chore: split debug info for EE release builds

Generate line-table debug info in release builds and split it into
a separate .debug file. The shipped binary remains stripped (same
size as before), while the .debug files are attached to GitHub
releases for both amd64 and arm64 EE builds.

This enables production debugging with gdb/perf by copying the
matching .debug file into a running pod.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/docker-image.yml

@@ -199,10 +199,17 @@ jobs:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
           path: "/usr/src/app/windmill"
 
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-ee-debug
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          path: "/usr/src/app/windmill.debug"
+
       - name: Rename binary with corresponding architecture
         run: |
           mv "${{ steps.extract.outputs.destination }}/windmill" "${{ steps.extract.outputs.destination }}/windmill-${ARCH}"
           mv "${{ steps.extract-ee.outputs.destination }}/windmill" "${{ steps.extract-ee.outputs.destination }}/windmill-ee-${ARCH}"
+          mv "${{ steps.extract-ee-debug.outputs.destination }}/windmill.debug" "${{ steps.extract-ee-debug.outputs.destination }}/windmill-ee-${ARCH}.debug"
 
       - name: Attach binary to release
         uses: softprops/action-gh-release@v2
@@ -210,8 +217,36 @@ jobs:
           files: |
             ${{ steps.extract.outputs.destination }}/*
             ${{ steps.extract-ee.outputs.destination }}/*
+            ${{ steps.extract-ee-debug.outputs.destination }}/*
             ${{ steps.extract-duckdb-ffi-internal.outputs.destination }}/*
 
+  attach_arm64_ee_debug_to_release:
+    needs: [build_ee]
+    runs-on: ubicloud-standard-2-arm
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    env:
+      ARCH: arm64
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          docker pull --platform "linux/$ARCH" ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-ee-debug
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          path: "/usr/src/app/windmill.debug"
+
+      - name: Rename debug file with corresponding architecture
+        run: |
+          mv "${{ steps.extract-ee-debug.outputs.destination }}/windmill.debug" "${{ steps.extract-ee-debug.outputs.destination }}/windmill-ee-${ARCH}.debug"
+
+      - name: Attach debug file to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            ${{ steps.extract-ee-debug.outputs.destination }}/*
+
   # attach_arm64_binary_to_release:
   #   needs: [build, build_ee]
   #   runs-on: ubicoud

Dockerfile

@@ -118,6 +118,11 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
+# Split debug info into a separate file, then strip the binary.
+# The .debug file can be extracted as a CI artifact for production debugging.
+RUN objcopy --only-keep-debug /windmill/target/release/windmill /windmill/target/release/windmill.debug \
+    && strip /windmill/target/release/windmill
+
 FROM ${DEBIAN_IMAGE}
 
 ARG TARGETPLATFORM
@@ -252,6 +257,7 @@ ENV TZ=Etc/UTC
 
 COPY --from=builder /frontend/build /static_frontend
 COPY --from=builder /windmill/target/release/windmill ${APP}/windmill
+COPY --from=builder /windmill/target/release/windmill.debug ${APP}/windmill.debug
 COPY --from=windmill_duckdb_ffi_internal_builder /windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so ${APP}/libwindmill_duckdb_ffi_internal.so
 
 COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno

backend/Cargo.toml

@@ -100,6 +100,8 @@ debug = false
 
 [profile.release]
 lto = "thin"
+debug = "line-tables-only"
+strip = "none"
 
 [features]
 default = []