ci: D1 release matrix over the four non-macOS targets

release.yaml becomes test (once, host) -> build (matrix) over the four
cargo-zigbuild targets; each matrix job uploads its binary + .sha256 to
the shared release (idempotent create-or-get). Records the expansion in
ADR-ci-001 (2026-06-13 amendment); macOS stays deferred.

.gitea/workflows/release.yaml

@@ -1,13 +1,15 @@
-# Release: on a version tag, build the static Linux binary (D2) and publish it
-# to a Gitea release with a checksum. Runs in the same prebuilt CI image as the
-# gate, so the pinned toolchain + musl target/cc are already warm.
+# Release: on a version tag, build the cross-platform binaries and publish them
+# to a Gitea release with checksums. Runs in the prebuilt CI image, so the
+# pinned toolchain + the release targets + cargo-zigbuild/zig are already warm.
 #
-# Scope: x86_64-unknown-linux-musl only, for now. The rest of the D1 matrix
-# (aarch64, macOS, Windows) and the D3 package-manager manifests layer on later,
-# step by step.
+# Matrix (D1, cross-built from Linux x86_64 via cargo-zigbuild):
+#   x86_64-unknown-linux-musl   aarch64-unknown-linux-musl   (static, D2)
+#   x86_64-pc-windows-gnu       aarch64-pc-windows-gnullvm   (standalone .exe)
+# macOS is deferred — its arboard/AppKit link needs Apple's SDK (see ADR-ci-001).
+# D3 package-manager manifests layer on later.
 #
-# Tests run here before the build so a tag can never publish untested code,
-# even one pointing at a commit that was never gated on a branch.
+# Tests run once (host) before the matrix, so a tag can never publish untested
+# code, even one pointing at a commit that was never gated on a branch.
 name: release
 on:
   push:
@@ -15,46 +17,59 @@ on:
       - 'v*'
 
 jobs:
-  release:
+  test:
     runs-on: ci-public
     container:
       image: git.lazyeval.net/oli/rdbms-playground-ci:latest
-    env:
-      TARGET: x86_64-unknown-linux-musl
     steps:
       - uses: actions/checkout@v4
-
       - name: test
         run: nix develop -c cargo test --no-fail-fast
 
-      - name: build static binary
-        run: nix develop -c cargo build --release --target "$TARGET"
+  build:
+    needs: test
+    runs-on: ci-public
+    container:
+      image: git.lazyeval.net/oli/rdbms-playground-ci:latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - x86_64-unknown-linux-musl
+          - aarch64-unknown-linux-musl
+          - x86_64-pc-windows-gnu
+          - aarch64-pc-windows-gnullvm
+    steps:
+      - uses: actions/checkout@v4
 
-      - name: package artifacts
+      - name: build
+        run: nix develop -c cargo zigbuild --release --target ${{ matrix.target }}
+
+      - name: package + publish
         # Pin bash: the runner defaults scripted steps to dash, which rejects
         # `set -o pipefail`. bash is in the CI image.
-        shell: bash
-        run: |
-          set -euo pipefail
-          BIN="target/$TARGET/release/rdbms-playground"
-          ls -l "$BIN"
-          OUT="rdbms-playground-${{ github.ref_name }}-$TARGET"
-          mkdir -p dist
-          cp "$BIN" "dist/$OUT"
-          ( cd dist && sha256sum "$OUT" > "$OUT.sha256" )
-          ls -l dist
-
-      - name: publish gitea release + assets
         shell: bash
         env:
-          # Auto-provided by Gitea Actions; has repo write (release) scope.
+          TARGET: ${{ matrix.target }}
+          # GITEA_TOKEN is auto-provided with repo write (release) scope.
           TOKEN: ${{ secrets.GITEA_TOKEN }}
           API: ${{ github.server_url }}/api/v1
           REPO: ${{ github.repository }}
           TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          # Create the release for this tag; if it already exists, look it up.
+
+          # Windows targets produce a .exe; the rest a bare binary.
+          case "$TARGET" in *windows*) EXT=.exe ;; *) EXT= ;; esac
+          BIN="target/$TARGET/release/rdbms-playground$EXT"
+          OUT="rdbms-playground-$TAG-$TARGET$EXT"
+          mkdir -p dist
+          cp "$BIN" "dist/$OUT"
+          ( cd dist && sha256sum "$OUT" > "$OUT.sha256" )
+          ls -l dist
+
+          # Create the release for this tag; if a sibling matrix job already
+          # created it, look it up instead (idempotent + race-tolerant).
           created=$(curl -sS -X POST "$API/repos/$REPO/releases" \
             -H "Authorization: token $TOKEN" \
             -H "Content-Type: application/json" \
@@ -66,6 +81,7 @@ jobs:
               | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{process.stdout.write(String(JSON.parse(s).id))})')
           fi
           echo "release id: $id"
+
           for f in dist/*; do
             name=$(basename "$f")
             echo "uploading $name"
@@ -73,4 +89,4 @@ jobs:
               -H "Authorization: token $TOKEN" \
               -F "attachment=@$f" > /dev/null
           done
-          echo "published $TAG"
+          echo "published $TARGET assets for $TAG"