From 4ef11714903b1e00bd8c94e21388b1ce3663aef9 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 26 Jul 2026 18:26:04 -0500
Subject: [PATCH 1/3] build: compress linux release binaries with upx

Add a goreleaser upx step (--best --lzma) scoped to the linux release
build ids (devsy-linux, devsy-pro-dev), shrinking the linux/amd64 binary
from ~124MB to ~24MB. Local dev builds (devsy-dev, devsy) are left
uncompressed so they don't require upx or pay the compression cost.

Install upx on the linux leg of the release and pr-ci workflows via the
sha-pinned crazy-max/ghaction-upx action (install-only).
---
 .github/workflows/pr-ci.yml   | 6 ++++++
 .github/workflows/release.yml | 6 ++++++
 .goreleaser.yml               | 7 +++++++
 3 files changed, 19 insertions(+)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index 5d4698886..3c1ba0f7c 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -105,6 +105,12 @@ jobs:
           fi
           echo "runner_os=$OS" >> "$GITHUB_OUTPUT"
 
+      - name: install upx
+        if: runner.os == 'Linux'
+        uses: crazy-max/ghaction-upx@c83f378efc804f828e988debb88ed6116feb2368 # v4.0.0
+        with:
+          install-only: true
+
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0acebc656..955304466 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,6 +36,12 @@ jobs:
           fi
           echo "runner_os=$OS" >> "$GITHUB_OUTPUT"
 
+      - name: install upx
+        if: runner.os == 'Linux'
+        uses: crazy-max/ghaction-upx@c83f378efc804f828e988debb88ed6116feb2368 # v4.0.0
+        with:
+          install-only: true
+
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser
diff --git a/.goreleaser.yml b/.goreleaser.yml
index fc143c33a..47823fdda 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -90,6 +90,13 @@ builds:
           env:
             - DEVSY_PRO_NS={{ .Env.DEVSY_PRO_NS | default "default" }}
 
+upx:
+  - enabled: true
+    ids: [devsy-linux, devsy-pro-dev]
+    goos: [linux]
+    compress: best
+    lzma: true
+
 archives:
   - formats: [tar.gz]
     format_overrides:

From 68d02eb599da23bb41a8c1ff232e96aa56dcaf21 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 26 Jul 2026 21:15:13 -0500
Subject: [PATCH 2/3] build: drop upx --lzma to avoid per-exec decompression
 latency

The devsy binary is copied into containers and re-exec'd frequently
(credentials server, git credential helper per git op, agent setup).
--lzma has the slowest decompression, which broke timing-sensitive e2e
specs (credentials server startup, secret injection, ssh socket cleanup,
workspace status). Use UCL (compress: best) instead: ~10x faster
decompression at a smaller size reduction.
---
 .goreleaser.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 47823fdda..336d39df9 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -95,7 +95,6 @@ upx:
     ids: [devsy-linux, devsy-pro-dev]
     goos: [linux]
     compress: best
-    lzma: true
 
 archives:
   - formats: [tar.gz]

From 6d7a9294dceb38abc46a4b0d26c4fc4580269f94 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 27 Jul 2026 10:41:45 -0500
Subject: [PATCH 3/3] feat: restore lzma compression

---
 .goreleaser.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 336d39df9..47823fdda 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -95,6 +95,7 @@ upx:
     ids: [devsy-linux, devsy-pro-dev]
     goos: [linux]
     compress: best
+    lzma: true
 
 archives:
   - formats: [tar.gz]