chore: enhance release workflow and update Cargo.toml for standalone binaries

- Commented out macOS build configurations in the release workflow to focus on ensuring the flow works correctly.
- Added steps to build and upload standalone CLI binaries for `openhuman-core` and `openhuman-cli`.
- Updated `Cargo.toml` to require the `standalone-bins` feature for both binaries, streamlining the build process.

.github/workflows/release.yml

@@ -209,12 +209,19 @@ jobs:
       fail-fast: false
       matrix:
         settings:
-          - platform: macos-latest
-            args: --target aarch64-apple-darwin
-          - platform: macos-latest
-            args: --target x86_64-apple-darwin
+          # macOS builds are disabled for now to ensure the flow works first
+          # - platform: macos-latest
+          #   args: --target aarch64-apple-darwin
+          #   target: aarch64-apple-darwin
+          #   artifact_suffix: aarch64-apple-darwin
+          # - platform: macos-latest
+          #   args: --target x86_64-apple-darwin
+          #   target: x86_64-apple-darwin
+          #   artifact_suffix: x86_64-apple-darwin
           - platform: ubuntu-22.04
-            args: ''
+            args: ""
+            target: ""
+            artifact_suffix: ubuntu
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
@@ -280,7 +287,7 @@ jobs:
         env:
           BASE_URL: ${{ vars.BASE_URL }}
           UPDATER_PUBLIC_KEY: ${{ secrets.UPDATER_PUBLIC_KEY }}
-          WITH_UPDATER: 'true'
+          WITH_UPDATER: "true"
         with:
           script: |
             const workspacePath = process.env.GITHUB_WORKSPACE.replace(/\\/g, '/');
@@ -300,6 +307,7 @@ jobs:
 
       - name: Build, package and upload to release
         uses: tauri-apps/tauri-action@v0.6.2
+        id: tauri-build
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -310,19 +318,67 @@ jobs:
           BASE_URL: ${{ vars.BASE_URL }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY || secrets.UPDATER_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD || secrets.UPDATER_PRIVATE_KEY_PASSWORD }}
-          WITH_UPDATER: 'true'
+          WITH_UPDATER: "true"
           MACOSX_DEPLOYMENT_TARGET: ${{ matrix.settings.platform == 'macos-latest' && '10.15' || '' }}
         with:
           # Tools discovery now uses a JS mock registry (no Rust discovery
           # binary target), so there is no extra helper executable for Tauri
           # to copy/sign inside release app bundles.
-          args: -c ${{ steps.config-overrides.outputs.json }} ${{ matrix.settings.args }}
+          # Build/package only the app binary to keep standalone CLI bins
+          # out of the signed macOS app bundle.
+          args: -c ${{ steps.config-overrides.outputs.json }} ${{ matrix.settings.args }} -- --bin OpenHuman
           includeDebug: false
           includeRelease: true
           releaseId: ${{ needs.create-release.outputs.release_id }}
           owner: tinyhumansai
           repo: openhuman
 
+      - name: Verify macOS app bundle excludes standalone core binary
+        if: matrix.settings.platform == 'macos-latest'
+        shell: bash
+        run: |
+          APP_PATH="src-tauri/target/${{ matrix.settings.target }}/release/bundle/macos/OpenHuman.app"
+          echo "Inspecting bundle at: $APP_PATH"
+          ls -la "$APP_PATH/Contents/MacOS"
+          if [ -f "$APP_PATH/Contents/MacOS/openhuman-core" ]; then
+            echo "Unexpected standalone binary found inside app bundle: openhuman-core"
+            exit 1
+          fi
+
+      - name: Build standalone CLI binaries
+        shell: bash
+        run: |
+          CARGO_TARGET=""
+          if [ -n "$MATRIX_TARGET" ]; then
+            CARGO_TARGET="--target $MATRIX_TARGET"
+          fi
+          cargo build --manifest-path src-tauri/Cargo.toml --release --features standalone-bins $CARGO_TARGET --bin openhuman-core --bin openhuman-cli
+        env:
+          MATRIX_TARGET: ${{ matrix.settings.target }}
+
+      - name: Resolve standalone CLI artifact paths
+        id: cli-paths
+        shell: bash
+        run: |
+          if [ -n "$MATRIX_TARGET" ]; then
+            BASE_DIR="src-tauri/target/$MATRIX_TARGET/release"
+          else
+            BASE_DIR="src-tauri/target/release"
+          fi
+          echo "base_dir=$BASE_DIR" >> "$GITHUB_OUTPUT"
+          echo "core_path=$BASE_DIR/openhuman-core" >> "$GITHUB_OUTPUT"
+          echo "cli_path=$BASE_DIR/openhuman-cli" >> "$GITHUB_OUTPUT"
+        env:
+          MATRIX_TARGET: ${{ matrix.settings.target }}
+
+      - name: Upload standalone CLI artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: standalone-bins-${{ matrix.settings.platform }}-${{ matrix.settings.artifact_suffix }}
+          path: |
+            ${{ steps.cli-paths.outputs.core_path }}
+            ${{ steps.cli-paths.outputs.cli_path }}
+
   cleanup-failed-release:
     name: Remove release and tag if build failed
     runs-on: ubuntu-latest

src-tauri/Cargo.toml

@@ -22,10 +22,12 @@ path = "src/main.rs"
 [[bin]]
 name = "openhuman-core"
 path = "src/bin/openhuman-core.rs"
+required-features = ["standalone-bins"]
 
 [[bin]]
 name = "openhuman-cli"
 path = "src/bin/openhuman-cli.rs"
+required-features = ["standalone-bins"]
 
 [build-dependencies]
 tauri-build = { version = "2", features = [] }
@@ -191,3 +193,4 @@ landlock = ["sandbox-landlock"]
 probe = ["dep:probe-rs"]
 rag-pdf = ["dep:pdf-extract"]
 whatsapp-web = ["dep:wa-rs", "dep:wa-rs-core", "dep:wa-rs-binary", "dep:wa-rs-proto", "dep:wa-rs-ureq-http", "dep:wa-rs-tokio-transport", "serde-big-array"]
+standalone-bins = []