feat(runner): assemble target-owned Claude Linux provider packs

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/release-smoke.yml

@@ -242,6 +242,13 @@ jobs:
           pattern: ${{ needs.qualification_daemons.outputs.runner_artifact_prefix }}-*
           path: ${{ runner.temp }}/release-runner-inputs
           merge-multiple: true
+      - name: Download target-owned Linux provider-pack identities
+        if: needs.qualification_daemons.outputs.provider_pack_artifact_prefix != ''
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.qualification_daemons.outputs.provider_pack_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-provider-pack-inputs
+          merge-multiple: true
       - name: Bind the immutable Linux producer source
         env:
           SOURCE_SHA: ${{ inputs.qualification_source_sha }}
@@ -259,9 +266,14 @@ jobs:
         env:
           SOURCE_SHA: ${{ inputs.qualification_source_sha }}
         run: |
+          pack_args=()
+          if [[ -d "$RUNNER_TEMP/release-provider-pack-inputs" ]]; then pack_args=("$RUNNER_TEMP/release-provider-pack-inputs"); fi
           node packages/paperclip-runner/scripts/stage-release-runner-binaries.mjs \
-            assemble-daemons "$RUNNER_TEMP/release-runner-inputs" "$SOURCE_SHA"
+            assemble-daemons "$RUNNER_TEMP/release-runner-inputs" "$SOURCE_SHA" "${pack_args[@]}"
           cp -R packages/paperclip-runner/dist/bin/. server/dist/vendor/paperclip-runner/bin/
+          if [[ -d packages/paperclip-runner/dist/remote-provider-packs ]]; then
+            cp -R packages/paperclip-runner/dist/remote-provider-packs server/dist/vendor/paperclip-runner/
+          fi
       - name: Verify clean public installation and retain the same package bytes
         env:
           PAPERCLIP_RUNNER_PUBLIC_PACKS_DIR: ${{ runner.temp }}/public-runner-packs

.github/workflows/release-verify.yml

@@ -15,6 +15,8 @@ on:
     outputs:
       runner_artifact_prefix:
         value: ${{ jobs.runner_binaries.outputs.artifact_prefix }}
+      provider_pack_artifact_prefix:
+        value: ${{ jobs.runner_binaries.outputs.provider_pack_artifact_prefix }}
       native_consumer_matrix:
         value: ${{ jobs.runner_binary_targets.outputs.native_consumers }}
 
@@ -513,6 +515,7 @@ jobs:
       matrix: ${{ fromJSON(needs.runner_binary_targets.outputs.matrix) }}
     outputs:
       artifact_prefix: ${{ steps.identity.outputs.artifact_prefix }}
+      provider_pack_artifact_prefix: ${{ steps.identity.outputs.provider_pack_artifact_prefix }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -535,6 +538,9 @@ jobs:
           [[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
           [[ "$(node -p 'process.platform + "-" + process.arch')" == "$TARGET" ]] || exit 1
           echo "artifact_prefix=runner-release-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
+          if node --input-type=module -e 'const m = await import("./packages/paperclip-runner/scripts/stage-release-runner-binaries.mjs"); process.exit(m.RELEASE_PROVIDER_PACK_TARGETS ? 0 : 1)'; then
+            echo "provider_pack_artifact_prefix=runner-provider-packs-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
+          fi
       - name: Pin native Cargo workspace and toolchain
         id: native_rust_workspace
         working-directory: packages/paperclip-runner
@@ -618,3 +624,29 @@ jobs:
           path: ${{ runner.temp }}/runner-release/
           if-no-files-found: error
           retention-days: 14
+
+      - name: Build target-owned Linux provider pack
+        id: provider_pack
+        if: startsWith(matrix.target, 'linux-') && steps.identity.outputs.provider_pack_artifact_prefix != ''
+        env:
+          SOURCE_SHA: ${{ inputs.ref }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          set -euo pipefail
+          pack="$RUNNER_TEMP/provider-pack"
+          PAPERCLIP_RUNNER_SOURCE_REVISION="$SOURCE_SHA" node packages/paperclip-runner/scripts/build-provider-pack.mjs "$pack"
+          node --input-type=module - "$pack/provider-pack.json" <<'NODE'
+          import { readFileSync } from 'node:fs';
+          import { verifyReleaseProviderPack } from './packages/paperclip-runner/scripts/release-provider-pack.mjs';
+          verifyReleaseProviderPack(JSON.parse(readFileSync(process.argv[2], 'utf8')), process.env.SOURCE_SHA, process.env.TARGET);
+          NODE
+          mkdir -p "$RUNNER_TEMP/release-provider-packs/$TARGET"
+          cp "$pack/provider-pack.json" "$RUNNER_TEMP/release-provider-packs/$TARGET/provider-pack.json"
+          tar -C "$pack" -czf "$RUNNER_TEMP/release-provider-packs/$TARGET/provider-pack.tar.gz" .
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: startsWith(matrix.target, 'linux-') && steps.identity.outputs.provider_pack_artifact_prefix != ''
+        with:
+          name: ${{ steps.identity.outputs.provider_pack_artifact_prefix }}-${{ matrix.target }}
+          path: ${{ runner.temp }}/release-provider-packs/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/release.yml

@@ -432,6 +432,16 @@ jobs:
           pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
           path: ${{ runner.temp }}/release-runner-inputs
           merge-multiple: true
+      - name: Download target-owned Linux provider-pack identities
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-provider-pack-inputs
+          merge-multiple: true
+      - name: Bind provider-pack inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
       - name: Bind daemon inputs for release assembly
         if: needs.release_runner_source.outputs.required == 'true'
         run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
@@ -729,6 +739,16 @@ jobs:
           pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
           path: ${{ runner.temp }}/release-runner-inputs
           merge-multiple: true
+      - name: Download target-owned Linux provider-pack identities
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-provider-pack-inputs
+          merge-multiple: true
+      - name: Bind provider-pack inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
       - name: Bind daemon inputs for release assembly
         if: needs.release_runner_source.outputs.required == 'true'
         run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
@@ -1008,6 +1028,16 @@ jobs:
           pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
           path: ${{ runner.temp }}/release-runner-inputs
           merge-multiple: true
+      - name: Download target-owned Linux provider-pack identities
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-provider-pack-inputs
+          merge-multiple: true
+      - name: Bind provider-pack inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
       - name: Bind daemon inputs for release assembly
         if: needs.release_runner_source.outputs.required == 'true'
         run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
@@ -1389,6 +1419,16 @@ jobs:
           pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
           path: ${{ runner.temp }}/release-runner-inputs
           merge-multiple: true
+      - name: Download target-owned Linux provider-pack identities
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-provider-pack-inputs
+          merge-multiple: true
+      - name: Bind provider-pack inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
       - name: Bind daemon inputs for release assembly
         if: needs.release_runner_source.outputs.required == 'true'
         run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
@@ -1447,6 +1487,16 @@ jobs:
           pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
           path: ${{ runner.temp }}/release-runner-inputs
           merge-multiple: true
+      - name: Download target-owned Linux provider-pack identities
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
+          path: ${{ runner.temp }}/release-provider-pack-inputs
+          merge-multiple: true
+      - name: Bind provider-pack inputs for release assembly
+        if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
+        run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
       - name: Bind daemon inputs for release assembly
         if: needs.release_runner_source.outputs.required == 'true'
         run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"