release.yml

name: release
run-name: Release ${{ startsWith(github.event.client_payload.version || inputs.version, 'v') && (github.event.client_payload.version || inputs.version) || format('v{0}', github.event.client_payload.version || inputs.version) }}

on:
  repository_dispatch:
    types: [maestro-signed-release]
  workflow_dispatch:
    inputs:
      version:
        description: Semver (with or without leading v)
        required: true

permissions:
  contents: read
concurrency:
  # Normalize manual and repository dispatch versions to one immutable tag.
  # Serialize equivalent versions so those paths cannot publish twice.
  group: ${{ github.workflow }}-${{ startsWith(github.event.client_payload.version || inputs.version, 'v') && (github.event.client_payload.version || inputs.version) || format('v{0}', github.event.client_payload.version || inputs.version) }}
  cancel-in-progress: false

jobs:
  prepare:
    if: github.repository == 'dx-corp/code' && github.ref == 'refs/heads/main'
    runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      package_name: ${{ steps.release.outputs.package_name }}
      release_sha: ${{ steps.release.outputs.release_sha }}
      release_tag: ${{ steps.release.outputs.release_tag }}
      release_version: ${{ steps.release.outputs.release_version }}
      release_channel: ${{ steps.release.outputs.release_channel }}
      npm_tag: ${{ steps.release.outputs.npm_tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - id: release
        name: Resolve immutable release tag
        env:
          EVENT_NAME: ${{ github.event_name }}
          REQUESTED: ${{ github.event.client_payload.version || github.event.inputs.version || github.ref_name }}
          TRIGGER_SHA: ${{ github.sha }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          release_version="${REQUESTED#v}"
          if [[ ! "$release_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::Requested release version '$REQUESTED' is not semver."
            exit 1
          fi

          release_tag="v${release_version}"
          release_channel="$(node scripts/resolve-release-channel.mjs --version "$release_version")"
          npm_tag="${release_channel}"
          if [[ "$release_channel" == "stable" ]]; then
            npm_tag=latest
          fi
          release_sha="$TRIGGER_SHA"
          if [[ "$EVENT_NAME" == "workflow_dispatch" || "$EVENT_NAME" == "repository_dispatch" ]]; then
            for attempt in 1 2 3; do
              if timeout 60s git \
                -c http.lowSpeedLimit=1000 \
                -c http.lowSpeedTime=30 \
                fetch --force --no-tags origin "refs/tags/${release_tag}:refs/tags/${release_tag}"; then
                break
              fi
              if [[ "$attempt" -eq 3 ]]; then
                echo "::error::Unable to fetch ${release_tag} after ${attempt} bounded attempts."
                exit 1
              fi
              sleep 2
            done
            release_sha="$(git rev-list -n 1 "$release_tag")"
          elif [[ "$EVENT_NAME" != "push" ]]; then
            echo "::error::Unsupported release event ${EVENT_NAME}."
            exit 1
          fi
          if [[ ! "$release_sha" =~ ^[0-9a-f]{40}$ ]]; then
            echo "::error::Release source ${release_sha} is not an immutable commit SHA."
            exit 1
          fi

          # Secrets require source admitted to protected main or a fully protected release branch.
          # A contents-write dispatch must not execute scripts from an arbitrary tag.
          timeout 60s git fetch --no-tags origin main
          if ! git merge-base --is-ancestor "$release_sha" FETCH_HEAD; then
            release_branch="releases/${release_tag}"
            rules="$(timeout 60s gh api "repos/dx-corp/code/rules/branches/releases%2F${release_tag}")"
            jq -e '
              any(.[]; .type == "pull_request") and
              any(.[]; .type == "non_fast_forward") and
              any(.[]; .type == "deletion") and
              any(.[]; .type == "required_linear_history") and
              any(.[]; .type == "required_status_checks" and
                .parameters.strict_required_status_checks_policy == true and
                any(.parameters.required_status_checks[]; .context == "require-internal-pr" and .integration_id == 15368) and
                any(.parameters.required_status_checks[]; .context == "unresolved-review-threads / unresolved-review-threads" and .integration_id == 15368) and
                any(.parameters.required_status_checks[]; .context == "maestro-ci" and .integration_id == 15368))
            ' <<<"$rules" >/dev/null
            timeout 60s git fetch --no-tags origin "refs/heads/$release_branch"
          fi
          git merge-base --is-ancestor "$release_sha" FETCH_HEAD
          git checkout --detach "$release_sha"
          package_version="$(node -p "require('./package.json').version")"
          package_name="$(node -p "require('./package.json').name")"
          if [[ "$package_version" != "$release_version" ]]; then
            echo "::error::${release_tag} contains package version ${package_version}, not ${release_version}."
            exit 1
          fi

          {
            echo "package_name=$package_name"
            echo "release_sha=$release_sha"
            echo "release_tag=$release_tag"
            echo "release_version=$release_version"
            echo "release_channel=$release_channel"
            echo "npm_tag=$npm_tag"
          } >> "$GITHUB_OUTPUT"

  identity-readiness:
    needs: prepare
    runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 3
    environment: npm-release
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
          sparse-checkout: .github/workflows
      - name: Authenticate to the release-test Secret Manager lane
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: ${{ vars.MAESTRO_RELEASE_TEST_GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.MAESTRO_RELEASE_TEST_GCP_SERVICE_ACCOUNT }}
          create_credentials_file: true
          export_environment_variables: true
      - name: Rotate and verify release-test Identity session
        env:
          MAESTRO_RELEASE_TEST_SESSION_SECRET: ${{ vars.MAESTRO_RELEASE_TEST_SESSION_SECRET }}
          MAESTRO_RELEASE_TEST_ORG_ID: ${{ vars.MAESTRO_RELEASE_TEST_ORG_ID }}
          MAESTRO_RELEASE_TEST_WORKSPACE_ID: ${{ vars.MAESTRO_RELEASE_TEST_WORKSPACE_ID }}
          MAESTRO_RELEASE_TEST_SUBJECT: ${{ vars.MAESTRO_RELEASE_TEST_SUBJECT }}
        run: node .github/workflows/refresh-release-identity.mjs
      - name: Verify release-test Identity session
        env:
          MAESTRO_EVALOPS_ORG_ID: ${{ vars.MAESTRO_RELEASE_TEST_ORG_ID }}
        run: node .github/workflows/check-release-identity.mjs

  binaries:
    needs: prepare
    runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 15
    permissions:
      # GitHub requires push access to read unpublished draft releases.
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.prepare.outputs.release_sha }}
      - name: Install cosign
        run: |
          set -euo pipefail
          cosign_version="2.6.1"
          cosign_sha256="064954c5d8c7e3b28188eee5b1727b31c411550bc5fefd41aa672d3c761d103a"
          mkdir -p "$RUNNER_TEMP/cosignbin"
          curl -fsSL --max-time 180 --retry 2 --retry-delay 5 \
            -o "$RUNNER_TEMP/cosignbin/cosign" \
            "https://github.com/sigstore/cosign/releases/download/v${cosign_version}/cosign-linux-amd64"
          echo "${cosign_sha256}  $RUNNER_TEMP/cosignbin/cosign" | sha256sum -c -
          chmod +x "$RUNNER_TEMP/cosignbin/cosign"
          echo "$RUNNER_TEMP/cosignbin" >> "$GITHUB_PATH"
      - name: Download signed Mono artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
        run: |
          set -euo pipefail
          mkdir release-binaries
          timeout 300s gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --dir release-binaries \
            --pattern MONO_SHA256SUMS --pattern MONO_SHA256SUMS.cosign.bundle --pattern release-metadata.json --pattern release-source-manifest.json \
            --pattern maestro-linux-x64 --pattern maestro-linux-arm64 --pattern maestro-darwin-x64 --pattern maestro-darwin-arm64 --pattern 'runtime-passport-maestro-*.json' \
            --pattern 'code-device-*.json' --pattern 'deixic-code-device-*.app.tar.gz' --pattern 'smoked-*.txt' --pattern 'rustc-*.txt' --pattern 'signed-*.json' --pattern 'notarized-*.json'
      - name: Authenticate artifacts and release receipts
        env:
          RELEASE_VERSION: ${{ needs.prepare.outputs.release_version }}
        run: |
          set -euo pipefail
          node scripts/verify-staged-release.mjs release-binaries "$RELEASE_VERSION"
          # Also enforce marker authentication here when dispatching an older tag
          # whose source verifier predates the optional capability contract.
          for platform in darwin-x64 darwin-arm64; do
            (
              cd release-binaries
              grep -E "^[a-f0-9]{64}  code-device-${platform}\.json$" MONO_SHA256SUMS | sha256sum --check --strict
              if [[ "$(jq -r '.enabled' "code-device-${platform}.json")" != true && -e "deixic-code-device-${platform}.app.tar.gz" ]]; then
                echo "::error::Disabled Code device helper must not be present in release assets."
                exit 1
              fi
            )
          done
          chmod +x release-binaries/maestro-linux-* release-binaries/maestro-darwin-*
          for platform in darwin-x64 darwin-arm64; do
            if [[ "$(jq -r '.enabled' "release-binaries/code-device-${platform}.json")" == true ]]; then
              tar -xzf "release-binaries/deixic-code-device-${platform}.app.tar.gz" -C release-binaries
            fi
          done
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: maestro-verified-native
          path: release-binaries/*

  publish:
    needs:
      - prepare
      - binaries
      - identity-readiness
    # Public free hosted minutes by default. Do not point this at private
    # self-hosted labels unless the runner group allows public repos.
    runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 60
    environment: npm-release
    permissions:
      contents: read
      # Required for npm trusted publishing (OIDC). Last successful
      # @evalops/maestro publish used GitHub OIDC, not classic NPM_TOKEN.
      id-token: write
    outputs:
      package_name: ${{ needs.prepare.outputs.package_name }}
      release_tag: ${{ needs.prepare.outputs.release_tag }}
      release_version: ${{ needs.prepare.outputs.release_version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.prepare.outputs.release_sha }}
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0
        with:
          pattern: maestro-*
          path: release-binaries
          merge-multiple: true
      - name: Verify native package inputs
        env:
          RELEASE_VERSION: ${{ needs.prepare.outputs.release_version }}
        run: |
          set -euo pipefail
          test "$(node -p "require('./package.json').version")" = "$RELEASE_VERSION"
          npm run check:rust-only-runtime
      - name: Materialize native npm package
        run: node scripts/materialize-native-package.mjs --input-dir release-binaries
      - id: pack
        run: |
          PACK_JSON=$(npm pack --json)
          echo "$PACK_JSON"
          node -e 'const fs=require("node:fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); p.name="@evalops/maestro"; fs.writeFileSync("package.json", JSON.stringify(p, null, "\t")+"\n")'
          ALIAS_PACK_JSON=$(npm pack --json)
          echo "$ALIAS_PACK_JSON"
          git checkout -- package.json
          {
            echo "tarball=$(echo "$PACK_JSON" | jq -r '.[0].filename')"
            echo "integrity=$(echo "$PACK_JSON" | jq -r '.[0].integrity')"
            echo "alias_tarball=$(echo "$ALIAS_PACK_JSON" | jq -r '.[0].filename')"
            echo "alias_integrity=$(echo "$ALIAS_PACK_JSON" | jq -r '.[0].integrity')"
          } >> "$GITHUB_OUTPUT"
      - name: Smoke packed package without JS runtime
        env:
          MAESTRO_REQUIRE_PACKAGED_TUI: "1"
          NPM_CONFIG_FETCH_RETRIES: "1"
          NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: "2000"
          NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: "1000"
          NPM_CONFIG_FETCH_TIMEOUT: "30000"
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org
          PACKED_TARBALL: ${{ steps.pack.outputs.tarball }}
        run: node scripts/smoke-packed-cli.js "$PACKED_TARBALL"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          retention-days: 14
          name: npm-tarball-${{ needs.prepare.outputs.release_tag }}
          overwrite: true
          path: |
            ${{ steps.pack.outputs.tarball }}
            ${{ steps.pack.outputs.alias_tarball }}
      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          PACKAGE_NAME: ${{ needs.prepare.outputs.package_name }}
          ALIAS_PACKAGE_NAME: "@evalops/maestro"
          PACKED_INTEGRITY: ${{ steps.pack.outputs.integrity }}
          ALIAS_PACKED_INTEGRITY: ${{ steps.pack.outputs.alias_integrity }}
          RELEASE_VERSION: ${{ needs.prepare.outputs.release_version }}
          NPM_TAG: ${{ needs.prepare.outputs.npm_tag }}
          TARBALL: ${{ steps.pack.outputs.tarball }}
          ALIAS_TARBALL: ${{ steps.pack.outputs.alias_tarball }}
          NPM_CONFIG_FETCH_RETRIES: "1"
          NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: "2000"
          NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: "1000"
          NPM_CONFIG_FETCH_TIMEOUT: "30000"
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org
        run: |
          set -euo pipefail

          # Trusted publishing (OIDC) is the primary path for @evalops/maestro.
          # Classic NPM_TOKEN is fallback only; a dead token returns E404 on PUT.
          publish_with_oidc() {
            local tarball="$1"
            # npm ≥ 11.5.1 required for OIDC; pin via npx for stable behavior.
            npx --yes npm@11.10.0 publish "$tarball" --access public --tag "$NPM_TAG" --registry "$NPM_CONFIG_REGISTRY"
          }

          publish_with_token() {
            local tarball="$1"
            if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then
              echo "::error::OIDC publish failed and secrets.NPM_TOKEN is empty. Configure npm trusted publishing for dx-corp/code release.yml (npm-release env) and ensure this job has id-token: write, or set a granular NPM_TOKEN with write on @evalops/maestro."
              return 1
            fi

            printf "//registry.npmjs.org/:_authToken=%s\n" "$NODE_AUTH_TOKEN" > "$RUNNER_TEMP/npmrc"
            NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/npmrc" \
              NODE_AUTH_TOKEN="$NODE_AUTH_TOKEN" \
              npx --yes npm@11.10.0 publish "$tarball" --access public --tag "$NPM_TAG" --registry "$NPM_CONFIG_REGISTRY"
          }

          verify_published_tarball() {
            local package_name="$1"
            local packed_integrity="$2"
            local registry_integrity
            registry_integrity="$(
              command npm view "${package_name}@${RELEASE_VERSION}" --registry "$NPM_CONFIG_REGISTRY" dist.integrity 2>/dev/null
            )" || registry_integrity=""
            if [[ -z "$registry_integrity" ]]; then
              # Immutable version metadata can arrive before the package index.
              registry_integrity="$(node --input-type=module - "$package_name" "$RELEASE_VERSION" <<'NODE'
          const [name, version] = process.argv.slice(2);
          const url = `https://registry.npmjs.org/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
          const response = await fetch(url, { signal: AbortSignal.timeout(30000), redirect: "error" });
          if (!response.ok) process.exit(1);
          const metadata = await response.json();
          if (metadata.name !== name || metadata.version !== version || typeof metadata.dist?.integrity !== "string") process.exit(1);
          console.log(metadata.dist.integrity);
          NODE
              )" || return 1
            fi

            if [[ -z "$registry_integrity" ]]; then
              return 1
            fi
            if [[ "$registry_integrity" != "$packed_integrity" ]]; then
              echo "::error::npm already contains ${package_name}@${RELEASE_VERSION} with integrity ${registry_integrity}, not ${packed_integrity}."
              return 2
            fi
            echo "Verified ${package_name}@${RELEASE_VERSION} already contains the packed tarball."
          }

          wait_for_registry() {
            local package_name="$1"
            local packed_integrity="$2"
            local registry_integrity=""
            local attempt remaining
            local deadline=$((SECONDS + 300))
            for attempt in {1..60}; do
              remaining=$((deadline - SECONDS))
              if [[ "$remaining" -le 0 ]]; then break; fi
              registry_integrity="$(timeout "${remaining}s" npm view "${package_name}@${RELEASE_VERSION}" --registry "$NPM_CONFIG_REGISTRY" dist.integrity 2>/dev/null)" || registry_integrity=""
              if [[ "$registry_integrity" == "$packed_integrity" ]]; then
                return 0
              fi
              if [[ -n "$registry_integrity" ]]; then
                echo "::error::Registry integrity mismatch for ${package_name}@${RELEASE_VERSION}."
                return 2
              fi
              remaining=$((deadline - SECONDS))
              if [[ "$remaining" -le 5 ]]; then break; fi
              if [[ "$attempt" -lt 60 ]]; then sleep 5; fi
            done
            echo "::error::Registry metadata did not propagate for ${package_name}@${RELEASE_VERSION}; rerun after it is readable."
            return 1
          }

          publish_or_verify() {
            local publisher="$1"
            local package_name="$2"
            local tarball="$3"
            local packed_integrity="$4"
            local publish_status=0
            local registry_status=0

            "$publisher" "$tarball" || publish_status=$?
            if [[ "$publish_status" -eq 0 ]]; then
              return 0
            fi

            verify_published_tarball "$package_name" "$packed_integrity" || registry_status=$?
            if [[ "$registry_status" -eq 0 ]]; then
              return 0
            fi
            if [[ "$registry_status" -eq 2 ]]; then
              return 2
            fi
            return "$publish_status"
          }

          publish_package() {
            local package_name="$1"
            local tarball="$2"
            local packed_integrity="$3"
            local registry_status=0
            verify_published_tarball "$package_name" "$packed_integrity" || registry_status=$?
            if [[ "$registry_status" -eq 0 ]]; then
              return 0
            fi
            if [[ "$registry_status" -eq 2 ]]; then
              return 2
            fi
            if publish_or_verify publish_with_oidc "$package_name" "$tarball" "$packed_integrity"; then
              return 0
            fi
            echo "::warning::OIDC trusted publish failed for ${package_name}; trying secrets.NPM_TOKEN fallback."
            publish_or_verify publish_with_token "$package_name" "$tarball" "$packed_integrity"
          }

          # shellcheck disable=SC2153 # Values are supplied by the step env block.
          publish_package "$PACKAGE_NAME" "$TARBALL" "$PACKED_INTEGRITY"
          wait_for_registry "$PACKAGE_NAME" "$PACKED_INTEGRITY"
          publish_package "$ALIAS_PACKAGE_NAME" "$ALIAS_TARBALL" "$ALIAS_PACKED_INTEGRITY"
          wait_for_registry "$ALIAS_PACKAGE_NAME" "$ALIAS_PACKED_INTEGRITY"
  github-release:
    needs:
      - prepare
      - binaries
      - publish
      - post-publish-canary
    runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 15
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.prepare.outputs.release_sha }}
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0
        with:
          name: npm-tarball-${{ needs.prepare.outputs.release_tag }}
          path: release-assets
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0
        with:
          pattern: maestro-*
          path: release-assets
          merge-multiple: true
      - name: Install cosign
        run: |
          set -euo pipefail
          cosign_version="2.6.1"
          cosign_sha256="064954c5d8c7e3b28188eee5b1727b31c411550bc5fefd41aa672d3c761d103a"
          mkdir -p "$RUNNER_TEMP/cosignbin"
          curl -fsSL --max-time 180 --retry 2 --retry-delay 5 \
            -o "$RUNNER_TEMP/cosignbin/cosign" \
            "https://github.com/sigstore/cosign/releases/download/v${cosign_version}/cosign-linux-amd64"
          echo "${cosign_sha256}  $RUNNER_TEMP/cosignbin/cosign" | sha256sum -c -
          chmod +x "$RUNNER_TEMP/cosignbin/cosign"
          echo "$RUNNER_TEMP/cosignbin" >> "$GITHUB_PATH"
      - name: Create signed channel metadata
        env:
          CHANNEL_KEY_ID: ${{ needs.prepare.outputs.release_channel == 'stable' && 'stable-2026-08-0c3df2ac' || 'preview-2026-08-912a0dab' }}
          MAESTRO_CHANNEL_PRIVATE_KEY: ${{ needs.prepare.outputs.release_channel == 'stable' && secrets.MAESTRO_STABLE_CHANNEL_PRIVATE_KEY || secrets.MAESTRO_PREVIEW_CHANNEL_PRIVATE_KEY }}
          RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }}
          RELEASE_SHA: ${{ needs.prepare.outputs.release_sha }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
          RELEASE_VERSION: ${{ needs.prepare.outputs.release_version }}
        run: |
          set -euo pipefail
          # Preserve the authenticated Mono source and native passports.
          # Public packaging must not relabel a binary with the mirror commit SHA.
          RELEASE_SHA="$(jq -r '.receipt.sourceSha' release-assets/release-metadata.json)"
          cp release-assets/release-metadata.json release-assets/version.json
          node scripts/create-release-channel-manifest.mjs \
            --version "$RELEASE_VERSION" \
            --channel "$RELEASE_CHANNEL" \
            --key-id "$CHANNEL_KEY_ID" \
            --release-url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${RELEASE_TAG}" \
            --metadata-url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${RELEASE_TAG}/release-metadata.json" \
            --metadata-file release-assets/release-metadata.json \
            --source-sha "$RELEASE_SHA" \
            --out release-assets/channel-manifest.json
          cp release-assets/channel-manifest.json release-assets/manifest.json
      - name: Sign native release assets
        working-directory: release-assets
        run: |
          set -euo pipefail
          files=(
            maestro-darwin-arm64
            maestro-darwin-x64
            maestro-linux-arm64
            maestro-linux-x64
          )
          files+=(release-metadata.json version.json channel-manifest.json manifest.json)
          files+=(runtime-passport-maestro-*.json code-device-*.json)
          for platform in darwin-x64 darwin-arm64; do
            if [[ "$(jq -r '.enabled' "code-device-${platform}.json")" == true ]]; then
              files+=("deixic-code-device-${platform}.app.tar.gz")
            fi
          done
          sha256sum "${files[@]}" > SHA256SUMS
          cosign sign-blob --yes --bundle SHA256SUMS.cosign.bundle SHA256SUMS
          for binary in maestro-darwin-arm64 maestro-darwin-x64 maestro-linux-arm64 maestro-linux-x64; do
            cosign sign-blob --yes --bundle "${binary}.cosign.bundle" "$binary"
          done
          for passport in runtime-passport-maestro-*.json; do
            cosign sign-blob --yes --bundle "${passport}.cosign.bundle" "$passport"
          done
      - name: Verify release tag has not moved
        env:
          EXPECTED_RELEASE_SHA: ${{ needs.prepare.outputs.release_sha }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
        run: |
          set -euo pipefail
          for attempt in 1 2 3; do
            if timeout 60s git \
              -c http.lowSpeedLimit=1000 \
              -c http.lowSpeedTime=30 \
              fetch --force --no-tags origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"; then
              break
            fi
            if [[ "$attempt" -eq 3 ]]; then
              echo "::error::Unable to verify ${RELEASE_TAG} after ${attempt} bounded attempts."
              exit 1
            fi
            sleep 2
          done
          current_release_sha="$(git rev-list -n 1 "$RELEASE_TAG")"
          if [[ "$current_release_sha" != "$EXPECTED_RELEASE_SHA" ]]; then
            echo "::error::${RELEASE_TAG} moved from ${EXPECTED_RELEASE_SHA} to ${current_release_sha}; refusing to create a mismatched release."
            exit 1
          fi
      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64
        with:
          tag_name: ${{ needs.prepare.outputs.release_tag }}
          name: Maestro ${{ needs.prepare.outputs.release_version }}
          generate_release_notes: true
          draft: false
          prerelease: ${{ needs.prepare.outputs.release_channel != 'stable' }}
          make_latest: ${{ needs.prepare.outputs.release_channel == 'stable' }}
          files: |
            release-assets/*.json
            release-assets/*.tgz
            release-assets/*.tar.gz
            release-assets/*.txt
            release-assets/*SUMS
            release-assets/*.bundle
            release-assets/maestro-linux-arm64
            release-assets/maestro-linux-x64
            release-assets/maestro-darwin-arm64
            release-assets/maestro-darwin-x64
  post-publish-canary:
    environment: npm-release
    needs:
      - prepare
      - publish
    runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.prepare.outputs.release_sha }}
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org
      - name: Check out protected workflow helpers
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
          path: .release-workflow
          sparse-checkout: .github/workflows
      - name: Authenticate to the release-test Secret Manager lane
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: ${{ vars.MAESTRO_RELEASE_TEST_GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.MAESTRO_RELEASE_TEST_GCP_SERVICE_ACCOUNT }}
          create_credentials_file: true
          export_environment_variables: true
      - name: Rotate release-test Identity session
        env:
          MAESTRO_RELEASE_TEST_SESSION_SECRET: ${{ vars.MAESTRO_RELEASE_TEST_SESSION_SECRET }}
          MAESTRO_RELEASE_TEST_ORG_ID: ${{ vars.MAESTRO_RELEASE_TEST_ORG_ID }}
          MAESTRO_RELEASE_TEST_WORKSPACE_ID: ${{ vars.MAESTRO_RELEASE_TEST_WORKSPACE_ID }}
          MAESTRO_RELEASE_TEST_SUBJECT: ${{ vars.MAESTRO_RELEASE_TEST_SUBJECT }}
        run: node .release-workflow/.github/workflows/refresh-release-identity.mjs
      - name: Verify published package from npm
        env:
          CLI_COMMAND: maestro
          MAESTRO_EVALOPS_ORG_ID: ${{ vars.MAESTRO_RELEASE_TEST_ORG_ID }}
          MAESTRO_INSTALL_AUDIT_LEVEL: critical
          MAESTRO_PUBLISHED_REPLAY_SANDBOX_MODE: local
          MAESTRO_REGISTRY_SMOKE_EVIDENCE_DIR: published-replay-evidence
          MAESTRO_REGISTRY_POLL_ATTEMPTS: "120"
          MAESTRO_REGISTRY_POLL_DELAY_MS: "5000"
          NPM_CONFIG_FETCH_RETRIES: "1"
          NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: "2000"
          NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: "1000"
          NPM_CONFIG_FETCH_TIMEOUT: "30000"
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org
          PACKAGE_NAME: ${{ needs.prepare.outputs.package_name }}
          RELEASE_VERSION: ${{ needs.prepare.outputs.release_version }}
        run: |
          set -euo pipefail
          node scripts/smoke-registry-install.js \
            --package "$PACKAGE_NAME" \
            --version "$RELEASE_VERSION" \
            --cli-command "$CLI_COMMAND"
      - name: Validate published replay evidence
        run: node scripts/verify-published-replay-evidence.js --evidence-dir published-replay-evidence
      - name: Upload published replay evidence
        if: ${{ always() && hashFiles('published-replay-evidence/*.json') != '' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          retention-days: 14
          name: published-replay-evidence-${{ needs.prepare.outputs.release_tag }}
          overwrite: true
          path: published-replay-evidence/*.json