build: publish static Linux x64 webfetch CLI

.github/workflows/ci.yml

@@ -18,15 +18,15 @@ jobs:
       - run: cargo clippy --all-targets --locked -- -D warnings
       - name: Verify release target contract
         run: |
-          ! grep -q 'x86_64-unknown-linux' .github/workflows/release.yml
+          grep -q 'x86_64-unknown-linux-musl' .github/workflows/release.yml
           ! grep -q 'x86_64-apple-darwin' .github/workflows/release.yml
           grep -q 'aarch64-apple-darwin' .github/workflows/release.yml
           grep -q 'x86_64-pc-windows-msvc' .github/workflows/release.yml
           grep -q 'environment: macos-release' .github/workflows/release.yml
           grep -q './scripts/sign_and_notarize_macos.sh' .github/workflows/release.yml
           grep -q 'environment: cos-release' .github/workflows/release.yml
           grep -q './scripts/upload-release-to-cos.sh cos-upload webfetch-cli' .github/workflows/release.yml
-          grep -q 'needs: \[build-macos, build-windows\]' .github/workflows/release.yml
+          grep -q 'needs: \[build-linux, build-macos, build-windows\]' .github/workflows/release.yml
           ! grep -q 'skills/lexmount-webfetch/bin/' .github/workflows/release.yml
       - run: bash -n scripts/sign_and_notarize_macos.sh scripts/upload-release-to-cos.sh
       - run: sh -n scripts/package-skill.sh skills/lexmount-webfetch/scripts/bootstrap.sh skills/lexmount-webfetch/scripts/doctor.sh
@@ -93,6 +93,25 @@ jobs:
           & .\skills\lexmount-webfetch\scripts\bootstrap.ps1
           & (Join-Path $env:LEXMOUNT_WEBFETCH_CLI_INSTALL_DIR "webfetch-cli.exe") version
 
+  linux-release:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-musl
+      - run: sudo apt-get update && sudo apt-get install --yes musl-tools
+      - name: Build static Linux binary
+        run: cargo build --release --locked --target x86_64-unknown-linux-musl
+      - name: Verify standalone Linux executable
+        run: |
+          binary="target/x86_64-unknown-linux-musl/release/webfetch-cli"
+          if readelf --program-headers --wide "$binary" | grep -F 'Requesting program interpreter'; then
+            echo 'Linux release binary is dynamically linked' >&2
+            exit 1
+          fi
+          "$binary" version
+
   windows-release:
     runs-on: windows-latest
     steps:

.github/workflows/release.yml

@@ -37,6 +37,34 @@ jobs:
           name: release-aarch64-apple-darwin
           path: webfetch-cli-v*-aarch64-apple-darwin*
 
+  build-linux:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-musl
+      - run: sudo apt-get update && sudo apt-get install --yes musl-tools
+      - run: cargo test --locked
+      - name: Build static Linux binary
+        run: cargo build --release --locked --target x86_64-unknown-linux-musl
+      - name: Package
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          asset="webfetch-cli-v${version}-x86_64-unknown-linux-musl"
+          cp target/x86_64-unknown-linux-musl/release/webfetch-cli "$asset"
+          chmod 755 "$asset"
+          if readelf --program-headers --wide "$asset" | grep -F 'Requesting program interpreter'; then
+            echo 'Linux release binary is dynamically linked' >&2
+            exit 1
+          fi
+          "./$asset" version
+          sha256sum "$asset" > "$asset.sha256"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-x86_64-unknown-linux-musl
+          path: webfetch-cli-v*-x86_64-unknown-linux-musl*
+
   build-windows:
     runs-on: windows-latest
     steps:
@@ -59,7 +87,7 @@ jobs:
           path: webfetch-cli-v*-x86_64-pc-windows-msvc*
 
   publish:
-    needs: [build-macos, build-windows]
+    needs: [build-linux, build-macos, build-windows]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: cos-release
@@ -89,6 +117,7 @@ jobs:
           mkdir cos-upload
           cp \
             "webfetch-cli-v${version}-aarch64-apple-darwin" \
+            "webfetch-cli-v${version}-x86_64-unknown-linux-musl" \
             "webfetch-cli-v${version}-x86_64-pc-windows-msvc.exe" \
             cos-upload/
           (cd cos-upload && sha256sum webfetch-cli-v* | sort -k2 > SHA256SUMS)

README.md

@@ -49,12 +49,12 @@ The ZIP contains exactly eight files: `SKILL.md`, three references, and the
 bootstrap/doctor scripts for both platforms. Native executables are published
 separately. On first use, the matching script downloads the pinned release from
 Tencent Cloud COS and verifies its SHA-256 digest. Tagged releases publish the
-Skill ZIP, `SHA256SUMS`, and exactly two standalone binaries: signed and
-notarized macOS ARM64 plus Windows x64. Linux and macOS Intel are not release
-platforms.
+Skill ZIP, `SHA256SUMS`, and exactly three standalone binaries: signed and
+notarized macOS ARM64, static Linux x64, and Windows x64. macOS Intel is not a
+release platform.
 
 The macOS signing job reads its certificate and notarization credentials from
-the `macos-release` GitHub environment. The publish job uploads both platform
+the `macos-release` GitHub environment. The publish job uploads all three platform
 binaries to Tencent Cloud COS through the `cos-release` environment, using
 `TENCENT_CLOUD_SECRET_ID` and `TENCENT_CLOUD_SECRET_KEY` secrets plus
 `COS_BUCKET`, `COS_REGION`, `COS_PUBLIC_BASE_URL`, and `COS_OBJECT_PREFIX`