From cec1cda9f5262c59ac284f8b4c9af52e6c0211e5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 1 Oct 2026 20:53:33 +0000
Subject: [PATCH] Use the vexctl release binary on Linux/Windows

The test job compiled vexctl v0.3.0 with `go install` on every OS:
~80s on ubuntu and ~180s on windows per run, where test (windows) is
the slowest job in CI and gates the yarn/cargo matrices. The compile
also builds sigstore/cosign and reads dozens of sum.golang.org tiles,
which has failed the step on otherwise-green runs.

Linux and Windows now download the release binary and check it
against a pinned sha256 (from the release's vexctl_checksums.txt).
macOS keeps the retried compile: the release's darwin binaries are
built with go1.22.7 and have no LC_UUID, which the runner's dyld
refuses to load.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LPCZKE7kADjPbgE9NrbgdS
---
 .github/workflows/ci.yml | 54 +++++++++++++++++++++++++++++-----------
 1 file changed, 39 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b55cec7df..69d7fc60e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -284,25 +284,49 @@ jobs:
           cache: false
 
       - name: Install vexctl
-        # `go install` puts the binary in $(go env GOPATH)/bin; surface
-        # that path to subsequent steps so `Command::new("vexctl")` in
-        # the test resolves. Pinned to a tagged release rather than
-        # @latest for reproducibility.
+        # Linux / Windows: the v0.3.0 release binary, checked against the
+        # sha256 pinned here (from the release's vexctl_checksums.txt).
+        # Compiling it took ~80s on ubuntu and ~180s on windows, the
+        # slowest job in this workflow.
         #
-        # Retried: the install compiles sigstore/cosign, whose module
-        # verification reads dozens of sum.golang.org checksum tiles, and
-        # transient INTERNAL_ERROR stream resets there have failed this
-        # step on otherwise-green runs (2026-08-20: two attempts ~18 min
-        # apart, different modules each time — an upstream incident, not
-        # one bad tile). The backoff rides out short resets; a persistent
-        # outage still fails loudly on the last attempt. Follow-up option
-        # if this recurs: install the pinned release BINARY (sha256-pinned)
-        # instead of compiling, which sidesteps module verification and
-        # drops ~100s of compile time per leg.
+        # macOS still compiles: the release's darwin binaries are built
+        # with go1.22.7 and have no LC_UUID, so the runner's dyld refuses
+        # them (see the Go step above). The compile is retried: it builds
+        # sigstore/cosign, whose module verification reads dozens of
+        # sum.golang.org checksum tiles, and transient INTERNAL_ERROR
+        # stream resets there have failed this step on otherwise-green
+        # runs (2026-08-20: two attempts ~18 min apart, different modules
+        # each time — an upstream incident, not one bad tile). The backoff
+        # rides out short resets; a persistent outage still fails loudly
+        # on the last attempt.
+        #
+        # Either way the binary's directory goes on PATH so
+        # `Command::new("vexctl")` in the tests resolves.
         shell: bash
+        env:
+          VEXCTL_VERSION: v0.3.0
+          VEXCTL_SHA256_LINUX_AMD64: cd7f8b57d20642166ed4eb3dd1fd849bbb30bbd7c5b9f5b0316b6003b57ceaba
+          VEXCTL_SHA256_WINDOWS_AMD64: 346fb3104b656fe1a407cbae88ea29a636b36f4569ec58a5a8dadca7343993ed
         run: |
+          set -euo pipefail
+          case "$RUNNER_OS" in
+            Linux) asset=vexctl-linux-amd64 bin=vexctl sha="$VEXCTL_SHA256_LINUX_AMD64" ;;
+            Windows) asset=vexctl-windows-amd64.exe bin=vexctl.exe sha="$VEXCTL_SHA256_WINDOWS_AMD64" ;;
+            *) asset='' ;;
+          esac
+          if [ -n "$asset" ]; then
+            dir="$RUNNER_TEMP/vexctl-bin"
+            mkdir -p "$dir"
+            curl -fsSL --retry 5 --retry-all-errors -o "$dir/$bin" \
+              "https://github.com/openvex/vexctl/releases/download/$VEXCTL_VERSION/$asset"
+            echo "$sha  $dir/$bin" | sha256sum -c -
+            chmod +x "$dir/$bin"
+            "$dir/$bin" version
+            echo "$dir" >> "$GITHUB_PATH"
+            exit 0
+          fi
           for attempt in 1 2 3 4 5; do
-            if go install github.com/openvex/vexctl@v0.3.0; then
+            if go install "github.com/openvex/vexctl@$VEXCTL_VERSION"; then
               break
             fi
             if [ "$attempt" = 5 ]; then