ci(tui): cross-build releases on free runners

.github/workflows/ci.yml

@@ -197,14 +197,8 @@ jobs:
         include:
           - name: Terminal UI
             os: ubuntu-latest
-          - name: Terminal UI (macOS)
-            os: macos-latest
-          - name: Terminal UI (macOS Intel)
-            os: macos-15-intel
           - name: Terminal UI (Windows)
             os: windows-latest
-          - name: Terminal UI (Linux arm64)
-            os: ubuntu-24.04-arm
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/tui-release.yml

@@ -10,22 +10,17 @@ permissions:
 jobs:
   build:
     name: ${{ matrix.target }}
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - os: macos-15
-            target: darwin-arm64
-          - os: macos-15-intel
-            target: darwin-x64
-          - os: ubuntu-latest
-            target: linux-x64
-          - os: ubuntu-24.04-arm
-            target: linux-arm64
-          - os: windows-latest
-            target: win32-x64
+        target:
+          - darwin-arm64
+          - darwin-x64
+          - linux-arm64
+          - linux-x64
+          - win32-x64
 
     steps:
       - uses: actions/checkout@v4
@@ -39,10 +34,31 @@ jobs:
         working-directory: tui
         run: bun install --frozen-lockfile
 
+      - name: Install ${{ matrix.target }} native dependencies
+        working-directory: tui
+        run: bun scripts/prepare-target.ts ${{ matrix.target }}
+
       - name: Build ${{ matrix.target }}
         working-directory: tui
         run: bun run build -- ${{ matrix.target }}
 
+      - name: Ad-hoc sign macOS executable
+        if: startsWith(matrix.target, 'darwin-')
+        uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1
+        with:
+          input_path: tui/dist/nanobot-tui-${{ matrix.target }}
+          rcodesign_version: 0.29.0
+
+      - name: Refresh signed checksum
+        working-directory: tui/dist
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          asset="nanobot-tui-${TARGET}"
+          if [[ "$TARGET" == win32-* ]]; then asset="${asset}.exe"; fi
+          sha256sum "$asset" > "${asset}.sha256"
+
       - name: Upload release assets
         env:
           GH_TOKEN: ${{ github.token }}

tui/scripts/prepare-target.ts

@@ -0,0 +1,41 @@
+import { join } from "node:path"
+
+const packagesByTarget: Record<string, string[]> = {
+  "darwin-arm64": ["@opentui/core-darwin-arm64"],
+  "darwin-x64": ["@opentui/core-darwin-x64"],
+  "linux-arm64": ["@opentui/core-linux-arm64", "@opentui/core-linux-arm64-musl"],
+  "linux-x64": ["@opentui/core-linux-x64", "@opentui/core-linux-x64-musl"],
+  "win32-x64": ["@opentui/core-win32-x64"],
+}
+
+const target = process.argv[2]
+if (!target) throw new Error("target is required")
+const packages = packagesByTarget[target]
+if (!packages) throw new Error(`unsupported target: ${target}`)
+
+const root = join(import.meta.dir, "..")
+const manifest = await Bun.file(join(root, "package.json")).json()
+const version = manifest.dependencies?.["@opentui/core"]
+if (typeof version !== "string" || !/^\d+\.\d+\.\d+$/.test(version)) {
+  throw new Error("@opentui/core must use an exact version")
+}
+
+const npm = process.platform === "win32" ? "npm.cmd" : "npm"
+const result = Bun.spawnSync(
+  [
+    npm,
+    "install",
+    "--no-save",
+    "--ignore-scripts",
+    "--force",
+    "--package-lock=false",
+    ...packages.map((name) => `${name}@${version}`),
+  ],
+  {
+    cwd: root,
+    stdout: "inherit",
+    stderr: "inherit",
+  },
+)
+
+if (result.exitCode !== 0) process.exit(result.exitCode)