ci(upgrade): adopt BYK/binpatch action for delta patch generation/publish

[BYK]

Replaces the hand-rolled ~250 lines of generate-patches and publish-nightly bash in .github/workflows/ci.yml with the BYK/binpatch/action@v0.4.1 composite action. The action handles:

• ORAS CLI install + GHCR login
• Previous-nightly discovery (with the same-series filter that fixes the cross-major nightly tag confusion)
• zig-bsdiff invocation + patch size gate (50% ratio)
• Binary + versioned-tag + patch manifest push with from-version annotation threaded via action outputs

This eliminates the divergence bug we hit twice:

• The PREV_TAG recomputation divergence between generate-patches and publish-nightly (PR fix(upgrade): use generated-patch from-version + close output fd synchronously #1327 fixed this in the hand-rolled shell; the action solves it generically by exposing generate-ghcr.outputs.from-version and consuming it as a publish-ghcr input — see fix(action): publish-ghcr re-derives from-version independently of generate-ghcr BYK/binpatch#40)
• The cross-major nightly tag confusion (PR fix(upgrade): restrict delta patch from-version to same major.minor series #1329 fixed this in the hand-rolled shell; the action's validateChainStep does the equivalent check at chain-resolution time)

Also bumps the binpatch runtime dep from ^0.3.1 to ^0.4.1 for the new openSync/writeSync/closeSync output path (which avoids the ETXTBSY race when chaining into a spawn(tempPath)).

Files

• .github/workflows/ci.yml: -220 lines of hand-rolled shell, +10 lines of action wiring
• packages/cli/package.json: binpatch ^0.3.1 → ^0.4.1
• pnpm-lock.yaml: regenerated

Diff

.github/workflows/ci.yml                           | 347 +++++++-------
packages/cli/package.json                          |   2 +-
pnpm-lock.yaml                                     |  10 +-

Verification

• node -e 'require("yaml").parse(...)' parses cleanly
• pnpm --filter sentry run typecheck: clean
• pnpm --filter sentry run lint: clean
• Lint passes (no shell-script lint script; YAML is the only surface)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 079ea28. Configure here.}

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-01 01:04 UTC