build(release): split core builds from release-only artifacts

- add a dedicated build-release-artifacts target for Android bundle packaging
- switch CI and release workflows to Corepack-managed pnpm with cache support
- pin the frontend pnpm version and make dependency installs deterministic
- inject version metadata into launcher binaries in GoReleaser
- update build documentation to reflect the new workflow

.github/workflows/build.yml

@@ -16,5 +16,15 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: web/frontend/pnpm-lock.yaml
+
+      - name: Setup pnpm
+        run: corepack enable && corepack install
+
       - name: Build
         run: make build-all

.github/workflows/create_dmg.yml

@@ -17,29 +17,35 @@ jobs:
         with:
           ref: main
 
-      # 1. 安装指定版本的 Go (可选，但推荐)
+      # 1. Install Go from go.mod
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
-      # 2. 安装 pnpm
-      - name: Install pnpm
-        run: brew install pnpm
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: web/frontend/pnpm-lock.yaml
 
-      # 3. 运行你的 Makefile 编译二进制文件
+      - name: Setup pnpm
+        run: corepack enable && corepack install
+
+      # 3. Build the application bundle
       - name: Build with Make
         run: make build ARCH=${{ matrix.arch }} && make build-macos-app ARCH=${{ matrix.arch }}
 
-      # 4. 签名
+      # 4. Apply ad-hoc signing
       - name: Ad-hoc Sign
         run: codesign --force --deep --sign - "build/PicoClaw Launcher.app"
 
-      # 5. 安装打包工具
+      # 5. Install the DMG packaging tool
       - name: Install create-dmg
         run: brew install create-dmg
 
-      # 6. 执行打包命令
+      # 6. Create the DMG
       - name: Create DMG
         run: |
           mkdir -p dist
@@ -54,7 +60,7 @@ jobs:
             "dist/picoclaw-${{ matrix.arch }}.dmg" \
             "build/PicoClaw Launcher.app"
 
-      # 7. 上传文件到 GitHub Artifacts (供你下载)
+      # 7. Upload the DMG as a GitHub artifact
       - name: Upload DMG
         uses: actions/upload-artifact@v7
         with:

.github/workflows/nightly.yml

@@ -51,9 +51,11 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: 22
+          cache: pnpm
+          cache-dependency-path: web/frontend/pnpm-lock.yaml
 
       - name: Setup pnpm
-        run: corepack enable && corepack prepare pnpm@latest --activate
+        run: corepack enable && corepack install
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -97,6 +99,11 @@ jobs:
           MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
           MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
 
+      - name: Build release-only artifacts
+        run: |
+          sudo apt-get install -y zip
+          make build-release-artifacts
+
       - name: Update nightly release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -123,7 +130,7 @@ jobs:
 
           # Collect release artifacts from goreleaser dist/
           ASSETS=()
-          for f in dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm dist/checksums.txt; do
+          for f in dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm dist/checksums.txt build/picoclaw-android-universal.zip; do
             [ -f "$f" ] && ASSETS+=("$f")
           done
 
@@ -135,4 +142,3 @@ jobs:
             --prerelease \
             --latest=false \
             "${ASSETS[@]}"
-

.github/workflows/release.yml

@@ -69,9 +69,11 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: 22
+          cache: pnpm
+          cache-dependency-path: web/frontend/pnpm-lock.yaml
 
       - name: Setup pnpm
-        run: corepack enable && corepack prepare pnpm@latest --activate
+        run: corepack enable && corepack install
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -110,13 +112,13 @@ jobs:
           MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
           MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
 
-      - name: Build and upload Android arm64
+      - name: Build and upload release-only artifacts
         shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           sudo apt-get install -y zip
-          make build-android-bundle
+          make build-release-artifacts
           gh release upload "${{ inputs.tag }}" \
             build/picoclaw-android-universal.zip \
             --clobber