Add CI workflow that packs tarballs and installer artifacts

[webzherd]

Summary

• Adds .github/workflows/pack.yml — on workflow_dispatch and v* tag pushes, builds:

  • Tarballs for linux-x64, linux-arm64, darwin-x64, darwin-arm64, win32-x64 (.tar.gz + .tar.xz, bundled Node 20)
  • macOS .pkg installers for darwin-x64 and darwin-arm64 (built on a macos-latest runner using native pkgbuild — Ubuntu 24.04 dropped both xar and bomutils from its repos)
  • Windows .exe installer (NSIS) for win32-x64

  All artifacts upload as workflow artifacts under two names — bitmovin-cli-tarballs-and-windows and bitmovin-cli-macos. 30-day retention. Internal testing only: zip-wrapped (GitHub limitation) and unsigned. Code signing + GitHub Release publishing + npm publishing will land in subsequent PRs.

• Guards the prepare script with a dist-presence check: [ -d dist ] || tsc -b. oclif pack runs an internal npm install --production in a temp workspace, which previously triggered an unconditional tsc -b even though TypeScript is a devDependency. The new form runs the build only when dist/ is missing — fails loud if tsc is then unavailable, silently skips when dist/ is already present (oclif's tmp workspace, npm install from the shipped tarball).

Test plan

• Tag-pushed test run on a throwaway v0.0.0-pack-test.x tag — both jobs green
• Linux artifact: 5 tarballs + 1 .exe, ~576 MB total. Linux-x64 tarball extracted locally, bin/bitmovin --version / --help / config show --json all work with bundled Node 20 + correct secret masking.
• macOS artifact: 2 .pkg files (darwin-x64, darwin-arm64), ~272 MB total
• Workflow re-verified after revert of the release job

Out of scope (follow-ups)

1. Code signing — Apple Developer ID + notarization for macOS, Authenticode (EV) for Windows. Has to land before any user-facing Release publishing to avoid Gatekeeper / SmartScreen warnings undercutting the install experience.
2. GitHub Release publishing — attach signed installers as individual download assets on v* tag push. Bundle with Bump lodash from 4.17.23 to 4.18.1 #1.
3. npm publish on tag — needs NPM_TOKEN secret. README install instructions.
4. Debian .deb — oclif pack deb, straightforward addition.
5. NSIS compression — current .exe is 303 MB; LZMA/SOLID compression should bring it down significantly.
6. S3 hosting + autoupdate channels (stable, beta) via oclif upload.
7. Homebrew tap (bitmovin/homebrew-tap).
8. Prerelease channel — npm publish --tag next for -rc/-beta tags.

🤖 Generated with Claude Code

[lukaskroepfl]

The prepare shim silently skips on failure. Original tsc -b failed loud; the new if [ -x ./node_modules/.bin/tsc ]; then tsc -b; fi returns 0 whether tsc ran or not — so a future install path that produces a half-broken state where tsc is missing won't surface. It's also treating a symptom (oclif pack's temp npm install --production triggers the prepare hook) when the cause might be better fixed at the oclif invocation — e.g. skipping lifecycle scripts in oclif's temp workspace, or pre-building and configuring oclif not to re-install. Worth checking which fix is structurally right before shipping the shim.

[lukaskroepfl]

Two things on this expanded version:

1. prepare shim is unchanged — the silent-skip concern from my earlier comment still applies. Worth confirming this is the structurally right fix vs. addressing it at the oclif invocation, especially before this PR also lands Release publishing where a half-broken state would ship to users.

2. Scope expansion contradicts the staging the PR opened with. The original test plan was "inspect actual artifacts before anything reaches users" with publishing deferred to a follow-up. Now it's tarballs + macOS .pkg + Windows .exe + draft Release on tag, all in one PR. That's a lot more surface to revert if any one piece misbehaves, and the draft-Release job in particular only runs on v* tags so it can't be exercised from workflow_dispatch before merging. Strong vote for splitting the Release job back out — the original two-step plan was sounder.

3. Unsigned .pkg and .exe ship through the Release. Apple Gatekeeper will block the .pkg unless users right-click → Open; Windows SmartScreen will warn. Acknowledging this in CHANGELOG is good, but if the goal is "users can install without Node," telling them "and now disable Gatekeeper" undercuts that. Worth either keeping installers as workflow artifacts (internal testing) until signing/notarization lands, or being explicit in the Release notes about the install ceremony required.

[lukaskroepfl]

All three points addressed cleanly:

1. Release job reverted — back to artifact-only, matches the staged plan in the original PR description.
2. prepare shim — [ -d dist ] || tsc -b is the right shape. When dist/ is missing it runs tsc -b and fails loud if tsc isn't there; when dist/ already exists (the oclif pack temp-workspace case) it short-circuits without trying to build. Preserves the install-from-git path while letting the production install succeed.
3. macOS .pkg is signed with Developer ID Installer (SHA1 fingerprint to disambiguate).

Two small follow-ups, neither blocking:

• CHANGELOG drift: the entry still says "Installers are unsigned. Code signing… will follow" but the .pkg is now signed in this PR. Worth tightening to "macOS .pkg is signed with Developer ID Installer; notarization and Windows Authenticode will follow."
• Notarization is the other half of the Gatekeeper story. Signing alone doesn't satisfy spctl --assess for downloaded .pkg's; users will still hit "Apple cannot check this for malicious software" unless they right-click → Open or you notarize. Worth queueing as the next signing follow-up.

Approving on the artifact-only scope.