ci: slim console runtime - universal dist + cross-compiled API, no macOS runner

Build the dashboard dist once (platform-independent) and cross-compile the Go
API (CGO disabled) for darwin-arm64, linux-amd64, linux-arm64 in a single
ubuntu job. Drops the macOS runners and per-arch docker. node_modules is
excluded from the runtime (nodejs role provides Node on target), so the
tarballs only carry the API binary + built dist + scripts + manifest. macOS is
arm64-only; Linux covers amd64/arm64 (Debian and Ubuntu share the binary).

.github/workflows/runtime-release.yaml

@@ -55,112 +55,70 @@ concurrency:
 
 jobs:
   build:
-    name: Build runtime ${{ matrix.os }}-${{ matrix.arch }}
+    name: Build console runtime (universal dist + cross-compiled API)
-    runs-on: ${{ matrix.runner }}
+    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: linux
-            arch: amd64
-            runner: ubuntu-latest
-          - os: linux
-            arch: arm64
-            runner: ubuntu-latest
-          - os: darwin
-            arch: arm64
-            runner: macos-14
-          - os: darwin
-            arch: amd64
-            runner: macos-13
     steps:
       - uses: actions/checkout@v4
 
-      - uses: docker/setup-qemu-action@v3
-        if: matrix.os == 'linux'
-
       - uses: actions/setup-go@v6
         with:
           go-version-file: api/go.mod
           cache: false
 
       - uses: actions/setup-node@v4
-        if: matrix.os == 'darwin'
         with:
           node-version: "24"
 
-      - name: Build target runtime
+      - name: Build universal dashboard (dist) once
-        env:
-          TARGET_OS: ${{ matrix.os }}
-          TARGET_ARCH: ${{ matrix.arch }}
         run: |
           set -euo pipefail
-          root="dist/runtime/xworkspace-console"
+          # The dashboard compiles to platform-independent static assets, so it
-          mkdir -p "${root}/dashboard" "${root}/bin" "dist/assets"
+          # is built a single time and reused by every target. node_modules is a
+          # build-only dependency and is intentionally excluded from the runtime
+          # (Node is provided by the playbook nodejs role on target).
+          ( cd dashboard && npm ci --no-audit --no-fund && npm run build )
 
-          cp -a scripts "${root}/"
+      - name: Package per-platform runtimes
-          cp dashboard/package.json dashboard/package-lock.json dashboard/index.html \
+        run: |
-            dashboard/tsconfig.json dashboard/vite.config.ts "${root}/dashboard/"
+          set -euo pipefail
-          cp -a dashboard/src "${root}/dashboard/"
+          mkdir -p dist/assets
-
+          # Supported runtime targets: macOS is arm64-only; Linux (Debian and
-          if [ "${TARGET_OS}" = "linux" ]; then
+          # Ubuntu share the same binary) is amd64 + arm64. The Go API is a pure
-            # Cross-arch dashboard build inside a matching linux/${TARGET_ARCH} container.
+          # cross-compile (CGO disabled); the dashboard dist is the universal
-            docker run --rm --platform "linux/${TARGET_ARCH}" \
+          # bundle built above.
-              -v "${PWD}/dashboard:/src:ro" \
+          for target in darwin/arm64 linux/amd64 linux/arm64; do
-              -v "${PWD}/${root}/dashboard:/out" \
+            os="${target%/*}"
-              node:24-bookworm \
+            arch="${target#*/}"
-              bash -lc '
+            root="dist/runtime/${os}-${arch}/xworkspace-console"
-                set -euo pipefail
+            mkdir -p "${root}/dashboard" "${root}/bin"
-                cp -a /src/. /tmp/dashboard/
+            cp -a scripts "${root}/"
-                cd /tmp/dashboard
+            cp -a dashboard/dist "${root}/dashboard/"
-                npm ci --no-audit --no-fund
-                npm run build
-                cp -a dist node_modules /out/
-              '
-          else
-            # Native macOS build on the matching arch runner so node_modules and
-            # the API binary are genuinely darwin/${TARGET_ARCH}.
             (
-              cd dashboard
+              cd api
-              npm ci --no-audit --no-fund
+              CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" \
-              npm run build
+                go build -buildvcs=false -trimpath -o "../${root}/bin/xworkspace-api" .
             )
-            cp -a dashboard/dist dashboard/node_modules "${root}/dashboard/"
+            cat > "${root}/manifest.json" <<JSON
-          fi
-
-          (
-            cd api
-            CGO_ENABLED=0 GOOS="${TARGET_OS}" GOARCH="${TARGET_ARCH}" \
-              go build -buildvcs=false -trimpath -o "../${root}/bin/xworkspace-api" .
-          )
-
-          cat > "${root}/manifest.json" <<JSON
           {
             "component": "xworkspace-console",
             "commit": "${GITHUB_SHA}",
-            "os": "${TARGET_OS}",
+            "os": "${os}",
-            "arch": "${TARGET_ARCH}",
+            "arch": "${arch}",
             "apiBinary": "bin/xworkspace-api",
             "dashboard": "dashboard"
           }
           JSON
-          tar -czf "dist/assets/xworkspace-console-runtime-${TARGET_OS}-${TARGET_ARCH}.tar.gz" \
+            tar -czf "dist/assets/xworkspace-console-runtime-${os}-${arch}.tar.gz" \
-            -C "dist/runtime" xworkspace-console
+              -C "dist/runtime/${os}-${arch}" xworkspace-console
-          (
+          done
-            cd dist/assets
+          ( cd dist/assets && sha256sum -- *.tar.gz > SHA256SUMS )
-            if command -v sha256sum >/dev/null 2>&1; then
-              sha256sum -- ./*.tar.gz | sed 's# \./# #' > "SHA256SUMS-${TARGET_OS}-${TARGET_ARCH}"
-            else
-              shasum -a 256 -- ./*.tar.gz | sed 's# \./# #' > "SHA256SUMS-${TARGET_OS}-${TARGET_ARCH}"
-            fi
-          )
 
       - uses: actions/upload-artifact@v4
         with:
-          name: xworkspace-console-runtime-${{ matrix.os }}-${{ matrix.arch }}
+          name: xworkspace-console-runtime
           path: |
             dist/assets/*.tar.gz
-            dist/assets/SHA256SUMS-*
+            dist/assets/SHA256SUMS
           if-no-files-found: error
 
   publish:
@@ -172,9 +130,8 @@ jobs:
     steps:
       - uses: actions/download-artifact@v4
         with:
-          pattern: xworkspace-console-runtime-*
+          name: xworkspace-console-runtime
           path: dist
-          merge-multiple: true
 
       - name: Publish assets
         id: publish
@@ -183,8 +140,6 @@ jobs:
         run: |
           set -euo pipefail
           tag="runtime-${GITHUB_SHA::12}"
-          cat dist/SHA256SUMS-* | sort -u > dist/SHA256SUMS
-          rm -f dist/SHA256SUMS-*
           if gh release view "${tag}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
             gh release upload "${tag}" dist/*.tar.gz dist/SHA256SUMS \
               --repo "${GITHUB_REPOSITORY}" --clobber
@@ -193,7 +148,7 @@ jobs:
               --repo "${GITHUB_REPOSITORY}" \
               --target "${GITHUB_SHA}" \
               --title "XWorkspace Console runtime ${GITHUB_SHA::12}" \
-              --notes "Prebuilt Linux and macOS runtime assets. No target-host build is required."
+              --notes "Prebuilt console runtime (cross-compiled Go API + universal dashboard dist). Targets: darwin-arm64, linux-amd64, linux-arm64."
           fi
           echo "tag=${tag}" >> "$GITHUB_OUTPUT"