harden release workflow: musl builds, --locked, version check, portable sed

5 files changed, 50 insertions, 6 deletions

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75047cdd..6c4f1ffc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,15 +8,18 @@ on:
 permissions:
   contents: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   build:
     strategy:
       matrix:
         include:
-          - target: x86_64-unknown-linux-gnu
+          - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
             name: herdr-linux-x86_64
-          - target: aarch64-unknown-linux-gnu
+          - target: aarch64-unknown-linux-musl
             os: ubuntu-latest
             name: herdr-linux-aarch64
           - target: x86_64-apple-darwin
@@ -31,20 +34,35 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Verify tag matches Cargo.toml version
+        run: |
+          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
+            echo "error: tag $GITHUB_REF_NAME doesn't match Cargo.toml version $CARGO_VERSION"
+            exit 1
+          fi
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
 
+      - name: Install musl tools (Linux x86_64)
+        if: matrix.target == 'x86_64-unknown-linux-musl'
+        run: sudo apt-get update && sudo apt-get install -y musl-tools
+
       - name: Install cross-compilation tools (Linux aarch64)
-        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        if: matrix.target == 'aarch64-unknown-linux-musl'
         run: |
           sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
+          sudo apt-get install -y gcc-aarch64-linux-gnu musl-tools
+          # Install aarch64 musl cross-compiler
+          sudo apt-get install -y crossbuild-essential-arm64
+          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
 
       - name: Build
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --release --locked --target ${{ matrix.target }}
 
       - name: Rename binary
         run: cp target/${{ matrix.target }}/release/herdr ${{ matrix.name }}
diff --git a/AGENTS.md b/AGENTS.md
index f65fa0ef..575192bd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -29,3 +29,7 @@ Integration tests are markdown specs in `tests/integration/specs/`. A pi agent e
 - Rust: no `unwrap()` in production code. `tracing` for logging. `#[allow]` only with a comment explaining why.
 - Don't bypass checks. If tests fail, fix them before committing.
 - Don't add dependencies without a reason. Check if the existing deps cover it first.
+
+## Releases
+
+`just release 0.x.y` — bumps Cargo.toml, runs tests, commits, tags, pushes. GitHub Actions builds binaries.
diff --git a/Cargo.lock b/Cargo.lock
index ce358691..51c40ab1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -456,6 +456,7 @@ dependencies = [
  "base64",
  "bytes",
  "crossterm",
+ "libc",
  "portable-pty",
  "ratatui",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 2fc9ea48..37d1e865 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,4 +23,7 @@ toml = "0.8"
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 tui-term = "0.3"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+libc = "0.2"
 vt100 = "0.16"
diff --git a/justfile b/justfile
index 3700b040..5a23d395 100644
--- a/justfile
+++ b/justfile
@@ -24,6 +24,24 @@ clean-tests:
     @rm -f tests/integration/results/*.json tests/integration/results/*.txt 2>/dev/null || true
     @echo "cleaned"
 
+# Bump version, commit, tag, push, trigger release build (usage: just release 0.1.1)
+release version:
+    @if [ -n "$(git status --porcelain)" ]; then \
+        echo "error: commit your changes first"; \
+        exit 1; \
+    fi
+    @if git rev-parse "v{{version}}" >/dev/null 2>&1; then \
+        echo "error: tag v{{version}} already exists"; \
+        exit 1; \
+    fi
+    sed -i.bak 's/^version = ".*"/version = "{{version}}"/' Cargo.toml && rm -f Cargo.toml.bak
+    cargo test --quiet
+    git add Cargo.toml Cargo.lock
+    git commit -m "release: v{{version}}"
+    git tag v{{version}}
+    git push --follow-tags
+    @echo "v{{version}} released — GitHub Actions building binaries"
+
 # Print default config
 default-config:
     cargo run --release -- --default-config