feat(release): allow native build profile override

.github/workflows/publish.yaml

@@ -12,6 +12,15 @@ on:
         required: true
         type: boolean
         default: true
+      profile:
+        description: "Native binary build profile. Auto keeps releases optimized and previews in debug mode."
+        required: true
+        type: choice
+        options:
+          - auto
+          - release
+          - debug
+        default: auto
 
 concurrency:
   group: publish-${{ github.ref }}
@@ -35,6 +44,7 @@ jobs:
       npm_tag: ${{ steps.ctx.outputs.npm_tag }}
       sha: ${{ steps.ctx.outputs.sha }}
       latest: ${{ steps.ctx.outputs.latest }}
+      build_profile: ${{ steps.mode.outputs.profile }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -49,6 +59,26 @@ jobs:
       - id: ctx
         name: Resolve publish context
         run: pnpm --filter=publish exec tsx src/ci/bin.ts context-output
+      - id: mode
+        name: Resolve native build profile
+        env:
+          REQUESTED_PROFILE: ${{ inputs.profile }}
+          TRIGGER: ${{ steps.ctx.outputs.trigger }}
+        run: |
+          set -euo pipefail
+          profile="${REQUESTED_PROFILE:-auto}"
+          if [ "$profile" = "auto" ]; then
+            if [ "$TRIGGER" = "release" ]; then
+              profile="release"
+            else
+              profile="debug"
+            fi
+          fi
+          case "$profile" in
+            release|debug) ;;
+            *) echo "invalid native build profile: $profile" >&2; exit 2 ;;
+          esac
+          echo "profile=$profile" >> "$GITHUB_OUTPUT"
 
   wasm-commands:
     name: WASM Commands
@@ -121,23 +151,14 @@ jobs:
         with:
           name: agentos-${{ matrix.platform }}
           keep-state: ${{ contains(matrix.runner, 'self-hosted') }}
-      - name: Resolve build profile
-        id: mode
-        run: |
-          set -euo pipefail
-          if [ "${{ needs.context.outputs.trigger }}" = "release" ]; then
-            echo "profile=release" >> "$GITHUB_OUTPUT"
-          else
-            echo "profile=debug" >> "$GITHUB_OUTPUT"
-          fi
       - name: Build linux artifacts
         uses: docker/build-push-action@v6
         with:
           context: .
           file: docker/build/linux-gnu.Dockerfile
           build-args: |
             TARGET=${{ matrix.target }}
-            BUILD_PROFILE=${{ steps.mode.outputs.profile }}
+            BUILD_PROFILE=${{ needs.context.outputs.build_profile }}
             CACHE_PLATFORM=${{ matrix.platform }}
             RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}
             LINUX_GNU_LLVM_VERSION=${{ env.LINUX_GNU_LLVM_VERSION }}
@@ -197,15 +218,6 @@ jobs:
           keep-state: true
       - name: Log in to ghcr.io
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-      - name: Compute build profile
-        id: mode
-        run: |
-          set -euo pipefail
-          if [ "${{ needs.context.outputs.trigger }}" = "release" ]; then
-            echo "profile=release" >> "$GITHUB_OUTPUT"
-          else
-            echo "profile=debug" >> "$GITHUB_OUTPUT"
-          fi
       - name: Cross-compile via osxcross
         uses: docker/build-push-action@v6
         with:
@@ -214,7 +226,7 @@ jobs:
           build-args: |
             TARGET=${{ matrix.target }}
             CLANG=${{ matrix.clang }}
-            BUILD_PROFILE=${{ steps.mode.outputs.profile }}
+            BUILD_PROFILE=${{ needs.context.outputs.build_profile }}
             CACHE_PLATFORM=${{ matrix.platform }}
             RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN }}
           tags: agentos-darwin-${{ matrix.platform }}

CLAUDE.md

@@ -226,6 +226,9 @@ custom host-syscall imports. Treat that target as **native POSIX**;
 - The release workflow must build and stage the native sidecar binaries,
   runtime-sidecar binaries, registry WASM commands, and pyodide assets before
   publish.
+- For an urgent release, use `just release-fast --patch` (or pass
+  `--profile debug` to `just release`). This still rebuilds every release
+  artifact, but publishes larger, unoptimized debug native binaries.
 - `scripts/verify-fixed-versions.mjs` must pass in the committed tree.
 
 ## Docs

justfile

@@ -3,6 +3,10 @@ set positional-arguments := true
 release *args:
 	pnpm --filter=publish release "$@"
 
+# Emergency release path: compile larger, slower debug sidecars.
+release-fast *args:
+	pnpm --filter=publish release --profile debug "$@"
+
 # Cut a release-preview (debug build, npm-only, branch dist-tag) — see the
 # release-preview skill for the end-to-end flow.
 release-preview REF:

scripts/publish/src/local/cut-release.ts

@@ -61,6 +61,7 @@ interface CliOpts {
 	dryRun?: boolean;
 	yes?: boolean;
 	skipChecks?: boolean;
+	profile?: string;
 }
 
 async function main() {
@@ -77,10 +78,15 @@ async function main() {
 		.option("--dry-run", "Resolve and print the release plan without triggering the workflow")
 		.option("-y, --yes", "Skip interactive confirmation")
 		.option("--skip-checks", "Skip local type-check fail-fast")
+		.option("--profile <profile>", "Native binary build profile (release or debug)", "release")
 		.parse();
 
 	const opts = program.opts<CliOpts>();
 	const repoRoot = findRepoRoot();
+	const profile = opts.profile ?? "release";
+	if (profile !== "release" && profile !== "debug") {
+		throw new Error(`invalid --profile ${profile}; expected release or debug`);
+	}
 
 	// 1. Resolve version.
 	const version = await resolveVersion({
@@ -107,6 +113,7 @@ async function main() {
 	console.log("Release plan");
 	console.log(`  Version:  ${version}`);
 	console.log(`  Latest:   ${latest}`);
+	console.log(`  Profile:  ${profile}`);
 	console.log(`  Branch:   ${branch.trim()}`);
 	console.log(`  Previous: ${latestGit ?? "(none)"}`);
 	if (opts.dryRun) console.log("  Dry run:  no workflow trigger");
@@ -150,7 +157,7 @@ async function main() {
 	await $({
 		stdio: "inherit",
 		cwd: repoRoot,
-	})`gh workflow run .github/workflows/publish.yaml -f version=${version} -f latest=${latestFlag} --ref ${currentBranch}`;
+	})`gh workflow run .github/workflows/publish.yaml -f version=${version} -f latest=${latestFlag} -f profile=${profile} --ref ${currentBranch}`;
 
 	const { stdout: repo } =
 		await $`gh repo view --json nameWithOwner -q .nameWithOwner`;