feat(release): publish Linux CLI and relay binaries

.github/workflows/cli-package.yml

@@ -80,6 +80,11 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     needs: prepare
 
+    # Linux x86_64/aarch64 are intentionally absent. They are built and published
+    # by .github/workflows/linux-binaries.yml, which is the only producer that
+    # also covers nightly and which must hold the CLI and Relay archives together
+    # to emit linux-binaries.json. Adding them back here would upload identical
+    # asset names from two workflows racing on the same `release: published`.
     strategy:
       fail-fast: false
       matrix:
@@ -90,12 +95,6 @@ jobs:
           - os: macos-15-intel
             name: macos-x64
             target: x86_64-apple-darwin
-          - os: ubuntu-latest
-            name: linux-x64
-            target: x86_64-unknown-linux-gnu
-          - os: ubuntu-24.04-arm
-            name: linux-arm64
-            target: aarch64-unknown-linux-gnu
           - os: windows-latest
             name: windows-x64
             target: x86_64-pc-windows-msvc
@@ -106,20 +105,6 @@ jobs:
         with:
           ref: ${{ needs.prepare.outputs.checkout_ref }}
 
-      - name: Install Linux system dependencies
-        if: runner.os == 'Linux'
-        shell: bash
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            pkg-config \
-            build-essential \
-            libssl-dev \
-            libxcb1-dev \
-            libxcb-render0-dev \
-            libxcb-shape0-dev \
-            libxcb-xfixes0-dev
-
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -214,11 +199,16 @@ jobs:
           echo "CLI release assets:"
           find cli-release-assets -type f | sort
 
-      - name: Generate combined SHA256SUMS
+      - name: Generate SHA256SUMS for macOS and Windows archives
         working-directory: cli-release-assets
         run: |
           set -euo pipefail
-          # Sort for reproducibility; include Unix tarballs and the Windows zip.
+          # Scope note: Linux archives are published by linux-binaries.yml in a
+          # different workflow run that finishes after this one, so they cannot
+          # be folded in here deterministically. Every archive on the release —
+          # Linux included — still ships its own `<archive>.sha256` sidecar, which
+          # is the complete and uniform verification surface. Keep this file's
+          # contents deterministic rather than dependent on cross-workflow timing.
           mapfile -t archives < <(
             find . -maxdepth 1 -type f \
               \( -name 'bitfun-cli-*.tar.gz' -o -name 'bitfun-cli-*.zip' \) \

.github/workflows/desktop-package.yml

@@ -239,10 +239,19 @@ jobs:
             src/apps/desktop/target/release/bundle
             BitFun-Installer/src-tauri/target/release/bitfun-installer.exe
 
+  linux-binaries:
+    name: Linux CLI and Relay Server
+    needs: prepare
+    uses: ./.github/workflows/linux-binaries.yml
+    with:
+      checkout_ref: ${{ needs.prepare.outputs.checkout_ref }}
+      version: ${{ needs.prepare.outputs.version }}
+      artifact_prefix: ${{ needs.prepare.outputs.release_tag }}
+
   # ── Upload assets to GitHub Release ────────────────────────────────
   upload-release-assets:
     name: Upload Release Assets
-    needs: [prepare, package]
+    needs: [prepare, package, linux-binaries]
     if: needs.prepare.outputs.upload_to_release == 'true'
     runs-on: ubuntu-latest
     env:
@@ -259,10 +268,19 @@ jobs:
           path: release-assets
           merge-multiple: true
 
+      - name: Download Linux binary artifacts
+        uses: actions/download-artifact@v7
+        with:
+          pattern: bitfun-linux-${{ needs.prepare.outputs.release_tag }}-*
+          path: linux-release-assets
+          merge-multiple: true
+
       - name: List release assets
         run: |
           echo "Release assets:"
           find release-assets -type f | sort
+          echo "Linux CLI and Relay Server assets:"
+          find linux-release-assets -type f | sort
 
       - name: Collect updater assets
         run: |
@@ -289,6 +307,15 @@ jobs:
             --version "${{ needs.prepare.outputs.version }}" \
             --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
 
+      - name: Generate Linux binaries manifest
+        run: |
+          node scripts/generate-linux-binaries-manifest.mjs \
+            --assets-dir linux-release-assets \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --tag "${{ needs.prepare.outputs.release_tag }}" \
+            --repo "GCWing/BitFun" \
+            --out linux-release-assets/linux-binaries.json
+
       - name: Upload to release
         uses: softprops/action-gh-release@v3
         with:
@@ -301,6 +328,11 @@ jobs:
             release-assets/**/*.dmg
             release-assets/**/*.rpm
             release-assets/**/*bitfun-installer.exe
+            linux-release-assets/bitfun-cli-*.tar.gz
+            linux-release-assets/bitfun-cli-*.tar.gz.sha256
+            linux-release-assets/bitfun-relay-server-*.tar.gz
+            linux-release-assets/bitfun-relay-server-*.tar.gz.sha256
+            linux-release-assets/linux-binaries.json
           fail_on_unmatched_files: true
 
       - name: Verify published updater manifest
@@ -313,3 +345,10 @@ jobs:
             --version "${{ needs.prepare.outputs.version }}" \
             --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" \
             --check-urls true
+
+      - name: Verify published Linux binaries manifest
+        run: |
+          curl -fsSL --retry 5 --retry-delay 3 \
+            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
+            -o linux-binaries.published.json
+          test "$(jq -r '.version' linux-binaries.published.json)" = "${{ needs.prepare.outputs.version }}"

.github/workflows/linux-binaries.yml

@@ -0,0 +1,131 @@
+name: Linux Binary Build
+
+on:
+  workflow_call:
+    inputs:
+      checkout_ref:
+        description: "Tag or commit SHA to build."
+        required: true
+        type: string
+      version:
+        description: "Release version used by binaries and archive metadata."
+        required: true
+        type: string
+      artifact_prefix:
+        description: "Stable prefix that isolates artifacts in the caller run."
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Linux Binaries (${{ matrix.platform.name }})
+    runs-on: ${{ matrix.platform.os }}
+    timeout-minutes: 90
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - os: ubuntu-22.04
+            name: linux-x64
+            target: x86_64-unknown-linux-gnu
+          - os: ubuntu-24.04-arm
+            name: linux-arm64
+            target: aarch64-unknown-linux-gnu
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.checkout_ref }}
+
+      - name: Install Linux system dependencies
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential \
+            clang \
+            cmake \
+            curl \
+            libssl-dev \
+            libxcb1-dev \
+            libxcb-render0-dev \
+            libxcb-shape0-dev \
+            libxcb-xfixes0-dev \
+            pkg-config \
+            python3
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.platform.target }}
+
+      - name: Cache Rust build
+        uses: swatinem/rust-cache@v2
+        with:
+          shared-key: "linux-binaries-v1-${{ matrix.platform.name }}"
+          cache-bin: false
+
+      - name: Patch build version
+        shell: bash
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          # Strip SemVer build metadata (`+<sha>`): GitHub rewrites non-alphanumeric
+          # characters in uploaded release asset names, so a `+` in a filename would
+          # make every URL in linux-binaries.json a 404. Desktop packaging strips it
+          # the same way, which also keeps the two asset sets on one version string.
+          ASSET_VERSION="${RELEASE_VERSION%%+*}"
+          echo "ASSET_VERSION=${ASSET_VERSION}" >>"$GITHUB_ENV"
+          sed -i \
+            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
+            Cargo.toml
+          sed -i \
+            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
+            src/apps/relay-server/Cargo.toml
+
+      - name: Build CLI and Relay Server
+        shell: bash
+        run: |
+          cargo build --release \
+            --target ${{ matrix.platform.target }} \
+            -p bitfun-cli \
+            -p bitfun-relay-server \
+            --bins
+
+      - name: Test CLI installer
+        shell: bash
+        env:
+          CARGO_BUILD_TARGET: ${{ matrix.platform.target }}
+        run: bash scripts/cli/test-install-unix.sh "${{ matrix.platform.target }}"
+
+      - name: Package CLI
+        id: cli-stage
+        shell: bash
+        env:
+          TARGET: ${{ matrix.platform.target }}
+        run: bash scripts/cli/package-unix.sh "$ASSET_VERSION" "$TARGET"
+
+      - name: Package Relay Server
+        id: relay-stage
+        shell: bash
+        env:
+          TARGET: ${{ matrix.platform.target }}
+        run: bash scripts/relay/package-unix.sh "$ASSET_VERSION" "$TARGET"
+
+      - name: Upload Linux binary artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: bitfun-linux-${{ inputs.artifact_prefix }}-${{ matrix.platform.name }}
+          if-no-files-found: error
+          retention-days: 7
+          path: |
+            ${{ steps.cli-stage.outputs.archive }}
+            ${{ steps.cli-stage.outputs.checksum }}
+            ${{ steps.relay-stage.outputs.archive }}
+            ${{ steps.relay-stage.outputs.checksum }}

.github/workflows/nightly.yml

@@ -212,10 +212,20 @@ jobs:
             src/apps/desktop/target/release/bundle
             BitFun-Installer/src-tauri/target/release/bitfun-installer.exe
 
+  linux-binaries:
+    name: Linux CLI and Relay Server
+    needs: check-changes
+    if: needs.check-changes.outputs.should_build == 'true'
+    uses: ./.github/workflows/linux-binaries.yml
+    with:
+      checkout_ref: ${{ github.sha }}
+      version: ${{ needs.check-changes.outputs.nightly_version }}
+      artifact_prefix: nightly
+
   # ── Publish nightly pre-release ────────────────────────────────────
   publish-nightly:
     name: Publish Nightly
-    needs: [check-changes, package]
+    needs: [check-changes, package, linux-binaries]
     if: needs.check-changes.outputs.should_build == 'true'
     runs-on: ubuntu-latest
 
@@ -229,17 +239,39 @@ jobs:
           path: release-assets
           merge-multiple: true
 
+      - name: Download Linux binary artifacts
+        uses: actions/download-artifact@v7
+        with:
+          pattern: bitfun-linux-nightly-*
+          path: linux-release-assets
+          merge-multiple: true
+
       - name: List release assets
         run: |
           echo "Nightly assets:"
           find release-assets -type f | sort
+          echo "Nightly Linux CLI and Relay Server assets:"
+          find linux-release-assets -type f | sort
 
       - name: Delete previous nightly release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release delete "${{ env.NIGHTLY_TAG }}" --yes --cleanup-tag 2>/dev/null || true
 
+      - name: Generate Linux binaries manifest
+        env:
+          NIGHTLY_VERSION: ${{ needs.check-changes.outputs.nightly_version }}
+        run: |
+          set -euo pipefail
+          # Asset names drop the `+<sha>` build metadata (see linux-binaries.yml).
+          node scripts/generate-linux-binaries-manifest.mjs \
+            --assets-dir linux-release-assets \
+            --version "${NIGHTLY_VERSION%%+*}" \
+            --tag "${{ env.NIGHTLY_TAG }}" \
+            --repo "GCWing/BitFun" \
+            --out linux-release-assets/linux-binaries.json
+
       - name: Create nightly release
         uses: softprops/action-gh-release@v3
         with:
@@ -260,3 +292,8 @@ jobs:
             release-assets/**/*.dmg
             release-assets/**/*.rpm
             release-assets/**/*bitfun-installer.exe
+            linux-release-assets/bitfun-cli-*.tar.gz
+            linux-release-assets/bitfun-cli-*.tar.gz.sha256
+            linux-release-assets/bitfun-relay-server-*.tar.gz
+            linux-release-assets/bitfun-relay-server-*.tar.gz.sha256
+            linux-release-assets/linux-binaries.json

release-please-config.json

@@ -21,6 +21,10 @@
         {
           "type": "generic",
           "path": "Cargo.toml"
+        },
+        {
+          "type": "generic",
+          "path": "src/apps/relay-server/Cargo.toml"
         }
       ]
     }