ci: attach the HRX portable packages to releases as a preview

.github/workflows/debian-portable.yml

@@ -317,9 +317,12 @@ jobs:
           VERSION=$(git describe --tags --always | sed 's/^v//')
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
-      - name: Download all portable artifacts
+      # By name: this run also publishes the models-from-source and HRX
+      # tarballs, and neither belongs in the default release asset set.
+      - name: Download portable artifact
         uses: actions/download-artifact@v4
         with:
+          name: portable
           path: portable
 
       - name: Upload Binaries to Release
@@ -328,4 +331,28 @@ jobs:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ github.ref }}
           file_glob: true
-          file: portable/**/*.gz
+          file: portable/fastflowlm_*_linux.tar.gz
+
+  # The HRX build ships as a preview, so it gets its own release job: a failed
+  # HRX build leaves the release without the HRX asset instead of holding back
+  # the default one.
+  release-hrx:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    needs: build-HRX-portable
+    if: github.ref_type == 'tag'
+    steps:
+      - name: Download HRX portable artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: HRX-portable
+          path: portable
+
+      - name: Upload HRX Binaries to Release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ github.ref }}
+          file_glob: true
+          file: portable/HRX_fastflowlm_*_linux.tar.gz

.github/workflows/model-sweep.yml

@@ -17,10 +17,10 @@ name: Model Sweep
 # matrix job each, so a failure in one modality does not hide the others and
 # "Re-run failed jobs" restarts only what actually broke.
 #
-# Each platform is swept against the default portable build and the HRX build.
-# Commit sweeps also run Gemma 4 against separate Linux and Windows packages
-# that build model engines from source. Releases do not ship these additional
-# artifacts.
+# Each platform is swept against the default portable build and the HRX build;
+# releases ship both, the HRX one as a preview under an HRX_ prefix. Commit
+# sweeps also run Gemma 4 against separate Linux and Windows packages that
+# build model engines from source. Releases do not ship those.
 
 on:
   pull_request:
@@ -159,10 +159,18 @@ jobs:
               echo "::warning::Release ${tag} has no fastflowlm_*_windows_amd64.zip asset; skipping the Windows sweep."
             fi
 
-            # Releases ship no HRX assets today, so the HRX sweeps only ever
-            # run off CI artifacts. Say so rather than leaving a dispatch
-            # looking like it swept everything.
-            echo "::notice::HRX sweeps are skipped in release mode; ${tag} ships no HRX_* assets."
+            # HRX assets ship from v1.0.8 on, and a failed HRX build leaves a
+            # release without them, so their absence is a notice, not a warning.
+            if printf '%s\n' "${assets}" | grep -q '^HRX_fastflowlm_.*_linux\.tar\.gz$'; then
+              echo "linux_hrx_ready=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "::notice::Release ${tag} has no HRX_fastflowlm_*_linux.tar.gz asset; skipping the Linux HRX sweep."
+            fi
+            if printf '%s\n' "${assets}" | grep -q '^HRX_fastflowlm_.*_windows_amd64\.zip$'; then
+              echo "windows_hrx_ready=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "::notice::Release ${tag} has no HRX_fastflowlm_*_windows_amd64.zip asset; skipping the Windows HRX sweep."
+            fi
             exit 0
           fi
 
@@ -474,8 +482,7 @@ jobs:
   # succeeded gets swept, independently of the other.
   sweep-linux-hrx:
     needs: resolve-build
-    # Only ever set in run mode: no release carries an HRX asset, so a
-    # dispatch leaves this unset and the job skips.
+    # Unset when no Linux HRX build could be resolved, whichever mode we are in.
     if: needs.resolve-build.outputs.linux_hrx_ready == 'true'
     runs-on: [self-hosted, linux, x64, npu, sweep]
     timeout-minutes: 120
@@ -505,9 +512,13 @@ jobs:
           # blob:none makes git fetch only the blobs the sparse paths need.
           filter: blob:none
 
+      # Exactly one of the next two steps runs. Both land the same
+      # HRX_fastflowlm_<version>_linux.tar.gz in build-artifact/.
+
       # Same shape as the default artifact, under the HRX- name and holding a
       # single HRX_-prefixed tarball.
       - name: Download Linux HRX portable build (CI run)
+        if: needs.resolve-build.outputs.mode == 'run'
         uses: dawidd6/action-download-artifact@v25
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -516,6 +527,15 @@ jobs:
           path: build-artifact
           if_no_artifact_found: fail
 
+      - name: Download Linux HRX portable build (release ${{ needs.resolve-build.outputs.release_tag }})
+        if: needs.resolve-build.outputs.mode == 'release'
+        uses: robinraju/release-downloader@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ needs.resolve-build.outputs.release_tag }}
+          fileName: "HRX_fastflowlm_*_linux.tar.gz"
+          out-file-path: build-artifact
+
       - name: Unpack Linux HRX portable build
         run: |
           set -euo pipefail
@@ -760,8 +780,7 @@ jobs:
   # sweep-windows but has its own readiness flag.
   sweep-windows-hrx:
     needs: resolve-build
-    # Only ever set in run mode: no release carries an HRX asset, so a
-    # dispatch leaves this unset and the job skips.
+    # Unset when no Windows HRX build could be resolved, whichever mode we are in.
     if: needs.resolve-build.outputs.windows_hrx_ready == 'true'
     runs-on: [self-hosted, windows, x64, npu, sweep]
     timeout-minutes: 120
@@ -794,10 +813,14 @@ jobs:
           New-Item -ItemType Directory -Force $modelPath | Out-Null
           "FLM_MODEL_PATH=$modelPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
 
+      # Exactly one of the next two steps runs. Both leave flm.exe and its DLLs
+      # at the top level of flm-windows/, which is where the verify step looks.
+
       # Same payload as the default Windows portable artifact, under the HRX-
       # prefixed name: flm.exe and its DLLs at the top level, with the HRX op
       # libraries and hrx.dll overlaid.
       - name: Download Windows HRX portable build (CI run)
+        if: needs.resolve-build.outputs.mode == 'run'
         uses: dawidd6/action-download-artifact@v25
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -806,6 +829,18 @@ jobs:
           path: flm-windows
           if_no_artifact_found: fail
 
+      # The HRX release zip is that same artifact zipped from inside the
+      # directory, so extracting it in place reproduces the CI layout.
+      - name: Download Windows HRX portable build (release ${{ needs.resolve-build.outputs.release_tag }})
+        if: needs.resolve-build.outputs.mode == 'release'
+        uses: robinraju/release-downloader@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ needs.resolve-build.outputs.release_tag }}
+          fileName: "HRX_fastflowlm_*_windows_amd64.zip"
+          out-file-path: flm-windows
+          extract: true
+
       - name: Verify FLM binary runs
         shell: powershell
         run: |

.github/workflows/windows-build.yml

@@ -381,3 +381,40 @@ jobs:
             flm-setup.msi
           overwrite_files: true
           fail_on_unmatched_files: true
+
+  # The HRX build ships as a preview, so it gets its own release job: a failed
+  # HRX build leaves the release without the HRX asset instead of holding back
+  # the default ones.
+  release-hrx:
+    runs-on: ubuntu-latest
+    needs: build-windows-portable-hrx
+    if: github.ref_type == 'tag'
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download HRX portable artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: HRX-fastflowlm-windows-${{ github.sha }}
+          path: hrx-dist
+
+      - name: Create HRX release zip
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          zip_name="HRX_fastflowlm_${version}_windows_amd64.zip"
+
+          # Same layout as the default zip: flm.exe and its DLLs at the top level.
+          cd hrx-dist
+          zip -r "../${zip_name}" .
+
+      - name: Upload HRX assets to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: Release ${{ github.ref_name }}
+          files: |
+            HRX_fastflowlm_*.zip
+          overwrite_files: true
+          fail_on_unmatched_files: true