ci: publish pre-built dsl-parser binary to GHCR

Adds a GitHub Actions workflow that builds the OCaml dsl-parser binary
for amd64 and arm64, then publishes it as a multi-arch scratch image
to ghcr.io/griffincancode/callosum-dsl-parser:latest.

This lets downstream consumers (uniqpath) pull the ~5 MB binary in ~2s
instead of compiling OCaml from source (~220s per build).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: GriffinCanCode

.github/workflows/build-binary.yml

@@ -0,0 +1,75 @@
+name: Build dsl-parser binary
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "core/**"
+      - ".github/workflows/build-binary.yml"
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository_owner }}/callosum-dsl-parser
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            platform: linux/amd64
+            tag_suffix: amd64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64
+            tag_suffix: arm64
+
+    runs-on: ${{ matrix.runner }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./core
+          file: ./core/Dockerfile.binary
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag_suffix }}
+          platforms: ${{ matrix.platform }}
+          cache-from: type=gha,scope=callosum-${{ matrix.tag_suffix }}
+          cache-to: type=gha,mode=max,scope=callosum-${{ matrix.tag_suffix }}
+
+  manifest:
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create multi-arch manifest
+        run: |
+          docker manifest create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:amd64 \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:arm64
+          docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

core/Dockerfile.binary

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+#
+# Builds the dsl-parser binary and exports it in a minimal scratch image.
+# Consumed by uniqpath via: COPY --from=ghcr.io/griffincancode/callosum-dsl-parser:latest /dsl-parser /app/bin/dsl-parser
+#
+# Usage:
+#   docker build -f Dockerfile.binary -t callosum-dsl-parser .
+#   docker cp "$(docker create callosum-dsl-parser)":/dsl-parser ./dsl-parser
+
+ARG OCAML_VERSION=5.3
+
+FROM ocaml/opam:debian-12-ocaml-${OCAML_VERSION} AS build
+
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*
+USER opam
+
+COPY --chown=opam:opam . /home/opam/callosum/core
+WORKDIR /home/opam/callosum/core
+
+RUN opam install . --deps-only --yes --quiet 2>&1 && \
+    opam exec -- dune build bin/main.exe 2>&1
+
+RUN test -x _build/default/bin/main.exe && \
+    cp _build/default/bin/main.exe /tmp/dsl-parser && \
+    chmod 755 /tmp/dsl-parser && \
+    strip /tmp/dsl-parser
+
+# Scratch image with just the binary (~5 MB)
+FROM scratch
+COPY --from=build /tmp/dsl-parser /dsl-parser