fix: extract debug files in same build_ee job to avoid double compile

Move the debuginfo extraction into the build_ee job, right after the
main build+push. Since it runs on the same depot runner with a warm
cache, the --target debuginfo step should be a cache hit (no recompile).
The separate attach_ee_debug_to_release job caused a full recompile
on v1.658.0 (~16 min per platform).

The .debug file stays out of the final image (zero image size increase).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/docker-image.yml

@@ -162,6 +162,31 @@ jobs:
             ${{ steps.meta-ee-public.outputs.labels }}
             org.opencontainers.image.licenses=Windmill-Enterprise-License
 
+      - name: Extract EE debug files from cached builder layer
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        uses: depot/build-push-action@v1
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          target: debuginfo
+          build-args: |
+            features=ee
+          outputs: type=local,dest=./debuginfo
+
+      - name: Rename EE debug files
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          mv ./debuginfo/linux_amd64/windmill.debug ./debuginfo/windmill-ee-amd64.debug
+          mv ./debuginfo/linux_arm64/windmill.debug ./debuginfo/windmill-ee-arm64.debug
+
+      - name: Upload EE debug files
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            ./debuginfo/windmill-ee-amd64.debug
+            ./debuginfo/windmill-ee-arm64.debug
+
   attach_amd64_binary_to_release:
     needs: [build, build_ee]
     runs-on: ubicloud

Dockerfile

@@ -118,6 +118,18 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
+# Split debug info into a separate file, then strip the binary.
+# The .debug file can be extracted as a CI artifact for production debugging.
+# The debuglink allows gdb to auto-discover the debug file when placed next to the binary.
+RUN objcopy --only-keep-debug /windmill/target/release/windmill /windmill/target/release/windmill.debug \
+    && strip /windmill/target/release/windmill \
+    && objcopy --add-gnu-debuglink=/windmill/target/release/windmill.debug /windmill/target/release/windmill
+
+# Lightweight stage for extracting the .debug file without bloating the final image.
+# Usage: docker build --target debuginfo --output type=local,dest=./out .
+FROM scratch AS debuginfo
+COPY --from=builder /windmill/target/release/windmill.debug /windmill.debug
+
 FROM ${DEBIAN_IMAGE}
 
 ARG TARGETPLATFORM

backend/Cargo.toml

@@ -100,6 +100,8 @@ debug = false
 
 [profile.release]
 lto = "thin"
+debug = "line-tables-only"
+strip = "none"
 
 [features]
 default = []