build: publish static Linux x64 browser CLI

.github/workflows/ci.yml

@@ -18,15 +18,15 @@ jobs:
       - run: cargo clippy --all-targets --locked -- -D warnings
       - name: Verify release target contract
         run: |
-          ! grep -q 'x86_64-unknown-linux' .github/workflows/release.yml
+          grep -q 'x86_64-unknown-linux-musl' .github/workflows/release.yml
           ! grep -q 'x86_64-apple-darwin' .github/workflows/release.yml
           grep -q 'aarch64-apple-darwin' .github/workflows/release.yml
           grep -q 'x86_64-pc-windows-msvc' .github/workflows/release.yml
           grep -q 'environment: macos-release' .github/workflows/release.yml
           grep -q './scripts/sign_and_notarize_macos.sh' .github/workflows/release.yml
           grep -q 'environment: cos-release' .github/workflows/release.yml
           grep -q './scripts/upload-release-to-cos.sh cos-upload browser-cli' .github/workflows/release.yml
-          grep -q 'needs: \[build-macos, build-windows\]' .github/workflows/release.yml
+          grep -q 'needs: \[build-linux, build-macos, build-windows\]' .github/workflows/release.yml
           ! grep -q 'skills/lexmount-browser/bin/' .github/workflows/release.yml
       - run: bash -n scripts/sign_and_notarize_macos.sh scripts/upload-release-to-cos.sh
       - run: sh -n scripts/package-skill.sh skills/lexmount-browser/scripts/bootstrap.sh skills/lexmount-browser/scripts/doctor.sh

.github/workflows/release.yml

@@ -37,6 +37,37 @@ jobs:
           name: release-aarch64-apple-darwin
           path: browser-cli-v*-aarch64-apple-darwin*
 
+  build-linux:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-musl
+      - run: sudo apt-get update && sudo apt-get install --yes musl-tools
+      - run: cargo test --locked
+      - name: Build static Linux binary
+        env:
+          CC_x86_64_unknown_linux_musl: musl-gcc
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
+        run: cargo build --release --locked --target x86_64-unknown-linux-musl
+      - name: Package
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          asset="browser-cli-v${version}-x86_64-unknown-linux-musl"
+          cp target/x86_64-unknown-linux-musl/release/browser-cli "$asset"
+          chmod 755 "$asset"
+          if readelf --program-headers --wide "$asset" | grep -F 'Requesting program interpreter'; then
+            echo 'Linux release binary is dynamically linked' >&2
+            exit 1
+          fi
+          "./$asset" version
+          sha256sum "$asset" > "$asset.sha256"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-x86_64-unknown-linux-musl
+          path: browser-cli-v*-x86_64-unknown-linux-musl*
+
   build-windows:
     runs-on: windows-latest
     steps:
@@ -59,7 +90,7 @@ jobs:
           path: browser-cli-v*-x86_64-pc-windows-msvc*
 
   publish:
-    needs: [build-macos, build-windows]
+    needs: [build-linux, build-macos, build-windows]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: cos-release
@@ -89,6 +120,7 @@ jobs:
           mkdir cos-upload
           cp \
             "browser-cli-v${version}-aarch64-apple-darwin" \
+            "browser-cli-v${version}-x86_64-unknown-linux-musl" \
             "browser-cli-v${version}-x86_64-pc-windows-msvc.exe" \
             cos-upload/
           (cd cos-upload && sha256sum browser-cli-v* | sort -k2 > SHA256SUMS)

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "lexmount-browser"
-version = "1.1.13"
+version = "1.1.14"
 edition = "2024"
 license = "MIT"
 description = "Native Rust SDK and CLI for Lexmount cloud browsers"

README.md

@@ -44,19 +44,18 @@ metadata, Claude Code uses `${CLAUDE_SKILL_DIR}`, and WorkBuddy/CodeBuddy uses
 or download inputs. Once started, the bootstrap and doctor scripts also locate
 the Skill directory from their own path.
 
-Published binaries are intentionally limited to two targets: macOS arm64 and
-Windows x64. The macOS binary is signed with a Developer ID Application
-certificate, hardened-runtime enabled, and accepted by Apple's notarization
-service before it is published. Linux and macOS Intel remain unsupported
-release platforms.
+Published binaries include macOS arm64, Windows x64, and static Linux x64. The
+macOS binary is signed with a Developer ID Application certificate,
+hardened-runtime enabled, and accepted by Apple's notarization service before
+it is published. macOS Intel remains an unsupported release platform.
 
 The release workflow reads the signing certificate and notarization credentials
 from the `macos-release` GitHub environment. It requires
 `MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64`,
 `MACOS_DEVELOPER_ID_P12_PASSWORD`, `APPLE_NOTARY_APPLE_ID`,
 `APPLE_NOTARY_TEAM_ID`, and `APPLE_NOTARY_APP_PASSWORD`.
 
-The publish job uploads both platform binaries and their checksum manifest to
+The publish job uploads all three platform binaries and their checksum manifest to
 Tencent Cloud COS through the `cos-release` GitHub environment. It requires
 `TENCENT_CLOUD_SECRET_ID` and `TENCENT_CLOUD_SECRET_KEY` secrets plus
 `COS_BUCKET`, `COS_REGION`, `COS_PUBLIC_BASE_URL`, and `COS_OBJECT_PREFIX`

skills/lexmount-browser/scripts/bootstrap.ps1

@@ -12,7 +12,7 @@ function Invoke-Tls12Download {
   }
 }
 
-$version = if ($env:LEXMOUNT_BROWSER_CLI_VERSION) { $env:LEXMOUNT_BROWSER_CLI_VERSION } else { "1.1.13" }
+$version = if ($env:LEXMOUNT_BROWSER_CLI_VERSION) { $env:LEXMOUNT_BROWSER_CLI_VERSION } else { "1.1.14" }
 $downloadBaseUrl = if ($env:LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL) { $env:LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL.TrimEnd('/') } else { "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli" }
 $architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
 if ($architecture -ne "AMD64") { throw "Only Windows x64 is supported" }

skills/lexmount-browser/scripts/bootstrap.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 
-version="${LEXMOUNT_BROWSER_CLI_VERSION:-1.1.13}"
+version="${LEXMOUNT_BROWSER_CLI_VERSION:-1.1.14}"
 download_base_url="${LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL:-https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli}"
 repo="${download_base_url%/}/v${version}"
 case "$(uname -s)-$(uname -m)" in