[eersnington]

Add pipboy native. It measures agentos-native-sidecar as the publish workflow builds it.

• Build with docker/build/linux-gnu.Dockerfile and docker/build/darwin.Dockerfile in release mode, on the same runners as publish.yaml.
• Read RUST_TOOLCHAIN, LINUX_GNU_LLVM_VERSION, and LINUX_GNU_SYSROOT_TAG from publish.yaml, so the build cannot drift from the release.
• Compare against the nearest main build and the latest @rivet-dev/agentos-runtime-sidecar-<platform>, with symbol bytes per crate from nm.

Change	Platforms built
Any Rust change	linux-x64-gnu
Cargo.*, build.rs, docker/build/, new cfg(target_*), or the ci: native-all label	all 4
Push to main with a Rust change	all 4, stored as the baseline

Security

• The native job gets no secrets and a read-only token. The osxcross base image is public, so it needs no registry login.

---

This is part 3 of 4 in a stack:

•  4  ci(pipboy): add per-commit CI trace command #2063
•  3  ci(pipboy): add native binary sizes #2062 👈
•  2  ci(pipboy): add rust dependency hygiene #2061
•  1  ci(pipboy): add package footprint #2060

[github-actions]

📟 Pip-Boy · 1d75714

📦 Packages · fresh npm install resolve, no lockfile · this PR vs base

No notable install size, dependency, or entrypoint changes across 6 packages.

All 6 packages · linux-x64-gnu

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/agentos-core	458.2 MB	458.2 MB	458.2 MB	0	121 (0)
@rivet-dev/agentos-node-pty	7.6 KB	18.0 KB	18.0 KB	0	1 (0)
@rivet-dev/agentos-posix	253.6 MB	253.6 MB	253.6 MB	0	7 (0)
@rivet-dev/agentos-runtime-core	253.6 MB	253.6 MB	253.6 MB	0	6 (0)
@rivet-dev/agentos-sandbox	495.5 MB	495.5 MB	495.5 MB	0	177 (0)
@rivet-dev/agentos-toolchain	130.8 KB	141.2 KB	141.2 KB	0	2 (0)

🧹 Rust dependencies · cargo deny + cargo shear

check	new in this PR	fixed	existing on base
advisories	✅ 0	0	26
licenses	✅ 0	0	0
sources	✅ 0	0	0
bans	✅ 0	0	0
unused	✅ 0	0	16

🦀 Binaries · publish Dockerfiles, --release

No native build on main to compare against yet.

artifact	npm @latest	base	this PR	Δ vs base
agentos-native-sidecar linux-x64-gnu	143.6 MB	—	143.6 MB	—

⏱ Timing

job	wall time	slowest step
zizmor	9s	Set up job · 2s
changes	28s	checkout · 23s
self-test	25s	Run pnpm --filter pipboy test · 7s
footprint	1m52s	Pack this commit · 34s
native · linux-x64-gnu	13m51s	Build with the publish Dockerfile · 13m30s
hygiene	54s	checkout · 24s
report	21s	setup-node · 5s

🔭 Full CI trace for this commit

One OpenTelemetry trace of CI and Pip-Boy for 1d75714: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha 1d757141b325db2225033068750b0243054c8ea2

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/agentos checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.