ci(amicode): build and release a linux-arm64 binary

.github/workflows/amicode-release.yml

@@ -1,8 +1,8 @@
 # AMICODE fork: tag-triggered binary release.
 # Push a tag `v<base-version>-amicode.<n>` (e.g. v1.17.3-amicode.4) → builds
-# linux-x64 (native) + darwin-arm64 (cross-compiled), verifies the channel
-# gate (AMICODE-PATCHES.md gotcha 2), and publishes a GitHub release with
-# sha256s. Replaces the hand-rolled releases (amicode.1–.3).
+# linux-x64 (native) + darwin-arm64 and linux-arm64 (both cross-compiled),
+# verifies the channel gate (AMICODE-PATCHES.md gotcha 2), and publishes a
+# GitHub release with sha256s. Replaces the hand-rolled releases (amicode.1–.3).
 name: amicode-release
 on:
   push:
@@ -37,18 +37,21 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
-      - name: Build linux-x64 (native) + darwin-arm64 (cross)
+      - name: Build linux-x64 (native) + darwin-arm64, linux-arm64 (cross)
         working-directory: packages/opencode
         env:
           OPENCODE_VERSION: ${{ steps.v.outputs.version }}
           # NOT "latest": that compiles the web UI with VITE_OPENCODE_CHANNEL=prod,
           # defaulting newLayoutDesigns OFF and hiding every amicode surface
           # (gotcha 2 in AMICODE-PATCHES.md; bit releases amicode.1/.2).
           OPENCODE_CHANNEL: dev
-          OPENCODE_BUILD_TARGETS: "opencode-linux-x64,opencode-darwin-arm64"
+          # linux-arm64 serves devcontainers on Apple Silicon (amicode ships it as
+          # a third lean .vsix target). Bun cross-compiles it from this x64 runner,
+          # same as darwin-arm64.
+          OPENCODE_BUILD_TARGETS: "opencode-linux-x64,opencode-darwin-arm64,opencode-linux-arm64"
         run: bun run script/build.ts
 
-      - name: Gate check — amicode UI default must be ON in both binaries
+      - name: Gate check — amicode UI default must be ON in every binary
         run: |
           set -euo pipefail
           check() {
@@ -82,31 +85,37 @@ jobs:
           LIN=packages/opencode/dist/opencode-linux-x64/bin/opencode
           check "$LIN"
           check packages/opencode/dist/opencode-darwin-arm64/bin/opencode
+          check packages/opencode/dist/opencode-linux-arm64/bin/opencode
+          # Only the native binary can be executed here; the two cross builds are
+          # grep-gated above and smoke-tested downstream (amicode's boot-smoke job
+          # runs linux-arm64 natively on an arm runner).
           GOT=$("$LIN" --version)
           [ "$GOT" = "${{ steps.v.outputs.version }}" ] || { echo "FAIL: --version=$GOT expected ${{ steps.v.outputs.version }}"; exit 1; }
 
       - name: Package assets (flat 'opencode' inside, per amicode fetcher contract)
         run: |
           set -euo pipefail
           mkdir -p out
-          cp packages/opencode/dist/opencode-linux-x64/bin/opencode out/opencode
-          tar -czf out/opencode-linux-x64.tar.gz -C out opencode && rm out/opencode
+          for ARCH in x64 arm64; do
+            cp "packages/opencode/dist/opencode-linux-$ARCH/bin/opencode" out/opencode
+            tar -czf "out/opencode-linux-$ARCH.tar.gz" -C out opencode && rm out/opencode
+          done
           (cd packages/opencode/dist/opencode-darwin-arm64/bin && zip -qj "$GITHUB_WORKSPACE/out/opencode-darwin-arm64.zip" opencode)
-          sha256sum out/opencode-linux-x64.tar.gz out/opencode-darwin-arm64.zip | sed 's|out/||' | tee out/SHA256SUMS.txt
+          sha256sum out/opencode-linux-x64.tar.gz out/opencode-linux-arm64.tar.gz out/opencode-darwin-arm64.zip | sed 's|out/||' | tee out/SHA256SUMS.txt
 
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           TAG="${{ steps.v.outputs.tag }}"
-          NOTES="opencode fork binary for amicode bundling. Built by the amicode-release workflow from \`$TAG\` @ $GITHUB_SHA; base opencode ${{ steps.v.outputs.version }}; OPENCODE_CHANNEL=dev (UI gate verified ON in both binaries).
+          NOTES="opencode fork binary for amicode bundling. Built by the amicode-release workflow from \`$TAG\` @ $GITHUB_SHA; base opencode ${{ steps.v.outputs.version }}; OPENCODE_CHANNEL=dev (UI gate verified ON in every binary).
 
-          Assets: linux-x64 (native, smoke-tested), darwin-arm64 (cross-compiled from Linux — not natively smoke-tested).
+          Assets: linux-x64 (native, smoke-tested), linux-arm64 and darwin-arm64 (cross-compiled from Linux — not smoke-tested here; amicode's boot-smoke covers linux-arm64 natively).
 
           sha256 (pin these in amicode's opencode.lock.json):
           \`\`\`
           $(cat out/SHA256SUMS.txt)
           \`\`\`"
           gh release create "$TAG" --title "Amicode binary $TAG" --notes "$NOTES" \
-            out/opencode-linux-x64.tar.gz out/opencode-darwin-arm64.zip
+            out/opencode-linux-x64.tar.gz out/opencode-linux-arm64.tar.gz out/opencode-darwin-arm64.zip