build: publish browser CLI for DSH platforms

.github/workflows/ci.yml

@@ -18,15 +18,17 @@ jobs:
       - run: cargo clippy --all-targets --locked -- -D warnings
       - name: Verify release target contract
         run: |
-          ! grep -q 'x86_64-unknown-linux' .github/workflows/release.yml
-          ! grep -q 'x86_64-apple-darwin' .github/workflows/release.yml
+          grep -q 'x86_64-unknown-linux-musl' .github/workflows/release.yml
+          grep -q 'x86_64-apple-darwin' .github/workflows/release.yml
           grep -q 'aarch64-apple-darwin' .github/workflows/release.yml
           grep -q 'x86_64-pc-windows-msvc' .github/workflows/release.yml
           grep -q 'environment: macos-release' .github/workflows/release.yml
           grep -q './scripts/sign_and_notarize_macos.sh' .github/workflows/release.yml
           grep -q 'environment: cos-release' .github/workflows/release.yml
           grep -q './scripts/upload-release-to-cos.sh cos-upload browser-cli' .github/workflows/release.yml
-          grep -q 'needs: \[build-macos, build-windows\]' .github/workflows/release.yml
+          grep -q 'needs: \[build-linux, build-macos, build-windows\]' .github/workflows/release.yml
+          grep -q 'git merge-base --is-ancestor' .github/workflows/release.yml
+          grep -q 'test "${GITHUB_REF_NAME}" = "v${version}"' .github/workflows/release.yml
           ! grep -q 'skills/lexmount-browser/bin/' .github/workflows/release.yml
       - run: bash -n scripts/sign_and_notarize_macos.sh scripts/upload-release-to-cos.sh
       - run: sh -n scripts/package-skill.sh skills/lexmount-browser/scripts/bootstrap.sh skills/lexmount-browser/scripts/doctor.sh

.github/workflows/release.yml

@@ -5,39 +5,95 @@ on:
     tags: ["v*"]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
+  validate-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Validate tag and source commit
+        run: |
+          version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)"
+          test -n "${version}"
+          test "${GITHUB_REF_NAME}" = "v${version}"
+          git merge-base --is-ancestor "${GITHUB_SHA}" origin/main
+
   build-macos:
-    runs-on: macos-14
+    needs: validate-release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: aarch64-apple-darwin
+            runner: macos-14
+          - target: x86_64-apple-darwin
+            runner: macos-15-intel
+    runs-on: ${{ matrix.runner }}
     environment: macos-release
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: aarch64-apple-darwin
+          targets: ${{ matrix.target }}
       - run: cargo test --locked
-      - run: cargo build --release --locked --target aarch64-apple-darwin
+      - run: cargo build --release --locked --target '${{ matrix.target }}'
       - name: Sign and notarize
         env:
           MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64 }}
           MACOS_DEVELOPER_ID_P12_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_P12_PASSWORD }}
           APPLE_NOTARY_APPLE_ID: ${{ secrets.APPLE_NOTARY_APPLE_ID }}
           APPLE_NOTARY_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }}
           APPLE_NOTARY_APP_PASSWORD: ${{ secrets.APPLE_NOTARY_APP_PASSWORD }}
-        run: ./scripts/sign_and_notarize_macos.sh target/aarch64-apple-darwin/release/browser-cli
+        run: ./scripts/sign_and_notarize_macos.sh 'target/${{ matrix.target }}/release/browser-cli'
       - name: Package
         run: |
           version="${GITHUB_REF_NAME#v}"
-          asset="browser-cli-v${version}-aarch64-apple-darwin"
-          cp target/aarch64-apple-darwin/release/browser-cli "$asset"
+          asset="browser-cli-v${version}-${{ matrix.target }}"
+          cp 'target/${{ matrix.target }}/release/browser-cli' "$asset"
+          "./$asset" version
           shasum -a 256 "$asset" > "$asset.sha256"
       - uses: actions/upload-artifact@v4
         with:
-          name: release-aarch64-apple-darwin
-          path: browser-cli-v*-aarch64-apple-darwin*
+          name: release-${{ matrix.target }}
+          path: browser-cli-v*-${{ matrix.target }}*
+
+  build-linux:
+    needs: validate-release
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-musl
+      - run: sudo apt-get update && sudo apt-get install --yes musl-tools
+      - run: cargo test --locked
+      - name: Build static Linux binary
+        env:
+          CC_x86_64_unknown_linux_musl: musl-gcc
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
+        run: cargo build --release --locked --target x86_64-unknown-linux-musl
+      - name: Package
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          asset="browser-cli-v${version}-x86_64-unknown-linux-musl"
+          cp target/x86_64-unknown-linux-musl/release/browser-cli "$asset"
+          chmod 755 "$asset"
+          if readelf --program-headers --wide "$asset" | grep -F 'Requesting program interpreter'; then
+            echo 'Linux release binary is dynamically linked' >&2
+            exit 1
+          fi
+          "./$asset" version
+          sha256sum "$asset" > "$asset.sha256"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-x86_64-unknown-linux-musl
+          path: browser-cli-v*-x86_64-unknown-linux-musl*
 
   build-windows:
+    needs: validate-release
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v5
@@ -52,17 +108,20 @@ jobs:
           version="${GITHUB_REF_NAME#v}"
           asset="browser-cli-v${version}-x86_64-pc-windows-msvc.exe"
           cp target/x86_64-pc-windows-msvc/release/browser-cli.exe "$asset"
+          "./$asset" version
           sha256sum "$asset" > "$asset.sha256"
       - uses: actions/upload-artifact@v4
         with:
           name: release-x86_64-pc-windows-msvc
           path: browser-cli-v*-x86_64-pc-windows-msvc*
 
   publish:
-    needs: [build-macos, build-windows]
+    needs: [build-linux, build-macos, build-windows]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: cos-release
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v5
       - uses: actions/download-artifact@v4
@@ -89,7 +148,9 @@ jobs:
           mkdir cos-upload
           cp \
             "browser-cli-v${version}-aarch64-apple-darwin" \
+            "browser-cli-v${version}-x86_64-apple-darwin" \
             "browser-cli-v${version}-x86_64-pc-windows-msvc.exe" \
+            "browser-cli-v${version}-x86_64-unknown-linux-musl" \
             cos-upload/
           (cd cos-upload && sha256sum browser-cli-v* | sort -k2 > SHA256SUMS)
           ./scripts/upload-release-to-cos.sh cos-upload browser-cli "${version}"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lexmount-browser"
-version = "1.1.11"
+version = "1.1.12"
 edition = "2024"
 license = "MIT"
 description = "Native Rust SDK and CLI for Lexmount cloud browsers"

README.md

@@ -35,19 +35,20 @@ release from Tencent Cloud COS and verifies its SHA-256 digest. Set
 `LEXMOUNT_BROWSER_CLI_VERSION` or `LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL` only
 when testing a different published release or mirror.
 
-Published binaries are intentionally limited to two targets: macOS arm64 and
-Windows x64. The macOS binary is signed with a Developer ID Application
-certificate, hardened-runtime enabled, and accepted by Apple's notarization
-service before it is published. Linux and macOS Intel remain unsupported
-release platforms.
+The native release publishes four targets: macOS arm64, macOS Intel, Windows
+x64, and static Linux x64. Both macOS binaries are signed with a Developer ID
+Application certificate, hardened-runtime enabled, and accepted by Apple's
+notarization service before publication. The WorkBuddy Skill continues to
+select only its existing macOS arm64 and Windows x64 targets; the additional
+assets are consumed by integrations such as the DSH wrapper.
 
 The release workflow reads the signing certificate and notarization credentials
 from the `macos-release` GitHub environment. It requires
 `MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64`,
 `MACOS_DEVELOPER_ID_P12_PASSWORD`, `APPLE_NOTARY_APPLE_ID`,
 `APPLE_NOTARY_TEAM_ID`, and `APPLE_NOTARY_APP_PASSWORD`.
 
-The publish job uploads both platform binaries and their checksum manifest to
+The publish job uploads all four platform binaries and their checksum manifest to
 Tencent Cloud COS through the `cos-release` GitHub environment. It requires
 `TENCENT_CLOUD_SECRET_ID` and `TENCENT_CLOUD_SECRET_KEY` secrets plus
 `COS_BUCKET`, `COS_REGION`, `COS_PUBLIC_BASE_URL`, and `COS_OBJECT_PREFIX`

skills/lexmount-browser/scripts/bootstrap.ps1

@@ -12,7 +12,7 @@ function Invoke-Tls12Download {
   }
 }
 
-$version = if ($env:LEXMOUNT_BROWSER_CLI_VERSION) { $env:LEXMOUNT_BROWSER_CLI_VERSION } else { "1.1.11" }
+$version = if ($env:LEXMOUNT_BROWSER_CLI_VERSION) { $env:LEXMOUNT_BROWSER_CLI_VERSION } else { "1.1.12" }
 $downloadBaseUrl = if ($env:LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL) { $env:LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL.TrimEnd('/') } else { "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli" }
 $architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
 if ($architecture -ne "AMD64") { throw "Only Windows x64 is supported" }

skills/lexmount-browser/scripts/bootstrap.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 
-version="${LEXMOUNT_BROWSER_CLI_VERSION:-1.1.11}"
+version="${LEXMOUNT_BROWSER_CLI_VERSION:-1.1.12}"
 download_base_url="${LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL:-https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli}"
 repo="${download_base_url%/}/v${version}"
 case "$(uname -s)-$(uname -m)" in