build: improve release packaging and updater

.github/workflows/release.yml

@@ -48,35 +48,33 @@ jobs:
         with:
           name: web-dist
           path: server/webui/dist
-      - name: Build
+      - name: Build and package with build.sh
         env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-          CGO_ENABLED: "0"
+          ARTEX_TARGET_OS: ${{ matrix.goos }}
+          ARTEX_TARGET_ARCH: ${{ matrix.goarch }}
+          ARTEX_BUILD_VERSION: ${{ github.ref_name }}
+          ARTEX_SKIP_FRONTEND: "1"
+          ARTEX_SKIP_NPM_CI: "1"
+          # UPX 自解压 ELF 在部分 Linux 内核、虚拟化和安全策略下会崩溃。
+          # Release 使用 Go linker 裁剪和 zip 压缩，优先保证可移植性。
+          ARTEX_COMPRESS: "0"
+          ARTEX_PACKAGE: "1"
+          ARTEX_PACKAGE_DIR: dist
         run: |
-          BIN=artex
-          [ "$GOOS" = "windows" ] && BIN=artex.exe
-          go build -tags embedui -trimpath \
-            -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" \
-            -o "$BIN" ./cmd/artex
-      - name: Package
-        run: |
-          NAME="artex-${GITHUB_REF_NAME}-${{ matrix.goos }}-${{ matrix.goarch }}"
-          mkdir -p "$NAME"
-          cp -r skills "$NAME"/
-          cp config.example.json "$NAME"/
-          if [ "${{ matrix.goos }}" = "windows" ]; then cp artex.exe "$NAME"/; else cp artex "$NAME"/; fi
-          zip -r "$NAME.zip" "$NAME"
+          ./build.sh --target "${ARTEX_TARGET_OS}/${ARTEX_TARGET_ARCH}"
+      - name: Smoke test Linux amd64 binary
+        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
+        run: dist/artex-linux-amd64/artex -h
       - uses: actions/upload-artifact@v4
         with:
           name: pkg-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: "*.zip"
+          path: "dist/*.zip"
       # Linux 生二进制单独上传，供 docker job 复用（免在镜像里重编前端+Go）
       - if: matrix.goos == 'linux'
         uses: actions/upload-artifact@v4
         with:
           name: bin-linux-${{ matrix.goarch }}
-          path: artex
+          path: dist/artex-linux-${{ matrix.goarch }}/artex
 
   # ③ 汇总所有 zip → 创建 GitHub Release
   release:
@@ -88,9 +86,14 @@ jobs:
           pattern: pkg-*
           merge-multiple: true
           path: dist
+      - name: Generate checksums
+        working-directory: dist
+        run: sha256sum *.zip > SHA256SUMS
       - uses: softprops/action-gh-release@v2
         with:
-          files: dist/*.zip
+          files: |
+            dist/*.zip
+            dist/SHA256SUMS
           generate_release_notes: true
 
   # ④ 多架构镜像 → 推 Docker Hub（复用 binaries 编好的 Linux 二进制，

README.md

@@ -108,6 +108,22 @@ CGO_ENABLED=0 go build -tags embedui -o artex ./cmd/artex
 ./artex
 ```
 
+### 方式五：构建跨平台 Release 压缩包
+
+`build.sh` 会先构建并嵌入前端，再使用 Go linker 去除调试信息，并将发布文件压缩为 zip。Release 模式默认生成 Linux amd64/arm64、macOS amd64/arm64 和 Windows amd64 的 zip 包：
+
+```bash
+./build.sh --release
+# 产物：dist/artex-0.3.3-*.zip
+```
+
+UPX 自解压二进制可能与部分 Linux 内核、虚拟化环境或安全策略不兼容，因此默认不启用。可用 `ARTEX_TARGETS` 自定义目标；确认目标运行环境兼容时，可显式传入 `--upx` 进一步缩小二进制：
+
+```bash
+ARTEX_TARGETS=linux/amd64,windows/amd64 ./build.sh --release
+./build.sh --target linux/amd64 --upx
+```
+
 ---
 
 ## 更新升级

update.sh

@@ -38,10 +38,13 @@ update_docker(){
     ok "已将 ARTEX_TAG 设为 ${tag}"
   fi
 
-  info "拉取新镜像…"
-  docker compose pull
+  # 只动 artex：postgres 是固定的 16-alpine，不需要跟着升级（拉它纯属浪费带宽，
+  # 且大版本变动还会有兼容风险）。artex 声明了 depends_on postgres，所以带服务名
+  # up 时若 pg 没起会自动拉起，已在跑的则原样保留、不重建。
+  info "拉取新镜像（仅 artex）…"
+  docker compose pull artex
   info "重建并启动（artex 重启时自动迁移 schema）…"
-  docker compose up -d
+  docker compose up -d artex
   ok "更新完成 → http://localhost:8787"
   info "查看日志：docker compose logs -f artex"
   info "清理旧镜像（可选）：docker image prune -f"