From 71b013d5409cd5391c4c9eaa9f7bef35d6736822 Mon Sep 17 00:00:00 2001
From: NovusEdge <novusedge0@gmail.com>
Date: Mon, 7 Sep 2026 18:58:51 +0300
Subject: [PATCH] ci(release): publish darwin and windows archives

The release workflow built linux amd64 and arm64 only. Add darwin
amd64 and arm64 tarballs, and windows amd64 and arm64 zips.

These binaries run doctor and capabilities. hostops refuses every
other command until #82 and #83 qualify those hosts, so the
installation guide says so next to the download.

Signed-off-by: NovusEdge <novusedge0@gmail.com>
---
 .github/workflows/release.yml        | 26 ++++++++++++++++++++------
 CHANGELOG.md                         |  8 ++++++++
 docs/getting-started/installation.md |  8 ++++++++
 3 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f22b2390..abce996e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,17 +17,31 @@ jobs:
       - name: Build
         env:
           CGO_ENABLED: '0'
-          GOOS: linux
         run: |
-          for arch in amd64 arm64; do
-            GOARCH=$arch go build \
-              -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" -o stoat ./cmd/stoat
-            tar czf stoat_${GITHUB_REF_NAME}_linux_$arch.tar.gz stoat
+          # darwin and windows binaries run doctor and capabilities only.
+          # hostops refuses every other command there until #82 and #83 land.
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
+            os=${target%/*}
+            arch=${target#*/}
+            bin=stoat
+            if [ "$os" = windows ]; then
+              bin=stoat.exe
+            fi
+            GOOS=$os GOARCH=$arch go build \
+              -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" -o "$bin" ./cmd/stoat
+            name=stoat_${GITHUB_REF_NAME}_${os}_${arch}
+            if [ "$os" = windows ]; then
+              zip -q "$name.zip" "$bin"
+            else
+              tar czf "$name.tar.gz" "$bin"
+            fi
+            rm -f "$bin"
           done
-          sha256sum stoat_*.tar.gz > checksums.txt
+          sha256sum stoat_*.tar.gz stoat_*.zip > checksums.txt
       - uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true
           files: |
             *.tar.gz
+            *.zip
             checksums.txt
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9acba24..96402be5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## Unreleased
+
+### Changes
+
+- Release archives cover darwin (amd64, arm64) and windows (amd64, arm64)
+  next to the linux tarballs. Windows ships a zip. Those binaries run `doctor`
+  and `capabilities` only until #82 and #83 qualify the hosts.
+
 ## v0.4.1
 
 Plainer CLI output and a shorter `stoat.toml` sample, plus the fixes that
diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md
index b7b8600f..d61ccc1c 100644
--- a/docs/getting-started/installation.md
+++ b/docs/getting-started/installation.md
@@ -186,6 +186,14 @@ tar xzf stoat_vX.Y.Z_linux_amd64.tar.gz
 install -Dm755 stoat ~/.local/bin/stoat
 ```
 
+A release also carries `darwin_amd64` and `darwin_arm64` tarballs, and
+`windows_amd64` and `windows_arm64` zip archives. On those hosts Stoat runs
+`doctor` and `capabilities` only. Every other command reports the host as
+unqualified, because macOS needs the QEMU HVF accelerator
+([#82](https://github.com/NovusEdge/stoat/issues/82)) and Windows needs WHPX
+([#83](https://github.com/NovusEdge/stoat/issues/83)). Linux with KVM is the
+supported host today.
+
 ## Install via the Nix flake
 
 The repository includes a `flake.nix` with a default package and development