ci(release): multi-arch v0.1.0 (8 targets) + install-script arch support

.github/workflows/release.yml

@@ -3,8 +3,8 @@
 # Triggered by pushing a vX.Y.Z tag (or manually via
 # workflow_dispatch). Produces:
 #
-#   - Cross-compiled binaries for linux/{amd64,arm64},
-#     darwin/{amd64,arm64}, windows/amd64
+#   - Cross-compiled binaries for linux/{amd64,arm64,386,arm},
+#     darwin/{amd64,arm64}, windows/{amd64,arm64}
 #   - Cosign keyless signature for each binary (Sigstore Rekor;
 #     same machinery as tracebloc/data-ingestors' image release)
 #   - SHA256SUMS file covering every binary
@@ -56,13 +56,21 @@ jobs:
             arch: amd64
           - os: linux
             arch: arm64
+          - os: linux
+            arch: '386'
+          - os: linux
+            arch: arm
+            goarm: '6'   # armv6 baseline runs on armv6 + armv7 (Pi Zero → Pi 4)
           - os: darwin
             arch: amd64
           - os: darwin
             arch: arm64
           - os: windows
             arch: amd64
             ext: .exe
+          - os: windows
+            arch: arm64
+            ext: .exe
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -97,6 +105,9 @@ jobs:
         env:
           GOOS: ${{ matrix.os }}
           GOARCH: ${{ matrix.arch }}
+          # GOARM only applies when GOARCH=arm; empty for every other
+          # target, which Go ignores.
+          GOARM: ${{ matrix.goarm }}
           CGO_ENABLED: '0'
         run: |
           mkdir -p dist

README.md

@@ -6,11 +6,11 @@ The customer-facing CLI for the tracebloc declarative ingestion path. Wraps the
 
 ## Status
 
-**v0.1.0-alpha is published** — the first [release](https://github.com/tracebloc/cli/releases/tag/v0.1.0-alpha), a pre-release for early testers, cut from `develop`. Every phase of the [v0.1 roadmap](https://github.com/tracebloc/client/issues/147) (#148–#153) is merged. The binary implements `version`, `completion`, `ingest validate`, `cluster info`, and the full `dataset push` flow — local schema validation, cluster discovery, data staging, submission, and Job watching, end to end.
+**v0.1.0 is released** — the first stable [release](https://github.com/tracebloc/cli/releases/latest), cut from `develop` (superseding the earlier `v0.1.0-alpha` preview). Every phase of the [v0.1 roadmap](https://github.com/tracebloc/client/issues/147) (#148–#153) is merged. The binary implements `version`, `completion`, `ingest validate`, `cluster info`, and the full `dataset push` flow — local schema validation, cluster discovery, data staging, submission, and Job watching, end to end.
 
 `dataset push` covers **9 of 10 task categories**: `image_classification`, `object_detection`, `keypoint_detection`, `text_classification`, `masked_language_modeling`, `tabular_classification`, `tabular_regression`, `time_series_forecasting`, and `time_to_event_prediction`. `semantic_segmentation` is pending mask-sidecar support upstream ([data-ingestors#136](https://github.com/tracebloc/data-ingestors/issues/136)); `instance_segmentation` is not yet implemented.
 
-The release pipeline has shipped [`v0.1.0-alpha`](https://github.com/tracebloc/cli/releases/tag/v0.1.0-alpha): cosign-signed binaries for linux/darwin/windows (amd64/arm64), `SHA256SUMS`, and the install scripts. Install it via [Customer experience](#customer-experience) or [build from source](#building-from-source). (The `install.tracebloc.io` shortcut, the `latest` one-liner, and a Homebrew tap all wait for the first **stable** `v*` tag — see below.)
+The release pipeline ships [`v0.1.0`](https://github.com/tracebloc/cli/releases/latest) as **cosign-signed, multi-arch binaries** — Linux (`amd64`, `arm64`, `386`, `arm`), macOS (`amd64`, `arm64`), and Windows (`amd64`, `arm64`) — each with `SHA256SUMS` and the install scripts. Install via [Customer experience](#customer-experience) or [build from source](#building-from-source). (A Homebrew tap and the `install.tracebloc.io` vanity URL are later follow-ups; the GitHub release URL serves installs today.)
 
 The Helm chart remains a sibling interface for the Kubernetes-native workflow: `helm install tracebloc/ingestor --set-file ingestConfig=./ingest.yaml` (see the chart's [README](https://github.com/tracebloc/client/blob/develop/ingestor/README.md)).
 
@@ -43,13 +43,13 @@ The protocol — the v1 schema + the POST endpoint — is the stable point. Ever
 
 ## Customer experience
 
-> `v0.1.0-alpha` is a **pre-release**, so the `install.tracebloc.io` shortcut isn't wired up yet and GitHub's `latest` skips pre-releases. Install the alpha by explicit tag (below), or [build from source](#building-from-source).
+> Installs the latest stable release. Pin a specific version with `--version vX.Y.Z` (`sh`) or `$env:RELEASE_VERSION` (PowerShell), or [build from source](#building-from-source).
 
 ```bash
-# Install the alpha — pins the pre-release tag (Linux/macOS)
-curl -fsSL https://github.com/tracebloc/cli/releases/download/v0.1.0-alpha/install.sh \
-  | sh -s -- --version v0.1.0-alpha
-# Windows + manual/signed downloads: https://github.com/tracebloc/cli/releases/tag/v0.1.0-alpha
+# Install — Linux / macOS
+curl -fsSL https://github.com/tracebloc/cli/releases/latest/download/install.sh | sh
+# Install — Windows (PowerShell)
+irm https://github.com/tracebloc/cli/releases/latest/download/install.ps1 | iex
 
 # Per dataset
 tracebloc dataset push ./my-data \
@@ -101,7 +101,7 @@ All v0.1 phases are merged:
 | 2 | [#150](https://github.com/tracebloc/client/issues/150) | Cluster discovery + ingestor SA token via TokenRequest | ✅ |
 | 3 | [#151](https://github.com/tracebloc/client/issues/151) | Stage data into the shared PVC via ephemeral Pod | ✅ |
 | 4 | [#152](https://github.com/tracebloc/client/issues/152) | Submit to jobs-manager + watch ingestor Job + summary | ✅ |
-| 5 | [#153](https://github.com/tracebloc/client/issues/153) | GitHub Releases + install.sh distribution (Homebrew tap deferred) | ✅ — [`v0.1.0-alpha`](https://github.com/tracebloc/cli/releases/tag/v0.1.0-alpha) published (pre-release) |
+| 5 | [#153](https://github.com/tracebloc/client/issues/153) | GitHub Releases + install.sh distribution (Homebrew tap deferred) | ✅ — [`v0.1.0`](https://github.com/tracebloc/cli/releases/latest) released (stable, 8-platform) |
 
 Beyond the original phases, `dataset push` was widened from image-classification-only to 9 of 10 modalities, and the test suite gained unit-coverage wins plus a kind-based integration harness for the real-I/O seams.
 

scripts/RELEASE_CHECKLIST.md

@@ -8,8 +8,8 @@ have to reverse-engineer the surface area on release day.
 ## What runs automatically on `git push origin v0.1.0`
 
 1. `.github/workflows/release.yml` fires.
-2. Matrix build of 5 platform binaries (linux/{amd64,arm64},
-   darwin/{amd64,arm64}, windows/amd64).
+2. Matrix build of 8 platform binaries (linux/{amd64,arm64,386,arm},
+   darwin/{amd64,arm64}, windows/{amd64,arm64}).
 3. Each binary is signed with cosign keyless OIDC; the per-binary
    `.cert` + `.sig` files are produced.
 4. SHA256SUMS file is aggregated across the matrix.
@@ -73,7 +73,7 @@ The workflow takes 5-10 minutes. Monitor at
 
 ### 3. Verify the release
 
-- [ ] All 5 binaries attached to the GitHub Release
+- [ ] All 8 binaries attached to the GitHub Release
 - [ ] SHA256SUMS file present
 - [ ] install.sh + install.ps1 present
 - [ ] Each binary has a `.cert` + `.sig` pair

scripts/install.ps1

@@ -6,7 +6,7 @@
 #   $env:RELEASE_VERSION='v0.1.0'; irm <url> | iex
 #
 # What it does:
-#   1. Detects arch (amd64 only on Windows; arm64 not yet shipped)
+#   1. Detects arch (amd64 or arm64 on Windows)
 #   2. Resolves the latest release tag (or honors $env:RELEASE_VERSION)
 #   3. Downloads tracebloc-<tag>-windows-amd64.exe + SHA256SUMS
 #   4. Verifies SHA256
@@ -50,16 +50,18 @@ $BinaryName     = 'tracebloc.exe'
 # ---------------------------------------------------------------------
 function Get-Arch {
     # PROCESSOR_ARCHITECTURE is the canonical Windows arch env var:
-    #   AMD64 → x64 binary needed
-    #   ARM64 → Windows on ARM (not yet shipped — see below)
-    $proc = $env:PROCESSOR_ARCHITECTURE
+    #   AMD64 → x64 binary
+    #   ARM64 → Windows on ARM
+    # Caveat: a 32-bit / x64-emulated process on an ARM64 host reports
+    # the PROCESS arch in PROCESSOR_ARCHITECTURE but the NATIVE arch in
+    # PROCESSOR_ARCHITEW6432. Prefer the latter when set so an x64
+    # PowerShell on Windows-on-ARM still installs the native arm64 build.
+    $proc = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
     switch ($proc) {
         'AMD64' { return 'amd64' }
-        'ARM64' {
-            Fail "Windows ARM64 binary isn't released yet. File an issue at https://github.com/tracebloc/cli if you need it."
-        }
+        'ARM64' { return 'arm64' }
         default {
-            Fail "Unsupported PROCESSOR_ARCHITECTURE: $proc"
+            Fail "Unsupported processor architecture: $proc"
         }
     }
 }

scripts/install.sh

@@ -93,12 +93,14 @@ detect_os() {
 detect_arch() {
     uname_m="$(uname -m)"
     case "$uname_m" in
-        x86_64|amd64)        echo "amd64" ;;
-        arm64|aarch64)       echo "arm64" ;;
+        x86_64|amd64)                   echo "amd64" ;;
+        arm64|aarch64)                  echo "arm64" ;;
+        i386|i686)                      echo "386" ;;
+        armv6l|armv7l|armv8l|armhf|arm) echo "arm" ;;
         *)
             echo "Error: unsupported arch: $uname_m" >&2
-            echo "tracebloc CLI is released for amd64 + arm64; if you need" >&2
-            echo "another arch, please file an issue at github.com/tracebloc/cli." >&2
+            echo "tracebloc CLI ships linux binaries for amd64, arm64, 386, and arm;" >&2
+            echo "if you need another arch, please file an issue at github.com/tracebloc/cli." >&2
             exit 1
             ;;
     esac