# CI: cross-platform release binaries

`release.yml` builds the MoonBite node (`moonbited` + `moonbite-cli`) and the
solo-miner bundle for **Linux, Windows, and both macOS architectures**, and
attaches them to a GitHub Release on every `v*` tag.

## Reproducible, attested releases (2026-10-10)

Two workflows now carry the release trust model described in
[`docs/REPRODUCIBLE-BUILDS.md`](../../docs/REPRODUCIBLE-BUILDS.md); both are
SHA-pinned on every third-party action:

| Workflow | Repo | Does |
|---|---|---|
| `.github/workflows/release.yml` | moonbite-core | deterministic flags (`SOURCE_DATE_EPOCH`, `-ffile-prefix-map`, `strip -D`, sorted fixed-mtime archives), Linux target built **twice on separate runners** and compared, Sigstore attestation (`actions/attest-build-provenance`), optional minisign of `SHA256SUMS.txt`, disabled Guix job stub |
| `.github/workflows/release-bundles.yml` | this repo | downloads the core Windows binaries for the same tag, verifies sha256 + attestation (+ minisign once the key is live), builds the miner and wallet zips with `scripts/release/make-bundle.py` twice and compares, attests, optionally minisigns, uploads to this repo's Release |

User-side verification: `scripts/release/verify-release.sh` and
`scripts/release/Verify-Release.ps1` (sha256, minisign, `gh attestation verify`).

Secrets (both repos, optional): `MINISIGN_SECRET_KEY` (minisign secret key file
body) and `MINISIGN_PASSWORD`. When absent the signing step is skipped with a
notice and the manifest is published unsigned; the attestation and the
reproducibility gate still apply.

## Where it goes

This file builds the **C++ node**, so it lives in the node repo:

```
moonbite-core/.github/workflows/release.yml
```

The stale, unpinned copy that used to live here (`deploy/ci/release.yml`) was
deleted in the 2026-10-09 hardening (audit M3): a second copy drifts, and an
unpinned workflow is not a reviewable reference. Review the live one in
moonbite-core.

## How it works

- Rebuilds **RandomX v1.2.1** from source for each target and overwrites the
  vendored Linux `librandomx.a`. That version was verified byte-identical to
  the vendored library (same 32-byte-seed hash), so every platform's binary is
  consensus-correct.
- Builds dependencies with the `depends` system, `NO_QT=1` (daemon + cli only).
- **Windows** is cross-compiled from an Ubuntu runner with mingw-w64 (posix
  threads). **macOS** builds natively on GitHub's macOS runners, which carry the
  Apple SDK that cannot be used off Apple hardware - the reason macOS cannot be
  cross-built from Linux.
- Bundles the binaries with `mine.sh` / `mine.ps1` / `README.md` pulled from
  this repo (`release/miner/`), so the miner scripts have one source of truth.
- Publishes all archives plus `SHA256SUMS.txt` to the Release.

## Releasing

```bash
git tag v0.1.0 && git push origin v0.1.0
```

The `build` matrix runs; the `release` job collects the artifacts and creates
the Release. `depends` output is cached per host, so only the first tag pays
the full dependency-build cost.