From a74986ffff342d30f985ecc1277b628c5cd0f1a8 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 16 Mar 2026 15:18:03 +0000
Subject: [PATCH] chore: split debug info for EE release builds

Generate line-table debug info in release builds and split it into
a separate .debug file. The shipped binary remains stripped (same
size as before), while the .debug files are attached to GitHub
releases for both amd64 and arm64 EE builds.

This enables production debugging with gdb/perf by copying the
matching .debug file into a running pod.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/docker-image.yml | 35 ++++++++++++++++++++++++++++++
 Dockerfile                         |  6 +++++
 backend/Cargo.toml                 |  2 ++
 3 files changed, 43 insertions(+)

diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 09d3728fba..94ff1ea103 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -199,10 +199,17 @@ jobs:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
           path: "/usr/src/app/windmill"
 
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-ee-debug
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          path: "/usr/src/app/windmill.debug"
+
       - name: Rename binary with corresponding architecture
         run: |
           mv "${{ steps.extract.outputs.destination }}/windmill" "${{ steps.extract.outputs.destination }}/windmill-${ARCH}"
           mv "${{ steps.extract-ee.outputs.destination }}/windmill" "${{ steps.extract-ee.outputs.destination }}/windmill-ee-${ARCH}"
+          mv "${{ steps.extract-ee-debug.outputs.destination }}/windmill.debug" "${{ steps.extract-ee-debug.outputs.destination }}/windmill-ee-${ARCH}.debug"
 
       - name: Attach binary to release
         uses: softprops/action-gh-release@v2
@@ -210,8 +217,36 @@ jobs:
           files: |
             ${{ steps.extract.outputs.destination }}/*
             ${{ steps.extract-ee.outputs.destination }}/*
+            ${{ steps.extract-ee-debug.outputs.destination }}/*
             ${{ steps.extract-duckdb-ffi-internal.outputs.destination }}/*
 
+  attach_arm64_ee_debug_to_release:
+    needs: [build_ee]
+    runs-on: ubicloud-standard-2-arm
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    env:
+      ARCH: arm64
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          docker pull --platform "linux/$ARCH" ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-ee-debug
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          path: "/usr/src/app/windmill.debug"
+
+      - name: Rename debug file with corresponding architecture
+        run: |
+          mv "${{ steps.extract-ee-debug.outputs.destination }}/windmill.debug" "${{ steps.extract-ee-debug.outputs.destination }}/windmill-ee-${ARCH}.debug"
+
+      - name: Attach debug file to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            ${{ steps.extract-ee-debug.outputs.destination }}/*
+
   # attach_arm64_binary_to_release:
   #   needs: [build, build_ee]
   #   runs-on: ubicoud
diff --git a/Dockerfile b/Dockerfile
index 2ebb8508df..f84afcc888 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -118,6 +118,11 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
+# Split debug info into a separate file, then strip the binary.
+# The .debug file can be extracted as a CI artifact for production debugging.
+RUN objcopy --only-keep-debug /windmill/target/release/windmill /windmill/target/release/windmill.debug \
+    && strip /windmill/target/release/windmill
+
 FROM ${DEBIAN_IMAGE}
 
 ARG TARGETPLATFORM
@@ -252,6 +257,7 @@ ENV TZ=Etc/UTC
 
 COPY --from=builder /frontend/build /static_frontend
 COPY --from=builder /windmill/target/release/windmill ${APP}/windmill
+COPY --from=builder /windmill/target/release/windmill.debug ${APP}/windmill.debug
 COPY --from=windmill_duckdb_ffi_internal_builder /windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so ${APP}/libwindmill_duckdb_ffi_internal.so
 
 COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 83e4c9c4cf..f787e0d73f 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -100,6 +100,8 @@ debug = false
 
 [profile.release]
 lto = "thin"
+debug = "line-tables-only"
+strip = "none"
 
 [features]
 default = []