Distribute devbox as installer-managed Linux and macOS binaries

[PabloZaiden]

Summary

• Added installer configuration and a binary release workflow for Linux and macOS distribution.
• Removed the npm package release workflow and simplified package publishing metadata.
• Updated CLI/core logic to support installer-managed update behavior.
• Refreshed README installation/update guidance for the new binary distribution model.

[Copilot]

Pull request overview

This PR transitions devbox distribution from an npm-published CLI package to installer-managed, Bun-compiled Linux/macOS binaries, and adds an update subcommand wired to the installer’s GitHub release-asset contract.

Changes:

• Added devbox update (with --check / --version) and wired it through @pablozaiden/installer.
• Switched build output from a bundled JS entrypoint to a compiled Bun binary and updated CI/release workflows accordingly.
• Updated docs and publishing metadata to reflect the new binary distribution model.

Reviewed changes

Copilot reviewed 15 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/update.test.ts	Adds tests covering the updater config and GitHub “latest release” contract behavior.
tests/status.test.ts	Updates test fixtures to reflect lastContainerId becoming optional/undefined in state.
tests/examples.live.test.ts	Adds explicit null guards for live-fixture fields used in assertions.
tests/core.test.ts	Adds argument-parsing tests for the new update subcommand and invalid option combos.
src/version.ts	Introduces DEVBOX_VERSION sourced from package.json.
src/update.ts	Adds runUpdateCommand wrapper and static updater configuration for the installer library.
src/types.d.ts	Declares a *.sh module type (string content).
src/status.ts	Aligns ParseError type import with the ESM entry used for parsing.
src/core.ts	Adds update command support in help/arg parsing and uses DEVBOX_VERSION in help banner.
src/cli.ts	Routes update command to the updater implementation and propagates exit code.
README.md	Replaces npm/bun global install docs with installer-based install/update instructions.
package.json	Marks package private, switches build scripts to Bun-compiled binary, adds installer dependency.
bun.lock	Locks new dependency graph including installer and its peer deps.
.github/workflows/release-npm-package.yml	Removes the npm publish workflow.
.github/workflows/pr-tests.yml	Updates CI to build and smoke-test the compiled binary.
.github/workflows/binary-release.yml	Adds a release-triggered binary build/upload workflow using the reusable installer workflow.
.github/installer.json	Adds installer metadata for binary naming, checksums, and supported platforms/arches.

Comments suppressed due to low confidence (1)

package.json:34

• @pablozaiden/installer declares a typescript peerDependency (it’s pulled into bun.lock), but package.json doesn’t list TypeScript. This can produce peer-dependency warnings and non-reproducible installs with package managers that don't auto-install peers. Add typescript explicitly to devDependencies.

  "devDependencies": {
    "@types/bun": "1.3.10"
  }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.