perf(publish): optimize CLI build and consolidate platform definitions

Changes:
- Build CLI bundle once in dedicated job, share via artifact
  (saves ~7-8 minutes by avoiding 8 redundant builds)
- Add dynamic matrix generation from PLATFORM_CONFIGS
- Centralize platform definitions in platform-targets.mjs
- Add error handling (set -euo pipefail) to bash loops
- Add helper scripts for workflow: get-platform-matrix.mjs,
  get-platform-targets.mjs

PLATFORM_CONFIGS is now the single source of truth for:
- Platform/arch combinations
- GitHub Actions runners
- Binary extensions
- CPU architectures
- Platform descriptions

Author: jdalton

.github/workflows/publish.yml

@@ -36,25 +36,56 @@ env:
   BUILD_MODE: prod
 
 jobs:
+  # Build CLI bundle once (platform-agnostic JS) and generate platform matrix.
+  build-cli:
+    if: ${{ inputs.publish-binaries }}
+    name: Build CLI bundle
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+
+      - uses: pnpm/action-setup@v4
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Build CLI
+        run: pnpm --filter @socketsecurity/cli run build
+
+      - name: Generate platform matrix
+        id: matrix
+        run: |
+          MATRIX=$(node scripts/get-platform-matrix.mjs)
+          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
+
+      - name: Upload CLI bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-bundle
+          path: packages/cli/build/cli.js
+          retention-days: 1
+
   # Build SEA binaries for all platforms (only if publishing binaries).
   build-binaries:
     if: ${{ inputs.publish-binaries }}
+    needs: [build-cli]
     name: Build ${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - { runner: ubuntu-latest, platform: linux, arch: x64 }
-          - { runner: ubuntu-latest, platform: linux, arch: arm64 }
-          - { runner: ubuntu-latest, platform: linux, arch: x64, libc: musl }
-          - { runner: ubuntu-latest, platform: linux, arch: arm64, libc: musl }
-          - { runner: macos-latest, platform: darwin, arch: x64 }
-          - { runner: macos-latest, platform: darwin, arch: arm64 }
-          - { runner: windows-latest, platform: win32, arch: x64 }
-          - { runner: windows-latest, platform: win32, arch: arm64 }
+      matrix: ${{ fromJson(needs.build-cli.outputs.matrix) }}
 
     steps:
       - uses: actions/checkout@v4
@@ -70,8 +101,11 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
-      - name: Build CLI
-        run: pnpm --filter @socketsecurity/cli run build
+      - name: Download CLI bundle
+        uses: actions/download-artifact@v4
+        with:
+          name: cli-bundle
+          path: packages/cli/build
 
       - name: Build SEA binary
         shell: bash
@@ -95,8 +129,8 @@ jobs:
   # Publish all packages.
   publish:
     name: Publish packages
-    needs: [build-binaries]
-    if: ${{ always() && (needs.build-binaries.result == 'success' || needs.build-binaries.result == 'skipped') }}
+    needs: [build-cli, build-binaries]
+    if: ${{ always() && (needs.build-cli.result == 'success' || needs.build-cli.result == 'skipped') && (needs.build-binaries.result == 'success' || needs.build-binaries.result == 'skipped') }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -139,7 +173,11 @@ jobs:
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          PLATFORMS=("linux-x64" "linux-arm64" "linux-x64-musl" "linux-arm64-musl" "darwin-x64" "darwin-arm64" "win32-x64" "win32-arm64")
+          set -euo pipefail
+
+          # Get platform targets from single source of truth.
+          PLATFORMS_STR=$(node scripts/get-platform-targets.mjs)
+          read -ra PLATFORMS <<< "$PLATFORMS_STR"
 
           for target in "${PLATFORMS[@]}"; do
             echo "::group::Publishing @socketbin/cli-${target}"

packages/build-infra/lib/platform-targets.mjs

@@ -1,22 +1,108 @@
 /**
  * @fileoverview Shared platform target utilities for SEA builds.
  * Provides constants and parsing functions for platform/arch/libc combinations.
+ * This is the single source of truth for all platform definitions.
  */
 
+/**
+ * Complete platform configuration with all metadata.
+ * This is the authoritative source for platform definitions.
+ * @type {ReadonlyArray<{
+ *   platform: string,
+ *   arch: string,
+ *   libc?: string,
+ *   runner: string,
+ *   cpu: string,
+ *   os: string,
+ *   binExt: string,
+ *   description: string
+ * }>}
+ */
+export const PLATFORM_CONFIGS = Object.freeze([
+  {
+    arch: 'arm64',
+    binExt: '',
+    cpu: 'arm64',
+    description: 'macOS ARM64 (Apple Silicon)',
+    os: 'darwin',
+    platform: 'darwin',
+    runner: 'macos-latest',
+  },
+  {
+    arch: 'x64',
+    binExt: '',
+    cpu: 'x64',
+    description: 'macOS x64 (Intel)',
+    os: 'darwin',
+    platform: 'darwin',
+    runner: 'macos-latest',
+  },
+  {
+    arch: 'arm64',
+    binExt: '',
+    cpu: 'arm64',
+    description: 'Linux ARM64 (glibc)',
+    os: 'linux',
+    platform: 'linux',
+    runner: 'ubuntu-latest',
+  },
+  {
+    arch: 'arm64',
+    binExt: '',
+    cpu: 'arm64',
+    description: 'Linux ARM64 (musl/Alpine)',
+    libc: 'musl',
+    os: 'linux',
+    platform: 'linux',
+    runner: 'ubuntu-latest',
+  },
+  {
+    arch: 'x64',
+    binExt: '',
+    cpu: 'x64',
+    description: 'Linux x64 (glibc)',
+    os: 'linux',
+    platform: 'linux',
+    runner: 'ubuntu-latest',
+  },
+  {
+    arch: 'x64',
+    binExt: '',
+    cpu: 'x64',
+    description: 'Linux x64 (musl/Alpine)',
+    libc: 'musl',
+    os: 'linux',
+    platform: 'linux',
+    runner: 'ubuntu-latest',
+  },
+  {
+    arch: 'arm64',
+    binExt: '.exe',
+    cpu: 'arm64',
+    description: 'Windows ARM64',
+    os: 'win32',
+    platform: 'win32',
+    runner: 'windows-latest',
+  },
+  {
+    arch: 'x64',
+    binExt: '.exe',
+    cpu: 'x64',
+    description: 'Windows x64',
+    os: 'win32',
+    platform: 'win32',
+    runner: 'windows-latest',
+  },
+])
+
 /**
  * Valid platform targets for SEA builds.
  * Format: <platform>-<arch>[-musl]
+ * Derived from PLATFORM_CONFIGS.
  */
-export const PLATFORM_TARGETS = [
-  'darwin-arm64',
-  'darwin-x64',
-  'linux-arm64',
-  'linux-arm64-musl',
-  'linux-x64',
-  'linux-x64-musl',
-  'win32-arm64',
-  'win32-x64',
-]
+export const PLATFORM_TARGETS = PLATFORM_CONFIGS.map(
+  c => `${c.platform}-${c.arch}${c.libc ? `-${c.libc}` : ''}`,
+)
 
 /**
  * Valid platforms.
@@ -92,6 +178,18 @@ export function isPlatformTarget(target) {
   return PLATFORM_TARGETS.includes(target)
 }
 
+/**
+ * Get the full platform config for a target string.
+ *
+ * @param {string} target - Target string (e.g., "darwin-arm64" or "linux-x64-musl").
+ * @returns {typeof PLATFORM_CONFIGS[number] | undefined} Full platform config or undefined.
+ */
+export function getPlatformConfig(target) {
+  return PLATFORM_CONFIGS.find(
+    c => `${c.platform}-${c.arch}${c.libc ? `-${c.libc}` : ''}` === target,
+  )
+}
+
 /**
  * Format platform info back into a target string.
  *

packages/package-builder/package.json

@@ -15,6 +15,7 @@
   },
   "dependencies": {
     "@socketsecurity/lib": "catalog:",
+    "build-infra": "workspace:*",
     "handlebars": "^4.7.8"
   },
   "engines": {

packages/package-builder/scripts/generate-socketbin-packages.mjs

@@ -10,69 +10,24 @@
 import { existsSync, promises as fs } from 'node:fs'
 import path from 'node:path'
 
+import { PLATFORM_CONFIGS } from 'build-infra/lib/platform-targets'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
 
 import { getSocketbinPackageDir, SOCKETBIN_TEMPLATE_DIR } from './paths.mjs'
 import { processTemplate } from './utils.mjs'
 
 const logger = getDefaultLogger()
 
-const PLATFORM_DESCRIPTIONS = {
-  __proto__: null,
-  'darwin-arm64': 'macOS ARM64 (Apple Silicon)',
-  'darwin-x64': 'macOS x64 (Intel)',
-  'linux-arm64': 'Linux ARM64 (glibc)',
-  'linux-arm64-musl': 'Linux ARM64 (musl/Alpine)',
-  'linux-x64': 'Linux x64 (glibc)',
-  'linux-x64-musl': 'Linux x64 (musl/Alpine)',
-  'win32-arm64': 'Windows ARM64',
-  'win32-x64': 'Windows x64',
-}
-
-const PACKAGES = [
-  { arch: 'arm64', binExt: '', cpu: 'arm64', os: 'darwin', platform: 'darwin' },
-  { arch: 'x64', binExt: '', cpu: 'x64', os: 'darwin', platform: 'darwin' },
-  { arch: 'arm64', binExt: '', cpu: 'arm64', os: 'linux', platform: 'linux' },
-  {
-    arch: 'arm64',
-    binExt: '',
-    cpu: 'arm64',
-    libc: 'musl',
-    os: 'linux',
-    platform: 'linux',
-  },
-  { arch: 'x64', binExt: '', cpu: 'x64', os: 'linux', platform: 'linux' },
-  {
-    arch: 'x64',
-    binExt: '',
-    cpu: 'x64',
-    libc: 'musl',
-    os: 'linux',
-    platform: 'linux',
-  },
-  {
-    arch: 'arm64',
-    binExt: '.exe',
-    cpu: 'arm64',
-    os: 'win32',
-    platform: 'win32',
-  },
-  { arch: 'x64', binExt: '.exe', cpu: 'x64', os: 'win32', platform: 'win32' },
-]
-
 /**
  * Generate a single socketbin package.
  */
 async function generatePackage(config) {
-  const { arch, binExt, cpu, libc, os, platform } = config
+  const { arch, binExt, cpu, description, libc, os, platform } = config
   const muslSuffix = libc === 'musl' ? '-musl' : ''
   const packageName = `socketbin-cli-${platform}-${arch}${muslSuffix}`
   const packagePath = getSocketbinPackageDir(platform, arch, libc)
   const templatePath = SOCKETBIN_TEMPLATE_DIR
 
-  const descKey = `${platform}-${arch}${muslSuffix}`
-  const description = PLATFORM_DESCRIPTIONS[descKey] || `${platform} ${arch}`
-
   // Template context for Handlebars.
   const context = {
     ARCH: arch,
@@ -140,12 +95,12 @@ async function main() {
   }
 
   // Generate all packages.
-  for (const config of PACKAGES) {
+  for (const config of PLATFORM_CONFIGS) {
     await generatePackage(config)
   }
 
   logger.log('')
-  logger.success(`Generated ${PACKAGES.length} socketbin packages`)
+  logger.success(`Generated ${PLATFORM_CONFIGS.length} socketbin packages`)
   logger.log('')
 }
 

pnpm-lock.yaml

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+/**
+ * Output platform matrix JSON for GitHub Actions.
+ * Used by publish workflow to generate dynamic matrix.
+ *
+ * Usage:
+ *   node scripts/get-platform-matrix.mjs
+ *   # Outputs: {"include":[...]}
+ */
+
+import { PLATFORM_CONFIGS } from '../packages/build-infra/lib/platform-targets.mjs'
+
+const matrix = {
+  include: PLATFORM_CONFIGS.map(c => ({
+    arch: c.arch,
+    libc: c.libc ?? null,
+    platform: c.platform,
+    runner: c.runner,
+  })),
+}
+
+console.log(JSON.stringify(matrix))

scripts/get-platform-matrix.mjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * Output platform targets for shell scripts.
+ * Used by publish workflow to iterate over platforms.
+ *
+ * Usage:
+ *   node scripts/get-platform-targets.mjs
+ *   # Outputs space-separated: linux-x64 linux-arm64 ...
+ */
+
+import { PLATFORM_TARGETS } from '../packages/build-infra/lib/platform-targets.mjs'
+
+console.log(PLATFORM_TARGETS.join(' '))