release.yml

name: Release

# Publish opencodex to npm — jawcode-style: triggered from the Actions tab with an explicit
# version, dist-tag, and a dry-run-first default. Bump package.json on main BEFORE dispatching
# (or use `bun run release <version>`, which does the bump+commit+push+dispatch for you); the
# workflow verifies the version matches before publishing.
on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to publish — must equal package.json (e.g. 0.1.0)"
        required: true
        type: string
      tag:
        description: "npm dist-tag"
        required: true
        type: choice
        options:
          - latest
          - preview
        default: latest
      dry-run:
        description: "Dry run (build + pack, no actual publish)"
        required: false
        type: boolean
        default: true
      resume-after-npm-publish:
        description: "Operator attestation: a previous run of this workflow acknowledged npm publication for this exact commit; skip npm publish and complete the GitHub side"
        required: false
        type: boolean
        default: false
      expected-sha:
        description: "Immutable release commit this dispatch must publish (fail if the branch moved)"
        required: true
        type: string

permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  validate-dispatch:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout trusted dispatch guard
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
          path: trusted-dispatch

      - name: Validate release dispatch
        env:
          EXPECTED_SHA: ${{ inputs.expected-sha }}
        run: |
          node - <<'NODE'
          const { validateReleaseDispatch } = require(
            "./trusted-dispatch/.github/scripts/release-dispatch-guard.cjs",
          );

          const failure = validateReleaseDispatch({
            eventName: process.env.GITHUB_EVENT_NAME,
            ref: process.env.GITHUB_REF,
            expectedSha: process.env.EXPECTED_SHA,
            actualSha: process.env.GITHUB_SHA,
          });

          if (failure) {
            console.error(`::error::${failure}`);
            process.exit(1);
          }
          NODE

  # Every publication precondition the dispatch can already decide, checked before any runner
  # starts packaging: channel and dist-tag, every version source, the tag, the GitHub release,
  # npm, the global tag ordering and the dev pre-move (scripts/ci/release-preflight.sh).
  #
  # Run 35783865160 packaged 2.62.0 for nineteen minutes and then failed the ordering gate in
  # `publish` on v2.63.0-preview.20260923. That tag already existed when the run's first job
  # started: the workflow-level `release` concurrency group above is one constant slot for every
  # ref, so the stable run had waited for the preview run to finish. The runs were serialised;
  # the check was in the wrong place. Because of that shared slot, this job sees whatever the
  # previous release run published.
  #
  # It is an early answer, not the final one. Tags, releases and registry state can still move
  # while a run packages (a hand-pushed tag, a first local publish), so `publish` repeats every
  # one of these checks immediately before `npm publish`.
  preflight:
    name: release preflight
    needs: validate-dispatch
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false
          fetch-tags: true

      - name: Setup project Bun
        uses: ./.github/actions/setup-project-bun

      - name: Fetch the dev line
        run: git fetch --no-tags --depth=1 origin +refs/heads/dev:refs/remotes/origin/dev

      - name: Refuse a release that cannot publish
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
          NPM_DIST_TAG: ${{ inputs.tag }}
          DRY_RUN: ${{ inputs.dry-run }}
          RESUME: ${{ inputs.resume-after-npm-publish }}
        run: bash scripts/ci/release-preflight.sh

  package-standalone:
    needs: [validate-dispatch, preflight]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: bun-linux-x64
            dependency_os: linux
            dependency_cpu: x64
            smoke: true
          - os: macos-latest
            target: bun-darwin-arm64
            dependency_os: darwin
            dependency_cpu: arm64
            smoke: true
          - os: macos-latest
            target: bun-darwin-x64
            dependency_os: darwin
            dependency_cpu: x64
            smoke: false
          - os: windows-latest
            target: bun-windows-x64
            dependency_os: win32
            dependency_cpu: x64
            smoke: true
          - os: ubuntu-latest
            target: bun-linux-arm64
            dependency_os: linux
            dependency_cpu: arm64
            smoke: false
    runs-on: ${{ matrix.os }}
    # The Windows leg can wait up to an hour for a release-signing approval in SignPath.
    timeout-minutes: ${{ matrix.target == 'bun-windows-x64' && 90 || 25 }}
    permissions:
      # actions: read lets the SignPath action read this job and download the unsigned artifact.
      actions: read
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup project Bun
        uses: ./.github/actions/setup-project-bun

      # Windows Authenticode signing through SignPath Foundation (#7207). Decided before the build, so
      # a broken SignPath configuration fails in seconds instead of after the build. The rules
      # (no token: skip; partial configuration: fail; test-signing: dry runs only) live in
      # scripts/ci/windows-signing-plan.sh, where tests/ci-workflows/release-windows-signing.test.ts
      # exercises them.
      - name: Decide Windows code signing
        id: windows-signing
        if: runner.os == 'Windows'
        shell: bash
        env:
          SIGNPATH_CONFIGURED: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
          SIGNPATH_ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          SIGNPATH_SIGNING_POLICY: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
          DRY_RUN: ${{ inputs.dry-run }}
        run: bash scripts/ci/windows-signing-plan.sh

      - name: Install dependencies
        run: bun install --frozen-lockfile --os=${{ matrix.dependency_os }} --cpu=${{ matrix.dependency_cpu }}

      - name: Build dashboard
        run: bun run build:gui

      - name: Build standalone binary
        run: bun run build:standalone --target ${{ matrix.target }}

      - name: Smoke test standalone binary
        if: matrix.smoke && runner.os != 'Windows'
        shell: bash
        run: |
          set -euo pipefail
          binary="dist/standalone/${{ matrix.target }}/ocx"
          "$binary" --version
          OPENCODEX_HOME="$RUNNER_TEMP/ocx-home" "$binary" start --port 10177 >"$RUNNER_TEMP/ocx.log" 2>&1 &
          pid=$!
          trap 'kill "$pid" 2>/dev/null || true' EXIT
          for _ in $(seq 1 30); do curl -fsS http://127.0.0.1:10177/healthz && break || sleep 1; done
          curl -fsS http://127.0.0.1:10177/healthz
          test "$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:10177/)" = 200

      - name: Smoke test standalone binary (Windows)
        if: matrix.smoke && runner.os == 'Windows'
        shell: pwsh
        run: |
          $binary = "dist/standalone/${{ matrix.target }}/ocx.exe"
          & $binary --version
          $env:OPENCODEX_HOME = Join-Path $env:RUNNER_TEMP "ocx-home"
          $process = Start-Process -FilePath $binary -ArgumentList "start", "--port", "10177" -PassThru
          try {
            for ($i = 0; $i -lt 30; $i++) {
              try { Invoke-WebRequest -UseBasicParsing http://127.0.0.1:10177/healthz | Out-Null; break } catch { Start-Sleep -Seconds 1 }
            }
            Invoke-WebRequest -UseBasicParsing http://127.0.0.1:10177/healthz | Select-Object -ExpandProperty Content
            Invoke-WebRequest -UseBasicParsing http://127.0.0.1:10177/ | Out-Null
          } finally { Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue }

      # Signed after the smoke test and before the archive, so the zip and its checksum are built
      # from the signed binary. The artifact holds ocx.exe alone at its root, which is the shape the
      # windows-standalone-zip artifact configuration expects. The keyring addons beside it are
      # third-party builds that the SignPath Foundation policy forbids signing with its certificate.
      - name: Upload the unsigned Windows binary for signing
        id: unsigned-ocx
        if: steps.windows-signing.outputs.mode == 'sign'
        continue-on-error: true
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: signpath-unsigned-${{ matrix.target }}
          path: dist/standalone/${{ matrix.target }}/ocx.exe
          if-no-files-found: error
          retention-days: 1

      # continue-on-error on every signing step: a SignPath outage, timeout or rejection must never
      # fail a release. The apply step reads this outcome and keeps the unsigned binary with a
      # warning. Under release-signing every request waits for a maintainer's manual approval in
      # app.signpath.io, hence the hour.
      - name: Sign the Windows binary through SignPath
        id: sign-ocx
        if: steps.windows-signing.outputs.mode == 'sign' && steps.unsigned-ocx.outcome == 'success'
        continue-on-error: true
        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
        timeout-minutes: 65
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          signing-policy-slug: ${{ steps.windows-signing.outputs.policy }}
          artifact-configuration-slug: windows-standalone-zip
          github-artifact-id: ${{ steps.unsigned-ocx.outputs.artifact-id }}
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 3600
          output-artifact-directory: ${{ runner.temp }}/signpath-signed-ocx

      - name: Swap in the verified signed Windows binary
        if: steps.windows-signing.outputs.mode == 'sign'
        continue-on-error: true
        shell: pwsh
        env:
          STANDALONE_TARGET: ${{ matrix.target }}
          SIGNPATH_OUTCOME: ${{ steps.sign-ocx.outcome }}
          SIGNING_TRUST: ${{ steps.windows-signing.outputs.trust }}
        run: |
          ./scripts/ci/apply-signed-windows-artifact.ps1 `
            -Target "dist/standalone/$env:STANDALONE_TARGET/ocx.exe" `
            -SignedDirectory (Join-Path $env:RUNNER_TEMP "signpath-signed-ocx") `
            -SubmitOutcome "$env:SIGNPATH_OUTCOME" `
            -Trust $env:SIGNING_TRUST


      - name: Archive standalone release
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
          STANDALONE_TARGET: ${{ matrix.target }}
        run: |
          set -euo pipefail
          cd "dist/standalone/$STANDALONE_TARGET"
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            powershell -NoProfile -Command 'Compress-Archive -Path ocx.exe,gui,keyring -DestinationPath ("../../ocx-{0}-{1}.zip" -f $env:RELEASE_VERSION,$env:STANDALONE_TARGET) -Force'
          else
            tar -czf "../../ocx-${RELEASE_VERSION}-${STANDALONE_TARGET}.tar.gz" ocx gui keyring
          fi
          cd ../..
          # The pre-publication verifier resolves every recorded checksum from
          # dist/release, where the artifact download lands these files flat; the
          # checksum therefore records the bare file name, which sha256sum takes
          # verbatim from its argument.
          if [[ "$RUNNER_OS" == "Windows" ]]; then sha256sum "ocx-${RELEASE_VERSION}-${STANDALONE_TARGET}.zip" > "ocx-${RELEASE_VERSION}-${STANDALONE_TARGET}.zip.sha256"
          else sha256sum "ocx-${RELEASE_VERSION}-${STANDALONE_TARGET}.tar.gz" > "ocx-${RELEASE_VERSION}-${STANDALONE_TARGET}.tar.gz.sha256"
          fi

      - name: Upload standalone release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: standalone-${{ matrix.target }}
          path: |
            dist/ocx-*.tar.gz
            dist/ocx-*.zip
            dist/ocx-*.sha256
          if-no-files-found: error
          retention-days: 7

  package-desktop:
    needs: [validate-dispatch, preflight]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: universal-apple-darwin
            dependency_os: darwin
            dependency_cpu: "*"
            bundles: app,dmg
            sidecar-targets: macos
            artifact-suffixes: macos.dmg,macos.app.tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            dependency_os: win32
            dependency_cpu: x64
            bundles: msi
            sidecar-targets: x86_64-pc-windows-msvc
            artifact-suffixes: windows-x64.msi
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            dependency_os: linux
            dependency_cpu: x64
            bundles: appimage,deb
            sidecar-targets: x86_64-unknown-linux-gnu
            artifact-suffixes: linux-x86_64.AppImage,linux-amd64.deb
    runs-on: ${{ matrix.os }}
    # The Windows leg can wait up to an hour for a release-signing approval in SignPath.
    timeout-minutes: ${{ matrix.target == 'x86_64-pc-windows-msvc' && 105 || 45 }}
    permissions:
      # actions: read lets the SignPath action read this job and download the unsigned artifact.
      actions: read
      contents: read
    env:
      # Whether this run holds the Developer ID material at all. A run without it still builds
      # locally useful bundles; a run with it must not silently downgrade any part of the app.
      DESKTOP_SIGNING_CONFIGURED: ${{ secrets.APPLE_CERTIFICATE != '' }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup project Bun
        uses: ./.github/actions/setup-project-bun

      # Windows Authenticode signing through SignPath Foundation (#7207). Decided before the build, so
      # a broken SignPath configuration fails in seconds instead of after the build. The rules
      # (no token: skip; partial configuration: fail; test-signing: dry runs only) live in
      # scripts/ci/windows-signing-plan.sh, where tests/ci-workflows/release-windows-signing.test.ts
      # exercises them.
      - name: Decide Windows code signing
        id: windows-signing
        if: runner.os == 'Windows'
        shell: bash
        env:
          SIGNPATH_CONFIGURED: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
          SIGNPATH_ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          SIGNPATH_SIGNING_POLICY: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
          DRY_RUN: ${{ inputs.dry-run }}
        run: bash scripts/ci/windows-signing-plan.sh

      # The desktop build takes its version from tauri.conf.json and Cargo.toml (the widget
      # plist inherits it), not from package.json or this input, while the updater manifest is
      # derived from the input. A mismatch ships an app that reports the previous version under a
      # manifest naming this one, so the updater re-offers the same release forever. Refuse
      # before anything is built. Bash on every runner: Windows would otherwise run PowerShell,
      # where "$RELEASE_VERSION" is not the environment variable.
      - name: Verify every version source matches the release
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: bun scripts/release-version-sources.ts check "$RELEASE_VERSION"

      - name: Install project dependencies
        run: bun install --frozen-lockfile --os=${{ matrix.dependency_os }} --cpu=${{ matrix.dependency_cpu }}

      - name: Build dashboard
        run: bun run build:gui

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
        with:
          toolchain: stable
          targets: ${{ runner.os == 'macOS' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Install Linux desktop dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev

      - name: Install desktop dependencies
        working-directory: desktop
        run: bun install --frozen-lockfile

      - name: Prepare macOS sidecars
        if: runner.os == 'macOS'
        run: |
          bun desktop/scripts/prepare-sidecar.ts --target aarch64-apple-darwin
          bun desktop/scripts/prepare-sidecar.ts --target x86_64-apple-darwin
          lipo -create desktop/src-tauri/binaries/ocx-aarch64-apple-darwin \
            desktop/src-tauri/binaries/ocx-x86_64-apple-darwin \
            -output desktop/src-tauri/binaries/ocx-universal-apple-darwin
          lipo desktop/src-tauri/binaries/ocx-universal-apple-darwin -verify_arch arm64 x86_64

      - name: Prepare sidecar
        if: runner.os != 'macOS'
        run: bun desktop/scripts/prepare-sidecar.ts --target ${{ matrix.sidecar-targets }}

      # The signing certificate has to be in a keychain before the widget is signed, and the
      # Tauri build step creates its own keychain only when it runs — which is after this. Until
      # this step existed, build-widget.sh saw no MACOS_SIGN_IDENTITY and took its unsigned
      # branch, and the bundler does not re-sign anything under PlugIns, so the extension would
      # have gone out ad-hoc inside a Developer ID host. No release has published a macOS
      # application yet, so this is a defect that had not reached anyone rather than one that had.
      - name: Import the release signing certificate
        if: runner.os == 'macOS'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          DRY_RUN: ${{ inputs.dry-run }}
        run: |
          set -euo pipefail
          # Checked as a set, because a partial set is the dangerous case: the Tauri CLI skips
          # notarization without failing when the notary credentials are missing, and the
          # unnotarized artifact is uploaded and attached exactly as a good one would be.
          missing=""
          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_ID APPLE_PASSWORD APPLE_TEAM_ID; do
            eval "value=\${$name:-}"
            [ -n "$value" ] || missing="$missing $name"
          done
          if [ -n "$missing" ]; then
            if [ "${DRY_RUN}" != "true" ]; then
              echo "::error::A real release needs the full signing and notarization credential set."
              echo "::error::Missing:$missing"
              exit 1
            fi
            echo "Signing credentials are incomplete, so this build stays ad-hoc signed:$missing"
            echo "It is usable for local validation and is not a release asset."
            exit 0
          fi
          keychain="$RUNNER_TEMP/opencodex-signing.keychain-db"
          # Recorded before anything is created, so the cleanup step can still find a keychain
          # that a failure left half-built.
          echo "OPENCODEX_SIGNING_KEYCHAIN=$keychain" >> "$GITHUB_ENV"
          keychain_password="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
          certificate="$RUNNER_TEMP/opencodex-signing.p12"
          # The decoded certificate must not outlive this step even when a later command fails.
          trap 'shred -u "$certificate" 2>/dev/null || rm -Pf "$certificate" 2>/dev/null || true' EXIT
          printf '%s' "$APPLE_CERTIFICATE" | base64 --decode > "$certificate"
          security create-keychain -p "$keychain_password" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "$keychain_password" "$keychain"
          security import "$certificate" -k "$keychain" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: \
            -s -k "$keychain_password" "$keychain" > /dev/null
          # shellcheck disable=SC2046 # the keychain list is intentionally word-split into arguments
          security list-keychain -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')

      - name: Build WidgetKit extension
        if: runner.os == 'macOS'
        env:
          MACOS_SIGN_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # A run holding Developer ID material must not produce an ad-hoc widget. Without this
          # the script's ad-hoc branch is the silent default, which is how a signed, notarized
          # app shipped with an extension macOS will not register.
          WIDGET_SIGN_REQUIRED: ${{ env.DESKTOP_SIGNING_CONFIGURED == 'true' && '1' || '0' }}
        run: bash desktop/scripts/build-widget.sh

      - name: Verify the extension carries the release signature
        if: runner.os == 'macOS'
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          DRY_RUN: ${{ inputs.dry-run }}
        run: |
          set -euo pipefail
          appex=desktop/src-tauri/widget/OpenCodexWidget.appex
          if [ -z "${APPLE_TEAM_ID}" ]; then
            if [ "${DRY_RUN}" != "true" ]; then
              echo "::error::A real release cannot assert its own signature without APPLE_TEAM_ID."
              exit 1
            fi
            echo "No team configured; skipping the signature assertion for this non-release build."
            exit 0
          fi
          codesign --verify --strict --deep "$appex"
          description="$(codesign -dvvv "$appex" 2>&1)"
          echo "$description"
          echo "$description" | grep -q "TeamIdentifier=$APPLE_TEAM_ID"
          echo "$description" | grep -q "flags=.*runtime"
          echo "$description" | grep -q "Timestamp="

      # Tauri signs the app, its sidecar and the widget it is handed, but nothing under Resources.
      # The packaged keyring addons (#6161) are Mach-O code, so Apple notarization rejects the whole
      # app unless each carries the Developer ID signature, the hardened runtime and a secure
      # timestamp (2.73.0-preview.20260930 was refused for exactly that). Sign them in place, after
      # the certificate import and before the bundler copies them.
      - name: Sign the packaged keyring addons
        if: runner.os == 'macOS'
        env:
          MACOS_SIGN_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          DRY_RUN: ${{ inputs.dry-run }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          addons=(desktop/src-tauri/resources/keyring/*.darwin-*.node)
          if [ "${#addons[@]}" -eq 0 ]; then
            echo "::error::No macOS keyring addon was prepared for the bundle."
            exit 1
          fi
          if [ "${DESKTOP_SIGNING_CONFIGURED}" != "true" ]; then
            if [ "${DRY_RUN}" != "true" ]; then
              echo "::error::A real release must sign the packaged keyring addons."
              exit 1
            fi
            echo "No signing material; the keyring addons stay as prepared for this non-release build."
            exit 0
          fi
          for addon in "${addons[@]}"; do
            codesign --force --timestamp --options runtime --sign "$MACOS_SIGN_IDENTITY" "$addon"
            codesign --verify --strict "$addon"
            description="$(codesign -dvvv "$addon" 2>&1)"
            echo "$description"
            # Here-strings, not pipes: under pipefail a matcher that exits on its first hit can
            # SIGPIPE the writer and fail the assertion it was meant to pass.
            grep -q "TeamIdentifier=$APPLE_TEAM_ID" <<<"$description"
            grep -q "flags=.*runtime" <<<"$description"
            grep -q "Timestamp=" <<<"$description"
          done

      - name: Prepare Windows installer version
        if: runner.os == 'Windows'
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: bun desktop/scripts/windows-installer-config.ts "$RELEASE_VERSION" "$RUNNER_TEMP/opencodex-msi.json"

      - name: Preserve the compiled Linux sidecar
        if: runner.os == 'Linux'
        run: |
          chmod +x desktop/scripts/appimage-patchelf.py
          echo "PATCHELF=$GITHUB_WORKSPACE/desktop/scripts/appimage-patchelf.py" >> "$GITHUB_ENV"

      # Release signing is intentionally secret-gated. Developer ID, notarization,
      # and updater signatures require maintainer-owned credentials; builds without
      # those secrets remain useful for local validation but are not release assets.
      - name: Build desktop bundles
        if: runner.os != 'Linux'
        working-directory: desktop
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          MACOS_SIGN_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        # linuxdeploy suppresses its own stderr at the default verbosity. Keep
        # diagnostics on the first attempt; Apple signing commands stay non-verbose.
        run: bunx tauri ${{ runner.os == 'Linux' && '--verbose' || '' }} build --ci --target ${{ matrix.target }} --bundles ${{ matrix.bundles }} --config "${{ runner.os == 'Windows' && format('{0}/opencodex-msi.json', runner.temp) || '{}' }}"

      # The Windows installer goes to SignPath after the build and before the asset rename, so the
      # renamed asset, its checksum and its updater signature all describe the signed MSI. The
      # windows-msi-zip artifact configuration signs every .exe inside the installer (the app and
      # the bundled ocx.exe sidecar) and then the MSI itself.
      - name: Locate the Windows installer for signing
        id: windows-msi
        if: steps.windows-signing.outputs.mode == 'sign'
        continue-on-error: true
        shell: bash
        env:
          DESKTOP_TARGET: ${{ matrix.target }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          installers=("desktop/src-tauri/target/$DESKTOP_TARGET/release/bundle/msi/"*.msi)
          if [ "${#installers[@]}" -ne 1 ]; then
            echo "::warning::Expected one MSI to sign, found ${#installers[@]}; the installer ships unsigned."
            exit 1
          fi
          echo "path=${installers[0]}" >> "$GITHUB_OUTPUT"

      - name: Upload the unsigned Windows installer for signing
        id: unsigned-msi
        if: steps.windows-signing.outputs.mode == 'sign' && steps.windows-msi.outcome == 'success'
        continue-on-error: true
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: signpath-unsigned-${{ matrix.target }}
          path: ${{ steps.windows-msi.outputs.path }}
          if-no-files-found: error
          retention-days: 1

      # continue-on-error, as for the standalone binary: an outage, timeout or rejection keeps the
      # unsigned installer and its original updater signature.
      - name: Sign the Windows installer through SignPath
        id: sign-msi
        if: steps.windows-signing.outputs.mode == 'sign' && steps.unsigned-msi.outcome == 'success'
        continue-on-error: true
        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
        timeout-minutes: 65
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          signing-policy-slug: ${{ steps.windows-signing.outputs.policy }}
          artifact-configuration-slug: windows-msi-zip
          github-artifact-id: ${{ steps.unsigned-msi.outputs.artifact-id }}
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 3600
          output-artifact-directory: ${{ runner.temp }}/signpath-signed-msi

      # Authenticode rewrites the MSI, so the Tauri updater signature made during the build no
      # longer matches it. The apply script regenerates <msi>.sig over the signed bytes with the
      # same key before swapping both in; verify-release then checks that signature against the
      # final MSI and writes latest.json from it.
      - name: Swap in the verified signed Windows installer
        if: steps.windows-signing.outputs.mode == 'sign' && steps.windows-msi.outcome == 'success'
        continue-on-error: true
        shell: pwsh
        env:
          MSI_PATH: ${{ steps.windows-msi.outputs.path }}
          SIGNPATH_OUTCOME: ${{ steps.sign-msi.outcome }}
          SIGNING_TRUST: ${{ steps.windows-signing.outputs.trust }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          ./scripts/ci/apply-signed-windows-artifact.ps1 `
            -Target "$env:MSI_PATH" `
            -SignedDirectory (Join-Path $env:RUNNER_TEMP "signpath-signed-msi") `
            -SubmitOutcome "$env:SIGNPATH_OUTCOME" `
            -Trust $env:SIGNING_TRUST `
            -Installer `
            -UpdaterSignature

      - name: Verify the packaged universal macOS runtime
        if: runner.os == 'macOS'
        run: |
          set -euo pipefail
          app=desktop/src-tauri/target/universal-apple-darwin/release/bundle/macos/OpenCodex.app
          test -f "$app/Contents/Resources/keyring/keyring.darwin-arm64.node"
          test -f "$app/Contents/Resources/keyring/keyring.darwin-x64.node"
          bash desktop/scripts/verify-macos-runtime.sh "$app"

      # Tauri patches a bundle-type marker into the application binary for each Linux format.
      # Keep each format in its own Cargo target so the deb cannot inherit the AppImage marker
      # and linuxdeploy cannot mutate the binary later consumed by the deb build.
      - name: Build Linux AppImage bundle
        if: runner.os == 'Linux'
        working-directory: desktop
        env:
          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-appimage-target
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: bunx tauri build --ci --target ${{ matrix.target }} --bundles appimage

      - name: Build Linux deb bundle
        if: runner.os == 'Linux'
        working-directory: desktop
        env:
          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-deb-target
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: bunx tauri build --ci --target ${{ matrix.target }} --bundles deb

      - name: Stage isolated Linux release bundles
        if: runner.os == 'Linux'
        shell: bash
        env:
          DESKTOP_TARGET: ${{ matrix.target }}
          APPIMAGE_TARGET: ${{ runner.temp }}/opencodex-appimage-target
          DEB_TARGET: ${{ runner.temp }}/opencodex-deb-target
        run: |
          set -euo pipefail
          bundle_root="$RUNNER_TEMP/opencodex-linux-release-bundles"
          mkdir -p "$bundle_root/appimage" "$bundle_root/deb"
          cp -a "$APPIMAGE_TARGET/$DESKTOP_TARGET/release/bundle/appimage/." "$bundle_root/appimage/"
          cp -a "$DEB_TARGET/$DESKTOP_TARGET/release/bundle/deb/." "$bundle_root/deb/"
          chmod -R a-w "$bundle_root"
          echo "DESKTOP_BUNDLE_ROOT=$bundle_root" >> "$GITHUB_ENV"

      # After the isolated AppImage exists, and against that staged copy: the default Cargo target
      # holds no Linux bundle any more, so verifying there would fail or check a stale artifact.
      - name: Verify the packaged Linux sidecar
        if: runner.os == 'Linux'
        run: bash desktop/scripts/verify-linux-sidecar.sh "$DESKTOP_BUNDLE_ROOT/appimage"

      - name: Rename release assets
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
          DESKTOP_TARGET: ${{ matrix.target }}
        run: |
          args=( \
            --version "$RELEASE_VERSION" \
            --target "$DESKTOP_TARGET" \
            --out dist/release \
          )
          if [[ -n "${DESKTOP_BUNDLE_ROOT:-}" ]]; then
            args+=(--bundle-root "$DESKTOP_BUNDLE_ROOT")
          fi
          bun desktop/scripts/collect-release-assets.ts "${args[@]}"

      # After the bundle exists, not before: a sweep that runs first passes by finding nothing.
      - name: Verify every Mach-O in the bundle carries the release identity
        if: runner.os == 'macOS'
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          DRY_RUN: ${{ inputs.dry-run }}
        run: |
          set -euo pipefail
          if [ -z "${APPLE_TEAM_ID}" ]; then
            if [ "${DRY_RUN}" != "true" ]; then
              echo "::error::A real release cannot verify its bundle without APPLE_TEAM_ID."
              exit 1
            fi
            echo "No team configured; skipping the bundle-wide assertion for this local build."
            exit 0
          fi
          # Executables are found by their magic bytes rather than by path or extension. A bundler
          # signs what it placed; anything copied in afterwards is invisible to it, and the
          # binaries that get missed are the ones with no extension to filter on.
          apps=0
          machos=0
          bad=0
          while IFS= read -r app; do
            apps=$((apps + 1))
            echo "checking $app"
            while IFS= read -r -d '' file; do
              # All eight Mach-O leading words: thin and fat, 32- and 64-bit, both byte orders.
              # A list that covers only the common ones skips the rest in silence while the
              # non-zero counter below still reports a healthy sweep.
              case "$(head -c 4 "$file" | xxd -p)" in
                cefaedfe|cffaedfe|feedface|feedfacf) ;;
                cafebabe|bebafeca|cafebabf|bfbafeca) ;;
                *) continue ;;
              esac
              machos=$((machos + 1))
              if ! codesign -dvvv "$file" 2>&1 | grep -q "TeamIdentifier=$APPLE_TEAM_ID"; then
                echo "::error::$file is not signed with the release identity"
                bad=1
              fi
            done < <(find "$app" -type f -print0)
          done < <(find desktop/src-tauri/target -maxdepth 6 -type d -name '*.app')
          echo "inspected $machos Mach-O files across $apps app bundles"
          # A sweep that inspected nothing is the failure mode this step exists to prevent.
          if [ "$apps" -eq 0 ] || [ "$machos" -eq 0 ]; then
            echo "::error::found $apps app bundles and $machos Mach-O files; the sweep inspected nothing"
            exit 1
          fi
          exit "$bad"

      - name: Upload desktop release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: desktop-${{ matrix.target }}
          path: dist/release/
          if-no-files-found: error
          retention-days: 7

      # always(), because a keychain holding the release identity must not survive a failed job
      # on a runner image that could be reused.
      - name: Remove the signing keychain
        if: always() && runner.os == 'macOS'
        run: |
          if [ -n "${OPENCODEX_SIGNING_KEYCHAIN:-}" ] && [ -f "${OPENCODEX_SIGNING_KEYCHAIN}" ]; then
            security delete-keychain "${OPENCODEX_SIGNING_KEYCHAIN}"
          fi

  # Pre-publication verification. Everything that will be published is checked
  # here — expected platform set, every checksum, the updater signatures, and the
  # manifest parse-back — and publication consumes this result rather than
  # verifying after the fact. Runs on dry-run too: a dry run must prove the same
  # chain a real release will rely on.
  verify-release:
    runs-on: ubuntu-latest
    needs: [validate-dispatch, package-standalone, package-desktop]
    timeout-minutes: 10
    permissions:
      contents: read
    env:
      UPDATER_SIGNING_CONFIGURED: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY != '' }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup project Bun
        uses: ./.github/actions/setup-project-bun

      - name: Download standalone packaged assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: standalone-*
          merge-multiple: true
          path: dist/release

      - name: Download desktop packaged assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: desktop-*
          merge-multiple: true
          path: dist/release

      - name: Verify release assets
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          args=(
            --version "$RELEASE_VERSION"
            --dir dist/release
            --repo "$GITHUB_REPOSITORY"
            --sha "$GITHUB_SHA"
            --receipt-out verification/receipt.json
          )
          # Signatures are verified whenever they exist; the manifest is only
          # generated when this run holds the updater key, exactly as before.
          if [ "$UPDATER_SIGNING_CONFIGURED" = "true" ]; then
            args+=(--manifest-out dist/release/latest.json --require-signatures)
          fi
          bun desktop/scripts/verify-release-assets.ts "${args[@]}"

      - name: Upload verified release bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: verified-release
          path: dist/release/
          if-no-files-found: error
          retention-days: 7

      - name: Upload verification receipt
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-verification-receipt
          path: verification/receipt.json
          if-no-files-found: error
          retention-days: 7

  attach-release:
    runs-on: ubuntu-latest
    needs: [publish, verify-release]
    if: ${{ inputs.dry-run != true }}
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Setup project Bun
        uses: ./.github/actions/setup-project-bun

      - name: Download the verified release bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: verified-release
          path: dist/release

      - name: Download the verification receipt
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-verification-receipt
          path: verification

      # The bundle is attached exactly as verified: the receipt must name this
      # run's version and commit, or nothing uploads.
      - name: Require the verification receipt for this commit
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          receipt_version="$(bun -e 'console.log(JSON.parse(await Bun.file("verification/receipt.json").text()).version)')"
          receipt_sha="$(bun -e 'console.log(JSON.parse(await Bun.file("verification/receipt.json").text()).sha)')"
          test "$receipt_version" = "$RELEASE_VERSION" || {
            echo "::error::verification receipt names version $receipt_version, not $RELEASE_VERSION"
            exit 1
          }
          test "$receipt_sha" = "$GITHUB_SHA" || {
            echo "::error::verification receipt names commit $receipt_sha, not $GITHUB_SHA"
            exit 1
          }

      - name: Attach to the release
        env:
          GH_TOKEN: ${{ github.token }}
          # Workflow inputs reach shell code through env, never by interpolation into
          # run: source. tests/ci-workflows.test.ts enforces this repo-wide.
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          release_tag="v${RELEASE_VERSION}"
          gh release upload "$release_tag" dist/release/* --clobber

          # A published release is immutable: GitHub rejects every later asset upload
          # with HTTP 422, which is why v2.55.0 through v2.60.0 shipped with zero
          # assets and left the desktop updater without anything to download. The
          # release is therefore created as a draft and becomes public here, once the
          # verified bundle is attached. The only edit permitted is this flip — the
          # notes still come from the validated notes file written at creation.
          draft_state="$(gh release view "$release_tag" --json isDraft --jq .isDraft)"
          case "$draft_state" in
            true) gh release edit "$release_tag" --draft=false ;;
            false) ;;
            # A successful query that answers neither true nor false — an empty body or an
            # unexpected shape — must not leave the release a silent draft: only an explicit
            # false may pass.
            *) echo "unexpected draft state: $draft_state" >&2; exit 1 ;;
          esac

  # One row per fact a release run can establish: the public GitHub release, the npm version read
  # back from the registry, and the npm dist-tag. A green run used to read the same whichever of
  # them were true, because the registry smoke continues to the GitHub release when its reads stay
  # pending, which is the intended publishing behaviour. This job only reports; it never changes the
  # run's result.
  #
  # A job of its own, not a step in attach-release: a failed publish skips attach-release entirely,
  # and that is when the rows matter most. It reads with the job token at contents: read, so a draft
  # release is invisible to it and reads as not public, which is the question the row answers.
  release-outcomes:
    name: release outcomes
    needs: [publish, attach-release]
    if: ${{ always() && inputs.dry-run != true }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Report release outcomes
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
          NPM_DIST_TAG: ${{ inputs.tag }}
          NPM_VERSION_STATE: ${{ needs.publish.outputs.npm_version }}
          NPM_DIST_TAG_STATE: ${{ needs.publish.outputs.npm_dist_tag }}
          PUBLISH_RESULT: ${{ needs.publish.result }}
          ATTACH_RESULT: ${{ needs.attach-release.result }}
        run: bash scripts/ci/release-outcome-report.sh

  publish:
    needs: [validate-dispatch, verify-release]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      npm_version: ${{ steps.registry-smoke.outputs.npm_version }}
      npm_dist_tag: ${{ steps.registry-smoke.outputs.npm_dist_tag }}
    permissions:
      contents: write
      actions: read
      pull-requests: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      - name: Verify dispatched SHA
        env:
          EXPECTED_SHA: ${{ inputs.expected-sha }}
        run: |
          if [ -z "$EXPECTED_SHA" ]; then
            echo "::error::expected-sha is required; refusing to publish without an audited commit"
            exit 1
          elif [ "$GITHUB_SHA" != "$EXPECTED_SHA" ]; then
            echo "::error::branch moved after the release audit (expected ${EXPECTED_SHA}, got ${GITHUB_SHA}) — refusing to publish an unaudited commit"
            exit 1
          fi

      # opencodex is bun-native (the prepublishOnly audit, GUI build, and typecheck run under bun).
      - name: Setup project Bun
        uses: ./.github/actions/setup-project-bun

      # node + npm perform the actual publish. registry-url points npm at the public registry.
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"

      # Trusted Publishing (OIDC) needs npm >= 11.5.1. Node 24 runners already
      # provide a compatible npm; avoid replacing the bundled npm because global
      # npm self-updates can lose publish-time dependencies such as sigstore.
      - name: Verify npm version
        run: |
          npm_version="$(npm --version)"
          echo "npm=${npm_version}"
          # shellcheck disable=SC2016 # the node script deliberately avoids shell expansion
          node -e '
            const [major, minor] = process.argv[1].split(".").map(Number);
            if (major < 11 || (major === 11 && minor < 5)) {
              console.error(`npm ${process.argv[1]} is too old for trusted publishing; need >= 11.5.1`);
              process.exit(1);
            }
          ' "$npm_version"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Dependency audit (high severity)
        run: bun run audit:high

      - name: Verify every version source matches the requested version
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          # package.json plus the desktop sources (tauri.conf.json, Cargo.toml and the
          # opencodex-desktop Cargo.lock entry). package-desktop already refused to build on a
          # mismatch; this re-proves it on the commit that is about to publish.
          bun scripts/release-version-sources.ts check "$RELEASE_VERSION" || {
            echo "::error::a version source != requested (${RELEASE_VERSION}) — run scripts/release.ts, which moves all of them, on main first";
            exit 1;
          }

      # The exact-SHA CI gate includes the hosted Linux, Windows, and macOS
      # keyring smoke matrix. Do not duplicate its Linux bootstrap here.
      - name: Require successful Cross-platform CI for this commit
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
          NPM_DIST_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail

          case "$GITHUB_REF" in
            refs/heads/main)
              expected_tag="latest"
              if [[ "$RELEASE_VERSION" == *-* ]]; then
                echo "::error::main releases must use a stable semver version; got ${RELEASE_VERSION}"
                exit 1
              fi
              ;;
            refs/heads/preview)
              expected_tag="preview"
              if [[ "$RELEASE_VERSION" != *-preview.* ]]; then
                echo "::error::preview releases must use a preview prerelease version; got ${RELEASE_VERSION}"
                exit 1
              fi
              ;;
            *)
              echo "::error::Release must run from main or preview; got ${GITHUB_REF}"
              exit 1
              ;;
          esac

          if [ "$NPM_DIST_TAG" != "$expected_tag" ]; then
            echo "::error::${GITHUB_REF#refs/heads/} releases must publish with npm dist-tag '${expected_tag}', got '${NPM_DIST_TAG}'"
            exit 1
          fi

          ci_url="$(
            gh run list \
              --workflow ci.yml \
              --branch "${GITHUB_REF#refs/heads/}" \
              --commit "$GITHUB_SHA" \
              --event push \
              --limit 10 \
              --json conclusion,url \
              --jq '[.[] | select(.conclusion == "success")][0].url // ""'
          )"

          if [ -z "$ci_url" ]; then
            # Deliberately narrower than "any successful ci.yml run for this SHA".
            # The release branch's own push run is the one whose trigger set,
            # runner selection, and job graph match what is being published —
            # a green PR run for the same SHA ran against a merge ref with a
            # different trigger context. Accepting it here would let a publish
            # proceed while the promotion run was still pending, or had failed.
            echo "::error::No successful Cross-platform CI run found for ${GITHUB_SHA} on ${GITHUB_REF#refs/heads/} (push event). A pull-request run does not qualify. Wait for the promotion run to pass before releasing."
            gh run list --workflow ci.yml --commit "$GITHUB_SHA" --limit 10 || true
            exit 1
          fi

          echo "Cross-platform CI passed for ${GITHUB_SHA}: ${ci_url}"

          # Service baseline (lineage-relative): merged tags only, so the
          # changed-files gate compares against the last release actually
          # reachable from this commit. The release-notes baseline below uses the
          # full tag set instead, so a stable on another lineage can anchor the
          # changelog range.
          # - Preview: newest prior release of either channel (stable or preview). A
          #   preview→preview-only baseline skips a shipped stable and restates it.
          # - Stable: newest prior stable only (matching preview carry adjusts the
          #   generate-notes range separately below).
          previous_tag="$(
            git tag --merged HEAD --list 'v[0-9]*' |
              bun scripts/release-notes.ts previous-release-tag "$RELEASE_VERSION"
          )"
          if [ -n "$previous_tag" ]; then
            changed_files="$(git diff --name-only "${previous_tag}..HEAD")"
          else
            changed_files="$(git diff-tree --no-commit-id --name-only -r "$GITHUB_SHA")"
          fi

          # Keep in sync with the service-lifecycle.yml trigger paths. src/cli.ts is
          # the pre-restructure compat stub that durable launchers still execute; the
          # service implementation itself is the src/service/ directory, and the desktop
          # shell packages and launches it.
          if printf '%s\n' "$changed_files" | grep -Eq '^(src/service\.ts|src/service/.*|desktop/.*|src/cli\.ts|src/cli/index\.ts|src/lib/bun-runtime\.ts|package\.json|bun\.lock|\.github/workflows/service-lifecycle\.yml|\.github/workflows/release\.yml)$'; then
            service_url="$(
              gh run list \
                --workflow service-lifecycle.yml \
                --commit "$GITHUB_SHA" \
                --limit 10 \
                --json conclusion,headSha,url,workflowName \
                --jq '[.[] | select(.conclusion == "success")][0].url // ""'
            )"
            if [ -z "$service_url" ]; then
              echo "::error::Service-related files changed since ${previous_tag:-initial commit}, but no successful Service lifecycle run was found for ${GITHUB_SHA}."
              gh run list --workflow service-lifecycle.yml --commit "$GITHUB_SHA" --limit 10 || true
              exit 1
            fi
            echo "Service lifecycle passed for ${GITHUB_SHA}: ${service_url}"
          fi

      - name: Require dev to be ready for this release
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          git fetch --force --tags origin +refs/heads/dev:refs/remotes/origin/dev
          dev_version="$(git show origin/dev:package.json | bun -e 'console.log(JSON.parse(await Bun.stdin.text()).version)')"
          bun scripts/version-line.ts assert-ahead "$dev_version" "$RELEASE_VERSION"

      # Tokenless publish via Trusted Publishing (OIDC) — NO NPM_TOKEN secret. npm auto-detects the
      # OIDC environment (`id-token: write` above) and generates provenance automatically, so neither a
      # token nor `--provenance` is needed. `npm publish` runs prepublishOnly first (typecheck + build
      # the GUI into gui/dist), so even a dry-run fully verifies the build.
      # PREREQUISITE: configure the Trusted Publisher for this repo + workflow on npmjs.com — possible
      # only AFTER the package's first version exists (do the first publish locally, see the runbook).
      - name: Preflight release metadata
        id: metadata
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
          DRY_RUN: ${{ inputs.dry-run }}
          RESUME: ${{ inputs.resume-after-npm-publish }}
        run: |
          set -euo pipefail

          pkg_name="$(node -p "require('./package.json').name")"
          release_tag="v${RELEASE_VERSION}"
          dry_run="$DRY_RUN"

          git fetch --force --tags origin

          existing_tag_sha="$(git rev-parse -q --verify "refs/tags/${release_tag}^{commit}" || true)"
          if [ -n "$existing_tag_sha" ] && [ "$existing_tag_sha" != "$GITHUB_SHA" ]; then
            echo "::error::${release_tag} already points at ${existing_tag_sha}, not ${GITHUB_SHA}"
            exit 1
          fi

          if [ -n "$existing_tag_sha" ]; then
            if [ "$RESUME" = "true" ]; then
              echo "::notice::${release_tag} already exists at this commit; resuming"
            elif [ "$dry_run" = "true" ]; then
              echo "::notice::${release_tag} already exists at this commit; dry-run only"
            else
              echo "::error::${release_tag} already exists. Refusing to publish a version with pre-existing Git metadata."
              exit 1
            fi
          fi

          if gh release view "$release_tag" >/dev/null 2>&1; then
            if [ "$RESUME" = "true" ]; then
              echo "::notice::GitHub Release ${release_tag} already exists; resuming to complete the attachment"
            elif [ "$dry_run" = "true" ]; then
              echo "::notice::GitHub Release ${release_tag} already exists; dry-run only"
            else
              echo "::error::GitHub Release ${release_tag} already exists. Choose the next unused patch version."
              exit 1
            fi
          fi

          if [ "$RESUME" = "true" ] && [ "$dry_run" = "true" ]; then
            echo "::error::resume-after-npm-publish is a real-publication recovery path and cannot combine with dry-run"
            exit 1
          fi
          if npm view "${pkg_name}@${RELEASE_VERSION}" version >/dev/null 2>&1; then
            if [ "$RESUME" = "true" ]; then
              resume_git_head="$(timeout --kill-after=2s 10s npm view "${pkg_name}@${RELEASE_VERSION}" gitHead --json --registry=https://registry.npmjs.org --fetch-retries=0 --fetch-timeout=8000)" || {
                echo "::error::Cannot verify the existing npm package source; resume refused"
                exit 1
              }
              bun scripts/verify-release-resume.ts "$GITHUB_SHA" "$resume_git_head"
              echo "resume_sha=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
              echo "::notice::${pkg_name}@${RELEASE_VERSION} is acknowledged on npm; resuming after the recorded partial publication"
            elif [ "$dry_run" = "true" ]; then
              echo "::notice::${pkg_name}@${RELEASE_VERSION} already exists on npm; dry-run only"
            else
              echo "::error::${pkg_name}@${RELEASE_VERSION} already exists on npm. If a previous run acknowledged this publication and failed afterwards, re-dispatch with resume-after-npm-publish: true; otherwise choose the next unused patch version."
              exit 1
            fi
          elif [ "$RESUME" = "true" ]; then
            echo "::error::resume-after-npm-publish is set, but ${pkg_name}@${RELEASE_VERSION} is not on npm — there is no acknowledged publication to resume from"
            exit 1
          fi

      - name: Refuse a release the current tag set already outranks
        env:
          RELEASE_VERSION: ${{ inputs.version }}
          DRY_RUN: ${{ inputs.dry-run }}
          RESUME: ${{ inputs.resume-after-npm-publish }}
        run: |
          set -euo pipefail
          allow=""
          existing_tag_sha="$(git rev-parse -q --verify "refs/tags/v${RELEASE_VERSION}^{commit}" || true)"
          # Dry-run re-dispatches and the resume path both legitimately find the tag
          # already at this commit; a moved tag is still refused above.
          if { [ "$DRY_RUN" = "true" ] || [ "$RESUME" = "true" ]; } && [ -n "$existing_tag_sha" ] && [ "$existing_tag_sha" = "$GITHUB_SHA" ]; then
            allow="--allow-existing-tag-at-head"
          fi
          git tag --list 'v*' | bun scripts/version-line.ts assert-releasable "$RELEASE_VERSION" $allow

      - name: Build and validate release changelog
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
          NPM_DIST_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          notes_file="$GITHUB_WORKSPACE/.release-notes.md"
          bun scripts/build-release-changelog.ts \
            --version "$RELEASE_VERSION" \
            --dist-tag "$NPM_DIST_TAG" \
            --repository "$GITHUB_REPOSITORY" \
            --target "$GITHUB_SHA" \
            --out "$notes_file"
          test -s "$notes_file" || {
            echo "::error::release changelog builder produced an empty notes file"
            exit 1
          }

      - name: Publish (or dry-run)
        id: publication
        env:
          DRY_RUN: ${{ inputs.dry-run }}
          NPM_DIST_TAG: ${{ inputs.tag }}
          RESUME: ${{ inputs.resume-after-npm-publish }}
          RELEASE_VERSION: ${{ inputs.version }}
          VERIFIED_RESUME_SHA: ${{ steps.metadata.outputs.resume_sha }}
        run: |
          set -euo pipefail
          pkg_name="$(node -p "require('./package.json').name")"
          if [ "$RESUME" = "true" ]; then
            if [ -z "$VERIFIED_RESUME_SHA" ] || [ "$VERIFIED_RESUME_SHA" != "$GITHUB_SHA" ]; then
              echo "::error::Resume has no matching registry source verification; publication remains unacknowledged"
              exit 1
            fi
            # npm publication was acknowledged by the earlier run and confirmed by the
            # preflight above; completing the GitHub side must never republish.
            echo "::notice::RESUME — npm publish skipped; publication already acknowledged"
            echo "published=true" >> "$GITHUB_OUTPUT"
            echo "Publication resumed for ${pkg_name}@${RELEASE_VERSION} at ${GITHUB_SHA} (npm publish skipped; acknowledged by the earlier run)." >> "$GITHUB_STEP_SUMMARY"
          elif [ "$DRY_RUN" = "true" ]; then
            echo "::notice::DRY RUN — building + packing, not publishing"
            npm run prepublishOnly
            npm pack --dry-run
          else
            npm publish --tag "$NPM_DIST_TAG" --access public
            echo "published=true" >> "$GITHUB_OUTPUT"
            echo "Publication acknowledged for ${pkg_name}@${RELEASE_VERSION} at ${GITHUB_SHA}. If any later step in this run fails, re-dispatch with the same version and expected-sha plus resume-after-npm-publish: true — never republish this version." >> "$GITHUB_STEP_SUMMARY"
          fi

      # Publication is acknowledged before registry reads, which can lag or fail.
      # Recover only observation failures in this run; never retry npm publish.
      - name: Post-publish registry smoke
        id: registry-smoke
        if: ${{ inputs.dry-run != true && steps.publication.outputs.published == 'true' }}
        env:
          RELEASE_VERSION: ${{ inputs.version }}
          NPM_DIST_TAG: ${{ inputs.tag }}
          PUBLISHED: ${{ steps.publication.outputs.published }}
        run: |
          set -euo pipefail
          test "$PUBLISHED" = "true" || {
            echo "::error::No successful publication receipt; refusing registry recovery"
            exit 1
          }
          pkg_name="$(node -p "require('./package.json').name")"
          for attempt in $(seq 1 6); do
            if VERSION=$(timeout --kill-after=2s 10s npm view "${pkg_name}@${RELEASE_VERSION}" version --fetch-retries=0 --fetch-timeout=8000 2>/dev/null); then
              if [ "$VERSION" != "$RELEASE_VERSION" ]; then
                echo "::error::Registry returned an unexpected version; refusing to create a release"
                exit 1
              fi
              echo "registry version=$VERSION"
              echo "verification=verified" >> "$GITHUB_OUTPUT"
              echo "npm_version=confirmed" >> "$GITHUB_OUTPUT"
              echo "Registry verified ${pkg_name}@${RELEASE_VERSION}." >> "$GITHUB_STEP_SUMMARY"
              # The dist-tag is its own outcome: a version can be on the registry while the tag
              # still names the previous release.
              dist_tag_state="unconfirmed"
              if dist_tags="$(timeout --kill-after=2s 10s npm dist-tag ls "$pkg_name" --fetch-retries=0 --fetch-timeout=8000)"; then
                printf '%s\n' "$dist_tags"
                tagged="$(printf '%s\n' "$dist_tags" | awk -F': ' -v tag="$NPM_DIST_TAG" '$1 == tag { print $2; exit }')"
                if [ "$tagged" = "$RELEASE_VERSION" ]; then
                  dist_tag_state="confirmed"
                elif [ -n "$tagged" ]; then
                  dist_tag_state="mismatch"
                  echo "::warning::npm dist-tag ${NPM_DIST_TAG} points at ${tagged}, not ${RELEASE_VERSION}"
                else
                  echo "::warning::npm dist-tag ${NPM_DIST_TAG} is not listed for ${pkg_name}"
                fi
              else
                echo "::warning::Could not read npm dist-tags; exact version was verified"
              fi
              echo "npm_dist_tag=${dist_tag_state}" >> "$GITHUB_OUTPUT"
              echo "npm dist-tag ${NPM_DIST_TAG}: ${dist_tag_state}." >> "$GITHUB_STEP_SUMMARY"
              exit 0
            fi
            echo "::notice::Registry lookup not confirmed (attempt $attempt/6)"
            if [ "$attempt" -lt 6 ]; then sleep 5; fi
          done
          echo "verification=pending" >> "$GITHUB_OUTPUT"
          echo "npm_version=unconfirmed" >> "$GITHUB_OUTPUT"
          echo "npm_dist_tag=unconfirmed" >> "$GITHUB_OUTPUT"
          echo "::warning::npm publish succeeded, but registry verification remains pending; continuing GitHub release creation without republishing"
          echo "Publication acknowledged for ${pkg_name}@${RELEASE_VERSION}; registry verification pending after bounded reads. Inspect the registry before announcing availability. Do not republish this version." >> "$GITHUB_STEP_SUMMARY"

      - name: Create GitHub release
        if: ${{ inputs.dry-run != true && steps.publication.outputs.published == 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
          RESUME: ${{ inputs.resume-after-npm-publish }}
        run: |
          set -euo pipefail

          release_tag="v${RELEASE_VERSION}"
          notes_file="$GITHUB_WORKSPACE/.release-notes.md"
          test -s "$notes_file" || {
            echo "::error::validated release notes are missing; refusing to tag or create a release"
            exit 1
          }

          git fetch --force --tags origin

          existing_tag_sha="$(git rev-parse -q --verify "refs/tags/${release_tag}^{commit}" || true)"
          if [ -n "$existing_tag_sha" ] && [ "$existing_tag_sha" != "$GITHUB_SHA" ]; then
            echo "::error::${release_tag} already points at ${existing_tag_sha}, not ${GITHUB_SHA}"
            exit 1
          fi

          prerelease_flag=""
          if [[ "$RELEASE_VERSION" == *-preview.* ]]; then
            prerelease_flag="--prerelease"
          fi

          if [ -z "$existing_tag_sha" ]; then
            git tag "$release_tag" "$GITHUB_SHA"
            git push origin "refs/tags/${release_tag}"
          fi

          # Idempotent only for the resume path: a previous run may already have
          # created the release and then failed before the assets were attached.
          # Outside resume, finding a release here means the preflight was bypassed
          # or the release appeared mid-run, and that stays a hard failure.
          if gh release view "$release_tag" >/dev/null 2>&1; then
            if [ "$RESUME" = "true" ]; then
              echo "::notice::GitHub Release ${release_tag} already exists; reusing it for attachment"
            else
              echo "::error::GitHub Release ${release_tag} already exists; refusing to reuse it outside the resume path"
              exit 1
            fi
          else
            # Draft first. Publication freezes a release under GitHub's immutable
            # releases, so attach-release attaches the verified bundle to the draft
            # and publishes it afterwards.
            gh release create "$release_tag" --draft --target "$GITHUB_SHA" --title "$release_tag" \
              --notes-file "$notes_file" ${prerelease_flag:+$prerelease_flag}
          fi