Update release process

Signed-off-by: Bryan Frimin <bryan@probo.com>

.github/workflows/make.yaml

@@ -45,9 +45,9 @@ jobs:
             packages/emails/dist/
           retention-days: 1
 
-  # ── Snapshot: build Go binaries (matrix by GOOS/GOARCH) ────────────
+  # ── Snapshot: build probod group binaries (matrix by GOOS/GOARCH) ──
   build-snapshot-binary:
-    name: "binary (${{ matrix.goos }}/${{ matrix.goarch }})"
+    name: "probod binary (${{ matrix.goos }}/${{ matrix.goarch }})"
     if: github.event_name == 'push'
     needs: [build-apps]
     runs-on: "runs-on=${{ github.run_id }}/runner=4cpu-linux-x64/extras=s3-cache"
@@ -106,6 +106,45 @@ jobs:
           path: "dist/"
           retention-days: 1
 
+  # ── Snapshot: build probo-agent binaries (matrix by GOOS/GOARCH) ───
+  build-snapshot-probo-agent:
+    name: "probo-agent (${{ matrix.goos }}/${{ matrix.goarch }})"
+    if: github.event_name == 'push'
+    runs-on: "runs-on=${{ github.run_id }}/runner=4cpu-linux-x64/extras=s3-cache"
+    permissions:
+      contents: "read"
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { goos: linux, goarch: amd64 }
+          - { goos: linux, goarch: arm64 }
+          - { goos: darwin, goarch: amd64 }
+          - { goos: darwin, goarch: arm64 }
+          - { goos: windows, goarch: amd64 }
+          - { goos: windows, goarch: arm64 }
+          - { goos: freebsd, goarch: amd64 }
+          - { goos: freebsd, goarch: arm64 }
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
+        with:
+          submodules: recursive
+      - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2
+      - uses: "./.github/actions/setup"
+        with:
+          node: "false"
+      - name: "Build probo-agent"
+        env:
+          CGO_ENABLED: "0"
+          GOOS: "${{ matrix.goos }}"
+          GOARCH: "${{ matrix.goarch }}"
+        run: |
+          EXT=""
+          if [ "$GOOS" = "windows" ]; then EXT=".exe"; fi
+
+          go build -ldflags "-s -w -X 'main.version=snapshot'" \
+            -gcflags="-e" -o "dist/probo-agent${EXT}" ./cmd/probo-agent/main.go
+
   # ── Snapshot: build Docker images (matrix by architecture) ─────────
   build-snapshot-docker:
     name: "docker (${{ matrix.arch }})"
@@ -190,9 +229,9 @@ jobs:
           severity-cutoff: critical
           output-format: table
 
-  # ── Build (PR + push validation) ───────────────────────────────────
+  # ── Build probod group (PR + push validation) ────────────────────────
   build:
-    name: "build"
+    name: "build-probod"
     runs-on: "runs-on=${{ github.run_id }}/runner=8cpu-linux-x64/extras=s3-cache"
     permissions:
       contents: "read"
@@ -216,7 +255,7 @@ jobs:
           go generate ./pkg/server/api/console/v1
           go generate ./pkg/server/api/trust/v1
           go generate ./pkg/server/api/mcp/v1
-      - name: "Build binaries"
+      - name: "Build probod group binaries"
         env:
           CGO_ENABLED: "0"
         run: |
@@ -229,6 +268,26 @@ jobs:
             -gcflags="-e" -o bin/prb ./cmd/prb/main.go & pids+=($!)
           for pid in "${pids[@]}"; do wait "$pid"; done
 
+  build-probo-agent:
+    name: "build-probo-agent"
+    runs-on: "runs-on=${{ github.run_id }}/runner=4cpu-linux-x64/extras=s3-cache"
+    permissions:
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
+        with:
+          submodules: recursive
+      - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2
+      - uses: "./.github/actions/setup"
+        with:
+          node: "false"
+      - name: "Build probo-agent"
+        env:
+          CGO_ENABLED: "0"
+        run: |
+          go build -ldflags "-s -w -X 'main.version=snapshot'" \
+            -gcflags="-e" -o bin/probo-agent ./cmd/probo-agent/main.go
+
   lint-go:
     name: "lint-go"
     runs-on: "runs-on=${{ github.run_id }}/runner=4cpu-linux-x64/extras=s3-cache"

contrib/claude/release/README.md

@@ -1,6 +1,6 @@
 # Release
 
-The repository ships seven independently-versioned tracks. Each has its own
+The repository ships eight independently-versioned tracks. Each has its own
 version source, its own `CHANGELOG.md`, its own tag pattern, and its own
 release workflow. Cutting a release means: bump the version, write a
 changelog entry, commit, tag, push.
@@ -11,6 +11,7 @@ changelog entry, commit, tag, push.
 | Server (`probod` group) | `probod/v*`                    | [probod.md](./probod.md)         |
 | `probod-bootstrap`      | `probod-bootstrap/v*`          | [probod-bootstrap.md](./probod-bootstrap.md) |
 | `proboctl`              | `proboctl/v*`                  | [proboctl.md](./proboctl.md)     |
+| `probo-agent`           | `probo-agent/v*`               | [probo-agent.md](./probo-agent.md) |
 | `@probo/n8n-nodes-probo` | `@probo/n8n-nodes-probo/v*`   | [n8n-nodes-probo.md](./n8n-nodes-probo.md) |
 | `@probo/cookie-banner`  | `@probo/cookie-banner/v*`      | [cookie-banner.md](./cookie-banner.md) |
 | Helm chart (`probo`)    | `helm/v*`                      | [helm.md](./helm.md)                   |
@@ -63,6 +64,10 @@ git log $(git describe --tags --abbrev=0 --match='probod-bootstrap/v*')..HEAD --
 git log $(git describe --tags --abbrev=0 --match='proboctl/v*')..HEAD --oneline \
   -- cmd/proboctl pkg/proboctl
 
+# probo-agent
+git log $(git describe --tags --abbrev=0 --match='probo-agent/v*')..HEAD --oneline \
+  -- cmd/probo-agent pkg/deviceagent
+
 # @probo/n8n-nodes-probo
 git log $(git describe --tags --abbrev=0 --match='@probo/n8n-nodes-probo/v*')..HEAD --oneline \
   -- packages/n8n-node

contrib/claude/release/probo-agent.md

@@ -0,0 +1,41 @@
+# Release `probo-agent`
+
+After confirming commits below, follow the
+[common steps](./README.md#3-common-steps-every-track).
+
+## Track facts
+
+- **Tag pattern**: `probo-agent/v*`
+- **Version source**: `cmd/probo-agent/VERSION` (single `X.Y.Z` line)
+- **Version bump**: Edit `cmd/probo-agent/VERSION` directly
+- **Changelog**: `cmd/probo-agent/CHANGELOG.md`
+- **Files to stage**: `cmd/probo-agent/VERSION`, `cmd/probo-agent/CHANGELOG.md`
+- **Workflow**: `.github/workflows/release-probo-agent.yaml`
+- **Path filter**: `cmd/probo-agent pkg/deviceagent`
+
+## Detect commits
+
+```shell
+git log $(git describe --tags --abbrev=0 --match='probo-agent/v*')..HEAD --oneline \
+  -- cmd/probo-agent pkg/deviceagent
+```
+
+If empty or non-user-facing only, do not release this track.
+
+## Build
+
+```shell
+make bin/probo-agent
+```
+
+## Notes
+
+CI builds binaries for 8 OS/arch targets (linux, darwin, and windows on
+amd64 and arm64; freebsd on amd64 and arm64), publishes a GitHub
+Release with signed checksums, SBOM, and build attestations. The agent
+auto-update path downloads the matching archive plus `checksums.txt` and
+verifies the cosign bundle before installing.
+
+macOS `.pkg` installers are built locally with
+`cmd/probo-agent/installer/macos/build.sh` (requires macOS and a
+pre-built binary). They are not part of the GitHub Release workflow yet.