71275 100644 --- a/README.md +++ b/README.md @@ -49,12 +49,12 @@ The ZIP contains exactly eight files: `SKILL.md`, three references, and the bootstrap/doctor scripts for both platforms. Native executables are published separately. On first use, the matching script downloads the pinned release from Tencent Cloud COS and verifies its SHA-256 digest. Tagged releases publish the -Skill ZIP, `SHA256SUMS`, and exactly two standalone binaries: signed and -notarized macOS ARM64 plus Windows x64. Linux and macOS Intel are not release -platforms. +Skill ZIP, `SHA256SUMS`, and exactly three standalone binaries: signed and +notarized macOS ARM64, static Linux x64, and Windows x64. macOS Intel is not a +release platform. The macOS signing job reads its certificate and notarization credentials from -the `macos-release` GitHub environment. The publish job uploads both platform +the `macos-release` GitHub environment. The publish job uploads all three platform binaries to Tencent Cloud COS through the `cos-release` environment, using `TENCENT_CLOUD_SECRET_ID` and `TENCENT_CLOUD_SECRET_KEY` secrets plus `COS_BUCKET`, `COS_REGION`, `COS_PUBLIC_BASE_URL`, and `COS_OBJECT_PREFIX`