release.yml

# This file is maintained alongside dist-workspace.toml.
# The user triggers a real release by pushing a version tag; ordinary pushes run the plan check only.

name: Release

permissions:
  contents: read

on:
  push:
  pull_request:

env:
  CARGO_DIST_VERSION: "0.31.0"

jobs:
  release-policy:
    name: release policy
    runs-on: ubuntu-22.04
    outputs:
      lane: ${{ steps.lane.outputs.lane }}
      tag: ${{ steps.lane.outputs.tag }}
      version: ${{ steps.lane.outputs.version }}
      build_artifacts: ${{ steps.lane.outputs.build_artifacts }}
      publishes: ${{ steps.lane.outputs.publishes }}
      publish_github_release: ${{ steps.lane.outputs.publish_github_release }}
      publish_homebrew: ${{ steps.lane.outputs.publish_homebrew }}
      publish_npm: ${{ steps.lane.outputs.publish_npm }}
      requires_macos_signing: ${{ steps.lane.outputs.requires_macos_signing }}
      requires_windows_signing: ${{ steps.lane.outputs.requires_windows_signing }}
      requires_attestation: ${{ steps.lane.outputs.requires_attestation }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - id: lane
        name: Classify release lane
        shell: bash
        run: |
          node release/trust/release-trust.mjs lane \
            --ref "$GITHUB_REF" \
            --repo "$GITHUB_REPOSITORY" \
            --out release-lane.json \
            --github-output "$GITHUB_OUTPUT"
      - name: Validate release tag, version, and changelog policy
        shell: bash
        run: |
          node release/trust/release-trust.mjs validate \
            --ref "$GITHUB_REF" \
            --repo "$GITHUB_REPOSITORY"
      - name: Upload release lane metadata
        uses: actions/upload-artifact@v4
        with:
          name: release-lane
          path: release-lane.json

  release-preflight:
    name: release trust preflight
    if: needs.release-policy.outputs.build_artifacts == 'true'
    needs:
      - release-policy
    runs-on: ubuntu-22.04
    env:
      APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }}
      APPLE_CERT_PWD: ${{ secrets.APPLE_CERT_PWD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_APP_PWD: ${{ secrets.APPLE_APP_PWD }}
      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      NPM_TRUSTED_PUBLISHING: ${{ vars.NPM_TRUSTED_PUBLISHING }}
      WINDOWS_CERT_PFX: ${{ secrets.WINDOWS_CERT_PFX }}
      WINDOWS_CERT_PWD: ${{ secrets.WINDOWS_CERT_PWD }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Fail closed for official missing trust material
        shell: bash
        run: |
          node release/trust/release-trust.mjs preflight \
            --ref "$GITHUB_REF" \
            --repo "$GITHUB_REPOSITORY"

  dist-plan:
    name: dist plan
    runs-on: ubuntu-22.04
    needs:
      - release-policy
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Install dist
        shell: bash
        run: |
          curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh
      - name: Plan release artifacts
        shell: bash
        run: |
          # Planning is read-only on branches, pull requests, and release tags.
          # Only publish-github-release owns GitHub Release mutations.
          dist plan --output-format=json > dist-plan.json
          jq . dist-plan.json > /dev/null
      - name: Upload dist plan
        uses: actions/upload-artifact@v4
        with:
          name: dist-plan
          path: dist-plan.json

  release-verify:
    name: release verify
    if: needs.release-policy.outputs.build_artifacts == 'true'
    needs:
      - release-policy
      - release-preflight
      - dist-plan
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          # Full release verification validates checked Watchkeeper evidence
          # against the runner at its recorded source revision.
          fetch-depth: 0
          persist-credentials: false
      - name: Install verification prerequisites
        shell: bash
        run: |
          # Match the working branch-CI test environment: bubblewrap is the
          # enforceable Linux read-only sandbox and expect(1) drives the
          # interactive-prompt tests. The suite fails loudly when either is
          # missing rather than weakening or skipping coverage.
          sudo apt-get update -qq
          sudo apt-get install -y -qq bubblewrap expect
      - name: Full release verification
        shell: bash
        run: |
          # The suite is portable now (no hardcoded developer paths — guarded
          # by tests/portability.rs — and the PTY test handles util-linux
          # script): no release ships on a suite that never ran.
          cargo fmt --check
          cargo clippy --workspace --locked -- -D warnings
          # Characterization integration tests spawn this gated compatibility
          # binary directly; build it first just as branch CI and `make test`
          # do, or those tests fail with ENOENT rather than exercising it.
          cargo build -p deadreckon --features internal-characterization --bin deadreckon-characterization --locked
          cargo test --workspace --locked --no-fail-fast
          cargo test --release -p deadreckon --features internal-characterization --test chain --test orchestrate --locked
          make size-check

  build-evaluator-sidecars:
    name: build evaluator ${{ matrix.target }}
    if: needs.release-policy.outputs.build_artifacts == 'true'
    needs:
      - release-policy
      - release-preflight
      - release-verify
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        target:
          - aarch64-unknown-linux-musl
          - x86_64-unknown-linux-musl
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Install evaluator Rust target
        run: rustup target add ${{ matrix.target }}
      - name: Install cargo-zigbuild for static Linux evaluators
        shell: bash
        run: |
          python3 -m pip install --user cargo-zigbuild==0.23.0 ziglang==0.14.1
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Build static evaluator
        shell: bash
        run: |
          cargo zigbuild \
            --release \
            --locked \
            --no-default-features \
            -p deadreckon \
            --bin dr-gate \
            --target ${{ matrix.target }}
          mkdir -p target/evaluator-sidecars
          install -m 0755 \
            "target/${{ matrix.target }}/release/dr-gate" \
            "target/evaluator-sidecars/dr-gate-evaluator-${{ matrix.target }}"
          node release/evaluator-sidecars.mjs verify-sidecars \
            --sidecars-dir target/evaluator-sidecars \
            --target ${{ matrix.target }}
      - name: Upload static evaluator
        uses: actions/upload-artifact@v4
        with:
          name: evaluator-sidecar-${{ matrix.target }}
          path: target/evaluator-sidecars/**

  build-local-artifacts:
    name: build ${{ matrix.target }}
    if: needs.release-policy.outputs.build_artifacts == 'true'
    needs:
      - release-policy
      - release-preflight
      - release-verify
      - build-evaluator-sidecars
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            runner: macos-latest
          - target: x86_64-apple-darwin
            runner: macos-latest
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-22.04
            zigbuild: true
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-22.04
            zigbuild: true
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Check Windows stable signing secrets
        if: matrix.target == 'x86_64-pc-windows-msvc' && needs.release-policy.outputs.requires_windows_signing == 'true'
        shell: bash
        env:
          WINDOWS_CERT_PFX: ${{ secrets.WINDOWS_CERT_PFX }}
          WINDOWS_CERT_PWD: ${{ secrets.WINDOWS_CERT_PWD }}
        run: |
          missing=()
          for name in WINDOWS_CERT_PFX WINDOWS_CERT_PWD; do
            if [[ -z "${!name:-}" ]]; then
              missing+=("$name")
            fi
          done
          if (( ${#missing[@]} > 0 )); then
            echo "::error::Windows stable artifacts require a signing provider; missing ${missing[*]}"
            exit 1
          fi
      - name: Install Rust target
        run: rustup target add ${{ matrix.target }}
      - name: Install dist
        if: runner.os != 'Windows'
        shell: bash
        run: |
          curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh
      - name: Install dist
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          irm https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.ps1 | iex
      - name: Install cargo-zigbuild for glibc-pinned Linux
        if: matrix.zigbuild == true
        shell: bash
        run: |
          python3 -m pip install --user cargo-zigbuild==0.23.0 ziglang==0.14.1
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Build target artifacts
        run: |
          dist build --tag=${{ github.ref_name }} --artifacts=local --target=${{ matrix.target }} --output-format=json > dist-manifest-${{ matrix.target }}.json
      - name: Download static evaluator sidecars
        uses: actions/download-artifact@v4
        with:
          pattern: evaluator-sidecar-*
          path: target/evaluator-sidecars
          merge-multiple: true
      - name: Assemble complete target archive
        shell: bash
        run: |
          node release/evaluator-sidecars.mjs verify-sidecars \
            --sidecars-dir target/evaluator-sidecars
          node release/evaluator-sidecars.mjs assemble \
            --dir target/distrib \
            --target ${{ matrix.target }} \
            --sidecars-dir target/evaluator-sidecars
      - name: Decode Windows signing certificate
        if: matrix.target == 'x86_64-pc-windows-msvc' && needs.release-policy.outputs.requires_windows_signing == 'true'
        shell: pwsh
        env:
          WINDOWS_CERT_PFX: ${{ secrets.WINDOWS_CERT_PFX }}
        run: |
          $certPath = Join-Path $env:RUNNER_TEMP "deadreckon-windows-signing.pfx"
          [IO.File]::WriteAllBytes($certPath, [Convert]::FromBase64String($env:WINDOWS_CERT_PFX))
          "WINDOWS_CERT_PATH=$certPath" >> $env:GITHUB_ENV
      - name: Sign and verify packaged Windows artifacts
        if: matrix.target == 'x86_64-pc-windows-msvc' && needs.release-policy.outputs.requires_windows_signing == 'true'
        shell: pwsh
        env:
          WINDOWS_CERT_PWD: ${{ secrets.WINDOWS_CERT_PWD }}
        run: |
          node release/trust/sign-windows-artifacts.mjs `
            --dir target/distrib `
            --target ${{ matrix.target }} `
            --cert "$env:WINDOWS_CERT_PATH" `
            --password "$env:WINDOWS_CERT_PWD"
      - name: Import Apple Developer ID certificate
        if: contains(matrix.target, 'apple-darwin') && needs.release-policy.outputs.requires_macos_signing == 'true'
        shell: bash
        env:
          APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }}
          APPLE_CERT_PWD: ${{ secrets.APPLE_CERT_PWD }}
        run: |
          cert="$RUNNER_TEMP/developer-id.p12"
          keychain="$RUNNER_TEMP/deadreckon-signing.keychain-db"
          echo "$APPLE_CERT_P12" | base64 -D > "$cert"
          security create-keychain -p "" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "" "$keychain"
          security import "$cert" -k "$keychain" -P "$APPLE_CERT_PWD" -T /usr/bin/codesign
          security list-keychains -d user -s "$keychain" login.keychain-db
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" "$keychain"
      - name: Sign and verify packaged macOS artifacts
        if: contains(matrix.target, 'apple-darwin') && needs.release-policy.outputs.requires_macos_signing == 'true'
        timeout-minutes: 45
        shell: bash
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_PWD: ${{ secrets.APPLE_APP_PWD }}
        run: |
          # The helper signs and verifies every native executable, submits the
          # complete assembled payload with xcrun notarytool submit, then
          # repacks the exact archive that will be checksummed and uploaded.
          node release/trust/sign-macos-artifacts.mjs \
            --dir target/distrib \
            --target ${{ matrix.target }} \
            --identity "Developer ID Application"
      - name: Refresh checksum and verify final target archive
        shell: bash
        run: |
          node release/evaluator-sidecars.mjs refresh-checksum \
            --dir target/distrib \
            --target ${{ matrix.target }}
          node release/evaluator-sidecars.mjs verify-archive \
            --dir target/distrib \
            --target ${{ matrix.target }}
      - name: Upload target artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist-local-${{ matrix.target }}
          path: |
            target/distrib/**
            dist-manifest-${{ matrix.target }}.json

  build-mac-app:
    name: build signed notarized universal macOS app
    if: needs.release-policy.outputs.build_artifacts == 'true'
    needs:
      - release-policy
      - build-local-artifacts
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Install XcodeGen
        shell: bash
        run: brew install xcodegen
      - name: Download finalized signed macOS CLI archives
        uses: actions/download-artifact@v4
        with:
          pattern: dist-local-*-apple-darwin
          # Keep the downloaded dist manifests outside the checkout so the
          # official app script can independently enforce a clean source tree.
          path: ${{ runner.temp }}/deadreckon-mac-input
          merge-multiple: true
      - name: Hydrate app resources from exact release archive bytes
        shell: bash
        run: |
          if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
            echo "::error::macOS app release checkout became dirty before hydration"
            git status --short
            exit 1
          fi
          node release/macos-app.mjs hydrate \
            --dir "$RUNNER_TEMP/deadreckon-mac-input/target/distrib" \
            --app-root deadreckon-mac \
            --version "${{ needs.release-policy.outputs.version }}" \
            --commit "$GITHUB_SHA"
      - name: Import Apple Developer ID certificate
        shell: bash
        env:
          APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }}
          APPLE_CERT_PWD: ${{ secrets.APPLE_CERT_PWD }}
        run: |
          cert="$RUNNER_TEMP/developer-id-app.p12"
          keychain="$RUNNER_TEMP/deadreckon-app-signing.keychain-db"
          echo "$APPLE_CERT_P12" | base64 -D > "$cert"
          security create-keychain -p "" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "" "$keychain"
          security import "$cert" -k "$keychain" -P "$APPLE_CERT_PWD" -T /usr/bin/codesign
          security list-keychains -d user -s "$keychain" login.keychain-db
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" "$keychain"
      - name: Test, sign, notarize, staple, and trust-bind app
        timeout-minutes: 60
        shell: bash
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_PWD: ${{ secrets.APPLE_APP_PWD }}
        run: |
          release_version="${{ needs.release-policy.outputs.version }}"
          app_version="${release_version%%-rc.*}"
          export DEADRECKON_RELEASE_MODE=official
          export DEADRECKON_CLI_VERSION="$release_version"
          export DEADRECKON_APP_VERSION="$app_version"
          export DEADRECKON_RELEASE_COMMIT="$GITHUB_SHA"
          export DEADRECKON_APP_BUILD_NUMBER="$GITHUB_RUN_NUMBER"
          export DEADRECKON_APP_DIST="$GITHUB_WORKSPACE/target/distrib"
          deadreckon-mac/scripts/release-app.sh
      - name: Upload signed notarized app
        uses: actions/upload-artifact@v4
        with:
          name: dist-mac-app
          if-no-files-found: error
          path: |
            target/distrib/deadreckon-mac.zip
            target/distrib/trust/macos-universal-apple-darwin-app.json

  build-global-artifacts:
    name: build installers and Homebrew formula
    if: needs.release-policy.outputs.build_artifacts == 'true'
    needs:
      - release-policy
      - build-local-artifacts
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Install dist
        shell: bash
        run: |
          curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Download local artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: dist-local-*
          # Each target artifact is uploaded from the repository root because
          # it also carries a root-level dist manifest. Restore that recorded
          # layout here; downloading into target/distrib would produce
          # target/distrib/target/distrib and hide the archives from the
          # generated Homebrew formula beside them.
          path: .
          merge-multiple: true
      - name: Build global artifacts
        run: |
          dist build --tag=${{ github.ref_name }} --artifacts=global --output-format=json > dist-manifest-global.json
      - name: Patch Homebrew formula receipt
        run: |
          node release/homebrew/patch-formula.mjs target/distrib
      - name: Patch and verify generated installers
        run: |
          node release/evaluator-sidecars.mjs patch-installers \
            --dir target/distrib
          node release/evaluator-sidecars.mjs verify-installers \
            --dir target/distrib
      - name: Upload global artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist-global
          path: |
            target/distrib/**
            dist-manifest-global.json

  release-trust-artifacts:
    name: release trust artifacts
    if: needs.release-policy.outputs.build_artifacts == 'true'
    needs:
      - release-policy
      - build-local-artifacts
      - build-global-artifacts
      - build-mac-app
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Download release artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: dist-local-*
          # Preserve the upload-time repository-relative layout. This keeps
          # target archives, the generated formula, checksums and manifests in
          # one canonical target/distrib tree for trust verification.
          path: .
          merge-multiple: true
      - name: Download global artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist-global
          path: .
      - name: Download signed notarized macOS app
        uses: actions/download-artifact@v4
        with:
          name: dist-mac-app
          # The app artifact's least common upload root is target/distrib, so
          # restore it there (ZIP at the root, trust JSON under trust/).
          path: target/distrib
      - name: Generate and verify archive-member manifest
        run: |
          node release/evaluator-sidecars.mjs manifest \
            --dir target/distrib \
            --out target/distrib/release-archive-members.json
          node release/evaluator-sidecars.mjs verify-manifest \
            --dir target/distrib \
            --manifest target/distrib/release-archive-members.json
      - name: Generate release SBOM
        run: |
          node release/trust/release-trust.mjs sbom \
            --dir target/distrib \
            --out target/distrib/release.spdx.json
      - name: Generate SHA256SUMS
        run: |
          node release/trust/release-trust.mjs checksums \
            --dir target/distrib \
            --out target/distrib/SHA256SUMS
      - name: Generate release manifest
        run: |
          node release/trust/release-trust.mjs manifest \
            --dir target/distrib \
            --ref "$GITHUB_REF" \
            --repo "$GITHUB_REPOSITORY" \
            --commit "$GITHUB_SHA" \
            --out target/distrib/release-manifest.json
      - name: Verify release manifest and checksums
        run: |
          node release/trust/release-trust.mjs verify-manifest \
            --dir target/distrib \
            --manifest target/distrib/release-manifest.json \
            --checksums target/distrib/SHA256SUMS
      - name: Verify Homebrew formula integrity
        run: |
          node release/trust/release-trust.mjs verify-homebrew \
            --dir target/distrib \
            --checksums target/distrib/SHA256SUMS
      - name: Upload release trust bundle
        uses: actions/upload-artifact@v4
        with:
          name: dist-trust
          path: target/distrib/**

  attest-release-artifacts:
    name: attest release artifacts
    if: needs.release-policy.outputs.requires_attestation == 'true'
    needs:
      - release-policy
      - release-trust-artifacts
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - name: Download release trust bundle
        uses: actions/download-artifact@v4
        with:
          name: dist-trust
          path: target/distrib
      - name: Generate artifact attestations
        uses: actions/attest@v4
        with:
          subject-path: target/distrib/**

  publish-github-release:
    name: publish GitHub release
    if: needs.release-policy.outputs.publish_github_release == 'true'
    needs:
      - release-policy
      - release-trust-artifacts
      - attest-release-artifacts
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Download release trust bundle
        uses: actions/download-artifact@v4
        with:
          name: dist-trust
          path: target/distrib
      - name: Create and announce release
        shell: bash
        run: |
          tag="${{ github.ref_name }}"
          # This is the workflow's sole GitHub Release mutation boundary. It
          # runs only after the trust bundle and attestations succeed. Collect
          # every release artifact, de-duplicated by basename (the global
          # artifact layout nests some files twice), then publish with gh.
          declare -A seen
          files=()
          while IFS= read -r f; do
            b="$(basename "$f")"
            if [ -z "${seen[$b]:-}" ]; then
              seen[$b]=1
              files+=("$f")
            fi
          done < <(find target/distrib -type f \( \
              -name '*.tar.xz' -o -name '*.tar.gz' -o -name '*.zip' \
              -o -name '*.sha256' -o -name 'sha256.sum' -o -name 'SHA256SUMS' \
              -o -name 'deadreckon-installer.sh' -o -name 'deadreckon-installer.ps1' \
              -o -name '*.rb' -o -name 'release-manifest.json' \
              -o -name 'release-archive-members.json' \
              -o -name 'release.spdx.json' -o -path '*/trust/*.json' \) | sort)
          notes="target/distrib/release-body.md"
          cat > "$notes" <<'EOF'
          ## Verify artifacts

          Download `SHA256SUMS`, `release-manifest.json`,
          `release-archive-members.json`, and `release.spdx.json` from this
          release, then verify artifacts with:

          ```sh
          shasum -a 256 -c SHA256SUMS
          gh attestation verify <artifact> --repo gregce/deadreckon
          ```

          macOS CLI archives and the universal `deadreckon.app` are Developer ID
          signed and notarized; the app also carries a stapled ticket and embeds
          the exact signed arm64 and x86_64 CLI release bytes. Every artifact is
          checksummed and attested. The release manifest records signing,
          notarization, stapling, checksum, package-manager, and attestation
          policy status.
          EOF
          if [ "${{ needs.release-policy.outputs.requires_windows_signing }}" = "true" ]; then
            printf '\nWindows artifacts are Authenticode signed.\n' >> "$notes"
          else
            printf '\nWindows Authenticode signing is deferred for this release; the Windows archive remains checksummed and attested.\n' >> "$notes"
          fi
          if [ "${{ needs.release-policy.outputs.publish_npm }}" = "true" ]; then
            printf '\nThe npm package family is published with provenance.\n' >> "$notes"
          else
            printf '\nnpm publication is deferred for this release.\n' >> "$notes"
          fi
          prerelease=()
          if [ "${{ needs.release-policy.outputs.lane }}" = "rc" ]; then
            prerelease=(--prerelease)
          fi
          if gh release view "$tag" >/dev/null 2>&1; then
            gh release edit "$tag" --title "$tag" --notes-file "$notes" "${prerelease[@]}"
            gh release upload "$tag" "${files[@]}" --clobber
          else
            gh release create "$tag" --title "$tag" --notes-file "$notes" "${prerelease[@]}" "${files[@]}"
          fi

  publish-homebrew-formula:
    name: publish Homebrew formula
    if: needs.release-policy.outputs.publish_homebrew == 'true'
    needs:
      - release-policy
      - publish-github-release
    runs-on: ubuntu-22.04
    env:
      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
    steps:
      - name: Check Homebrew tap token
        shell: bash
        run: |
          if [[ -z "${HOMEBREW_TAP_TOKEN:-}" ]]; then
            echo "::error::HOMEBREW_TAP_TOKEN is required to publish gregce/homebrew-tap formulae"
            exit 1
          fi
      - uses: actions/checkout@v4
        with:
          repository: gregce/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap
      # The formula is an asset of the just-published GitHub release (the
      # patched .rb from the installers job); the dist-trust artifact bundle
      # does not carry it — proven by the v0.1.0 cut.
      - name: Download published formula
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p target/distrib
          gh release download "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern '*.rb' \
            --dir target/distrib
      - name: Commit formula
        shell: bash
        run: |
          mkdir -p homebrew-tap/Formula
          cp target/distrib/*.rb homebrew-tap/Formula/
          cd homebrew-tap
          git config user.name "deadreckon release bot"
          git config user.email "release-bot@users.noreply.github.com"
          if git diff --quiet -- Formula; then
            echo "No Homebrew formula changes to publish"
            exit 0
          fi
          git add Formula/*.rb
          git commit -m "deadreckon ${GITHUB_REF_NAME#v}"
          git push

  publish-npm:
    name: publish npm packages
    if: needs.release-policy.outputs.publish_npm == 'true'
    needs:
      - release-policy
      - publish-github-release
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/publish-npm.yml
    with:
      tag: ${{ github.ref_name }}
    secrets: inherit