docs: note containerized upx fallback

.gitea/workflows/release.yml

@@ -251,25 +251,49 @@ jobs:
           set -euo pipefail
 
           upx_cmd=""
+          upx_runner=""
           if command -v upx >/dev/null 2>&1; then
             upx_cmd=upx
           elif command -v upx-ucl >/dev/null 2>&1; then
             upx_cmd=upx-ucl
+          elif command -v docker >/dev/null 2>&1; then
+            upx_runner=docker
+          elif command -v podman >/dev/null 2>&1; then
+            upx_runner=podman
           else
-            echo "UPX is not available on PATH; continuing without binary compression." >&2
+            echo "UPX is not available on PATH and no container runtime is available; continuing without binary compression." >&2
           fi
 
           mkdir -p dist
 
+          compress_with_upx() {
+            local file="$1"
+
+            if [[ -n "${upx_cmd}" ]]; then
+              "${upx_cmd}" --best --lzma "${file}"
+              return
+            fi
+
+            if [[ "${upx_runner}" == "docker" ]]; then
+              docker run --rm -v "$PWD/dist:/work" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
+              return
+            fi
+
+            if [[ "${upx_runner}" == "podman" ]]; then
+              podman run --rm -v "$PWD/dist:/work:Z" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
+              return
+            fi
+
+            return 0
+          }
+
           for target in linux/amd64 linux/arm64; do
             os="${target%/*}"
             arch="${target#*/}"
 
             bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
             GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
-            if [[ -n "${upx_cmd}" ]]; then
-              "${upx_cmd}" --best --lzma "dist/${bin}"
-            fi
+            compress_with_upx "dist/${bin}"
           done
 
           (
@@ -349,7 +373,7 @@ jobs:
               echo "- Tag: ${TAG_NAME}"
               echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
               echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
-              echo "- Release binaries are compressed with UPX when available, otherwise uploaded uncompressed."
+              echo "- Release binaries use local UPX when available, otherwise containerized UPX (Docker/Podman), otherwise uncompressed upload."
             } >> "$SUMMARY_FILE"
           else
             {

.gitea/workflows/update-release.yml

@@ -173,25 +173,49 @@ jobs:
           set -euo pipefail
 
           upx_cmd=""
+          upx_runner=""
           if command -v upx >/dev/null 2>&1; then
             upx_cmd=upx
           elif command -v upx-ucl >/dev/null 2>&1; then
             upx_cmd=upx-ucl
+          elif command -v docker >/dev/null 2>&1; then
+            upx_runner=docker
+          elif command -v podman >/dev/null 2>&1; then
+            upx_runner=podman
           else
-            echo "UPX is not available on PATH; continuing without binary compression." >&2
+            echo "UPX is not available on PATH and no container runtime is available; continuing without binary compression." >&2
           fi
 
           mkdir -p dist
 
+          compress_with_upx() {
+            local file="$1"
+
+            if [[ -n "${upx_cmd}" ]]; then
+              "${upx_cmd}" --best --lzma "${file}"
+              return
+            fi
+
+            if [[ "${upx_runner}" == "docker" ]]; then
+              docker run --rm -v "$PWD/dist:/work" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
+              return
+            fi
+
+            if [[ "${upx_runner}" == "podman" ]]; then
+              podman run --rm -v "$PWD/dist:/work:Z" ghcr.io/upx/upx:4.2.4 --best --lzma "/work/$(basename "${file}")"
+              return
+            fi
+
+            return 0
+          }
+
           for target in linux/amd64 linux/arm64; do
             os="${target%/*}"
             arch="${target#*/}"
 
             bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
             GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
-            if [[ -n "${upx_cmd}" ]]; then
-              "${upx_cmd}" --best --lzma "dist/${bin}"
-            fi
+            compress_with_upx "dist/${bin}"
           done
 
           (
@@ -271,7 +295,7 @@ jobs:
               echo "- Tag: ${TAG_NAME}"
               echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
               echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
-              echo "- Release binaries are compressed with UPX when available, otherwise uploaded uncompressed."
+              echo "- Release binaries use local UPX when available, otherwise containerized UPX (Docker/Podman), otherwise uncompressed upload."
             } >> "$SUMMARY_FILE"
           else
             {

CHANGELOG.md

@@ -24,7 +24,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 ### Fixed
 
 - Hardened `coverage-gate` file input handling by validating and normalizing policy/profile paths before opening files, resolving `G304` findings in `coverage-gate/parse.go`.
-- Made release binary builds resilient when `upx` is unavailable by falling back to uncompressed artifacts in both `release.yml` and `update-release.yml`.
+- Made release binary builds resilient by using local `upx` when available, then containerized UPX via Docker/Podman, with final fallback to uncompressed artifacts in both `release.yml` and `update-release.yml`.
 
 ## [1.1.0] - 2026-03-21