ci(release): nightlies system (cron + dispatch, nightly channel) (#592)

.github/workflows/build-binaries.yml

@@ -0,0 +1,167 @@
+# The ONE place dig-node's cross-OS binary build lives. It is a REUSABLE workflow
+# (`on: workflow_call` only — it never fires on its own): both release paths call it, so the
+# OS/arch matrix + toolchain setup are defined exactly once (DRY, CLAUDE.md §2.5):
+#
+#   * release.yml          — the STABLE `vX.Y.Z` tag builder, and
+#   * nightly-release.yml   — the NIGHTLY pre-release channel.
+#
+# The caller passes the version string stamped into each artifact's filename and, optionally, the
+# git ref to build. The job builds the self-contained `dig-node` service binary AND its first-class
+# `dign` alias (issue #548) for every supported OS/arch, and uploads them as run artifacts the
+# caller's publish job attaches to a GitHub Release.
+#
+# DUAL ASSET NAMING (SPEC §11.2) — every per-OS/arch binary is published under TWO names so both
+# downstream consumers resolve it with NO change on their side:
+#   * `dig-node-<ver>-<os>-<arch>[.exe]`      ← the CANONICAL name the dig-installer thin-shim
+#       PREFERS (its dig-node Repo stem is `dig-node`).
+#   * `dig-companion-<ver>-<os>-<arch>[.exe]` ← the legacy name. apt.dig.net's packaging resolves
+#       the Linux binary by this exact template, and the installer keeps it as its pre-rename
+#       fallback. The binary itself is identical; only the filename differs.
+# `dign` is a FIRST-CLASS alias binary (issue #548): a SEPARATE `[[bin]]` target sharing the SAME
+# entrypoint, published alongside `dig-node` under its own stem `dign-<ver>-<os>-<arch>[.exe]`.
+#
+# NO linux-arm64 asset is published: the Linux build graph pulls `openssl-sys` (via the Chia wallet
+# SDK), so an aarch64-Linux cross-compile would also have to cross-compile OpenSSL — fragile, and
+# no consumer requests it (SPEC §11.3).
+#
+# The gate runs fmt + clippy ONLY — a PR's own CI (ci.yml) already ran the full
+# fmt/clippy/test/coverage set (`cargo llvm-cov nextest --workspace`) against the merged tree
+# before merge (§2.4a). Re-running `cargo test` on the release path added nothing but a second
+# chance for a flaky test to block a release that already passed its gate once (#488/#489); fmt +
+# clippy stay because they are deterministic and a cheap fail-fast before spending build minutes.
+name: Build binaries (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Version string stamped into each artifact filename (e.g. `1.2.3` or `1.2.3-nightly.20260714.abc1234`)."
+        type: string
+        required: true
+      ref:
+        description: "Git ref (tag / branch / SHA) to check out and build. Empty = the caller run's commit."
+        type: string
+        required: false
+        default: ""
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+  # ENOSPC guard: the workspace compiles the full P2P stack (dig-nat/gossip/dht/pex/download) +
+  # wasmtime/cranelift + the chia wallet SDK, whose debug symbols blow the runner disk. Strip
+  # debuginfo from dev + test + release builds so a full build/clippy fits the CI disk.
+  CARGO_PROFILE_DEV_DEBUG: "0"
+  CARGO_PROFILE_TEST_DEBUG: "0"
+  CARGO_PROFILE_RELEASE_DEBUG: "0"
+
+jobs:
+  # Gate: fmt + clippy on Linux, once. A ref that doesn't pass the gate never produces release
+  # binaries. No test re-run here — see the header comment (#489).
+  check:
+    name: fmt + clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - name: Install Rust (stable + components)
+        run: |
+          rustup toolchain install stable --component rustfmt --component clippy
+          rustup default stable
+          rustc --version
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-companion-check-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-companion-check-
+      - run: cargo fmt --all --check
+      - run: cargo clippy --all-targets --locked -- -D warnings
+
+  build:
+    name: build (${{ matrix.out_name }})
+    needs: check
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bin: dig-node.exe
+            out_name: windows-x64.exe
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            bin: dig-node
+            out_name: linux-x64
+          # Both macOS arches build on the fast Apple-silicon macos-14 runner; the Intel binary is
+          # CROSS-COMPILED there (host arm64 → target x86_64-apple-darwin). The only C/asm dep in
+          # the macOS graph is `ring` (via rustls); `openssl-sys` is cfg-gated to non-Apple targets,
+          # so there is no vendored-openssl cross-compile to worry about.
+          - os: macos-14 # Apple silicon (arm64)
+            target: aarch64-apple-darwin
+            bin: dig-node
+            out_name: macos-arm64
+          - os: macos-14 # Apple silicon — cross-compiles the Intel binary
+            target: x86_64-apple-darwin
+            bin: dig-node
+            out_name: macos-x64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - name: Install Rust + target
+        shell: bash
+        run: |
+          rustup toolchain install stable
+          rustup default stable
+          rustup target add ${{ matrix.target }}
+          rustc --version
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-companion-build-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-companion-build-${{ matrix.target }}-
+      - name: Build release binaries (dig-node + dign alias)
+        # Build BOTH bins — `dign` is the first-class alias (issue #548), published alongside
+        # `dig-node` under its own asset stem below.
+        run: cargo build --release --locked --target ${{ matrix.target }} --bin dig-node --bin dign
+      - name: Stage artifact (dual-named)
+        id: stage
+        # The caller's `version` is stamped into the filename verbatim: a plain `1.2.3` for a
+        # stable tag, or the synthesized `1.2.3-nightly.YYYYMMDD.<shortsha>` for a nightly.
+        shell: bash
+        run: |
+          VER="${{ inputs.version }}"
+          mkdir -p dist
+          SRC="target/${{ matrix.target }}/release/${{ matrix.bin }}"
+          test -f "$SRC" || { echo "binary not produced: $SRC"; exit 1; }
+          # On Windows out_name already ends in .exe; on unix there is no extension. Publish the
+          # SAME binary under both the canonical dig-node-* name and the legacy dig-companion-*
+          # name (apt's template + the installer's pre-rename fallback). See the header comment.
+          cp "$SRC" "dist/dig-node-${VER}-${{ matrix.out_name }}"
+          cp "$SRC" "dist/dig-companion-${VER}-${{ matrix.out_name }}"
+          # The `dign` first-class alias (issue #548): a SEPARATE binary that behaves byte-for-byte
+          # like `dig-node`, published under its own `dign-*` stem (same shape as `dig-node-*`) so
+          # the dig-installer resolves it via Repo::dign(). Its filename differs from `dig-node`
+          # only by the `dig-node`->`dign` substring (incl. the `.exe` suffix on Windows).
+          DIGN_BIN="${{ matrix.bin }}"; DIGN_BIN="${DIGN_BIN/dig-node/dign}"
+          DIGN_SRC="target/${{ matrix.target }}/release/${DIGN_BIN}"
+          test -f "$DIGN_SRC" || { echo "dign binary not produced: $DIGN_SRC"; exit 1; }
+          cp "$DIGN_SRC" "dist/dign-${VER}-${{ matrix.out_name }}"
+          ls -la dist
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: dig-node-${{ matrix.out_name }}
+          path: dist/*
+          if-no-files-found: error