From 91b649c3691253b482d8484c1c147676e3b5c9fd Mon Sep 17 00:00:00 2001 From: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> Date: Wed, 2 Sep 2026 09:48:07 -0700 Subject: [PATCH 1/4] :construction_worker: Add variants to release binaries Signed-off-by: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> --- .github/workflows/release-binaries.yaml | 53 +++++++++++++++++++------ 1 file changed, 41 insertions(+), 12 deletions(-) diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml index fa1d2ac1a..2dcd71cf4 100644 --- a/.github/workflows/release-binaries.yaml +++ b/.github/workflows/release-binaries.yaml @@ -48,18 +48,45 @@ jobs: fi echo "Building version ${VERSION}" mkdir -p dist - for bin in abctl authbridge-proxy; do - for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do - os="${target%/*}" - arch="${target#*/}" - echo "==> ${bin} ${os}/${arch}" - ( cd "authbridge/cmd/${bin}" && \ - GOWORK=off CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" \ - go build -trimpath \ - -ldflags "-s -w -X main.version=${VERSION}" \ - -o "${GITHUB_WORKSPACE}/dist/${bin}" . ) - tar -C dist -czf "dist/${bin}_${VERSION}_${os}_${arch}.tar.gz" "${bin}" - rm -f "dist/${bin}" + + # authbridge-proxy variants: ":". Empty + # suffix is the default plugin set. One variant per opt-in + # plugin (or one combined "full") — never enumerate combos. + declare -a proxy_variants=( + ":" + "lite:exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker" + "sessionbudget:include_plugin_sessionbudget" + ) + + build_proxy() { + local variant="$1" tags="$2" os="$3" arch="$4" + local suffix=""; [ -n "${variant}" ] && suffix="-${variant}" + local archive="dist/authbridge-proxy${suffix}_${VERSION}_${os}_${arch}.tar.gz" + echo "==> authbridge-proxy${suffix} ${os}/${arch}" + ( cd authbridge/cmd/authbridge-proxy && \ + GOWORK=off CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" \ + go build -trimpath \ + -tags "${tags}" \ + -ldflags "-s -w -X main.version=${VERSION}" \ + -o "${GITHUB_WORKSPACE}/dist/authbridge-proxy" . ) + tar -C dist -czf "${archive}" authbridge-proxy + rm -f dist/authbridge-proxy + } + + for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do + os="${target%/*}"; arch="${target#*/}" + + echo "==> abctl ${os}/${arch}" + ( cd authbridge/cmd/abctl && \ + GOWORK=off CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" \ + go build -trimpath \ + -ldflags "-s -w -X main.version=${VERSION}" \ + -o "${GITHUB_WORKSPACE}/dist/abctl" . ) + tar -C dist -czf "dist/abctl_${VERSION}_${os}_${arch}.tar.gz" abctl + rm -f dist/abctl + + for entry in "${proxy_variants[@]}"; do + build_proxy "${entry%%:*}" "${entry#*:}" "${os}" "${arch}" done done ( cd dist && sha256sum ./*.tar.gz > checksums.txt ) @@ -74,6 +101,8 @@ jobs: TAG="${GITHUB_REF_NAME}" notes="Prebuilt \`abctl\` and \`authbridge-proxy\` binaries for linux and macOS (amd64/arm64). + \`authbridge-proxy\` ships in variants matching the container images: unqualified (default plugin set, matches the \`authbridge\` image), \`-lite\` (auth-only, matches \`authbridge-lite\`), plus one variant per opt-in plugin currently offered for try-out (today: \`-sessionbudget\`). Variants track opt-in plugins one-for-one; arbitrary combinations are not published. + Verify downloads with \`sha256sum -c checksums.txt\`. On macOS, clear the Gatekeeper quarantine after extracting: \`xattr -dr com.apple.quarantine ./abctl\`." if gh release view "${TAG}" >/dev/null 2>&1; then gh release upload "${TAG}" dist/*.tar.gz dist/checksums.txt --clobber From 3cd8c74d56382fe5322ecc07d606bf3db7a25e4d Mon Sep 17 00:00:00 2001 From: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> Date: Wed, 2 Sep 2026 11:02:05 -0700 Subject: [PATCH 2/4] :art: Format yaml Signed-off-by: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> --- .github/workflows/release-binaries.yaml | 26 +++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml index 2dcd71cf4..e858025c6 100644 --- a/.github/workflows/release-binaries.yaml +++ b/.github/workflows/release-binaries.yaml @@ -52,9 +52,13 @@ jobs: # authbridge-proxy variants: ":". Empty # suffix is the default plugin set. One variant per opt-in # plugin (or one combined "full") — never enumerate combos. + lite_tags="exclude_plugin_a2aparser,exclude_plugin_ibac" + lite_tags="${lite_tags},exclude_plugin_inferenceparser" + lite_tags="${lite_tags},exclude_plugin_mcpparser,exclude_plugin_opa" + lite_tags="${lite_tags},exclude_plugin_sparc,exclude_plugin_tokenbroker" declare -a proxy_variants=( ":" - "lite:exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker" + "lite:${lite_tags}" "sessionbudget:include_plugin_sessionbudget" ) @@ -99,11 +103,21 @@ jobs: run: | set -euo pipefail TAG="${GITHUB_REF_NAME}" - notes="Prebuilt \`abctl\` and \`authbridge-proxy\` binaries for linux and macOS (amd64/arm64). - - \`authbridge-proxy\` ships in variants matching the container images: unqualified (default plugin set, matches the \`authbridge\` image), \`-lite\` (auth-only, matches \`authbridge-lite\`), plus one variant per opt-in plugin currently offered for try-out (today: \`-sessionbudget\`). Variants track opt-in plugins one-for-one; arbitrary combinations are not published. - - Verify downloads with \`sha256sum -c checksums.txt\`. On macOS, clear the Gatekeeper quarantine after extracting: \`xattr -dr com.apple.quarantine ./abctl\`." + # Build release notes as printf lines so no single string exceeds + # yamllint's 150-char cap. Single-quoted %s formats keep backticks + # literal (no shell expansion). + notes="" + add() { notes="${notes}${1}"$'\n'; } + add 'Prebuilt `abctl` and `authbridge-proxy` binaries for linux and macOS (amd64/arm64).' + add '' + add '`authbridge-proxy` ships in variants matching the container images:' + add 'unqualified (default plugin set, matches the `authbridge` image),' + add '`-lite` (auth-only, matches `authbridge-lite`), plus one variant per' + add 'opt-in plugin currently offered for try-out (today: `-sessionbudget`).' + add 'Variants track opt-in plugins one-for-one; arbitrary combinations are not published.' + add '' + add 'Verify downloads with `sha256sum -c checksums.txt`. On macOS, clear the' + add 'Gatekeeper quarantine after extracting: `xattr -dr com.apple.quarantine ./abctl`.' if gh release view "${TAG}" >/dev/null 2>&1; then gh release upload "${TAG}" dist/*.tar.gz dist/checksums.txt --clobber else From bc7d61683449fa75e16c3debc51392cd60addef7 Mon Sep 17 00:00:00 2001 From: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> Date: Wed, 2 Sep 2026 11:02:21 -0700 Subject: [PATCH 3/4] :memo: Update claude.md for binary info Signed-off-by: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> --- authbridge/CLAUDE.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/authbridge/CLAUDE.md b/authbridge/CLAUDE.md index d79a4bb8f..6b911fcbe 100644 --- a/authbridge/CLAUDE.md +++ b/authbridge/CLAUDE.md @@ -34,6 +34,23 @@ binaries with shared auth logic in `authlib/`: Each binary is hardcoded to its deployment shape; mode is no longer selected at runtime. The YAML `mode:` field must match the binary or boot fails. +### Release binaries + +`v*` tag pushes trigger `.github/workflows/release-binaries.yaml`, which +cross-compiles `authbridge-proxy` and `abctl` for linux/darwin × +amd64/arm64 and attaches tarballs to the GitHub Release. `authbridge-proxy` +ships in variants that mirror the container images: + +| Variant | Tarball name shape | Matches | +|---|---|---| +| unqualified (default plugins) | `authbridge-proxy___.tar.gz` | `authbridge` image | +| `-lite` (jwt-validation + token-exchange only) | `authbridge-proxy-lite___.tar.gz` | `authbridge-lite` image | +| `-sessionbudget` (default + opt-in session-budget) | `authbridge-proxy-sessionbudget___.tar.gz` | no image today | + +One variant per opt-in plugin — never enumerate combos. To add one, +append to the `proxy_variants` array in the workflow. `authbridge-cpex` +stays image-only (needs cgo). + See [`authlib/README.md`](authlib/README.md) for the library reference. ## What AuthBridge Does From 73b1c1b4cb7cc7c78b3b0bf31c3c1faa370945c5 Mon Sep 17 00:00:00 2001 From: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> Date: Thu, 3 Sep 2026 09:25:17 -0700 Subject: [PATCH 4/4] docs: Address review comments on release-binaries variant docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - CLAUDE.md: rewrite `-lite` row to "drops the OPA SDK and the protocol parsers" — the earlier "jwt-validation + token-exchange only" wording undercounted the set (also leaves litellm-budget-track and static-inject compiled in). Matches what the size claim actually rests on. Flagged by @mrsabath and @huang195. - CLAUDE.md: soften "one variant per opt-in plugin" to "currently offered for try-out (today: -sessionbudget)" — the old wording implied a -contextguru tarball that does not exist. Names context-guru as deliberately not offered. Flagged by @huang195. - release-binaries.yaml: fix stale comment referring to printf/%s — the implementation uses direct assignment. Flagged by @huang195. Non-blocking follow-up on the four-copy lite-tags list filed as #854. Assisted-By: Claude (Anthropic AI) Signed-off-by: Evaline Ju <69598118+evaline-ju@users.noreply.github.com> --- .github/workflows/release-binaries.yaml | 6 +++--- authbridge/CLAUDE.md | 9 +++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml index e858025c6..6b3426ab6 100644 --- a/.github/workflows/release-binaries.yaml +++ b/.github/workflows/release-binaries.yaml @@ -103,9 +103,9 @@ jobs: run: | set -euo pipefail TAG="${GITHUB_REF_NAME}" - # Build release notes as printf lines so no single string exceeds - # yamllint's 150-char cap. Single-quoted %s formats keep backticks - # literal (no shell expansion). + # Build release notes one line at a time so no single string + # exceeds yamllint's 150-char cap. Single-quoted arguments keep + # backticks literal (no shell expansion). notes="" add() { notes="${notes}${1}"$'\n'; } add 'Prebuilt `abctl` and `authbridge-proxy` binaries for linux and macOS (amd64/arm64).' diff --git a/authbridge/CLAUDE.md b/authbridge/CLAUDE.md index 6b911fcbe..202d4c14d 100644 --- a/authbridge/CLAUDE.md +++ b/authbridge/CLAUDE.md @@ -44,12 +44,13 @@ ships in variants that mirror the container images: | Variant | Tarball name shape | Matches | |---|---|---| | unqualified (default plugins) | `authbridge-proxy___.tar.gz` | `authbridge` image | -| `-lite` (jwt-validation + token-exchange only) | `authbridge-proxy-lite___.tar.gz` | `authbridge-lite` image | +| `-lite` (drops the OPA SDK and the protocol parsers) | `authbridge-proxy-lite___.tar.gz` | `authbridge-lite` image | | `-sessionbudget` (default + opt-in session-budget) | `authbridge-proxy-sessionbudget___.tar.gz` | no image today | -One variant per opt-in plugin — never enumerate combos. To add one, -append to the `proxy_variants` array in the workflow. `authbridge-cpex` -stays image-only (needs cgo). +One variant per opt-in plugin currently offered for try-out (today: +`-sessionbudget`) — never enumerate combos. To add one, append to the +`proxy_variants` array in the workflow. `authbridge-cpex` stays image-only +(needs cgo); `context-guru` is opt-in but not yet offered as a variant. See [`authlib/README.md`](authlib/README.md) for the library reference.