[piekstra]

Summary

CI jobs install Lest with cargo install --git, which compiles from source on every run and embeds no UI. This adds prebuilt binaries and an action that installs them.

• .github/workflows/release.yml:
  • Trigger: a pushed tag v<MAJOR.MINOR>.<patch>, where MAJOR.MINOR must match the new version.txt (0.1), following the shared release convention.
  • Build: static musl binaries for Linux x86_64 (ubuntu-22.04) and arm64 (ubuntu-22.04-arm), with the UI built and embedded, checked with --version against the tag.
  • Publish: archives lest_v<version>_linux_<arch>.tar.gz plus checksums.txt (SHA-256). Running it by hand with an existing tag publishes that release again (--clobber).
  • Verify: after publishing, a job installs the release through the action on both architectures.
  • Pull requests that touch the release files build without publishing, so this PR exercises the build.
• action.yml (uses: open-cli-collective/lest@<tag>):
  • Inputs: version (default latest), install-browsers (runs npx playwright install --with-deps chromium in working-directory), and github-token.
  • Install: downloads the archive, checks it against checksums.txt, caches it in the tool cache, and puts lest on PATH. Linux runners only.
• Version stamp: the binary, reports, bundles and the UI API report LEST_VERSION from the build (the tag), falling back to the crate version.
• scripts/check-workflows.mjs now also requires SHA-pinned actions in action.yml.
• Docs: the README install section, docs/ci.md (the action and its inputs), and docs/development.md (the release process, and why it does not use the shared GoReleaser workflow).

Not in this PR

• macOS and Windows binaries. The shared release workflow builds Go on a macOS runner and signs darwin binaries there. Lest is Rust, and this repo adds no macOS runners. Source install still covers both.
• Auto-release on feat:/fix: merges. That needs a RELEASE_TAG_TOKEN secret and mints tags without a person deciding. Tags are pushed by hand for now.
• No tag or release is cut here.

Test plan

• actionlint on both workflows; node scripts/check-workflows.mjs
• make check locally (two timing tests failed under a machine load average of 17; they pass when rerun on their own, and this change does not touch the runner)
• LEST_VERSION=9.9.9 cargo build prints lest 9.9.9; without it, lest 0.1.0
• The Release build jobs on this PR: static binaries on both architectures, --version matches
• After the first tag: the publish and verify jobs

[piekstra]

Review dispositions (self-review of the diff):

• Release binaries were not stripped. Fixed in 407b1b8 (CARGO_PROFILE_RELEASE_STRIP=symbols).
• The action downloads with gh, which self-hosted runners may lack. Documented in docs/ci.md (407b1b8).
• The action cannot run end to end before a release exists. Covered by the verify job, which installs each published release through the action on x86_64 and arm64.
• The pr-title check fails on the body's model line, because it rejects AI tooling names. Left for the maintainer to decide: change the check or the line.
• macOS and Windows binaries are out of scope (no macOS runners). Source install covers them.

[piekstra]

Update: the model line is removed from the body, and pr-title now passes. That closes the fourth item in the earlier dispositions.