fix(ci): predict release impact and align Nightly build contracts

.github/workflows/linux-binaries.yml

@@ -15,6 +15,26 @@ on:
         description: "Stable prefix that isolates artifacts in the caller run."
         required: true
         type: string
+      artifact_retention_days:
+        description: "Retention for uploaded build artifacts."
+        required: false
+        default: 7
+        type: number
+      upload_artifacts:
+        description: "Whether to upload archives for a publishing caller."
+        required: false
+        default: true
+        type: boolean
+      cache_write:
+        description: "Allow a trusted non-PR caller to refresh build caches."
+        required: false
+        default: false
+        type: boolean
+      validate_relay_image:
+        description: "Build the Relay runtime image for each native architecture without pushing it."
+        required: false
+        default: true
+        type: boolean
     secrets:
       release_signing_key:
         description: "Tauri/minisign private key, base64. Absent on forks: archives ship unsigned."
@@ -47,9 +67,11 @@ jobs:
           - os: ubuntu-22.04
             name: linux-x64
             target: x86_64-unknown-linux-gnu
+            docker_arch: amd64
           - os: ubuntu-22.04-arm
             name: linux-arm64
             target: aarch64-unknown-linux-gnu
+            docker_arch: arm64
 
     steps:
       - name: Checkout
@@ -61,6 +83,13 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.3.14"
+          no-cache: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version-file: package.json
+          package-manager-cache: false
 
       - name: Build plugin Host resources
         run: |
@@ -91,8 +120,13 @@ jobs:
       - name: Cache Rust build
         uses: swatinem/rust-cache@v2
         with:
-          shared-key: "linux-binaries-v1-${{ matrix.platform.name }}"
+          shared-key: "linux-binaries-v2-${{ github.base_ref || github.ref_name }}-${{ matrix.platform.name }}"
           cache-bin: false
+          save-if: ${{ inputs.cache_write && github.event_name != 'pull_request' }}
+          cache-on-failure: ${{ inputs.cache_write && github.event_name != 'pull_request' }}
+
+      - name: Verify committed Cargo metadata
+        run: cargo metadata --locked --no-deps
 
       - name: Patch build version
         shell: bash
@@ -106,12 +140,10 @@ jobs:
           # the same way, which also keeps the two asset sets on one version string.
           ASSET_VERSION="${RELEASE_VERSION%%+*}"
           echo "ASSET_VERSION=${ASSET_VERSION}" >>"$GITHUB_ENV"
-          sed -i \
-            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
-            Cargo.toml
-          sed -i \
-            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
-            src/apps/relay-server/Cargo.toml
+          node scripts/set-build-version.mjs --version "$ASSET_VERSION"
+
+      - name: Verify projected Cargo metadata
+        run: cargo metadata --locked --no-deps
 
       - name: Build CLI and Relay Server
         shell: bash
@@ -121,7 +153,7 @@ jobs:
           # checksum-only.
           BITFUN_RELEASE_PUBKEY: ${{ secrets.release_pubkey }}
         run: |
-          cargo build --release \
+          cargo build --locked --release \
             --target ${{ matrix.platform.target }} \
             -p bitfun-cli \
             -p bitfun-relay-server \
@@ -179,12 +211,58 @@ jobs:
             "$CLI_ARCHIVE" "${CLI_ARCHIVE}.sha256" \
             "$RELAY_ARCHIVE" "${RELAY_ARCHIVE}.sha256"
 
+      - name: Verify Linux binary outputs
+        shell: bash
+        env:
+          CLI_ARCHIVE: ${{ steps.cli-stage.outputs.archive }}
+          CLI_CHECKSUM: ${{ steps.cli-stage.outputs.checksum }}
+          RELAY_ARCHIVE: ${{ steps.relay-stage.outputs.archive }}
+          RELAY_CHECKSUM: ${{ steps.relay-stage.outputs.checksum }}
+        run: |
+          set -euo pipefail
+          test -s "$CLI_ARCHIVE"
+          test -s "$CLI_CHECKSUM"
+          test -s "$RELAY_ARCHIVE"
+          test -s "$RELAY_CHECKSUM"
+          sha256sum --check "$CLI_CHECKSUM"
+          sha256sum --check "$RELAY_CHECKSUM"
+
+      - name: Stage Relay image validation context
+        if: ${{ inputs.validate_relay_image }}
+        shell: bash
+        env:
+          RELAY_ARCHIVE: ${{ steps.relay-stage.outputs.archive }}
+        run: |
+          set -euo pipefail
+          mkdir -p relay-image-context
+          cp "$RELAY_ARCHIVE" relay-image-context/
+          cp src/apps/relay-server/Dockerfile.release relay-image-context/
+
+      - name: Set up Docker Buildx
+        if: ${{ inputs.validate_relay_image }}
+        uses: docker/setup-buildx-action@v4
+
+      - name: Validate Relay runtime image
+        if: ${{ inputs.validate_relay_image }}
+        uses: docker/build-push-action@v7
+        with:
+          context: relay-image-context
+          file: relay-image-context/Dockerfile.release
+          platforms: linux/${{ matrix.platform.docker_arch }}
+          push: false
+          provenance: false
+          sbom: false
+          build-args: |
+            VERSION=${{ inputs.version }}
+            REVISION=${{ inputs.checkout_ref }}
+
       - name: Upload Linux binary artifacts
+        if: ${{ inputs.upload_artifacts }}
         uses: actions/upload-artifact@v6
         with:
           name: bitfun-linux-${{ inputs.artifact_prefix }}-${{ matrix.platform.name }}
           if-no-files-found: error
-          retention-days: 7
+          retention-days: ${{ inputs.artifact_retention_days }}
           path: |
             ${{ steps.cli-stage.outputs.archive }}
             ${{ steps.cli-stage.outputs.checksum }}