From 233f5c21e58246673fe636b43a14ce8314934be8 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@nexus>
Date: Thu, 1 Oct 2026 16:05:09 -0700
Subject: [PATCH] ci: multi-OS agent binary build

---
 .gitea/workflows/build-binaries.yml | 41 +++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 .gitea/workflows/build-binaries.yml

diff --git a/.gitea/workflows/build-binaries.yml b/.gitea/workflows/build-binaries.yml
new file mode 100644
index 0000000..c0ee72c
--- /dev/null
+++ b/.gitea/workflows/build-binaries.yml
@@ -0,0 +1,41 @@
+name: Build Agent Binaries
+on:
+  push:
+    paths: ['agents/agent.py', '.gitea/workflows/build-binaries.yml']
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install PyInstaller (unix)
+        if: matrix.os != 'windows-latest'
+        run: pip install pyinstaller
+      - name: Install PyInstaller (windows)
+        if: matrix.os == 'windows-latest'
+        run: pip install pyinstaller
+      - name: Bake token + build (unix)
+        if: matrix.os != 'windows-latest'
+        shell: bash
+        env:
+          AGENT_TOKEN: ${{ secrets.NEXUS_AGENT_TOKEN }}
+        run: |
+          sed "s/__AGENT_TOKEN__/$AGENT_TOKEN/" agents/agent.py > baked.py
+          pyinstaller --onefile --name NexusAgent-${{ matrix.os }} baked.py
+      - name: Bake token + build (windows)
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        env:
+          AGENT_TOKEN: ${{ secrets.NEXUS_AGENT_TOKEN }}
+        run: |
+          (Get-Content agents/agent.py) -replace '__AGENT_TOKEN__', $env:AGENT_TOKEN | Set-Content baked.py
+          pyinstaller --onefile --name NexusAgent-windows baked.py
+      - name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: NexusAgent-${{ matrix.os }}
+          path: dist/NexusAgent*