Switch to GitHub Actions artifact downloads for CI binaries

[jackzampolin]

Summary

• Replaces filesystem-cache binary lookups with gh run download for defra-iroh and hubd
• Resolves pinned ref to exact commit, finds the successful CI run for that commit, downloads the release artifact
• Hard-fails if no successful run exists for the pinned commit (preserves existing semantics)
• orbis-rs remains a source build (no CI artifact pipeline)

Dependencies

Requires these PRs to be merged first (they add artifact upload steps):

• Add release artifact uploads to CI defradb.rs#586
• Add release artifact uploads to CI hub.rs#83

Merge order

1. Merge defradb.rs#586 → triggers CI → produces artifacts
2. Merge hub.rs#83 → triggers CI → produces artifacts
3. Merge this PR → backbone CI downloads those artifacts

Test plan

• Verify defradb.rs CI produces defra-aarch64-apple-darwin and defra-iroh-aarch64-apple-darwin artifacts
• Verify hub.rs CI produces hubd-aarch64-apple-darwin artifact
• Verify backbone CI downloads artifacts and passes full-stack test

🤖 Generated with Claude Code

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: dfe09e50-4d9c-44e5-b9d9-7a96eac4e3a2

📥 Commits

Reviewing files that changed from the base of the PR and between 0709286 and 95613c4.

📒 Files selected for processing (1)

• .github/scripts/ensure-binaries.sh

---

📝 Walkthrough

Walkthrough

The script's binary acquisition strategy is refactored to download defra-iroh and hubd binaries from GitHub Actions artifacts instead of accessing a prebuilt binary cache. A new download_artifact helper function uses GitHub CLI to locate and retrieve artifacts from CI runs. orbis-rs shifts to local source builds. Supporting messages and verification output are updated.

Changes

Cohort / File(s)

Summary

Binary Artifact Download Workflow .github/scripts/ensure-binaries.sh

Replaced prebuilt binary linkage with GitHub Actions artifact downloads. Added new download_artifact helper function that uses gh run list and gh run download to retrieve binaries from CI. Updated control flow to resolve commits, locate successful runs, download artifacts, and cache them with executable permissions. orbis-rs now built locally. Updated status messages and binary verification output.

Sequence Diagram

sequenceDiagram
    participant Script as ensure-binaries.sh
    participant GH as GitHub CLI (gh)
    participant API as GitHub API
    participant Cache as Local Cache
    
    Script->>Script: Resolve commit reference
    Script->>GH: download_artifact(repo, ref)
    GH->>API: gh run list --repo --ref --status success
    API-->>GH: Return matching CI runs
    GH->>API: gh run download (run-id) --pattern artifact
    API-->>GH: Stream artifact download
    GH-->>Script: Artifact data
    Script->>Cache: Write binary to cache directory
    Script->>Script: Mark binary as executable
    Script->>Script: Verify binary readiness

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

📝 Coding Plan

• Generate coding plan for human review comments

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

You can make CodeRabbit's review stricter and more nitpicky using the `assertive` profile, if that's what you prefer.

Change the reviews.profile setting to assertive to make CodeRabbit's nitpick more issues in your PRs.