@mnci/cli 4.14.0 → 4.15.0

package/README.md

@@ -103,6 +103,7 @@ mnci add python-vendor shared --lib core  # wire core's module into shared's bui
 # Go (@nx-go/nx-go — one root go.mod, golangci-lint + go test)
 mnci add go-app api            # executable -> apps/ (binary, zipped into the drop)
 mnci add go-app cli --release  # ...released: tag + per-platform zips on the GitHub Release
+mnci add go-app tray --cgo     # needs a C toolchain: built on a runner of each OS
 mnci add go-function-app fn    # serverless handler -> apps/
 mnci add go-lib core           # publishable (by git tag) -> packages/
 mnci add go-internal-lib util  # private shared package -> libs/
@@ -1439,6 +1440,51 @@ pipeline installs `golangci-lint` itself (see below).
   `nx-release-publish` target is written: there is nothing to push. The only
   real difference between `go-lib` and `go-internal-lib` is intent, recorded
   in the `type:go-lib` tag and the `packages/` location.
+- **Pure-Go apps are cross-compiled; an app that needs a C toolchain is not
+  (`mnci add go-app <name> --cgo`).** `build-all` builds six static binaries from
+  one machine with `CGO_ENABLED=0`, which is right until the app needs cgo: a
+  system-tray icon (Cocoa on macOS, GTK on Linux), a native GUI toolkit, a cgo
+  database driver. Those can only be built where the C toolchain and the target
+  OS's libraries are, so a `--cgo` app is tagged `build:cgo` and gets
+  `build-native` and `package-native` (this machine only, `CGO_ENABLED=1`, the
+  same `VERSION` stamp and `-trimpath`, the zip named as `package-all` names a
+  platform's) **instead of** `package`, `build-all` and `package-all`. It keeps
+  `build`, `test`, `lint` and `start` for local work.
+  - **A `native` job, only when such an app exists.** The generated pipeline
+    gains a job with one leg each on `windows-latest`, `macos-latest` and
+    `ubuntu-latest` (GitHub Actions: a matrix; Azure Pipelines: a matrix of
+    `vmImage`s, with the original job moved under `jobs:`). Each leg lints,
+    tests, builds and packages the native apps and publishes its zips as an
+    artifact. The single-agent verify excludes them (`--exclude=tag:build:cgo`),
+    because it cannot build them. A workspace with no native app keeps a
+    pipeline byte-identical to the one it had: the job is decided when the file is
+    written, since neither provider can skip a whole job on a file's existence.
+  - **Run `mnci upgrade` after adding one.** `add` does not rewrite the
+    pipeline files, so until then CI would verify the app on the one agent that
+    cannot build it. `mnci add` says so, and `mnci doctor` fails while a
+    pipeline lacks the job, and while no C compiler is installed on the machine
+    (it reads `CC`, then `gcc`, `clang`, `cc`).
+  - **Linux prerequisites are yours to finish.** The leg installs a C compiler
+    and `pkg-config`, which is all mnci can know. The `-dev` packages your app
+    links (`libgtk-3-dev` and `libayatana-appindicator3-dev` for a tray icon) go
+    on that one marked line in the pipeline. The macOS runner ships Xcode's tools,
+    and the Windows leg relies on the hosted image's MinGW-w64 `gcc`: the nightly
+    e2e builds a cgo app on `windows-latest`, and says so loudly if it finds no
+    compiler there rather than passing.
+  - **Architectures: one per OS, the runner's own.** `windows-latest` and
+    `ubuntu-latest` are amd64 and `macos-latest` is arm64, so a native app ships
+    `windows-amd64`, `linux-amd64` and `darwin-arm64`. `darwin-amd64`,
+    `linux-arm64` and `windows-arm64` are not built: they need an Intel macOS
+    runner, an arm Linux runner or a cross-compiler. The legs are fixed in the
+    generated pipeline today, so adding one means editing a file `mnci upgrade`
+    rewrites (russoedu/MoNecromanCi#269 is about giving that a safe place).
+  - **Releasing one.** With `--release` as well, each leg, on a push to main and
+    after the `ci` job has tagged, runs
+    `node tools/go-app-release.cjs assets --native`, which builds
+    `package-native` with `VERSION` set to the tag's version and uploads that
+    OS's zip to the same GitHub Release, so one release collects a zip from every
+    runner. Azure Pipelines has no GitHub Release to attach to and stops at the
+    artifact.
 - **Releasing a Go app is an opt-in: `mnci add go-app <name> --release`.** The
   app is tagged `release:go`, which `release.projects` selects by tag (as it
   does for a VS Code extension, so `mnci upgrade` keeps it). Without the flag
@@ -1472,8 +1518,8 @@ pipeline installs `golangci-lint` itself (see below).
     commits that touch an app's dependencies, not only its own folder (measured:
     a `fix:` touching only an imported `go-internal-lib` produced a patch
     release of the app), which is right for a binary that links the library in.
-  - Not covered yet: apps that need a native toolchain (cgo) and so one runner
-    per OS (russoedu/MoNecromanCi#263). The asset step builds all six
+  - An app that needs a C toolchain is released from several runners instead:
+    see _Pure-Go apps are cross-compiled_ above. This step builds all six
     platforms on one runner, which is what `CGO_ENABLED=0` allows.
 - **No publish-time dependency injection**, unlike Python's vendoring: `go
 build` links statically, so the binary in the drop already contains

package/dist/cli.js

@@ -435,6 +435,17 @@ ${feedShortKey}:email=npm-requires-this-and-never-uses-it
 }
 var VSCODE_EXTENSION_TAG = "type:vscode-extension";
 var GO_RELEASE_TAG = "release:go";
+var GO_CGO_TAG = "build:cgo";
+function hasNativeGoApp(workspaceRoot) {
+  return (0, import_node_fs2.globSync)("apps/*/project.json", { cwd: workspaceRoot }).some((projectJson) => {
+    try {
+      const { tags } = JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path2.join)(workspaceRoot, projectJson), "utf8"));
+      return (tags ?? []).includes(GO_CGO_TAG);
+    } catch {
+      return false;
+    }
+  });
+}
 function releaseConfig(ci) {
   const githubReleases = ci === "github";
   return {
@@ -1035,7 +1046,126 @@ var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process
 var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
 var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('npm',['audit','--json'],{encoding:'utf8',shell:process.platform==='win32',maxBuffer:33554432});let d;try{d=JSON.parse(r.stdout)}catch{console.log('npm audit produced no JSON (exit '+r.status+') - not blocking on a broken audit.');process.exit(0)}const all=Object.values(d.vulnerabilities||{});const BLOCK=['critical','high','moderate'];const major=v=>v.fixAvailable&&typeof v.fixAvailable==='object'&&v.fixAvailable.isSemVerMajor;const act=all.filter(v=>v.fixAvailable&&BLOCK.includes(v.severity)&&!major(v));const rest=all.filter(v=>!act.includes(v));for(const v of rest)console.log('  note ['+v.severity+'] '+v.name+(!v.fixAvailable?' - NO fix available upstream, nothing to do here':major(v)?' - only a semver-major change would remove it (often a parent downgrade), not applied automatically':' - fix available, below the blocking threshold'));if(act.length===0){console.log('npm audit - '+all.length+' advisory(ies), none actionable at moderate or above.');process.exit(0)}for(const v of act)console.log('  BLOCKING ['+v.severity+'] '+v.name+' - fix available');console.log('Each has a published fix. Add a targeted overrides entry in package.json rather than npm audit fix --force.');process.exit(1)"`;
 var VERIFY_TARGETS = "lint,typecheck,test,build";
-var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
+function affectedOrAllGuard(exclude = "") {
+  const extra = exclude === "" ? "" : `+' ${exclude}'`;
+  return `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T${extra},{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base${extra},{stdio:'inherit',shell:true}).status ?? 1)"`;
+}
+var AFFECTED_OR_ALL_GUARD = affectedOrAllGuard();
+var AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE = affectedOrAllGuard(`--exclude=tag:${GO_CGO_TAG}`);
+var NATIVE_BUILD_COMMAND = `npx nx run-many -t lint,test,build-native,package-native --projects=tag:${GO_CGO_TAG}`;
+var NATIVE_LINUX_PREREQUISITES = "sudo apt-get update && sudo apt-get install -y gcc pkg-config";
+function githubNativeJob(npmAuthName, npmAuthValue, onMain) {
+  return `
+  # Apps that need a C toolchain (mnci add go-app --cgo) cannot be cross-compiled
+  # from the job above, so each is linted, tested, built and packaged here, on a
+  # runner of every OS it ships for, and is left out of that job's verify step.
+  native:
+    name: native (\${{ matrix.os }})
+    needs: ci
+    runs-on: \${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest, ubuntu-latest]
+    steps:
+      - uses: actions/checkout@${ACTION_VERSIONS["actions/checkout"]}
+        with:
+          fetch-depth: 0
+
+      # The release tags name the version a native build is stamped with.
+      - run: git fetch --all --prune --tags
+        name: Fetch branches and release tags
+
+      - uses: actions/setup-node@${ACTION_VERSIONS["actions/setup-node"]}
+        with:
+          node-version: ${NODE_VERSION}
+          cache: npm
+
+      - run: npm install -g npm@${NPM_VERSION}
+        name: Pin npm to the major mnci verifies against
+
+      - run: npm ci
+        name: Install dependencies
+        env:
+          ${npmAuthName}: ${npmAuthValue}
+
+      - run: ${GO_MODULE_DOWNLOAD_GUARD}
+        name: Download Go module dependencies
+
+      - run: ${GOLANGCI_LINT_INSTALL_GUARD}
+        name: Install golangci-lint
+
+      - run: ${GO_TOOL_PATH_GITHUB}
+        name: Add Go tool bin to PATH
+
+      # A C compiler and pkg-config, which is all mnci can know a cgo app needs.
+      # Add the -dev packages your app links to this line, for example
+      # libgtk-3-dev and libayatana-appindicator3-dev for a system-tray icon.
+      # macOS and Windows runners ship their toolchains.
+      - run: ${NATIVE_LINUX_PREREQUISITES}
+        name: Install native prerequisites (Linux)
+        if: \${{ runner.os == 'Linux' }}
+
+      - run: ${NATIVE_BUILD_COMMAND}
+        name: Lint, test, build and package the native apps
+
+      - uses: actions/upload-artifact@${ACTION_VERSIONS["actions/upload-artifact"]}
+        with:
+          name: native-\${{ matrix.os }}
+          path: dist/drop
+          if-no-files-found: ignore
+
+      # A releasable native app (--cgo with --release) gets this OS's zip attached to
+      # the GitHub Release the ci job just created, stamped with the tag's version.
+      - run: node tools/go-app-release.cjs assets --native
+        name: Attach this OS's zip to the GitHub Release (releasable native apps)
+        if: \${{ ${onMain} && hashFiles('tools/go-app-release.cjs') != '' }}
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+`;
+}
+function indentYaml(text, spaces) {
+  const pad = " ".repeat(spaces);
+  return text.split("\n").map((line) => line === "" ? line : pad + line).join("\n");
+}
+function withAzureNativeJob(document, nativeSteps) {
+  const poolAt = document.indexOf("\npool:\n");
+  const variablesAt = document.indexOf("\nvariables:\n");
+  const stepsAt = document.indexOf("\nsteps:\n");
+  if (poolAt === -1 || variablesAt < poolAt || stepsAt < variablesAt) {
+    throw new Error("The Azure pipeline no longer has its pool, variables and steps blocks in that order.");
+  }
+  const head = document.slice(0, poolAt + 1);
+  const pool2 = document.slice(poolAt + "\npool:\n".length, variablesAt).replace(/\n+$/, "");
+  const variables = document.slice(variablesAt + 1, stepsAt).replace(/\n+$/, "");
+  const steps = document.slice(stepsAt + "\nsteps:\n".length).replace(/\n+$/, "");
+  const matrix = Object.entries({ windows: "windows-latest", macos: "macos-latest", linux: "ubuntu-latest" }).map(([leg, image]) => `        ${leg}:
+          legName: ${leg}
+          vmImage: ${image}`).join("\n");
+  return `${head}${variables}
+
+jobs:
+  - job: ci
+    pool:
+${indentYaml(pool2, 4)}
+    steps:
+${indentYaml(steps, 4)}
+
+  # Apps that need a C toolchain (mnci add go-app --cgo) cannot be cross-compiled
+  # from the job above, so each is linted, tested, built and packaged here, on an
+  # agent of every OS it ships for, and is left out of that job's verify step.
+  - job: native
+    displayName: Native apps (cgo)
+    dependsOn: ci
+    strategy:
+      matrix:
+${matrix}
+    pool:
+      vmImage: $(vmImage)
+    steps:
+${indentYaml(nativeSteps, 4)}
+`;
+}
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});const hasCsproj=fs.globSync('apps/*/*.csproj').length>0;if(!hasProjectJson&&!hasInlineNx&&!hasCsproj){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
 var NPM_AUTH_PREFLIGHT = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(fs.globSync('packages/*/package.json').length===0){console.log('No npm packages to release - skipping.');process.exit(0)}if(!process.env.NODE_AUTH_TOKEN){console.error('NPM_TOKEN is empty or unset, so the publish would fail AFTER nx release has already tagged. Add it as a repository secret named exactly NPM_TOKEN - under Actions, not the Dependabot or Codespaces tab, and not an Environment secret. Use an npm Automation token - a Publish token is refused by 2FA in CI.');process.exit(1)}const r=cp.spawnSync('npm',['whoami','--registry=https://registry.npmjs.org/'],{encoding:'utf8',shell:process.platform==='win32'});if(r.status!==0){console.error('NPM_TOKEN is set but the registry rejected it - '+((r.stderr||'')+(r.stdout||'')).trim()+'. Check that it has not expired and that it grants publish rights on this scope.');process.exit(1)}console.log('npm auth OK as '+r.stdout.trim())"`;
 function npmAuthPreflight(registryKind) {
@@ -1076,7 +1206,7 @@ function npmAuthEnvVariable(registryKind, variableReference) {
 function poolBlock(agent) {
   return /^(?:ubuntu|windows|macos)-/i.test(agent) ? `  vmImage: ${agent}` : `  name: ${agent}`;
 }
-function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts", nugetFeedUrl2, npmAuth = "pat") {
+function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts", nugetFeedUrl2, npmAuth = "pat", nativeApps = false) {
   const onMain = "and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI'), eq(variables['Build.SourceBranchName'], 'main'))";
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(registryKind, (name) => `$(${name})`);
   const buildIdentity = npmAuth === "build-identity" && registryKind === "azure-artifacts";
@@ -1094,7 +1224,7 @@ function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKin
   const npmCiEnv = buildIdentity ? "" : `
     env:
       ${npmAuthName}: ${npmAuthValue}`;
-  return `name: monorepo-ci-$(Date:yyyyMMdd)$(Rev:.r)
+  const document = `name: monorepo-ci-$(Date:yyyyMMdd)$(Rev:.r)
 
 # Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
 # versions from conventional commits and pushes ONLY a tag to main, and each
@@ -1305,7 +1435,7 @@ ${npmAuthenticateStep}  - script: npm ci
   # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
   # below, so adding it back as its own step would only duplicate work \u2014 and on
   # a pull request it would re-lint every project, discarding the point of this.
-  - script: ${AFFECTED_OR_ALL_GUARD}
+  - script: ${nativeApps ? AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE : AFFECTED_OR_ALL_GUARD}
     displayName: Verify (affected on a PR, every project on main)
 
   # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
@@ -1396,8 +1526,56 @@ ${npmAuthPreflight(registryKind) ? `
     displayName: Push release tags (nx release's own push never runs without a remote Release configured)
     condition: ${onMain}
 `;
+  if (!nativeApps) {
+    return document;
+  }
+  const nativeSteps = `  - checkout: self
+    fetchDepth: 0
+
+  - task: UseNode@1
+    inputs:
+      version: 24.x
+
+  - task: Cache@2
+    displayName: Cache npm packages
+    inputs:
+      key: 'npm | "$(Agent.OS)" | package-lock.json'
+      restoreKeys: |
+        npm | "$(Agent.OS)"
+      path: $(npm_config_cache)
+
+${npmAuthenticateStep}  - script: npm ci
+    displayName: Install dependencies${npmCiEnv}
+
+  - script: ${GO_MODULE_DOWNLOAD_GUARD}
+    displayName: Download Go module dependencies
+
+  - script: ${GOLANGCI_LINT_INSTALL_GUARD}
+    displayName: Install golangci-lint
+
+  - script: ${GO_TOOL_PATH_AZURE}
+    displayName: Add Go tool bin to PATH
+
+  # A C compiler and pkg-config, which is all mnci can know a cgo app needs. Add the
+  # -dev packages your app links to this line, for example libgtk-3-dev and
+  # libayatana-appindicator3-dev for a system-tray icon. macOS and Windows agents
+  # ship their toolchains.
+  - script: ${NATIVE_LINUX_PREREQUISITES}
+    displayName: Install native prerequisites (Linux)
+    condition: eq(variables['Agent.OS'], 'Linux')
+
+  - script: ${NATIVE_BUILD_COMMAND}
+    displayName: Lint, test, build and package the native apps
+
+  - task: PublishBuildArtifacts@1
+    displayName: Publish this OS's native zips
+    inputs:
+      PathtoPublish: $(Build.SourcesDirectory)/dist/drop
+      ArtifactName: native-$(legName)
+`;
+  return withAzureNativeJob(document, nativeSteps);
 }
-function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github", nugetFeedUrl2) {
+function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github", nugetFeedUrl2, nativeApps = false) {
   const onMain = "github.event_name == 'push' && github.ref_name == 'main'";
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(
     registryKind,
@@ -1566,7 +1744,7 @@ jobs:
       # below, so adding it back as its own step would only duplicate work \u2014 and
       # on a pull request it would re-lint every project, discarding the point
       # of this.
-      - run: ${AFFECTED_OR_ALL_GUARD}
+      - run: ${nativeApps ? AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE : AFFECTED_OR_ALL_GUARD}
         name: Verify (affected on a PR, every project on main)
 
       # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
@@ -1688,7 +1866,7 @@ ${githubReleases ? `
       - run: git push origin --tags
         name: Push release tags (nx release's own push never runs without a remote Release configured)
         if: \${{ ${onMain} }}
-`}`;
+`}${nativeApps ? githubNativeJob(npmAuthName, npmAuthValue, onMain) : ""}`;
 }
 var PIP_PROJECT_GLOBS = ["apps", "python-packages", "libs"];
 var PUB_PROJECT_GLOBS = ["apps", "packages", "libs"];
@@ -2005,6 +2183,7 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
   }
   const publishUrl = pythonPublishUrl(options.registry);
   const nugetUrl = nugetFeedUrl(options.registry);
+  const nativeApps = hasNativeGoApp(workspaceRoot);
   if (options.ci === "azure" || options.ci === "both") {
     onProgress("azure-pipelines.yml \u2014 build, verify, pack and release");
     writeFileEnsured(
@@ -2015,7 +2194,8 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
         publishUrl,
         options.registry.kind,
         nugetUrl,
-        options.npmAuth
+        options.npmAuth,
+        nativeApps
       )
     );
   }
@@ -2023,7 +2203,7 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
     onProgress(".github/workflows/ci.yml and dependabot.yml");
     writeFileEnsured(
       (0, import_node_path2.join)(workspaceRoot, ".github/workflows/ci.yml"),
-      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci, nugetUrl)
+      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci, nugetUrl, nativeApps)
     );
     writeFileEnsured((0, import_node_path2.join)(workspaceRoot, ".github/dependabot.yml"), dependabotConfig(workspaceRoot));
   }
@@ -2631,10 +2811,11 @@ var GO_RELEASE_SCRIPT = String.raw`#!/usr/bin/env node
 // A releasable Go app (tag release:go) is versioned from its git tag, with no
 // manifest, and its per-platform zips are attached to its GitHub Release:
 //   release.version.versionActions   this file, loaded by 'nx release'
-//   node tools/go-app-release.cjs assets
+//   node tools/go-app-release.cjs assets            the apps built for all six platforms
+//   node tools/go-app-release.cjs assets --native   the apps that need a C toolchain, this OS only
 'use strict'
 const { spawnSync } = require('node:child_process')
-const { existsSync, readdirSync } = require('node:fs')
+const { existsSync, readdirSync, readFileSync } = require('node:fs')
 const { dirname, join } = require('node:path')
 const { VersionActions } = require('nx/release')
 
@@ -2691,17 +2872,28 @@ function nx (args, env) {
   return run(process.execPath, [join(dirname(manifest), entry), ...args], env)
 }
 
-function releasableApps () {
-  return JSON.parse(nx(['show', 'projects', '--projects', 'tag:release:go', '--json'])).filter(Boolean)
+function releasableApps (native) {
+  const names = existsSync('apps') ? readdirSync('apps') : []
+
+  return names.filter(name => {
+    try {
+      const tags = JSON.parse(readFileSync(join('apps', name, 'project.json'), 'utf8')).tags || []
+
+      return tags.includes('release:go') && tags.includes('build:cgo') === native
+    } catch {
+      return false
+    }
+  })
 }
 
-function attachAssets () {
-  const apps = releasableApps()
+function attachAssets (native) {
+  const apps = releasableApps(native)
   if (apps.length === 0) {
-    console.log('No releasable Go app - nothing to attach.')
+    console.log('No releasable ' + (native ? 'native ' : '') + 'Go app - nothing to attach.')
 
     return
   }
+  const target = native ? 'package-native' : 'package-all'
   const tags = run('git', ['tag', '--points-at', 'HEAD']).split(/\r?\n/).filter(Boolean)
   let attached = 0
   for (const app of apps) {
@@ -2711,11 +2903,11 @@ function attachAssets () {
       continue
     }
     const version = tag.slice(app.length + 1)
-    console.log(app + ': building the six platforms as ' + version)
-    nx(['run', app + ':package-all'], { VERSION: version })
+    console.log(app + ': ' + (native ? 'building for this OS' : 'building the six platforms') + ' as ' + version)
+    nx(['run', app + ':' + target], { VERSION: version })
     const prefix = 'go-app-' + app + '-'
     const zips = existsSync('dist/drop') ? readdirSync('dist/drop').filter(each => each.startsWith(prefix) && each.endsWith('.zip')) : []
-    if (zips.length === 0) fail(app + ': package-all produced no ' + prefix + '*.zip in dist/drop.')
+    if (zips.length === 0) fail(app + ': ' + target + ' produced no ' + prefix + '*.zip in dist/drop.')
     const upload = spawnSync('gh', ['release', 'upload', tag, ...zips.map(each => join('dist/drop', each)), '--clobber'], { stdio: 'inherit', shell: process.platform === 'win32' })
     if (upload.status !== 0) fail(app + ': could not attach the zips to the ' + tag + ' release (exit ' + upload.status + ').')
     console.log(app + ': attached ' + zips.length + ' zips to ' + tag)
@@ -2725,8 +2917,8 @@ function attachAssets () {
 }
 
 if (require.main === module) {
-  if (process.argv[2] !== 'assets') fail('Usage: node tools/go-app-release.cjs assets')
-  attachAssets()
+  if (process.argv[2] !== 'assets' || (process.argv[3] !== undefined && process.argv[3] !== '--native')) fail('Usage: node tools/go-app-release.cjs assets [--native]')
+  attachAssets(process.argv[3] === '--native')
 }
 `;
 var GO_RELEASE_PUBLISH_TARGET = {
@@ -2875,6 +3067,25 @@ function goPackageAllTarget(tag, name) {
     options: { command }
   };
 }
+var GO_HOST_PLATFORM = "const host=k=>spawnSync('go',['env',k],{encoding:'utf8'}).stdout.trim();const os=host('GOOS'),arch=host('GOARCH');";
+function goNativeBuildTarget(name) {
+  const command = `node -e "const{spawnSync}=require('node:child_process');${GO_HOST_PLATFORM}const v=process.env.VERSION||'dev';const out='../../dist/platforms/${name}/'+os+'-'+arch+'/${name}'+(os==='windows'?'.exe':'');const r=spawnSync('go',['build','-trimpath','-ldflags','-s -w -X main.version='+v,'-o',out,'.'],{cwd:'apps/${name}',stdio:'inherit',env:{...process.env,CGO_ENABLED:'1'}});process.exit(r.status??1)"`;
+  return {
+    executor: "nx:run-commands",
+    inputs: ["default", "^default", "{workspaceRoot}/go.mod", "{workspaceRoot}/go.sum", { env: "VERSION" }],
+    outputs: [`{workspaceRoot}/dist/platforms/${name}`],
+    options: { command }
+  };
+}
+function goNativePackageTarget(name) {
+  const command = `node -e "const fs=require('node:fs');const{spawnSync}=require('node:child_process');const A=require('adm-zip');${GO_HOST_PLATFORM}const d=os+'-'+arch;fs.mkdirSync('dist/drop',{recursive:true});const z=new A();z.addLocalFolder('dist/platforms/${name}/'+d);z.writeZip('dist/drop/go-app-${name}-'+d+'.zip')"`;
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build-native"],
+    outputs: [`{workspaceRoot}/dist/drop/go-app-${name}-*.zip`],
+    options: { command }
+  };
+}
 function addGoPlatformTargets(workspaceRoot) {
   const changed = [];
   const apps = (0, import_node_path7.join)(workspaceRoot, "apps");
@@ -2888,7 +3099,7 @@ function addGoPlatformTargets(workspaceRoot) {
     }
     const project = JSON.parse((0, import_node_fs6.readFileSync)(projectJsonPath, "utf8"));
     const tag = (project.tags ?? []).find((each) => each === "type:go-app" || each === "type:go-function-app")?.slice("type:".length);
-    if (tag === void 0) {
+    if (tag === void 0 || (project.tags ?? []).includes(GO_CGO_TAG)) {
       continue;
     }
     const missing = {};
@@ -2978,6 +3189,7 @@ function prepareGo(workspaceRoot) {
   ensureGoModule(workspaceRoot);
 }
 function addGoApp(workspaceRoot, name, options = {}) {
+  const cgo = options.cgo === true;
   prepareGo(workspaceRoot);
   ensureAdmZip(workspaceRoot);
   runNx(
@@ -2986,24 +3198,31 @@ function addGoApp(workspaceRoot, name, options = {}) {
       "@nx-go/nx-go:application",
       `apps/${name}`,
       `--name=${name}`,
-      "--tags=type:go-app",
+      cgo ? `--tags=type:go-app,${GO_CGO_TAG}` : "--tags=type:go-app",
       "--no-interactive"
     ],
     workspaceRoot
   );
   addProjectJsonTargets((0, import_node_path7.join)(workspaceRoot, "apps", name, "project.json"), {
-    "build": goBuildTarget(name),
-    "test": goTestTarget(),
-    "lint": goLintTarget(),
-    "package": goPackageTarget("go-app", name),
-    "build-all": goBuildAllTarget(name),
-    "package-all": goPackageAllTarget("go-app", name),
-    "start": goStartTarget(name)
+    build: goBuildTarget(name),
+    test: goTestTarget(),
+    lint: goLintTarget(),
+    ...cgo ? { "build-native": goNativeBuildTarget(name), "package-native": goNativePackageTarget(name) } : {
+      "package": goPackageTarget("go-app", name),
+      "build-all": goBuildAllTarget(name),
+      "package-all": goPackageAllTarget("go-app", name)
+    },
+    start: goStartTarget(name)
   });
   if (options.release === true) {
     makeGoAppReleasable(workspaceRoot, name);
   }
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+  if (cgo) {
+    logger.warn(
+      `${name} needs a C toolchain, so CI builds it on a runner of each OS. Run \`mnci upgrade\` to add the native job to your pipeline, and add the -dev packages it links to the Linux prerequisites step.`
+    );
+  }
 }
 function addGoFunctionApp(workspaceRoot, name) {
   prepareGo(workspaceRoot);
@@ -5454,8 +5673,10 @@ async function runAdd(kind, name, options) {
     message: "What kind of project?",
     choices: PROJECT_KINDS.map((value) => ({ name: value, value }))
   });
-  if (resolvedKind !== "go-app" && options.release === true) {
-    throw new Error(`--release applies to go-app only, not ${resolvedKind}.`);
+  for (const [flag, requested] of [["--release", options.release], ["--cgo", options.cgo]]) {
+    if (resolvedKind !== "go-app" && requested === true) {
+      throw new Error(`${flag} applies to go-app only, not ${resolvedKind}.`);
+    }
   }
   const resolvedName = name ?? await promptText("Project name");
   assertValidProjectName(resolvedName, "Project name");
@@ -5522,7 +5743,7 @@ async function runAdd(kind, name, options) {
       break;
     }
     case "go-app": {
-      addGoApp(workspaceRoot, resolvedName, { release: options.release });
+      addGoApp(workspaceRoot, resolvedName, { release: options.release, cgo: options.cgo });
       break;
     }
     case "go-function-app": {
@@ -5601,6 +5822,7 @@ function readWorkspaceStack(workspaceRoot) {
 }
 
 // src/workspace-diagnostics/check-invariants.use-case.ts
+var import_node_child_process = require("child_process");
 var import_node_fs14 = require("fs");
 var import_node_path21 = require("path");
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
@@ -5885,6 +6107,32 @@ function checkSync(workspaceRoot) {
     remedy: "run `npx nx sync` and commit the result"
   };
 }
+function hasCCompiler() {
+  const candidates = [process.env.CC?.split(" ", 1)[0], "gcc", "clang", "cc"];
+  return candidates.some((command) => command !== void 0 && command !== "" && (0, import_node_child_process.spawnSync)(command, ["--version"], { stdio: "ignore" }).status === 0);
+}
+function checkNativeApps(workspaceRoot) {
+  if (!hasNativeGoApp(workspaceRoot)) {
+    return [];
+  }
+  const pipelines = [
+    { file: ".github/workflows/ci.yml", marker: "native (${{ matrix.os }})" },
+    { file: "azure-pipelines.yml", marker: "- job: native" }
+  ];
+  const findings = pipelines.filter(({ file }) => fileExists((0, import_node_path21.join)(workspaceRoot, file))).map(({ file, marker }) => ({
+    check: `${file} builds the native apps on every OS`,
+    ok: (0, import_node_fs14.readFileSync)((0, import_node_path21.join)(workspaceRoot, file), "utf8").includes(marker),
+    detail: `${file} has no native job: CI would verify a cgo app on the one agent that cannot build it`,
+    remedy: "run `mnci upgrade`"
+  }));
+  findings.push({
+    check: "a C compiler is installed (cgo needs one)",
+    ok: hasCCompiler(),
+    detail: "none of CC, gcc, clang or cc answered --version, so nx run <app>:build-native cannot build here",
+    remedy: "install one: Xcode command line tools on macOS, build-essential on Linux, MinGW-w64 (gcc) on Windows"
+  });
+  return findings;
+}
 function checkNoRootRuntimeDependencies(workspaceRoot) {
   const manifestPath = (0, import_node_path21.join)(workspaceRoot, "package.json");
   if (!fileExists(manifestPath)) {
@@ -5986,7 +6234,8 @@ function collectFindings(workspaceRoot) {
     ...checkDeclarationSpecifiers(workspaceRoot),
     ...checkVersionActions(workspaceRoot),
     ...checkTargetFilesExist(workspaceRoot),
-    checkSync(workspaceRoot)
+    checkSync(workspaceRoot),
+    ...checkNativeApps(workspaceRoot)
   ].filter((finding) => finding !== void 0);
 }
 function runDoctor(workspaceRoot) {
@@ -6521,6 +6770,9 @@ function buildProgram(cliVersion) {
   ).option(
     "--release",
     "go-app only: release the app. Versioned from its git tag, its six-platform zips attached to its GitHub Release"
+  ).option(
+    "--cgo",
+    "go-app only: the app needs a C toolchain (a tray icon, a native GUI, a cgo driver), so CI builds it on a runner of each OS instead of cross-compiling"
   ).action(
     async (kind, name, options) => {
       await runAdd(kind, name, options);