finalize-release.yml

name: Finalize release after Homebrew

on:
  pull_request:
    types: [closed]
    paths:
      - Formula/microbridge.rb

permissions:
  contents: read

jobs:
  resolve:
    if: >-
      github.event.pull_request.merged == true &&
      github.event.pull_request.base.ref == 'main' &&
      startsWith(github.event.pull_request.head.ref, 'chore/brew-v')
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.release.outputs.tag }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - id: release
        env:
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          set -euo pipefail
          TAG="${HEAD_REF#chore/brew-}"
          [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"

  public-install:
    name: clean public install (${{ matrix.arch }})
    needs: resolve
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15
            arch: arm64
          - os: macos-15-intel
            arch: x86_64
    steps:
      - name: Install from public tap and exercise app/service lifecycle
        env:
          VERSION: ${{ needs.resolve.outputs.version }}
          EXPECTED_ARCH: ${{ matrix.arch }}
        run: |
          set -euo pipefail
          export HOMEBREW_NO_COLOR=1
          test "$(uname -m)" = "$EXPECTED_ARCH"
          brew tap DevVig/microbridge https://github.com/DevVig/microbridge
          brew update
          HOMEBREW_NO_INSTALL_CLEANUP=1 brew install DevVig/microbridge/microbridge
          test "$(brew info --json=v2 DevVig/microbridge/microbridge | jq -r '.formulae[0].installed[0].version')" = "$VERSION"
          microbridgectl help | grep -q Usage
          APP="$HOME/Applications/Microbridge.app"
          MARKER="$HOME/Applications/.Microbridge.app.microbridge-brew"
          LEGACY_MARKER="$APP/.microbridge-brew"
          test -x "$(brew --prefix DevVig/microbridge/microbridge)/bin/microbridged"
          microbridge-app install
          for _ in {1..30}; do
            [[ -f "$MARKER" ]] && break
            sleep 1
          done
          test -f "$MARKER"
          test ! -e "$LEGACY_MARKER"
          test "$(/usr/libexec/PlistBuddy -c 'Print:CFBundleShortVersionString' "$APP/Contents/Info.plist")" = "$VERSION"
          codesign --verify --deep --strict --verbose=4 "$APP"
          spctl --assess --type execute --verbose=4 "$APP"
          xcrun stapler validate "$APP"
          syspolicy_check distribution "$APP"
          APP_EXECUTABLE="$APP/Contents/MacOS/microbridge-ui"
          APP_LOG="$RUNNER_TEMP/microbridge-app.log"
          APP_PID=""
          for _ in {1..30}; do
            APP_PID="$(pgrep -f "^${APP_EXECUTABLE}$" | head -n1 || true)"
            [[ -n "$APP_PID" ]] && break
            sleep 1
          done
          if [[ -z "$APP_PID" ]] || ! kill -0 "$APP_PID"; then
            cat "$APP_LOG"
            exit 1
          fi
          microbridgectl status >"$APP_LOG"
          kill "$APP_PID" || true
          wait "$APP_PID" || true
          APP_DAEMON_STOPPED=0
          for _ in {1..30}; do
            if ! microbridgectl status >/dev/null 2>&1; then
              APP_DAEMON_STOPPED=1
              break
            fi
            sleep 1
          done
          test "$APP_DAEMON_STOPPED" -eq 1
          # Verify the separately opted-in headless service after the normal
          # app-owned lifecycle.
          brew services start DevVig/microbridge/microbridge
          SERVICE_STATE=""
          for _ in {1..30}; do
            SERVICE_STATE="$(brew services list --json | jq -r 'map(select(.name=="microbridge")) | .[0].status // empty')"
            [[ "$SERVICE_STATE" == "started" || "$SERVICE_STATE" == "scheduled" ]] && break
            sleep 1
          done
          if [[ "$SERVICE_STATE" != "started" && "$SERVICE_STATE" != "scheduled" ]]; then
            brew services list
            tail -200 "$(brew --prefix)/var/log/microbridge.log" || true
            exit 1
          fi
          brew services stop DevVig/microbridge/microbridge
          microbridge-app uninstall
          HOMEBREW_NO_INSTALL_CLEANUP=1 brew uninstall DevVig/microbridge/microbridge
          if brew services list --json | jq -e '.[] | select(.name=="microbridge")' >/dev/null; then
            echo "microbridge service is still registered after uninstall" >&2
            exit 1
          fi
          test ! -e "$APP"
          test ! -e "$MARKER"

  promote:
    name: promote verified release
    needs: [resolve, public-install]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Mark release final and record public availability
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.resolve.outputs.tag }}
        run: |
          set -euo pipefail
          BODY_FILE="$RUNNER_TEMP/release-body.md"
          gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json body --jq .body > "$BODY_FILE"
          python3 - "$BODY_FILE" <<'PY'
          from pathlib import Path
          import sys

          path = Path(sys.argv[1])
          body = path.read_text()
          body = body.replace(
              "Signed artifacts are published as a prerelease. This version is not\n"
              "promoted to a final release until the Homebrew formula PR merges and\n"
              "clean public-tap installations pass on Apple Silicon and Intel.",
              "Signed artifacts and the Homebrew formula are publicly available. "
              "Clean installs passed on Apple Silicon and Intel.",
          )
          body = body.replace(
              "Homebrew publication is pending; this release remains a prerelease.",
              "Homebrew installation is publicly available and verified on Apple Silicon and Intel.",
          )
          body = body.replace(
              "## Direct download (prerelease assets available now)",
              "## Direct download",
          )
          body = body.replace(
              "## Homebrew (available after the formula PR merges)",
              "## Homebrew (publicly available)",
          )
          path.write_text(body)
          PY
          gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --prerelease=false --latest --notes-file "$BODY_FILE"
          {
            echo "## Release finalized"
            echo "GitHub assets: published"
            echo "Homebrew formula: merged"
            echo "Clean public installs: Apple Silicon and Intel passed"
            echo "Release: https://github.com/$GITHUB_REPOSITORY/releases/tag/$TAG"
          } >> "$GITHUB_STEP_SUMMARY"