Repository navigation
Build prebuilt binaries for macOS arm64 and Linux x86_64 (MUS-14) - #165
Merged
Merged
Conversation
A release workflow builds muster-shim and muster-daemon with --locked on macOS (Apple silicon) and Ubuntu 22.04 (glibc 2.35, OpenSSL 3), smoke-runs each one, and names them muster-<bin>-<target>, as scripts/install-codex.sh expects. One job writes and checks a SHA256SUMS over every binary and install-codex.sh. workflow_dispatch is a dry run that only uploads the files as an artifact. A pushed v* tag also creates a draft release with them, which nobody sees until it's published by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rted) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…and workflow_dispatch only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Castor-o7
marked this pull request as ready for review
November 5, 2026 20:54
…macos-15 (MUS-14) Review asked that a moved tag can't change what builds a release and a poisoned cache entry can't reach a shipped binary: every action is now pinned to a full commit SHA with its version in a comment, and the build job no longer restores Swatinem/rust-cache. The macOS runner is pinned to macos-15, and the smoke test has a 2-minute limit in case a binary ever ignores the unknown flag and keeps running. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…cached build (to be reverted) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…and workflow_dispatch only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Castor-o7
added a commit
that referenced
this pull request
Nov 5, 2026
* docs(upstream): the next round after #164 and #165 merged Upstream is at v0.57.0 with lobo235's #140/#141 overlapping our layers. Adds Step 0 (catch-up and re-inventory), the new order (M2 first, Gate split), Levi L2/L3 in parallel, a pre-PR check modelled on lucid-max's review, and questions for the operator to raise upstream. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): Levi L1-L3 are already open as levi#43-45 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): additive-only for Marshal, Levi on hold until #43-45 merge The operator's direction on 2026-11-05. Default changes become proposals for upstream to choose, not PRs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): upstream at 9b00c6f (v0.58.0), stale overlaps, current owners, ~/src/marshal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): what v0.58.0 (#166) overlaps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): live cut per layer, M2 can go ahead of Step 0, questions for lucid-max Correct the reading of docs/pr-followups.md: it lists upstream's own closed PRs; #164 shows outside PRs merge, squashed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): lucid-max's answers to the operator's questions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): draft the single default-changes issue lucid-max asked for Checked against upstream 9b00c6f. Dropped: keeping mail for a reaped recipient, which upstream already does (MESSAGE_TTL, mail survives DEL). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): Gate vendors myko-server; default-changes list as checked against 9b00c6f Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): don't vendor myko-server; the RequestFilter hook goes to ignition-is-go/myko first Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): plan the myko RequestFilter PR; it overlaps myko#129 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): follow myko#129; trevorsargent leads, no competing filter PR Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): M2 is terminal-cmds-v3 at 3af92d7 on v0.58.0; refresh its evidence Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): M2 v3 has no internal tidy-up; upstream already has daemon_address() Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(upstream): M2 is open as marshal#168 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/workflows/release.yml(MUS-14) builds muster-shim and muster-daemon for macOS arm64 and Linux x86_64, with oneSHA256SUMS.workflow_dispatch(a dry run: build, check and upload a workflow artifact only) and a pushedv*tag. Nothing else.releasejob also creates a draft release with the files attached (gh release create --draft --verify-tag). Nothing is public until someone publishes the draft by hand. Only that job getscontents: write; everything else is read-only.scripts/install-codex.sh, which fetchesreleases/latest/download/muster-shim-<target>:muster-{shim,daemon}-aarch64-apple-darwinandmuster-{shim,daemon}-x86_64-unknown-linux-gnu, as raw binaries.install-codex.shitself is attached too, since its own one-liner downloads it from the latest release.cargo build --release --locked. Linux builds onubuntu-22.04for the oldest glibc (2.35); the binaries link OpenSSL 3 (native-tls) dynamically. Each binary is smoke-run on its own runner.packagejob writesSHA256SUMSover all five files, runssha256sum -c, and fails if any of the four binaries is missing.Tested
workflow_dispatchonly works for workflows already on the default branch, so commit 66f10d7 temporarily added apull_requesttrigger and ae98e86 reverts it. The tree at ae98e86 is identical to feb305a (git diff --exit-code). Run 42106353650:I downloaded the
muster-releaseartifact and checked it on Murph:sha256sum -c SHA256SUMS: all 5 OK.file: Mach-O arm64 for the two darwin binaries, and x86_64 ELF PIE for the two Linux ones.GLIBC_2.35(objdump -T) and run on Murph.install-codex.shis byte-identical to the repo's.Not done / follow-ups
workflow_dispatchdry run on main, artifacts only.install-codex.shalready clears it, but a browser download will meet Gatekeeper.install-codex.shdoesn't checkSHA256SUMSyet.CARGO_PROFILE_RELEASE_STRIP=symbolswould shrink them, at the cost of symbols in backtraces.🤖 Generated with Claude Code