chore(build): rework build process

.github/workflows/build.yaml

@@ -16,90 +16,68 @@ name: Build
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 permissions:
   contents: read
 
 jobs:
-  build-no-console:
-    name: Build (no console, no CGO)
+  # Linux + Windows are cross-compiled with zig on a (cheap) Linux runner.
+  cross-build:
+    name: Cross-build linux+windows (zig)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          submodules: true
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
 
-      - name: Build without console tag
-        env:
-          CGO_ENABLED: "0"
-        run: go build -o bin/lk ./cmd/lk
-
-      - name: Verify binary
-        run: bin/lk --help > /dev/null
-
-  lint-and-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Install Zig
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
-          submodules: true
+          version: 0.14.1
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - name: Cache cross-compile inputs
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
-          go-version-file: go.mod
+          path: .cross
+          key: cross-${{ runner.os }}-zig0.14.1-alsa1.2.12-${{ hashFiles('scripts/setup-cross.sh') }}
 
-      - name: Static Check
-        uses: dominikh/staticcheck-action@288b4e28bae83c59f35f73651aeb5cab746a06fc # v1.4.0
+      - name: GoReleaser snapshot build
+        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
         with:
-          version: "latest"
-          install-go: false
-
-      - name: Test
-        run: go test -v ./...
+          distribution: goreleaser
+          version: latest
+          # darwin is excluded here — it can't be cross-compiled from Linux
+          # (no macOS SDK/CoreAudio); it builds natively in the macos job below.
+          args: >-
+            build --snapshot --clean
+            --id lk-linux-amd64 --id lk-linux-arm64
+            --id lk-windows-amd64 --id lk-windows-arm64
+        env:
+          # goreleaser-action runs goreleaser via a Node wrapper that doesn't
+          # forward PWD; the .goreleaser.yaml CGO flags template {{ .Env.PWD }}
+          # to locate .cross/<target>. Provide it explicitly.
+          PWD: ${{ github.workspace }}
 
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: macos-latest
-            suffix: darwin_arm64
-          - os: ubuntu-latest
-            suffix: linux_amd64
-            zig_target: x86_64-linux-gnu.2.28
-            alsa_arch: amd64
-            alsa_triple: x86_64-linux-gnu
-          - os: ubuntu-latest
-            suffix: linux_arm64
-            zig_target: aarch64-linux-gnu.2.28
-            alsa_arch: arm64
-            alsa_triple: aarch64-linux-gnu
-            goarch: arm64
-          - os: ubuntu-latest
-            suffix: linux_arm
-            zig_target: arm-linux-gnueabihf.2.28
-            alsa_arch: armhf
-            alsa_triple: arm-linux-gnueabihf
-            goarch: arm
-            goarm: "7"
-          - os: ubuntu-latest
-            suffix: windows_amd64
-            zig_target: x86_64-windows-gnu
-            goos: windows
-            goarch: amd64
-          - os: ubuntu-latest
-            suffix: windows_arm64
-            zig_target: aarch64-windows-gnu
-            goos: windows
-            goarch: arm64
-    runs-on: ${{ matrix.os }}
+      - name: Verify linux binary runs
+        run: |
+          binary=$(find dist -type f -name lk -path '*linux*amd64*' | head -n1)
+          test -n "$binary" || { echo "no linux/amd64 binary in dist/"; exit 1; }
+          # Static-libgcc/libstdc++ binary should run on glibc 2.28+ Ubuntu runners.
+          "$binary" --help > /dev/null
+
+  # darwin builds natively on macOS — its cgo links the CoreAudio frameworks,
+  # which only exist on a Mac. No zig needed.
+  build-darwin:
+    name: Build darwin (native)
+    runs-on: macos-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -110,73 +88,11 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Install Zig
-        if: matrix.zig_target
-        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
-        with:
-          version: 0.14.1
-
-      - name: Install ALSA headers
-        if: matrix.alsa_arch
-        run: |
-          sudo dpkg --add-architecture ${{ matrix.alsa_arch }}
-          if [ "${{ matrix.alsa_arch }}" != "amd64" ]; then
-            CODENAME=$(lsb_release -cs)
-            # Restrict existing sources to amd64 to avoid 404s for foreign arch
-            for f in /etc/apt/sources.list.d/*.sources; do
-              grep -q '^Architectures:' "$f" || sudo sed -i '/^Types:/a Architectures: amd64 i386' "$f"
-            done
-            # Add ports.ubuntu.com for the foreign architecture
-            printf 'Types: deb\nURIs: http://ports.ubuntu.com/ubuntu-ports\nSuites: %s %s-updates\nComponents: main universe\nArchitectures: %s\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n' \
-              "$CODENAME" "$CODENAME" "${{ matrix.alsa_arch }}" | sudo tee /etc/apt/sources.list.d/ports.sources
-          fi
-          sudo apt-get update
-          sudo apt-get install -y libasound2-dev:${{ matrix.alsa_arch }}
-
-      - name: Generate Windows import libraries
-        if: matrix.goos == 'windows' && matrix.zig_target
+      - name: Build and verify
         run: |
-          ZIG_LIB=$(zig env | jq -r '.lib_dir')
-          echo "ZIG_LIB=${ZIG_LIB}" >> "$GITHUB_ENV"
-          LIB_DIR="${ZIG_LIB}/libc/mingw/lib-common"
-          # Zig bundles MinGW .def files but lld needs .a import libraries.
-          # Go's compiled objects embed COFF /DEFAULTLIB directives (e.g. dbghelp,
-          # bcrypt) that lld resolves directly, bypassing Zig's lazy .def→.a
-          # generation. Pre-generate all import libraries so lld can find them.
-          MACHINE=${{ matrix.goarch == 'amd64' && 'i386:x86-64' || 'arm64' }}
-          for def in "${LIB_DIR}"/*.def; do
-            lib=$(basename "$def" .def)
-            [ -f "${LIB_DIR}/lib${lib}.a" ] && continue
-            zig dlltool -d "$def" -l "${LIB_DIR}/lib${lib}.a" -m "$MACHINE" 2>/dev/null || true
-          done
-
-      - name: Build
-        env:
-          CGO_ENABLED: ${{ (matrix.goos && !matrix.zig_target) && '0' || '1' }}
-          CC: ${{ matrix.zig_target && format('zig cc -target {0}', matrix.zig_target) || '' }}
-          CXX: ${{ matrix.zig_target && format('zig c++ -target {0}', matrix.zig_target) || '' }}
-          # Zig uses its own sysroot; point it at the system ALSA headers and libraries
-          CGO_CFLAGS: ${{ matrix.alsa_triple && format('-isystem /usr/include -isystem /usr/include/{0}', matrix.alsa_triple) || '' }}
-          CGO_LDFLAGS: ${{ matrix.alsa_triple && format('-L/usr/lib/{0}', matrix.alsa_triple) || '' }}
-          # -fms-extensions: enable __try/__except (SEH) used by WebRTC
-          # -DNTDDI_VERSION: target Windows 10 base to skip WinRT includes absent from MinGW
-          CGO_CXXFLAGS: ${{ matrix.goos == 'windows' && '-fms-extensions -DNTDDI_VERSION=0x0A000000' || '' }}
-          GOOS: ${{ matrix.goos || '' }}
-          GOARCH: ${{ matrix.goarch || '' }}
-          GOARM: ${{ matrix.goarm || '' }}
-        shell: bash
-        run: |
-          EXT=""; if [ "${GOOS:-}" = "windows" ]; then EXT=".exe"; fi
-          TAGS=""
-          if [ "$CGO_ENABLED" = "1" ]; then TAGS="-tags console"; fi
-          # Force external linking for Windows so Go uses zig cc (CC) as the linker,
-          # and add Zig's MinGW lib path so lld can find the generated import libraries.
-          EXTLD=""
-          if [ "${GOOS:-}" = "windows" ] && [ "$CGO_ENABLED" = "1" ]; then
-            EXTLD="-linkmode=external -extldflags '-L${ZIG_LIB}/libc/mingw/lib-common'"
-          fi
-          go build $TAGS -ldflags "-w -s $EXTLD" -o "bin/lk${EXT}" ./cmd/lk
-
-      - name: Verify binary
-        if: "!matrix.goos && !matrix.goarch"
-        run: bin/lk --help > /dev/null
+          # arm64 native — build and run.
+          CGO_ENABLED=1 go build -o /tmp/lk ./cmd/lk
+          /tmp/lk --help > /dev/null
+          # amd64 (Intel) cross — Apple clang targets x86_64 from arm64; compile
+          # only (can't run an x86_64 binary on the arm64 runner).
+          CGO_ENABLED=1 GOARCH=amd64 go build -o /tmp/lk-amd64 ./cmd/lk