VirtualBeingsResearch · Zoupers · Jul 27, 2026 · Jul 27, 2026 · Jul 27, 2026 · Jul 27, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -34,7 +34,15 @@ updates:
     multi-ecosystem-group: all-dependencies
 
   - package-ecosystem: docker
-    directory: /
+    directories:
+      - /
+      - /apps/coworker-relay
+    patterns:
+      - "*"
+    multi-ecosystem-group: all-dependencies
+
+  - package-ecosystem: gomod
+    directory: /apps/coworker-relay
     patterns:
       - "*"
     multi-ecosystem-group: all-dependencies
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -269,6 +269,54 @@ jobs:
             pkg-config
       - run: cargo test --workspace --locked
 
+  go_relay:
+    name: Go Relay
+    needs: web_bundle
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: apps/coworker-relay
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: apps/coworker-relay/go.mod
+          cache-dependency-path: apps/coworker-relay/go.sum
+      - name: Check Go formatting
+        run: test -z "$(gofmt -l .)"
+      - name: Test Relay
+        run: go test -race ./...
+      - name: Vet Relay
+        run: go vet ./...
+      - name: Scan Relay Go dependencies
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
+      - name: Build Relay binaries
+        run: |
+          go build ./cmd/coworker-relay
+          go build ./cmd/relayctl
+      - name: Build Relay container
+        working-directory: ${{ github.workspace }}
+        run: docker build --tag coworker-relay:ci --file apps/coworker-relay/Dockerfile apps/coworker-relay
+      - name: Scan Relay container
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: coworker-relay:ci
+          format: table
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: "1"
+      - name: Validate initialized Compose deployment
+        run: |
+          go run ./cmd/relayctl init \
+            --dir "$RUNNER_TEMP/relay-deployment" \
+            --public-url https://relay.example.com \
+            --external-port 8443
+          docker compose \
+            --env-file "$RUNNER_TEMP/relay-deployment/.env" \
+            --file "$RUNNER_TEMP/relay-deployment/compose.yaml" \
+            config --quiet
+
   frontend:
     name: Frontend (${{ matrix.name }})
     needs: web_bundle

diff --git a/.github/workflows/container-release.yml b/.github/workflows/container-release.yml
@@ -64,15 +64,18 @@ jobs:
           fi
 
           image="ghcr.io/${GITHUB_REPOSITORY,,}"
+          relay_image="${image}-relay"
           runtime_tags=("$image:$version")
           embedder_tags=("$image:${version}-with-embedder")
           offline_tags=("$image:${version}-offline")
+          relay_tags=("$relay_image:$version")
 
           # Prereleases never replace the moving stable aliases.
           if [[ "$version" != *-* ]]; then
             runtime_tags+=("$image:latest")
             embedder_tags+=("$image:with-embedder")
             offline_tags+=("$image:offline")
+            relay_tags+=("$relay_image:latest")
           fi
 
           write_tags() {
@@ -88,9 +91,12 @@ jobs:
           write_tags runtime_tags "${runtime_tags[@]}"
           write_tags embedder_tags "${embedder_tags[@]}"
           write_tags offline_tags "${offline_tags[@]}"
+          write_tags relay_tags "${relay_tags[@]}"
           {
             echo "image=$image"
             echo "version=$version"
+            echo "relay_image=$relay_image"
+            echo "build_date=$(date -u +%FT%TZ)"
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
@@ -150,3 +156,22 @@ jobs:
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
             org.opencontainers.image.version=${{ steps.release.outputs.version }}
+
+      - name: Build and push Relay image
+        uses: docker/build-push-action@v7
+        with:
+          context: ./apps/coworker-relay
+          file: ./apps/coworker-relay/Dockerfile
+          build-args: |
+            RELAY_VERSION=${{ steps.release.outputs.version }}
+            RELAY_COMMIT=${{ github.sha }}
+            RELAY_BUILD_DATE=${{ steps.release.outputs.build_date }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          provenance: mode=max
+          sbom: true
+          tags: ${{ steps.release.outputs.relay_tags }}
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ steps.release.outputs.version }}
diff --git a/.github/workflows/relay-release.yml b/.github/workflows/relay-release.yml
@@ -0,0 +1,127 @@
+name: Publish Relay Binaries
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Git ref to build"
+        required: true
+        type: string
+      tag:
+        description: "Existing release tag to receive Relay assets"
+        required: true
+        type: string
+      version:
+        description: "Version without the v prefix"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+concurrency:
+  group: relay-release-${{ inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Relay ${{ matrix.goos }}/${{ matrix.goarch }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+            archive: tar
+          - goos: linux
+            goarch: arm64
+            archive: tar
+          - goos: darwin
+            goarch: amd64
+            archive: tar
+          - goos: darwin
+            goarch: arm64
+            archive: tar
+          - goos: windows
+            goarch: amd64
+            archive: zip
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: apps/coworker-relay/go.mod
+          cache-dependency-path: apps/coworker-relay/go.sum
+      - name: Validate release version
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          test "$RELEASE_TAG" = "v$RELEASE_VERSION"
+          test "$(tr -d '\r\n' < VERSION)" = "$RELEASE_VERSION"
+      - name: Build and package
+        id: package
+        working-directory: apps/coworker-relay
+        shell: bash
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          RELEASE_VERSION: ${{ inputs.version }}
+          ARCHIVE_FORMAT: ${{ matrix.archive }}
+        run: |
+          set -euo pipefail
+          output="$RUNNER_TEMP/relay-assets"
+          package="coworker-relay-${RELEASE_VERSION}-${GOOS}-${GOARCH}"
+          directory="$RUNNER_TEMP/$package"
+          mkdir -p "$output" "$directory"
+          suffix=""
+          if [[ "$GOOS" == windows ]]; then suffix=".exe"; fi
+          ldflags="-s -w \
+            -X github.com/VirtualBeingsResearch/CoWorker/apps/coworker-relay/internal/buildinfo.Version=$RELEASE_VERSION \
+            -X github.com/VirtualBeingsResearch/CoWorker/apps/coworker-relay/internal/buildinfo.Commit=$GITHUB_SHA \
+            -X github.com/VirtualBeingsResearch/CoWorker/apps/coworker-relay/internal/buildinfo.Date=$(date -u +%FT%TZ)"
+          CGO_ENABLED=0 go build -trimpath -ldflags="$ldflags" -o "$directory/coworker-relay$suffix" ./cmd/coworker-relay
+          CGO_ENABLED=0 go build -trimpath -ldflags="$ldflags" -o "$directory/relayctl$suffix" ./cmd/relayctl
+          cp ../../LICENSE "$directory/LICENSE"
+          go list -m all > "$directory/go-modules.txt"
+          if [[ "$ARCHIVE_FORMAT" == zip ]]; then
+            (cd "$RUNNER_TEMP" && zip -q -r "$output/$package.zip" "$package")
+            asset="$output/$package.zip"
+          else
+            tar -C "$RUNNER_TEMP" -czf "$output/$package.tar.gz" "$package"
+            asset="$output/$package.tar.gz"
+          fi
+          (cd "$output" && sha256sum "$(basename "$asset")" > "$(basename "$asset").sha256")
+          echo "asset=$asset" >> "$GITHUB_OUTPUT"
+      - name: Attest Relay archive
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: ${{ steps.package.outputs.asset }}
+      - uses: actions/upload-artifact@v7
+        with:
+          name: relay-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: ${{ runner.temp }}/relay-assets/*
+          if-no-files-found: error
+
+  publish:
+    name: Attach Relay binaries
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: relay-*
+          merge-multiple: true
+          path: ${{ runner.temp }}/relay-assets
+      - name: Upload immutable Relay assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: gh release upload "$RELEASE_TAG" "${RUNNER_TEMP}/relay-assets/"* --repo "$GITHUB_REPOSITORY" --clobber
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -245,3 +245,21 @@ jobs:
             --field version="$VERSION"
 
           echo "Started container publishing for $RELEASE_TAG."
+
+      - name: Start Relay binary release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          gh workflow run relay-release.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref "$RELEASE_TAG" \
+            --field ref="$RELEASE_TAG" \
+            --field tag="$RELEASE_TAG" \
+            --field version="$VERSION"
+
+          echo "Started Relay binary publishing for $RELEASE_TAG."
diff --git a/CONTRIBUTING.en.md b/CONTRIBUTING.en.md
@@ -15,6 +15,7 @@ Requirements:
 - [uv](https://docs.astral.sh/uv/)
 - Node.js 20+ for web or desktop changes
 - Stable Rust for bridge or Tauri changes
+- Go 1.26.5+ for Relay changes
 
 Install the Python workspace and development dependencies:
 

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -14,6 +14,7 @@
 - [uv](https://docs.astral.sh/uv/)
 - 修改 Web 或桌面端时需要 Node.js 20+
 - 修改 Bridge 或 Tauri 时需要稳定版 Rust
+- 修改 Relay 时需要 Go 1.26.5+
 
 安装 Python workspace 和开发依赖：