feat: add Nix, MSI, and DMG packaging support

.github/workflows/_build-binaries.yml

@@ -0,0 +1,176 @@
+# Reusable workflow for building binaries across all platforms
+# Called by ci.yml and release.yml
+
+name: Build Binaries
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      upload-artifacts:
+        description: 'Whether to upload artifacts'
+        required: false
+        default: true
+        type: boolean
+      artifact-retention-days:
+        description: 'Number of days to retain artifacts'
+        required: false
+        default: 7
+        type: number
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-22.04
+            artifact_name: tmpltool
+            asset_name: tmpltool-linux-x86_64
+            can_test: true
+
+          - target: x86_64-unknown-linux-musl
+            os: ubuntu-latest
+            artifact_name: tmpltool
+            asset_name: tmpltool-linux-x86_64-musl
+            can_test: true
+
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-22.04
+            artifact_name: tmpltool
+            asset_name: tmpltool-linux-aarch64
+            can_test: false  # Dynamically linked, needs aarch64 glibc libs
+
+          - target: aarch64-unknown-linux-musl
+            os: ubuntu-latest
+            artifact_name: tmpltool
+            asset_name: tmpltool-linux-aarch64-musl
+            can_test: true
+            use_qemu: true  # Statically linked, works with QEMU
+
+          - target: x86_64-apple-darwin
+            os: macos-latest
+            artifact_name: tmpltool
+            asset_name: tmpltool-macos-x86_64
+            can_test: true  # Rosetta 2 can run x86_64 on ARM runners
+
+          - target: aarch64-apple-darwin
+            os: macos-latest
+            artifact_name: tmpltool
+            asset_name: tmpltool-macos-aarch64
+            can_test: true  # Native on ARM runners
+
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            artifact_name: tmpltool.exe
+            asset_name: tmpltool-windows-x86_64.exe
+            can_test: true
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross (Linux ARM)
+        if: matrix.target == 'aarch64-unknown-linux-gnu' || matrix.target == 'aarch64-unknown-linux-musl'
+        run: cargo install cross --git https://github.com/cross-rs/cross
+
+      - name: Install musl tools (Linux musl x86_64)
+        if: matrix.target == 'x86_64-unknown-linux-musl'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y musl-tools
+
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/registry
+          key: ${{ runner.os }}-${{ matrix.target }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Cache cargo index
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/git
+          key: ${{ runner.os }}-${{ matrix.target }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Cache cargo build
+        uses: actions/cache@v4
+        with:
+          path: target
+          key: ${{ runner.os }}-${{ matrix.target }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Build (cross)
+        if: matrix.target == 'aarch64-unknown-linux-gnu' || matrix.target == 'aarch64-unknown-linux-musl'
+        run: cross build --release --target ${{ matrix.target }}
+
+      - name: Build (cargo)
+        if: matrix.target != 'aarch64-unknown-linux-gnu' && matrix.target != 'aarch64-unknown-linux-musl'
+        run: cargo build --release --target ${{ matrix.target }}
+
+      - name: Strip binary (Linux/macOS)
+        if: matrix.os != 'windows-latest'
+        run: strip target/${{ matrix.target }}/release/${{ matrix.artifact_name }} || true
+
+      # Install QEMU for cross-architecture testing
+      - name: Install QEMU (for ARM64 testing)
+        if: matrix.use_qemu
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y qemu-user-static binfmt-support
+          # Register QEMU as interpreter for aarch64 binaries
+          sudo update-binfmts --enable qemu-aarch64
+
+      # Run integration tests on the built binary
+      - name: Run integration tests
+        if: matrix.can_test
+        shell: bash
+        run: |
+          BINARY_PATH="./target/${{ matrix.target }}/release/${{ matrix.artifact_name }}"
+          echo "Testing binary: $BINARY_PATH"
+
+          if [ "${{ matrix.use_qemu }}" = "true" ]; then
+            echo "Using QEMU for aarch64 emulation"
+            # With binfmt_misc registered, we can run the binary directly
+            # The kernel will automatically invoke qemu-aarch64-static
+          fi
+
+          bash tests/integration/test_binary.sh "$BINARY_PATH"
+
+      - name: Create archive (Linux/macOS)
+        if: matrix.os != 'windows-latest'
+        run: |
+          cd target/${{ matrix.target }}/release
+          tar czf ${{ matrix.asset_name }}.tar.gz ${{ matrix.artifact_name }}
+          mv ${{ matrix.asset_name }}.tar.gz ../../..
+
+      - name: Create archive (Windows)
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: |
+          cd target/${{ matrix.target }}/release
+          Compress-Archive -Path ${{ matrix.artifact_name }} -DestinationPath ../../../${{ matrix.asset_name }}.zip
+
+      - name: Upload artifact (Linux/macOS)
+        if: inputs.upload-artifacts && matrix.os != 'windows-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset_name }}
+          path: ${{ matrix.asset_name }}.tar.gz
+          retention-days: ${{ inputs.artifact-retention-days }}
+
+      - name: Upload artifact (Windows)
+        if: inputs.upload-artifacts && matrix.os == 'windows-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset_name }}
+          path: ${{ matrix.asset_name }}.zip
+          retention-days: ${{ inputs.artifact-retention-days }}