feat: Pre-built binaries are committed to dist/, bloating the repository and preventing reproducible, CI-verifiable release artifacts.

[divyanshim27]

🐛 Repository Hygiene + Security Issue

The repository contains a committed dist/ directory. For a Rust project, compiled binaries in the repository are problematic for several reasons:

1. Binary provenance: When a binary is committed directly from a developer's machine rather than built by CI, there is no way for users or contributors to verify it was compiled from the source code in the repository. A supply-chain attack could substitute a malicious binary that looks identical in git log.

2. Repository bloat: Binary files grow git history permanently. A 5MB binary committed in 10 releases = 50MB of permanent git history that every contributor must clone, even if they're only contributing documentation.

3. CI/CD contradiction: The repository has a .github/workflows/ directory, suggesting GitHub Actions CI is already configured. If CI can build the binary, it should also be the one publishing it — not the developer's local machine.

4. macOS-specific binaries: ClipWallet is macOS-only. Committing macOS ARM or x86_64 binaries means Linux/Windows contributors download unrunnable artifacts for no reason.

Proposed Fix

1. Remove dist/ from git tracking

git rm -r --cached dist/
echo "/dist/" >> .gitignore
git filter-repo --path dist --invert-paths  # Purge from history
git push origin --force --all

2. Create a GitHub Actions release workflow that builds and publishes binaries

# .github/workflows/release.yml
name: Release

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  build-macos:
    name: Build macOS (${{ matrix.target }})
    runs-on: macos-latest
    strategy:
      matrix:
        target: [x86_64-apple-darwin, aarch64-apple-darwin]

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Package binary
        run: |
          BINARY="target/${{ matrix.target }}/release/clipwallet"
          ARCHIVE="clipwallet-${{ github.ref_name }}-${{ matrix.target }}.tar.gz"
          tar -czf "$ARCHIVE" -C "target/${{ matrix.target }}/release" clipwallet
          sha256sum "$ARCHIVE" > "${ARCHIVE}.sha256"

      - name: Upload to GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            *.tar.gz
            *.sha256
          generate_release_notes: true

3. Update install.sh and README to point to GitHub Releases

# install.sh — fetch from GitHub Releases, not the committed dist/ directory
REPO="shaaravraghu/ClipWallet"
VERSION=$(curl -s "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | cut -d'"' -f4)
ARCH=$(uname -m)  # x86_64 or arm64/aarch64

Files to Modify

File	Change
dist/	Delete from repository and purge from git history
.gitignore	Add /dist/
.github/workflows/release.yml	New — CI build and publish workflow
install.sh	Update to fetch from GitHub Releases
README.md	Update install instructions to reference GitHub Releases
build_release.sh	Update to build locally only, not commit to dist/

Suggested labels: bug, ci/cd, repository-hygiene, security

I would like to work on this. Could you please assign it to me?

[divyanshim27]

Hey @shaaravraghu ,
Please assign it to me under GSSoC 2026.
/claim /assign /claim-assignment