fix: deploy native bridge binary

.github/workflows/pipeline.yml

@@ -100,6 +100,7 @@ jobs:
       SERVICE_IMAGE_NAME: xworkmate-bridge
     outputs:
       artifact_name: ${{ steps.artifact_meta.outputs.artifact_name }}
+      binary_artifact_name: ${{ steps.binary_artifact_meta.outputs.binary_artifact_name }}
       service_image_ref: ${{ steps.service_ref.outputs.image_ref }}
     steps:
       - name: Checkout
@@ -136,6 +137,9 @@ jobs:
             BUILD_DATE=${{ github.event.head_commit.timestamp || github.event.repository.pushed_at }}
             BUILD_VERSION=v1.0-beta2
 
+      - name: Build native linux service binary
+        run: bash ./scripts/github-actions/build-artifact.sh dist/native-binary
+
       - name: Write image ref artifact
         run: |
           set -euo pipefail
@@ -146,12 +150,22 @@ jobs:
         id: artifact_meta
         run: bash ./scripts/github-actions/resolve-artifact-name.sh
 
+      - name: Record native binary artifact metadata
+        id: binary_artifact_meta
+        run: printf 'binary_artifact_name=xworkmate-bridge-linux-amd64-%s\n' "${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+
       - name: Upload image ref artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ steps.artifact_meta.outputs.artifact_name }}
           path: dist/service-image-ref.txt
 
+      - name: Upload native linux service binary
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ${{ steps.binary_artifact_meta.outputs.binary_artifact_name }}
+          path: dist/native-binary/xworkmate-bridge
+
   deploy:
     name: Deploy
     needs: build
@@ -182,6 +196,12 @@ jobs:
           name: ${{ needs.build.outputs.artifact_name }}
           path: xworkmate-bridge/dist/image-artifact
 
+      - name: Download native linux service binary
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        with:
+          name: ${{ needs.build.outputs.binary_artifact_name }}
+          path: xworkmate-bridge/dist/native-binary
+
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
@@ -217,6 +237,11 @@ jobs:
           SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
         run: bash ./scripts/github-actions/prepare-ssh.sh "${{ steps.deploy_meta.outputs.target_host }}" "${SSH_KNOWN_HOSTS}"
 
+      - name: Install native bridge binary on target
+        if: ${{ steps.deploy_meta.outputs.run_apply == 'true' }}
+        working-directory: xworkmate-bridge
+        run: bash ./scripts/github-actions/deploy-native-binary.sh "${{ steps.deploy_meta.outputs.target_host }}" "dist/native-binary/xworkmate-bridge" "$(git rev-parse --short HEAD)"
+
       - name: Run Ansible deploy playbook
         working-directory: playbooks
         env:

scripts/github-actions/deploy-native-binary.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TARGET_HOST="${1:?target host is required}"
+BINARY_PATH="${2:?binary path is required}"
+EXPECTED_COMMIT="${3:?expected short commit is required}"
+REMOTE_TMP="/tmp/xworkmate-bridge-${EXPECTED_COMMIT}"
+REMOTE_BINARY="/usr/local/bin/xworkmate-go-core"
+STALE_DROPIN="/etc/systemd/system/xworkmate-bridge.service.d/10-hotfix-openclaw-artifacts.conf"
+SERVICE_NAME="xworkmate-bridge.service"
+
+if [[ ! "${TARGET_HOST}" =~ ^[A-Za-z0-9._-]+$ ]]; then
+  echo "invalid target host: ${TARGET_HOST}" >&2
+  exit 1
+fi
+
+if [[ ! "${EXPECTED_COMMIT}" =~ ^[0-9a-f]{7,40}$ ]]; then
+  echo "invalid expected commit: ${EXPECTED_COMMIT}" >&2
+  exit 1
+fi
+
+if [[ ! -f "${BINARY_PATH}" ]]; then
+  echo "native bridge binary not found: ${BINARY_PATH}" >&2
+  exit 1
+fi
+
+chmod +x "${BINARY_PATH}"
+scp -q "${BINARY_PATH}" "root@${TARGET_HOST}:${REMOTE_TMP}"
+
+ssh "root@${TARGET_HOST}" "EXPECTED_COMMIT='${EXPECTED_COMMIT}' REMOTE_TMP='${REMOTE_TMP}' REMOTE_BINARY='${REMOTE_BINARY}' STALE_DROPIN='${STALE_DROPIN}' SERVICE_NAME='${SERVICE_NAME}' bash -s" <<'REMOTE'
+set -euo pipefail
+
+had_immutable=0
+restore_immutable() {
+  if [[ "${had_immutable}" == "1" ]] && command -v chattr >/dev/null 2>&1 && [[ -e "${REMOTE_BINARY}" ]]; then
+    chattr +i "${REMOTE_BINARY}" 2>/dev/null || true
+  fi
+}
+trap restore_immutable EXIT
+
+if command -v lsattr >/dev/null 2>&1 && [[ -e "${REMOTE_BINARY}" ]]; then
+  attrs="$(lsattr "${REMOTE_BINARY}" 2>/dev/null || true)"
+  if [[ "${attrs}" == *i* ]]; then
+    had_immutable=1
+    chattr -i "${REMOTE_BINARY}"
+  fi
+fi
+
+install -o root -g root -m 0755 "${REMOTE_TMP}" "${REMOTE_BINARY}"
+
+restore_immutable
+
+rm -f "${STALE_DROPIN}"
+rmdir --ignore-fail-on-non-empty "$(dirname "${STALE_DROPIN}")" 2>/dev/null || true
+
+version_json="$("${REMOTE_BINARY}" version)"
+actual_commit="$(VERSION_JSON="${version_json}" python3 - <<'PY'
+import json
+import os
+payload = json.loads(os.environ["VERSION_JSON"])
+print(str(payload.get("commit", "")))
+PY
+)"
+if [[ "${actual_commit}" != "${EXPECTED_COMMIT}" ]]; then
+  echo "deployed binary commit mismatch: expected ${EXPECTED_COMMIT}, got ${actual_commit}" >&2
+  exit 1
+fi
+
+systemctl daemon-reload
+systemctl restart "${SERVICE_NAME}"
+pid="$(systemctl show -p MainPID --value "${SERVICE_NAME}")"
+if [[ -z "${pid}" || "${pid}" == "0" ]]; then
+  echo "${SERVICE_NAME} did not start" >&2
+  exit 1
+fi
+if [[ "$(readlink -f "/proc/${pid}/exe")" != "${REMOTE_BINARY}" ]]; then
+  echo "${SERVICE_NAME} is not running ${REMOTE_BINARY}" >&2
+  exit 1
+fi
+REMOTE