fix(ci): restore binary releases + add musl Linux targets

.github/workflows/release-plz.yml

@@ -28,17 +28,32 @@ jobs:
         with:
           command: release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # GH_PAT lets release-plz's bot tag pushes trigger downstream
+          # workflows like `Release` (release.yml). With plain GITHUB_TOKEN,
+          # GitHub Actions' anti-recursion rule silently suppresses workflow
+          # runs from bot-pushed tags
+          # (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow),
+          # which is why binary releases stopped attaching after v0.2.2.
+          #
+          # Recommended: a fine-grained PAT scoped to this repo with
+          # `Contents: Read & write` (and `Pull requests: Read & write` if
+          # you also want this token to drive the release-pr step). A
+          # GitHub App token with the same permissions is even better —
+          # tokens are short-lived and scoped to the installation.
+          # Avoid classic PATs with the broad `workflow` scope unless
+          # actually needed; tag pushes alone don't require it.
+          # Falls back to GITHUB_TOKEN if GH_PAT isn't configured (no break for forks).
+          GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
       # Create PR for next release if changes exist
       - name: Create Release PR
         uses: release-plz/[email protected]
-        if: steps.release-plz.outputs.releases == '[]' || steps.release-plz.outputs.releases == '' 
+        if: steps.release-plz.outputs.releases == '[]' || steps.release-plz.outputs.releases == ''
         with:
           command: release-pr
         env:
-          # Use GH_PAT if set to trigger CI workflows, otherwise fallback to GITHUB_TOKEN
+          # Same token requirements as above — see comment on the release step.
           GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 

.github/workflows/release.yml

@@ -6,6 +6,12 @@ permissions:
 on:
   push:
     tags:
+      # `argus-ai` is the root binary crate (binary name `argus`) and
+      # the user-facing release. `npm/install.js` downloads from
+      # /releases/download/argus-ai-v<version>/, so binaries must
+      # attach to this tag's release. release-plz publishes
+      # argus-ai-v* on every release cycle alongside the per-crate
+      # tags (argus-core-v*, argus-mcp-v*, etc.).
       - 'argus-ai-v*'
 
 jobs:
@@ -17,6 +23,18 @@ jobs:
             os: ubuntu-latest
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-latest
+          # musl builds: statically linked, no GLIBC dependency. The
+          # *-unknown-linux-gnu binaries built on modern Ubuntu runners
+          # require GLIBC 2.39+, so they crash on older base images
+          # (Debian Bookworm ships GLIBC 2.36, Alpine uses musl, etc.).
+          # use_cross=true delegates to `cross`, which uses a Docker image
+          # with the full musl toolchain — no host-side apt acrobatics.
+          - target: x86_64-unknown-linux-musl
+            os: ubuntu-latest
+            use_cross: true
+          - target: aarch64-unknown-linux-musl
+            os: ubuntu-latest
+            use_cross: true
           - target: x86_64-apple-darwin
             os: macos-latest
           - target: aarch64-apple-darwin
@@ -41,8 +59,18 @@ jobs:
           sudo apt-get install -y gcc-aarch64-linux-gnu
           echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
 
-      - name: Build
-        run: cargo build --release --target ${{ matrix.target }}
+      - name: Install cross (musl targets)
+        if: matrix.use_cross
+        # Pinned for reproducibility — bumps should be deliberate.
+        run: cargo install cross --version 0.2.5 --locked
+
+      - name: Build (cross)
+        if: matrix.use_cross
+        run: cross build --release --locked --target ${{ matrix.target }}
+
+      - name: Build (cargo)
+        if: ${{ !matrix.use_cross }}
+        run: cargo build --release --locked --target ${{ matrix.target }}
 
       - name: Package (unix)
         if: matrix.os != 'windows-latest'

crates/argus-gitpulse/src/ownership.rs

@@ -173,8 +173,13 @@ pub fn analyze_ownership(commits: &[CommitInfo]) -> Result<OwnershipSummary, Arg
             });
         }
 
-        // Sort authors by commits descending
-        author_contribs.sort_by(|a, b| b.commits.cmp(&a.commits));
+        // Sort authors by commits descending, tie-breaking on email so the
+        // output order is deterministic across HashMap iteration runs.
+        author_contribs.sort_by(|a, b| {
+            b.commits
+                .cmp(&a.commits)
+                .then_with(|| a.email.cmp(&b.email))
+        });
 
         let dominant_author_ratio = max_commits as f64 / total_commits as f64;
         let bus_factor = author_contribs.iter().filter(|a| a.ratio > 0.10).count() as u32;
@@ -232,9 +237,12 @@ fn compute_project_bus_factor(files: &[FileOwnership]) -> u32 {
         }
     }
 
-    // Sort authors by number of files they contribute to (descending)
+    // Sort by file count descending, tie-breaking on email. Without the
+    // tie-break, HashMap iteration order makes the early-return below
+    // (orphaned > threshold) non-deterministic — different runs could
+    // remove different tied authors first and report different bus factors.
     let mut sorted_authors: Vec<(String, u32)> = all_authors.into_iter().collect();
-    sorted_authors.sort_by(|a, b| b.1.cmp(&a.1));
+    sorted_authors.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
 
     let total_files = files.len();
     let threshold = total_files / 2;

crates/argus-review/src/patch.rs

@@ -87,7 +87,7 @@ pub fn apply_patches(
         let mut lines: Vec<String> = file_content.lines().map(String::from).collect();
 
         // Sort by line number descending (bottom-up) to avoid offset issues
-        file_comments.sort_by(|a, b| b.line.cmp(&a.line));
+        file_comments.sort_by_key(|c| std::cmp::Reverse(c.line));
 
         for comment in &file_comments {
             let patch_content = comment.patch.as_deref().unwrap();