ci(publish): attach relayfile-mount binaries to releases

[khaliqgant]

Problem

The Publish Package workflow (publish.yml) only attaches relayfile-cli-* to the GitHub release. relayfile-mount has been silently missing from release assets since v0.1.13 — the last tag that shipped it is v0.1.6.

Release	relayfile-cli-*	relayfile-mount-*
v0.1.6	✓	✓
v0.1.13	✓	✗
v0.2.0	✓	✗
v0.2.1	✓	✗

Downstream impact: AgentWorkforce/cloud's .github/workflows/rebuild-snapshot.yml:43 still `curl`s `relayfile-mount-linux-amd64` from `v0.1.6` because that's the last tag that has it. The fix in relayfile#50 (preserve local files on write-denied) can't propagate into cloud snapshots until a released tag contains the updated binary.

Change

New build-mount-binaries job in publish.yml with a 4-platform matrix:

Platform	Runner	Toolchain
linux/amd64	ubuntu-latest	`go build -ldflags="-s -w -X main.version=v${VERSION}"`
linux/arm64	ubuntu-latest	same (cross-compile)
darwin/amd64	macos-latest	same
darwin/arm64	macos-latest	same

Each matrix entry:

• Checks out the tagged tree.
• Sets up Go via go.mod version.
• Cross-compiles ./cmd/relayfile-mount with CGO_ENABLED=0 and stamps the release version into main.version.
• Runs a sanity-size check (fails below 1MB).
• Smoke-tests `--help` on the matching native runner (linux-amd64 + darwin-arm64).
• Uploads the binary as an artifact.

create-release depends on build-mount-binaries, downloads the artifacts via a relayfile-mount-* pattern with merge-multiple: true, verifies all four platforms are present and executable, and passes both globs to softprops/action-gh-release:

files: |
  packages/cli/bin/relayfile-cli-*
  mount-binaries/relayfile-mount-*

The release body now documents the mount binaries and shows a pin-by-tag `curl` snippet. The `summary` job picks up the new stage.

Verification

• python3 -c 'import yaml; yaml.safe_load(open(\".github/workflows/publish.yml\"))' → OK.
• Local cross-compile proof:
  • CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./cmd/relayfile-mount → 7.25 MB binary.
  • CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build ./cmd/relayfile-mount → 6.79 MB binary, `--help` output matches the existing CLI.

Follow-up

After this lands and the next tagged release ships, cloud's rebuild-snapshot.yml pins will be bumped from v0.1.6 to the new tag in a separate PR. Tracked in my queue.

🤖 Generated with Claude Code

---

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a384d0576

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Fail smoke-test when relayfile-mount exits nonzero

The smoke-test command pipes ./relayfile-mount-... --help into head -20 without enabling pipefail, so the step can report success even when the binary fails to execute (for example, wrong architecture or a broken build). In GitHub Actions' default bash mode, the pipeline exit status comes from head, which masks failures from the binary and defeats the purpose of this validation gate.

Useful? React with 👍 / 👎.

[devin-ai-integration]

Devin Review found 1 potential issue.

View 4 additional findings in Devin Review.

[devin-ai-integration]

🟡 -X main.version linker flag targets a non-existent variable, so version is never embedded

The build step uses -ldflags="-s -w -X main.version=v${VERSION}" to stamp the version into the binary, but there is no var version string (or any variable named version) declared anywhere in the cmd/relayfile-mount package (cmd/relayfile-mount/main.go:1-389, cmd/relayfile-mount/fuse_mount.go:1-57). The Go linker silently ignores -X flags that reference non-existent variables, so the build succeeds but the version string is never embedded. The existing Makefile:9 also only uses -s -w without -X, confirming this variable was never declared. A var version string declaration needs to be added to cmd/relayfile-mount/main.go for the version stamping to take effect.

Prompt for agents

The go build command at .github/workflows/publish.yml:234-235 uses -ldflags with -X main.version=v${VERSION} to stamp the version into the relayfile-mount binary. However, no var version string exists in the cmd/relayfile-mount package (main.go, fuse_mount.go). The Go linker silently ignores -X flags targeting non-existent variables, so the version is never embedded.

To fix: add var version string at package level in cmd/relayfile-mount/main.go (e.g. after the const block around line 28). Optionally, also wire it into the flag.Usage output or add a --version flag so users can query the embedded version.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[khaliqgant]

Expanded scope per discussion: also deletes the two now-dead release workflows.

release.yml (Makefile-driven, tag-push) — zero runs in history. Every v* tag since v0.1.6 has been created by publish.yml via GITHUB_TOKEN, which by design cannot trigger downstream workflows.

release-binary.yml (builds only ./cmd/relayfile on every main push, cuts build-<sha> prereleases) — last successful prerelease was build-e4eab60 in February 2026. Everything since has cancelled itself via the concurrency group. Nothing downstream pins build-<sha>.

publish.yml is now the single source of truth for any release artifact.