ci(pipboy): add native binary sizes

.github/workflows/pipboy.yml

@@ -26,9 +26,12 @@ jobs:
       contents: read
     outputs:
       base: ${{ steps.changes.outputs.base }}
+      base_history: ${{ steps.changes.outputs.base_history }}
       footprint: ${{ steps.changes.outputs.footprint }}
       tool: ${{ steps.changes.outputs.tool }}
       rust: ${{ steps.changes.outputs.rust }}
+      native: ${{ steps.changes.outputs.native }}
+      native_matrix: ${{ steps.changes.outputs.native_matrix }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
@@ -38,16 +41,40 @@ jobs:
         env:
           EVENT: ${{ github.event_name }}
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BEFORE: ${{ github.event.before }}
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+          # The sidecar binaries the publish workflow ships, on the same runners.
+          # `linux` builds on any Rust change; the rest build on platform-specific
+          # changes or the `ci: native-all` label, which is read on the next push.
+          NATIVE_ALL: >-
+            [
+            {"platform":"linux-x64-gnu","target":"x86_64-unknown-linux-gnu","runner":"ubuntu-latest","dockerfile":"linux-gnu","clang":"","tier":"linux"},
+            {"platform":"linux-arm64-gnu","target":"aarch64-unknown-linux-gnu","runner":"ubuntu-24.04-arm","dockerfile":"linux-gnu","clang":"","tier":"all"},
+            {"platform":"darwin-x64","target":"x86_64-apple-darwin","runner":"ubuntu-latest","dockerfile":"darwin","clang":"x86_64-apple-darwin20.4","tier":"all"},
+            {"platform":"darwin-arm64","target":"aarch64-apple-darwin","runner":"ubuntu-latest","dockerfile":"darwin","clang":"aarch64-apple-darwin20.4","tier":"all"}
+            ]
         run: |
+          RUST='(\.rs$|(^|/)Cargo\.(toml|lock)$|^deny\.toml$|^rust-toolchain\.toml$|^docker/build/|^scripts/pipboy/|^\.github/workflows/pipboy\.yml$)'
+          PLATFORM_SENSITIVE='((^|/)Cargo\.(toml|lock)$|(^|/)build\.rs$|^docker/build/|^rust-toolchain\.toml$)'
+          matrix() { jq -c --arg tier "$1" 'map(select($tier == "all" or .tier == $tier))' <<< "$NATIVE_ALL"; }
+
           if [ "$EVENT" != "pull_request" ]; then
+            # Pushes to main record baselines. Natives build only when Rust changed,
+            # and then for every platform. Hygiene stores no baseline, so it skips main.
             echo "footprint=true" >> "$GITHUB_OUTPUT"
             echo "tool=true" >> "$GITHUB_OUTPUT"
-            # Hygiene stores no baseline, so it skips main.
             echo "rust=false" >> "$GITHUB_OUTPUT"
+            native=none
+            if ! files="$(git diff --name-only "$PUSH_BEFORE" HEAD 2>/dev/null)" || grep -qE "$RUST" <<< "$files"; then
+              native=all
+            fi
+            echo "native=$native" >> "$GITHUB_OUTPUT"
+            echo "native_matrix=$(matrix "$native")" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           base="$(git merge-base "$PR_BASE_SHA" HEAD)"
           echo "base=$base" >> "$GITHUB_OUTPUT"
+          echo "base_history=$(git rev-list --first-parent -n 200 "$base" | paste -sd, -)" >> "$GITHUB_OUTPUT"
           files="$(git diff --name-only "$base" HEAD)"
           footprint=false
           if grep -qE '^(packages/|pnpm-(lock|workspace)\.yaml|scripts/pipboy/|scripts/publish/|\.github/workflows/pipboy\.yml)' <<< "$files"; then
@@ -60,10 +87,19 @@ jobs:
           fi
           echo "tool=$tool" >> "$GITHUB_OUTPUT"
           rust=false
-          if grep -qE '(\.rs$|(^|/)Cargo\.(toml|lock)$|^deny\.toml$|^rust-toolchain\.toml$|^scripts/pipboy/|^\.github/workflows/pipboy\.yml$)' <<< "$files"; then
+          native=none
+          if grep -qE "$RUST" <<< "$files"; then
             rust=true
+            native=linux
+            if grep -qE "$PLATFORM_SENSITIVE" <<< "$files" \
+              || git diff -U0 "$base" HEAD -- '*.rs' | grep -qE '^\+.*(cfg\(target_|target_os|target_arch)' \
+              || jq -e 'index("ci: native-all")' <<< "$LABELS" > /dev/null; then
+              native=all
+            fi
           fi
           echo "rust=$rust" >> "$GITHUB_OUTPUT"
+          echo "native=$native" >> "$GITHUB_OUTPUT"
+          echo "native_matrix=$(matrix "$native")" >> "$GITHUB_OUTPUT"
 
   self-test:
     name: self-test
@@ -210,15 +246,72 @@ jobs:
           if-no-files-found: ignore
           retention-days: 30
 
+  native:
+    name: native · ${{ matrix.platform }}
+    needs: changes
+    if: needs.changes.outputs.native != 'none'
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.changes.outputs.native_matrix) }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      # The publish workflow's Dockerfile and build arguments in release mode, so
+      # the size is what ships. Toolchain versions are read from publish.yaml.
+      - name: Build with the publish Dockerfile
+        env:
+          PLATFORM: ${{ matrix.platform }}
+          TARGET: ${{ matrix.target }}
+          DOCKERFILE: ${{ matrix.dockerfile }}
+          CLANG: ${{ matrix.clang }}
+        run: |
+          publish_env() { sed -n "s/^  $1: \"\(.*\)\"$/\1/p" .github/workflows/publish.yaml; }
+          args=(--build-arg "TARGET=$TARGET" --build-arg BUILD_PROFILE=release --build-arg "CACHE_PLATFORM=$PLATFORM"
+            --build-arg "RUST_TOOLCHAIN=$(publish_env RUST_TOOLCHAIN)")
+          if [ "$DOCKERFILE" = darwin ]; then
+            args+=(--build-arg "CLANG=$CLANG")
+          else
+            args+=(--build-arg "LINUX_GNU_LLVM_VERSION=$(publish_env LINUX_GNU_LLVM_VERSION)"
+              --build-arg "LINUX_GNU_SYSROOT_TAG=$(publish_env LINUX_GNU_SYSROOT_TAG)")
+          fi
+          docker buildx build -f "docker/build/$DOCKERFILE.Dockerfile" "${args[@]}" -t pipboy-native --load .
+          cid="$(docker create pipboy-native)"
+          docker cp "$cid:/artifacts/agentos-native-sidecar" "$RUNNER_TEMP/agentos-native-sidecar"
+          docker rm "$cid"
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+      # No pnpm cache: this job runs fork code and doesn't need one.
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+      - run: pnpm install --frozen-lockfile --filter 'pipboy...'
+      - name: Measure
+        env:
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/reports"
+          pnpm --silent --filter pipboy pipboy native --target agentos-native-sidecar --platform "$PLATFORM" \
+            --artifact "$RUNNER_TEMP/agentos-native-sidecar" --out "$RUNNER_TEMP/reports/native-agentos-native-sidecar-$PLATFORM.json"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: report-native-agentos-native-sidecar-${{ matrix.platform }}
+          path: ${{ runner.temp }}/reports/native-agentos-native-sidecar-${{ matrix.platform }}.json
+          retention-days: 90
+
   report:
     name: report
-    needs: [changes, footprint, hygiene]
+    needs: [changes, footprint, hygiene, native]
     # Not `always()`: a run cancelled by a newer push must not post its partial results.
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
-      actions: read # job timings and report artifacts
+      actions: read # job timings, report artifacts, and native baselines from main
       pull-requests: write # the one Pip-Boy comment
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -239,12 +332,16 @@ jobs:
       - name: Write the comment and run summary
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
           # Empty for pushes and fork PRs: they get the run summary only.
           PR_NUMBER: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.number || '' }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BASE_HISTORY: ${{ needs.changes.outputs.base_history }}
           # Each check job's result, so a failed job is reported as failed, not skipped.
           JOB_RESULTS: ${{ toJSON(needs) }}
-        run: pnpm --silent --filter pipboy pipboy report --reports "$RUNNER_TEMP/reports"
+        run: |
+          pnpm --silent --filter pipboy pipboy report --reports "$RUNNER_TEMP/reports" \
+            --base-history "$BASE_HISTORY"
 
   zizmor:
     name: zizmor