Publish binaries compressed with zstd and consume them

.github/scripts/generate-install-script.sh

@@ -28,12 +28,17 @@ echo "Downloading releases for $VERSION..."
 # Download the archives (excluding FreeBSD)
 declare -A DOWNLOADS=(
   ["macos-aarch64"]="celq-macos-aarch64.tar.gz"
+  ["macos-aarch64-zstd"]="celq-macos-aarch64.tar.zst"
   ["macos-x86_64"]="celq-macos-x86_64.tar.gz"
   ["windows-x86_64"]="celq-windows-x86_64.zip"
   ["linux-x86_64-musl"]="celq-linux-x86_64-musl.tar.gz"
+  ["linux-x86_64-musl-zstd"]="celq-linux-x86_64-musl.tar.zst"
   ["linux-aarch64-musl"]="celq-linux-aarch64-musl.tar.gz"
+  ["linux-aarch64-musl-zstd"]="celq-linux-aarch64-musl.tar.zst"
   ["linux-x86_64-gnu"]="celq-linux-x86_64-gnu.tar.gz"
+  ["linux-x86_64-gnu-zstd"]="celq-linux-x86_64-gnu.tar.zst"
   ["linux-aarch64-gnu"]="celq-linux-aarch64-gnu.tar.gz"
+  ["linux-aarch64-gnu-zstd"]="celq-linux-aarch64-gnu.tar.zst"
   ["linux-riscv64-musl"]="celq-linux-riscv64-musl.tar.gz"
   ["linux-riscv64-gnu"]="celq-linux-riscv64-gnu.tar.gz"
 )
@@ -78,12 +83,17 @@ fi
 sed -e "s/{{CELQ_VERSION}}/${VERSION}/g" \
     -e "s|{{MINISIGN_PUBLIC_KEY}}|${MINISIGN_PUBLIC_KEY}|g" \
     -e "s/{{CHECKSUM_MACOS_AARCH64}}/${CHECKSUMS[macos-aarch64]}/g" \
+    -e "s/{{CHECKSUM_MACOS_AARCH64_ZSTD}}/${CHECKSUMS[macos-aarch64-zstd]}/g" \
     -e "s/{{CHECKSUM_MACOS_X86_64}}/${CHECKSUMS[macos-x86_64]}/g" \
     -e "s/{{CHECKSUM_WINDOWS_X86_64}}/${CHECKSUMS[windows-x86_64]}/g" \
     -e "s/{{CHECKSUM_LINUX_X86_64_MUSL}}/${CHECKSUMS[linux-x86_64-musl]}/g" \
+    -e "s/{{CHECKSUM_LINUX_X86_64_MUSL_ZSTD}}/${CHECKSUMS[linux-x86_64-musl-zstd]}/g" \
     -e "s/{{CHECKSUM_LINUX_AARCH64_MUSL}}/${CHECKSUMS[linux-aarch64-musl]}/g" \
+    -e "s/{{CHECKSUM_LINUX_AARCH64_MUSL_ZSTD}}/${CHECKSUMS[linux-aarch64-musl-zstd]}/g" \
     -e "s/{{CHECKSUM_LINUX_X86_64_GNU}}/${CHECKSUMS[linux-x86_64-gnu]}/g" \
+    -e "s/{{CHECKSUM_LINUX_X86_64_GNU_ZSTD}}/${CHECKSUMS[linux-x86_64-gnu-zstd]}/g" \
     -e "s/{{CHECKSUM_LINUX_AARCH64_GNU}}/${CHECKSUMS[linux-aarch64-gnu]}/g" \
+    -e "s/{{CHECKSUM_LINUX_AARCH64_GNU_ZSTD}}/${CHECKSUMS[linux-aarch64-gnu-zstd]}/g" \
     -e "s/{{CHECKSUM_LINUX_RISCV64_MUSL}}/${CHECKSUMS[linux-riscv64-musl]}/g" \
     -e "s/{{CHECKSUM_LINUX_RISCV64_GNU}}/${CHECKSUMS[linux-riscv64-gnu]}/g" \
     "$TEMPLATE_FILE" > "$OUTPUT_FILE"

.github/scripts/update-homebrew-formula.sh

@@ -21,10 +21,10 @@ echo "Temporary directory: $TEMP_DIR"
 
 # Define the archives we need to download
 declare -A DOWNLOADS=(
-  ["macos-aarch64"]="celq-macos-aarch64.tar.gz"
+  ["macos-aarch64"]="celq-macos-aarch64.tar.zst"
   ["macos-x86_64"]="celq-macos-x86_64.tar.gz"
-  ["linux-x86_64-gnu"]="celq-linux-x86_64-gnu.tar.gz"
-  ["linux-aarch64-gnu"]="celq-linux-aarch64-gnu.tar.gz"
+  ["linux-x86_64-gnu"]="celq-linux-x86_64-gnu.tar.zst"
+  ["linux-aarch64-gnu"]="celq-linux-aarch64-gnu.tar.zst"
 )
 
 declare -A CHECKSUMS
@@ -64,4 +64,4 @@ sed -e "s/{{CELQ_VERSION}}/${VERSION_WITHOUT_V}/g" \
 # Cleanup
 rm -rf "$TEMP_DIR"
 
-echo "✅ Formula updated successfully at $OUTPUT_PATH"
+echo "✅ Formula updated successfully at $OUTPUT_PATH"

.github/workflows/release_github.yml

@@ -286,9 +286,76 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh release upload ${VERSION} ${{ steps.archive.outputs.ARCHIVE_NAME }}
 
+  create-zstd-archives:
+    name: Zstandard (${{ matrix.pretty_target }})
+    needs: [build, build_mac]
+    runs-on: ubuntu-24.04
+    environment: github_release
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { pretty_target: macos-aarch64 }
+          - { pretty_target: linux-x86_64-gnu }
+          - { pretty_target: linux-aarch64-gnu }
+          - { pretty_target: linux-x86_64-musl }
+          - { pretty_target: linux-aarch64-musl }
+    steps:
+      - name: Install pinned zstd
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          cache: false
+          experimental: true
+          minimum_release_age: 2d
+          mise_toml: |
+            [tools]
+            "conda:zstd" = "1.5.7"
+          version: 2026.9.9
+
+      - name: Download gzip release archive
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_ARCHIVE: ${{ env.NAME }}-${{ matrix.pretty_target }}.tar.gz
+        run: |
+          mkdir -p "${RUNNER_TEMP}/release-assets"
+          gh release download "${VERSION}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --pattern "${SOURCE_ARCHIVE}" \
+            --dir "${RUNNER_TEMP}/release-assets"
+
+      - name: Create reproducible zstd release archive
+        id: archive
+        env:
+          SOURCE_ARCHIVE: ${{ env.NAME }}-${{ matrix.pretty_target }}.tar.gz
+        run: |
+          SOURCE_PATH="${RUNNER_TEMP}/release-assets/${SOURCE_ARCHIVE}"
+          TAR_PATH="${SOURCE_PATH%.gz}"
+          ZSTD_PATH="${TAR_PATH}.zst"
+
+          gzip --decompress --keep "${SOURCE_PATH}"
+          zstd -19 -T1 --no-progress "${TAR_PATH}" -o "${ZSTD_PATH}"
+
+          echo "ZSTD_PATH=${ZSTD_PATH}" >> "$GITHUB_OUTPUT"
+
+      - name: Generate attestation for zstd release archive
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: ${{ steps.archive.outputs.ZSTD_PATH }}
+
+      - name: Upload zstd release archive
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ZSTD_PATH: ${{ steps.archive.outputs.ZSTD_PATH }}
+        run: gh release upload "${VERSION}" "${ZSTD_PATH}" --repo "${GITHUB_REPOSITORY}"
+
   update-install-script:
     name: Update install script on GitHub Pages
-    needs: [build, build_mac, build_xwin]
+    needs: [build, build_mac, build_xwin, create-zstd-archives]
     permissions:
       contents: write
       id-token: write
@@ -299,7 +366,7 @@ jobs:
   generate-checksums:
     name: Generate SHA256 checksums
     runs-on: ubuntu-latest
-    needs: [build, build_mac, build_xwin, update-install-script]
+    needs: [build, build_mac, build_xwin, create-zstd-archives, update-install-script]
     environment: github_release
     permissions:
       contents: write
@@ -321,6 +388,7 @@ jobs:
           gh release download "${VERSION}" \
             --repo ${{ github.repository }} \
             --pattern "celq-*.tar.gz" \
+            --pattern "celq-*.tar.zst" \
             --pattern "celq-*.zip" \
             --pattern "install.sh"
 
@@ -387,13 +455,18 @@ jobs:
       matrix:
         include:
           - { target: aarch64-apple-darwin, archive: celq-macos-aarch64.tar.gz, archive_suffix: tar.gz }
+          - { target: aarch64-apple-darwin, archive: celq-macos-aarch64.tar.zst, archive_suffix: tar.zst }
           - { target: x86_64-apple-darwin, archive: celq-macos-x86_64.tar.gz, archive_suffix: tar.gz }
           - { target: x86_64-pc-windows-msvc, archive: celq-windows-x86_64.zip, archive_suffix: zip }
           - { target: aarch64-pc-windows-msvc, archive: celq-windows-arm64.zip, archive_suffix: zip }
           - { target: x86_64-unknown-linux-musl, archive: celq-linux-x86_64-musl.tar.gz, archive_suffix: tar.gz }
+          - { target: x86_64-unknown-linux-musl, archive: celq-linux-x86_64-musl.tar.zst, archive_suffix: tar.zst }
           - { target: aarch64-unknown-linux-musl, archive: celq-linux-aarch64-musl.tar.gz, archive_suffix: tar.gz }
+          - { target: aarch64-unknown-linux-musl, archive: celq-linux-aarch64-musl.tar.zst, archive_suffix: tar.zst }
           - { target: x86_64-unknown-linux-gnu, archive: celq-linux-x86_64-gnu.tar.gz, archive_suffix: tar.gz }
+          - { target: x86_64-unknown-linux-gnu, archive: celq-linux-x86_64-gnu.tar.zst, archive_suffix: tar.zst }
           - { target: aarch64-unknown-linux-gnu, archive: celq-linux-aarch64-gnu.tar.gz, archive_suffix: tar.gz }
+          - { target: aarch64-unknown-linux-gnu, archive: celq-linux-aarch64-gnu.tar.zst, archive_suffix: tar.zst }
           - { target: riscv64gc-unknown-linux-musl, archive: celq-linux-riscv64-musl.tar.gz, archive_suffix: tar.gz }
           - { target: riscv64gc-unknown-linux-gnu, archive: celq-linux-riscv64-gnu.tar.gz, archive_suffix: tar.gz }
           - { target: x86_64-unknown-freebsd, archive: celq-freebsd-x86_64.tar.gz, archive_suffix: tar.gz }
@@ -515,7 +588,7 @@ jobs:
 
   update-homebrew-formula:
     name: Update Homebrew formula
-    needs: [build, build_mac, build_xwin]
+    needs: [build, build_mac, build_xwin, create-zstd-archives]
     permissions:
       contents: read
     uses: $/.github/workflows/release_sub_homebrew.yml

.github/zizmor.yml

@@ -6,8 +6,8 @@ rules:
       - release_choco.yml
       - release_github.yml:107
       - release_github.yml:287
-      - release_github.yml:314
-      - release_github.yml:352
+      - release_github.yml:381
+      - release_github.yml:420
       - release_sub_homebrew.yml:29
       - release_sub_homebrew.yml:56
       - release_sub_homebrew.yml:69

Cargo.toml

@@ -77,6 +77,7 @@ file = "https://github.com/get-celq/signatures/releases/download/v{ version }/{
 
 [package.metadata.binstall.overrides.aarch64-apple-darwin]
 pkg-url = "{ repo }/releases/download/v{ version }/{ name }-macos-aarch64{ archive-suffix }"
+pkg-fmt = "tar.zst"
 
 [package.metadata.binstall.overrides.x86_64-apple-darwin]
 pkg-url = "{ repo }/releases/download/v{ version }/{ name }-macos-x86_64{ archive-suffix }"
@@ -91,15 +92,19 @@ pkg-fmt = "zip"
 
 [package.metadata.binstall.overrides.x86_64-unknown-linux-musl]
 pkg-url = "{ repo }/releases/download/v{ version }/{ name }-linux-x86_64-musl{ archive-suffix }"
+pkg-fmt = "tar.zst"
 
 [package.metadata.binstall.overrides.aarch64-unknown-linux-musl]
 pkg-url = "{ repo }/releases/download/v{ version }/{ name }-linux-aarch64-musl{ archive-suffix }"
+pkg-fmt = "tar.zst"
 
 [package.metadata.binstall.overrides.x86_64-unknown-linux-gnu]
 pkg-url = "{ repo }/releases/download/v{ version }/{ name }-linux-x86_64-gnu{ archive-suffix }"
+pkg-fmt = "tar.zst"
 
 [package.metadata.binstall.overrides.aarch64-unknown-linux-gnu]
 pkg-url = "{ repo }/releases/download/v{ version }/{ name }-linux-aarch64-gnu{ archive-suffix }"
+pkg-fmt = "tar.zst"
 
 [package.metadata.binstall.overrides.riscv64gc-unknown-linux-musl]
 pkg-url = "{ repo }/releases/download/v{ version }/{ name }-linux-riscv64-musl{ archive-suffix }"

brew/celq.rb

@@ -6,7 +6,7 @@ class Celq < Formula
 
   if OS.mac?
     if Hardware::CPU.arm?
-      url "https://github.com/IvanIsCoding/celq/releases/download/v{{CELQ_VERSION}}/celq-macos-aarch64.tar.gz"
+      url "https://github.com/IvanIsCoding/celq/releases/download/v{{CELQ_VERSION}}/celq-macos-aarch64.tar.zst"
       sha256 "{{CELQ_SHA256_MACOS_ARM64}}"
     end
     if Hardware::CPU.intel?
@@ -17,11 +17,11 @@ class Celq < Formula
 
   if OS.linux?
     if Hardware::CPU.arm?
-      url "https://github.com/IvanIsCoding/celq/releases/download/v{{CELQ_VERSION}}/celq-linux-aarch64-gnu.tar.gz"
+      url "https://github.com/IvanIsCoding/celq/releases/download/v{{CELQ_VERSION}}/celq-linux-aarch64-gnu.tar.zst"
       sha256 "{{CELQ_SHA256_LINUX_ARM64}}"
     end
     if Hardware::CPU.intel?
-      url "https://github.com/IvanIsCoding/celq/releases/download/v{{CELQ_VERSION}}/celq-linux-x86_64-gnu.tar.gz"
+      url "https://github.com/IvanIsCoding/celq/releases/download/v{{CELQ_VERSION}}/celq-linux-x86_64-gnu.tar.zst"
       sha256 "{{CELQ_SHA256_LINUX_X86_64}}"
     end
   end
@@ -34,4 +34,4 @@ def install
     output = shell_output("#{bin}/celq -n --arg='fruit:string=apple' 'fruit.contains(\"a\")'")
     assert_match "true", output
   end
-end
+end