release.yml

name: Release

env:
  JCODE_CI: "1"
  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
  RELEASE_REPAIR: ${{ inputs.recovery || 'none' }}
  RELEASE_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
  # CI builds without the local parallel-frontend rustc wrapper from
  # .cargo/config.toml (a POSIX shell script; see scripts/rustc-parallel-frontend).
  CARGO_BUILD_RUSTC_WRAPPER: ""
  CARGO_TERM_COLOR: always
  SCCACHE_GHA_ENABLED: "true"
  CARGO_INCREMENTAL: "0"
  # Optimize published binaries fully without changing local/selfdev profiles.
  CARGO_PROFILE_RELEASE_OPT_LEVEL: "3"
  # Preserve stable/nightly selected below rather than adopting a JR toolchain.
  JUSTRUST_TOOLCHAIN: system
  # Keep packaging paths deterministic and CI installation noninteractive.
  JUSTRUST_SLOTS: "0"
  JUSTRUST_NO_TELEMETRY: "1"

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag (vMAJOR.MINOR.PATCH)
        required: true
        type: string
      recovery:
        description: Reviewed source repair (only v0.96.0 or v0.97.0)
        type: choice
        default: none
        options: [none, windows-listener]
  push:
    tags:
      - 'v*'

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

permissions:
  actions: read
  contents: write

jobs:
  create-release:
    name: Create release
    # Publish only from the canonical repository. A fork that runs this
    # workflow on a `v*` tag would otherwise create a release carrying that
    # upstream version number with binaries built from the fork, which is the
    # same class of accidental-publication path as a fork pushing a package.
    # Every other job in this workflow needs `create-release`, directly or
    # transitively, so gating this one job skips the whole workflow: a skipped
    # dependency skips its dependents.
    if: github.repository == '1jehuang/jcode'
    runs-on: ubuntu-latest
    # Exact-commit CI includes a native Windows test job with a 150-minute cap.
    timeout-minutes: 190
    outputs:
      tag_sha: ${{ steps.source.outputs.tag_sha }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Validate release source
        id: source
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT_NAME: ${{ github.event_name }}
          WORKFLOW_REF: ${{ github.ref }}
          WORKFLOW_SHA: ${{ github.sha }}
          RELEASE_PROVENANCE_PATH: ${{ runner.temp }}/release-provenance.json
        run: |
          set -euo pipefail
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Invalid release tag" >&2; exit 1; }
          if [ "$EVENT_NAME" = workflow_dispatch ] && [ "$WORKFLOW_REF" != refs/heads/master ]; then
            echo "Recovery must use the reviewed workflow on master" >&2; exit 1
          fi
          tag_sha=$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")
          if [ "$EVENT_NAME" = push ] && [ "$tag_sha" != "$WORKFLOW_SHA" ]; then
            echo "Release tag no longer matches the triggering commit" >&2; exit 1
          fi
          echo "tag_sha=$tag_sha" >> "$GITHUB_OUTPUT"
          git show "$WORKFLOW_SHA:scripts/apply_release_recovery.py" > "$RUNNER_TEMP/recovery.py"
          git checkout --detach "$tag_sha"
          python3 "$RUNNER_TEMP/recovery.py" "$RELEASE_TAG" "$RELEASE_REPAIR" "$WORKFLOW_SHA"
          if [ "$EVENT_NAME" = workflow_dispatch ]; then
            python3 "$RUNNER_TEMP/recovery.py" --check-public-state "$RELEASE_TAG"
          fi

      - name: Require successful exact-commit CI for unpatched source
        if: env.RELEASE_REPAIR == 'none'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          WORKFLOW_SHA: ${{ github.sha }}
          TAG_SHA: ${{ steps.source.outputs.tag_sha }}
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/check_release_ci.py" > "$RUNNER_TEMP/check-release-ci.py"
          python3 "$RUNNER_TEMP/check-release-ci.py" "$TAG_SHA" --repo "$GITHUB_REPOSITORY" --timeout 10800

      - uses: dtolnay/rust-toolchain@stable

      - name: Verify frozen dependency resolution
        shell: bash
        run: |
          cargo metadata --locked --format-version 1 > "$RUNNER_TEMP/release-cargo-metadata.json"
          git diff --exit-code -- Cargo.lock

      # Render a human-readable changelog for the release body (issue #435):
      # changelog/v<version>.json when present, otherwise grouped commit
      # subjects since the previous tag, always ending with the compare link.
      - name: Generate release notes
        shell: bash
        run: |
          scripts/generate_release_notes.sh "$RELEASE_TAG" > release_notes.md
          if [ "$RELEASE_REPAIR" != none ]; then
            # shellcheck disable=SC2016 # Markdown backticks are literal prose.
            printf '\n## Release source recovery\n\nBuilt from existing tag `%s` with reviewed `%s` repair from workflow commit `%s`. The tag and version are unchanged. This is patched tag source, not the exact tagged tree. Release-only installer tooling is pinned to the same workflow commit. See `release-provenance.json` for source hashes and build run.\n' "$RELEASE_TAG" "$RELEASE_REPAIR" "$GITHUB_SHA" >> release_notes.md
          fi

      # Stage platform assets on a draft. The final job publishes every
      # successfully completed asset and records unavailable platforms.
      - name: Create draft release if missing
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if ! gh release view "${RELEASE_TAG}" >/dev/null 2>&1; then
            # quick-release.sh can race this job after pushing the tag. If it
            # creates the draft first, verify that release and continue.
            if ! gh release create "${RELEASE_TAG}" \
              --draft \
              --title "${RELEASE_TAG}" \
              --notes-file release_notes.md; then
              sleep 2
              gh release view "${RELEASE_TAG}" >/dev/null
            fi
          fi
          gh release edit "${RELEASE_TAG}" --notes-file release_notes.md

  recovery-preflight:
    name: Recovery companion preflight (${{ matrix.target }})
    needs: create-release
    if: github.event_name == 'workflow_dispatch' && inputs.recovery == 'windows-listener'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 35
    env:
      JUSTRUST_DISABLE: "1"
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            arch: amd64
          - os: windows-11-arm
            target: aarch64-pc-windows-msvc
            arch: amd64_arm64
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.create-release.outputs.tag_sha }}
          fetch-depth: 0
      - name: Apply reviewed release source recovery
        shell: bash
        env:
          WORKFLOW_SHA: ${{ github.sha }}
          RELEASE_PROVENANCE_PATH: ${{ runner.temp }}/release-provenance.json
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/apply_release_recovery.py" > "$RUNNER_TEMP/recovery.py"
          python3 "$RUNNER_TEMP/recovery.py" "$RELEASE_TAG" "$RELEASE_REPAIR" "$WORKFLOW_SHA"
      - uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: ${{ matrix.arch }}
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: recovery-companion-${{ matrix.target }}
      - name: Install pinned justrust
        shell: bash
        run: bash scripts/install_justrust_ci.sh
      - name: Check and test exact repaired companion source
        shell: pwsh
        run: |
          & justrust check --local --locked -p jcode-companion --target ${{ matrix.target }}
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          & justrust test --local --locked -p jcode-companion --lib --target ${{ matrix.target }}
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
      - name: Verify preflight preserved Cargo.lock
        shell: bash
        run: git diff --exit-code -- Cargo.lock

  build-linux-macos:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    needs: [create-release, recovery-preflight]
    if: ${{ always() && needs.create-release.result == 'success' && (needs.recovery-preflight.result == 'success' || needs.recovery-preflight.result == 'skipped') }}
    # Each matrix architecture is independent. A failed Linux or macOS target
    # must not suppress assets produced by the other successful targets.
    continue-on-error: true
    # v0.97.0 Intel macOS took 59m17s at optimization level 3. Keep headroom
    # for healthy cold-cache builds without changing any acceptance checks.
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - # Build Linux x86_64 release assets on a CentOS 7 / manylinux2014
            # glibc 2.17 baseline so they run on older distros as well as newer
            # Debian/Ubuntu containers used by many TB tasks.
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            artifact: jcode-linux-x86_64
            compat_container: true
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            artifact: jcode-linux-aarch64
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: jcode-macos-aarch64
          - os: macos-15-intel
            target: x86_64-apple-darwin
            artifact: jcode-macos-x86_64

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.create-release.outputs.tag_sha }}
          ssh-key: ${{ secrets.DEPLOY_KEY }}
          submodules: recursive
          fetch-depth: 0

      - name: Apply reviewed release source recovery
        shell: bash
        env:
          WORKFLOW_SHA: ${{ github.sha }}
          RELEASE_PROVENANCE_PATH: ${{ runner.temp }}/release-provenance.json
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/apply_release_recovery.py" > "$RUNNER_TEMP/recovery.py"
          python3 "$RUNNER_TEMP/recovery.py" "$RELEASE_TAG" "$RELEASE_REPAIR" "$WORKFLOW_SHA"

      - name: Configure SSH for cargo git dependencies
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.DEPLOY_KEY }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # Termux (Android) kernels implement ELF TLS Variant 1 while glibc
      # expects Variant 2, so native __thread variables are zero-initialized at
      # runtime and Tokio's runtime detection false-positives and panics.
      # Building the aarch64 glibc binary with emulated TLS
      # (pthread_getspecific) sidesteps kernel TLS entirely. That needs
      # nightly (-Z tls-model, -Z build-std) with rust-src.
      - name: Install nightly for emulated TLS (aarch64 only)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        uses: dtolnay/rust-toolchain@nightly
        with:
          targets: aarch64-unknown-linux-gnu
          components: rust-src

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@v0.0.7
        continue-on-error: true
        id: sccache

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}
          cache-all-crates: "true"

      - name: Install mold linker (Linux)
        if: runner.os == 'Linux' && matrix.compat_container != true
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq mold

      - name: Install pinned justrust
        if: matrix.compat_container != true
        shell: bash
        run: bash scripts/install_justrust_ci.sh

      # Hosted cannot preserve our ARM64 emulated-TLS build yet, and native
      # macOS hosted routing is not enabled. Keep the selected runner toolchain.
      - name: Build release binary
        if: matrix.compat_container != true
        shell: bash
        run: |
          mkdir -p .cargo
          if [ "$RUNNER_OS" = "Linux" ]; then
            cat > .cargo/config.toml << 'EOF'
          [target.x86_64-unknown-linux-gnu]
          linker = "clang"
          rustflags = ["-C", "link-arg=-fuse-ld=mold"]
          [target.aarch64-unknown-linux-gnu]
          linker = "clang"
          rustflags = ["-C", "link-arg=-fuse-ld=mold", "-Z", "tls-model=emulated"]
          EOF
          fi
          if command -v sccache &>/dev/null && sccache --start-server 2>/dev/null; then
            export RUSTC_WRAPPER=sccache
          fi
          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
            # Rebuild std with emulated TLS too; see the nightly install step
            # above for why Termux needs this.
            RUSTUP_TOOLCHAIN=nightly justrust build --local --locked -Z build-std=std,panic_abort --release --target ${{ matrix.target }}
          else
            justrust build --local --locked --release --target ${{ matrix.target }}
          fi
        env:
          JCODE_RELEASE_BUILD: "1"
          JCODE_CI_BUILD: "1"
          JCODE_BUILD_SEMVER: ${{ env.RELEASE_TAG }}

      - name: Build portable Linux x86_64 release binary
        if: matrix.compat_container == true
        shell: bash
        run: scripts/build_linux_compat.sh dist
        env:
          JCODE_RELEASE_BUILD: "1"
          JCODE_CI_BUILD: "1"
          JCODE_BUILD_SEMVER: ${{ env.RELEASE_TAG }}
          JCODE_COMPAT_ARTIFACT: ${{ matrix.artifact }}

      - name: Verify release build preserved Cargo.lock
        shell: bash
        run: git diff --exit-code -- Cargo.lock

      - name: Package binary
        if: matrix.compat_container != true
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/jcode dist/${{ matrix.artifact }}
          chmod +x dist/${{ matrix.artifact }}
          if [ "$RUNNER_OS" = "macOS" ]; then
            # The linker's ad-hoc signature uses cargo's hashed output name
            # (`jcode-<hash>`) as the code-signing identifier, so every release
            # looked like a different program. macOS Tahoe's "Allow in the Menu
            # Bar" keys unbundled executables on that identity, which added a new
            # jcode toggle per update and reset the menu bar item's placement
            # (#621). Re-sign ad-hoc with a stable identifier.
            codesign --force --sign - --identifier com.jcode.cli dist/${{ matrix.artifact }}
            codesign -dv dist/${{ matrix.artifact }} 2>&1 | grep -qx 'Identifier=com.jcode.cli'
          fi
          cd dist && tar czf ${{ matrix.artifact }}.tar.gz ${{ matrix.artifact }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: dist/${{ matrix.artifact }}.tar.gz

      # Attach this platform's asset to the draft release. It remains hidden
      # until the final job verifies the complete release set.
      - name: Publish asset to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${RELEASE_TAG}" "dist/${{ matrix.artifact }}.tar.gz" --clobber

  build-windows:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    needs: [create-release, recovery-preflight]
    if: ${{ always() && needs.create-release.result == 'success' && (needs.recovery-preflight.result == 'success' || needs.recovery-preflight.result == 'skipped') }}
    env:
      # Pinned alpha.17 measurement crashed on Windows x64 requesting 30 GiB.
      # Disable measurement only: the CLI still executes local Cargo and returns
      # its exit status. Native Windows hosted routing is unsupported. All
      # compile, launch, installer, signing and publication gates remain active.
      JUSTRUST_DISABLE: "1"
    # Both Windows architectures are required by the final complete-asset gate.
    # A compile failure must stop signing rather than cascading into missing files.
    # Windows x64 release smoke tests compile the e2e harness after the release
    # binary. GitHub-hosted Windows runners sometimes exceed 25 minutes, which
    # cancels otherwise healthy releases before artifacts can be uploaded.
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: jcode-windows-x86_64
            unsigned_artifact: windows-unsigned-x86_64
          - os: windows-11-arm
            target: aarch64-pc-windows-msvc
            artifact: jcode-windows-aarch64
            unsigned_artifact: windows-unsigned-aarch64
            cargo_args: "--no-default-features --features pdf"

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.create-release.outputs.tag_sha }}
          fetch-depth: 0

      - name: Apply reviewed release source recovery
        shell: bash
        env:
          WORKFLOW_SHA: ${{ github.sha }}
          RELEASE_PROVENANCE_PATH: ${{ runner.temp }}/release-provenance.json
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/apply_release_recovery.py" > "$RUNNER_TEMP/recovery.py"
          python3 "$RUNNER_TEMP/recovery.py" "$RELEASE_TAG" "$RELEASE_REPAIR" "$WORKFLOW_SHA"

      - name: Configure MSVC build environment (x64)
        if: matrix.target == 'x86_64-pc-windows-msvc'
        uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: amd64

      - name: Configure MSVC build environment (ARM64)
        if: matrix.target == 'aarch64-pc-windows-msvc'
        uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: amd64_arm64

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@v0.0.7
        continue-on-error: true
        id: sccache

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}
          cache-all-crates: "true"

      - name: Install pinned justrust
        shell: bash
        run: bash scripts/install_justrust_ci.sh

      # Native Windows hosted routing is not enabled. Preserve the MSVC runner.
      - name: Build release binary
        shell: pwsh
        run: |
          if (Get-Command sccache -ErrorAction SilentlyContinue) {
            sccache --start-server *> $null
            if ($LASTEXITCODE -eq 0) {
              $env:RUSTC_WRAPPER = "sccache"
            }
          }

          $cargoArgs = @("build", "--local", "--locked", "--release", "--target", "${{ matrix.target }}")
          $extraArgs = "${{ matrix.cargo_args }}"
          if (-not [string]::IsNullOrWhiteSpace($extraArgs)) {
            $cargoArgs += $extraArgs -split ' '
          }

          & justrust @cargoArgs
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
        env:
          JCODE_RELEASE_BUILD: "1"
          JCODE_CI_BUILD: "1"
          JCODE_BUILD_SEMVER: ${{ env.RELEASE_TAG }}

      - name: Verify release build preserved Cargo.lock
        shell: bash
        run: git diff --exit-code -- Cargo.lock

      - name: Verify built Windows binary launches
        shell: pwsh
        run: |
          & "target/${{ matrix.target }}/release/jcode.exe" --version
          if ($LASTEXITCODE -ne 0) {
            throw "Built Windows binary failed to run --version"
          }

      - name: Verify Windows installer with local artifact
        shell: pwsh
        run: |
          & ./.github/scripts/verify_windows_install.ps1 `
            -ArtifactExePath "target/${{ matrix.target }}/release/jcode.exe" `
            -Version "${{ env.RELEASE_TAG }}"

      - name: Stage unsigned binary for signing
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Copy-Item "target/${{ matrix.target }}/release/jcode.exe" "dist/${{ matrix.artifact }}.exe"

      - name: Upload unsigned binary for signing
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.unsigned_artifact }}
          path: dist/${{ matrix.artifact }}.exe

      # These debug-harness tests provide extra signal, but they must not block
      # publishing a release binary that already built, launched, and passed the
      # installer verification. A transient server-test disconnect caused the
      # Windows x64 asset to disappear from releases v0.44.0-v0.46.0 (#480).
      - name: Run advisory Windows runtime smoke tests (x64)
        if: matrix.target == 'x86_64-pc-windows-msvc'
        continue-on-error: true
        shell: pwsh
        run: |
          $tests = @(
            'provider_behavior::test_socket_model_cycle_supported_models',
            'provider_behavior::test_model_switch_resets_provider_session'
          )

          foreach ($testName in $tests) {
            & cargo test --locked --target ${{ matrix.target }} --test e2e $testName -- --exact --nocapture
            if ($LASTEXITCODE -ne 0) {
              throw "Windows smoke test failed: $testName"
            }
          }

  publish-windows:
    name: Sign and publish Windows assets
    runs-on: windows-latest
    needs: [create-release, build-windows]
    # Signing failures keep the complete release draft, including recovery runs.
    # The optional recovery-preflight ancestor is skipped for normal releases.
    # Override implicit success() so that skip does not suppress signing, while
    # still requiring both direct dependencies to succeed.
    if: always() && needs.create-release.result == 'success' && needs.build-windows.result == 'success'
    timeout-minutes: 30
    outputs:
      signing_enabled: ${{ steps.signing.outputs.enabled }}
    permissions:
      contents: write
      id-token: write
    env:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      WINDOWS_SIGNING_ENDPOINT: ${{ vars.WINDOWS_SIGNING_ENDPOINT }}
      WINDOWS_SIGNING_ACCOUNT: ${{ vars.WINDOWS_SIGNING_ACCOUNT }}
      WINDOWS_SIGNING_CERTIFICATE_PROFILE: ${{ vars.WINDOWS_SIGNING_CERTIFICATE_PROFILE }}
      WINDOWS_SIGNING_REQUIRED: ${{ vars.WINDOWS_SIGNING_REQUIRED }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.create-release.outputs.tag_sha }}
          fetch-depth: 0

      - name: Apply reviewed release source recovery
        shell: bash
        env:
          WORKFLOW_SHA: ${{ github.sha }}
          RELEASE_PROVENANCE_PATH: ${{ runner.temp }}/release-provenance.json
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/apply_release_recovery.py" > "$RUNNER_TEMP/recovery.py"
          python3 "$RUNNER_TEMP/recovery.py" "$RELEASE_TAG" "$RELEASE_REPAIR" "$WORKFLOW_SHA"

      - name: Download unsigned Windows binaries
        uses: actions/download-artifact@v4
        with:
          pattern: windows-unsigned-*
          path: artifacts

      - name: Determine signing mode
        id: signing
        shell: pwsh
        run: |
          $requiredValues = @(
            $env:AZURE_CLIENT_ID,
            $env:AZURE_TENANT_ID,
            $env:AZURE_SUBSCRIPTION_ID,
            $env:WINDOWS_SIGNING_ENDPOINT,
            $env:WINDOWS_SIGNING_ACCOUNT,
            $env:WINDOWS_SIGNING_CERTIFICATE_PROFILE
          )
          $configured = -not ($requiredValues | Where-Object { [string]::IsNullOrWhiteSpace($_) })
          "enabled=$($configured.ToString().ToLowerInvariant())" | Out-File -FilePath $env:GITHUB_OUTPUT -Append

          $signingRequired = $env:WINDOWS_SIGNING_REQUIRED -ne 'false'
          if (-not $configured -and $signingRequired) {
            throw 'Windows signing is required, but Azure Artifact Signing configuration is incomplete. See docs/WINDOWS.md.'
          }
          if (-not $configured) {
            Write-Warning 'Publishing unsigned Windows assets because WINDOWS_SIGNING_REQUIRED=false. This override is not suitable for an official Windows release.'
          }

      - name: Azure login with GitHub OIDC
        if: steps.signing.outputs.enabled == 'true'
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Authenticode-sign Windows binaries
        if: steps.signing.outputs.enabled == 'true'
        uses: azure/artifact-signing-action@v2
        with:
          endpoint: ${{ vars.WINDOWS_SIGNING_ENDPOINT }}
          signing-account-name: ${{ vars.WINDOWS_SIGNING_ACCOUNT }}
          certificate-profile-name: ${{ vars.WINDOWS_SIGNING_CERTIFICATE_PROFILE }}
          files: |
            ${{ github.workspace }}\artifacts\windows-unsigned-x86_64\jcode-windows-x86_64.exe
            ${{ github.workspace }}\artifacts\windows-unsigned-aarch64\jcode-windows-aarch64.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify signatures and package Windows assets
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          $assets = @(
            @{ Name = 'jcode-windows-x86_64'; Path = 'artifacts/windows-unsigned-x86_64/jcode-windows-x86_64.exe' },
            @{ Name = 'jcode-windows-aarch64'; Path = 'artifacts/windows-unsigned-aarch64/jcode-windows-aarch64.exe' }
          )

          foreach ($asset in $assets) {
            $source = (Resolve-Path -LiteralPath $asset.Path).Path
            if ('${{ steps.signing.outputs.enabled }}' -eq 'true') {
              $signature = Get-AuthenticodeSignature -LiteralPath $source
              if ($signature.Status -ne 'Valid') {
                throw "Authenticode verification failed for $($asset.Name): $($signature.Status) $($signature.StatusMessage)"
              }
              Write-Host "Signed by: $($signature.SignerCertificate.Subject)"
            }

            $destination = Join-Path dist "$($asset.Name).exe"
            Copy-Item -LiteralPath $source -Destination $destination -Force
            tar -czf "dist/$($asset.Name).tar.gz" -C dist "$($asset.Name).exe"
          }

      - name: Upload final Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: jcode-windows-x86_64
          path: |
            dist/jcode-windows-x86_64.exe
            dist/jcode-windows-x86_64.tar.gz

      - name: Upload final Windows ARM64 artifacts
        uses: actions/upload-artifact@v4
        with:
          name: jcode-windows-aarch64
          path: |
            dist/jcode-windows-aarch64.exe
            dist/jcode-windows-aarch64.tar.gz

      - name: Publish Windows assets to release
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          gh release upload "${env:RELEASE_TAG}" dist/jcode-windows-x86_64.exe dist/jcode-windows-x86_64.tar.gz dist/jcode-windows-aarch64.exe dist/jcode-windows-aarch64.tar.gz --clobber

  build-freebsd:
    name: Build (x86_64-unknown-freebsd)
    runs-on: ubuntu-latest
    needs: [create-release, recovery-preflight]
    if: ${{ always() && needs.create-release.result == 'success' && (needs.recovery-preflight.result == 'success' || needs.recovery-preflight.result == 'skipped') }}
    # GitHub has no native FreeBSD runners, so build inside a FreeBSD VM
    # (QEMU via vmactions), same approach as freebsd-smoke.yml (issues #416,
    # #433). Best-effort: a flaky VM build must not block the rest of the
    # release, so failures are surfaced but non-fatal.
    continue-on-error: true
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.create-release.outputs.tag_sha }}
          fetch-depth: 0

      - name: Apply reviewed release source recovery
        shell: bash
        env:
          WORKFLOW_SHA: ${{ github.sha }}
          RELEASE_PROVENANCE_PATH: ${{ runner.temp }}/release-provenance.json
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/apply_release_recovery.py" > "$RUNNER_TEMP/recovery.py"
          python3 "$RUNNER_TEMP/recovery.py" "$RELEASE_TAG" "$RELEASE_REPAIR" "$WORKFLOW_SHA"

      - name: Build release binary in FreeBSD VM
        uses: vmactions/freebsd-vm@v1
        with:
          release: "15.1"
          usesh: true
          # Give the build VM enough room: aws-lc-sys + tract pull in heavy C/Rust.
          mem: 6144
          cpu: 4
          # The project is OpenSSL-free (rustls + aws-lc-rs): only a C/C++
          # toolchain, cmake, and rust are needed.
          prepare: |
            pkg install -y rust cmake gmake pkgconf bash git
          run: |
            set -e
            echo "::group::Toolchain versions"
            uname -a
            cc --version | head -1
            cargo --version
            rustc --version
            echo "::endgroup::"

            export CARGO_TERM_COLOR=always
            # The VM does not inherit the runner's workflow environment.
            export CARGO_PROFILE_RELEASE_OPT_LEVEL="${{ env.CARGO_PROFILE_RELEASE_OPT_LEVEL }}"
            # CARGO_BUILD_JOBS keeps memory in check; aws-lc-sys is memory hungry.
            export CARGO_BUILD_JOBS=3
            export JCODE_RELEASE_BUILD=1
            export JCODE_CI_BUILD=1
            export JCODE_BUILD_SEMVER="${{ env.RELEASE_TAG }}"

            # VM source sync omits .git. Keep the baseline outside the source tree.
            lock_snapshot=$(mktemp /tmp/jcode-release-Cargo.lock.XXXXXX)
            trap 'rm -f "$lock_snapshot"' EXIT
            cp Cargo.lock "$lock_snapshot"

            echo "::group::cargo build (jcode binary)"
            # justrust has no FreeBSD client or hosted worker yet.
            cargo build --locked --release -p jcode --bin jcode
            cmp "$lock_snapshot" Cargo.lock
            echo "::endgroup::"

            echo "::group::Verify binary launches"
            ./target/release/jcode --version
            echo "::endgroup::"

            mkdir -p dist
            cp target/release/jcode dist/jcode-freebsd-x86_64
            chmod +x dist/jcode-freebsd-x86_64
            cd dist && tar czf jcode-freebsd-x86_64.tar.gz jcode-freebsd-x86_64

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: jcode-freebsd-x86_64
          path: dist/jcode-freebsd-x86_64.tar.gz

      - name: Publish asset to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${RELEASE_TAG}" "dist/jcode-freebsd-x86_64.tar.gz" --clobber

  release:
    name: Finalize release
    needs: [create-release, build-linux-macos, publish-windows, build-freebsd]
    # Every platform is independent. Wait until all jobs reach a terminal state,
    # then require all platform assets before publishing. Partial sets stay draft.
    if: ${{ always() && needs.create-release.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      actions: write
      contents: write
      issues: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.create-release.outputs.tag_sha }}
          fetch-depth: 0

      - name: Apply reviewed release source recovery
        shell: bash
        env:
          WORKFLOW_SHA: ${{ github.sha }}
          RELEASE_PROVENANCE_PATH: ${{ runner.temp }}/release-provenance.json
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/apply_release_recovery.py" > "$RUNNER_TEMP/recovery.py"
          python3 "$RUNNER_TEMP/recovery.py" "$RELEASE_TAG" "$RELEASE_REPAIR" "$WORKFLOW_SHA"

      - uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          path: artifacts
          pattern: jcode-*

      - name: Validate complete platform asset set
        shell: bash
        run: |
          set -euo pipefail
          expected=(
            artifacts/jcode-linux-x86_64/jcode-linux-x86_64.tar.gz
            artifacts/jcode-linux-aarch64/jcode-linux-aarch64.tar.gz
            artifacts/jcode-macos-aarch64/jcode-macos-aarch64.tar.gz
            artifacts/jcode-macos-x86_64/jcode-macos-x86_64.tar.gz
            artifacts/jcode-windows-x86_64/jcode-windows-x86_64.exe
            artifacts/jcode-windows-x86_64/jcode-windows-x86_64.tar.gz
            artifacts/jcode-windows-aarch64/jcode-windows-aarch64.exe
            artifacts/jcode-windows-aarch64/jcode-windows-aarch64.tar.gz
            artifacts/jcode-freebsd-x86_64/jcode-freebsd-x86_64.tar.gz
          )

          missing=()
          for asset in "${expected[@]}"; do
            if [ ! -f "$asset" ]; then
              missing+=("$asset")
            fi
          done
          if [ "${#missing[@]}" -ne 0 ]; then
            printf 'Missing required release asset: %s\n' "${missing[@]}" >&2
            echo "Keeping the release as a draft until every platform succeeds" >&2
            exit 1
          fi

      # Build jobs normally attach their own assets to the draft. Upload them
      # again here so a late per-platform upload failure cannot leave a built
      # artifact out of the public release.
      - name: Attach all completed platform assets
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mapfile -d '' assets < <(
            find artifacts -type f \( -name '*.tar.gz' -o -name '*.exe' \) -print0
          )
          if [ "${#assets[@]}" -eq 0 ]; then
            echo "No completed release assets found" >&2
            exit 1
          fi
          gh release upload "${RELEASE_TAG}" "${assets[@]}" --clobber

      - name: Record platform availability
        shell: bash
        run: |
          set -euo pipefail
          available() {
            if [ -f "$1" ]; then printf true; else printf false; fi
          }

          linux_x86_64=$(available artifacts/jcode-linux-x86_64/jcode-linux-x86_64.tar.gz)
          linux_aarch64=$(available artifacts/jcode-linux-aarch64/jcode-linux-aarch64.tar.gz)
          macos_aarch64=$(available artifacts/jcode-macos-aarch64/jcode-macos-aarch64.tar.gz)
          macos_x86_64=$(available artifacts/jcode-macos-x86_64/jcode-macos-x86_64.tar.gz)
          windows_x86_64=$(available artifacts/jcode-windows-x86_64/jcode-windows-x86_64.exe)
          windows_aarch64=$(available artifacts/jcode-windows-aarch64/jcode-windows-aarch64.exe)
          freebsd_x86_64=$(available artifacts/jcode-freebsd-x86_64/jcode-freebsd-x86_64.tar.gz)

          homebrew_ready=false
          aur_ready=false
          if [ "$linux_x86_64" = true ] && [ "$linux_aarch64" = true ] && \
             [ "$macos_aarch64" = true ] && [ "$macos_x86_64" = true ]; then
            homebrew_ready=true
          fi
          if [ "$linux_x86_64" = true ]; then
            aur_ready=true
          fi

          {
            echo "LINUX_X86_64_AVAILABLE=$linux_x86_64"
            echo "LINUX_AARCH64_AVAILABLE=$linux_aarch64"
            echo "MACOS_AARCH64_AVAILABLE=$macos_aarch64"
            echo "MACOS_X86_64_AVAILABLE=$macos_x86_64"
            echo "WINDOWS_X86_64_AVAILABLE=$windows_x86_64"
            echo "WINDOWS_AARCH64_AVAILABLE=$windows_aarch64"
            echo "FREEBSD_X86_64_AVAILABLE=$freebsd_x86_64"
            echo "HOMEBREW_READY=$homebrew_ready"
            echo "AUR_READY=$aur_ready"
          } >> "$GITHUB_ENV"
          {
            echo "## Platform availability"
            echo "- Linux x86_64: $linux_x86_64"
            echo "- Linux aarch64: $linux_aarch64"
            echo "- macOS Apple Silicon: $macos_aarch64"
            echo "- macOS Intel: $macos_x86_64"
            echo "- Windows x86_64: $windows_x86_64"
            echo "- Windows ARM64: $windows_aarch64"
            echo "- FreeBSD x86_64: $freebsd_x86_64"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Generate checksums
        shell: bash
        run: |
          python3 - << 'PY'
          import hashlib
          from pathlib import Path

          files = sorted(
              p for p in Path("artifacts").rglob("*")
              if p.is_file() and (p.name.endswith(".tar.gz") or p.name.endswith(".exe"))
          )
          if not files:
              raise SystemExit("No release assets found for checksum generation")

          with Path("SHA256SUMS").open("w", encoding="utf-8") as out:
              for path in files:
                  digest = hashlib.sha256(path.read_bytes()).hexdigest()
                  out.write(f"{digest}  {path.name}\n")
          PY
          cp "$RUNNER_TEMP/release-provenance.json" release-provenance.json
          sha256sum release-provenance.json >> SHA256SUMS
          cat SHA256SUMS

      # Per-platform assets were already attached to the draft by their build
      # jobs. Add the cross-cutting checksum file before making it public.
      - name: Upload checksums to release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${RELEASE_TAG}" SHA256SUMS release-provenance.json --clobber

      - name: Add platform availability to release notes
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          WINDOWS_SIGNING_ENABLED: ${{ needs.publish-windows.outputs.signing_enabled }}
        run: |
          set -euo pipefail
          gh release view "${RELEASE_TAG}" --json body --jq .body > release_notes.md
          python3 - << 'PY'
          import os
          import re
          import textwrap
          from pathlib import Path

          path = Path("release_notes.md")
          body = path.read_text(encoding="utf-8")
          start = "<!-- jcode-platform-availability:start -->"
          end = "<!-- jcode-platform-availability:end -->"
          body = re.sub(
              rf"\n?{re.escape(start)}.*?{re.escape(end)}\n?",
              "\n",
              body,
              flags=re.DOTALL,
          ).rstrip()

          def status(name: str) -> str:
              return "available" if os.environ[name] == "true" else "not available in this release"

          windows_signature = (
              "Authenticode signatures verified for both Windows architectures."
              if os.environ.get("WINDOWS_SIGNING_ENABLED") == "true"
              else "Windows executables are **unsigned**. Azure Artifact Signing is not configured and the repository's existing `WINDOWS_SIGNING_REQUIRED=false` override allowed unsigned publication. Windows may show publisher or SmartScreen warnings."
          )
          availability = textwrap.dedent(f"""
              {start}
              ## Platform availability

              - Linux x86_64: {status('LINUX_X86_64_AVAILABLE')}
              - Linux aarch64: {status('LINUX_AARCH64_AVAILABLE')}
              - macOS Apple Silicon: {status('MACOS_AARCH64_AVAILABLE')}
              - macOS Intel: {status('MACOS_X86_64_AVAILABLE')}
              - Windows x86_64: {status('WINDOWS_X86_64_AVAILABLE')}
              - Windows ARM64: {status('WINDOWS_AARCH64_AVAILABLE')}
              - FreeBSD x86_64: {status('FREEBSD_X86_64_AVAILABLE')}

              {windows_signature}
              {end}
          """).strip("\n")
          path.write_text(f"{body}\n\n{availability}\n", encoding="utf-8")
          PY
          gh release edit "${RELEASE_TAG}" --notes-file release_notes.md

      - name: Verify staged assets before publication
        if: env.RELEASE_REPAIR == 'none'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          WORKFLOW_SHA: ${{ github.sha }}
          TAG_SHA: ${{ needs.create-release.outputs.tag_sha }}
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/verify_public_release.py" > "$RUNNER_TEMP/verify-public-release.py"
          python3 "$RUNNER_TEMP/verify-public-release.py" "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --sha "$TAG_SHA" --allow-draft

      - name: Publish completed release
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          set -euo pipefail
          if [ "$EVENT_NAME" = workflow_dispatch ]; then
            python3 "$RUNNER_TEMP/recovery.py" --check-public-state "$RELEASE_TAG"
          fi
          if [ "$(gh release view "${RELEASE_TAG}" --json isDraft --jq .isDraft)" = "true" ]; then
            gh release edit "${RELEASE_TAG}" --draft=false --latest
          else
            echo "Release ${RELEASE_TAG} is already public; leaving it public."
          fi

      - name: Verify public assets and exact source provenance
        if: env.RELEASE_REPAIR == 'none'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          WORKFLOW_SHA: ${{ github.sha }}
          TAG_SHA: ${{ needs.create-release.outputs.tag_sha }}
        run: |
          set -euo pipefail
          git show "$WORKFLOW_SHA:scripts/verify_public_release.py" > "$RUNNER_TEMP/verify-public-release.py"
          python3 "$RUNNER_TEMP/verify-public-release.py" "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --sha "$TAG_SHA"

      - name: Smoke test public Linux installer in an isolated home
        if: env.RELEASE_REPAIR == 'none'
        shell: bash
        run: |
          set -euo pipefail
          install_home="$(mktemp -d "$RUNNER_TEMP/jcode-install.XXXXXX")"
          HOME="$install_home" XDG_CONFIG_HOME="$install_home/.config" \
            JCODE_HOME="$install_home/.jcode" JCODE_INSTALL_DIR="$install_home/.local/bin" \
            JCODE_VERSION="$RELEASE_TAG" JCODE_SKIP_SERVER_RELOAD=1 JCODE_NO_TELEMETRY=1 \
            bash scripts/install.sh
          reported_version="$("$install_home/.local/bin/jcode" --version)"
          printf '%s\n' "$reported_version"
          [[ "$reported_version" == "jcode $RELEASE_TAG "* ]] || {
            echo "Installed binary does not match published version" >&2
            exit 1
          }

      # Releases created with GITHUB_TOKEN do not trigger `release: published`,
      # but workflow_dispatch is allowed. Queue the dedicated, per-tag
      # announcement workflow without letting Discord block package publishing.
      - name: Queue Discord release announcement
        id: discord_announcement
        continue-on-error: true
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run discord-release.yml --ref "$DEFAULT_BRANCH" -f "tag=${RELEASE_TAG}"

      - name: Update Homebrew formula
        env:
          HOMEBREW_DEPLOY_KEY: ${{ secrets.HOMEBREW_DEPLOY_KEY }}
        if: env.HOMEBREW_DEPLOY_KEY != '' && env.HOMEBREW_READY == 'true'
        run: |
          VERSION="${RELEASE_TAG}"
          VERSION_NUM="${VERSION#v}"

          LINUX_SHA=$(sha256sum artifacts/jcode-linux-x86_64/jcode-linux-x86_64.tar.gz | cut -d' ' -f1)
          LINUX_ARM_SHA=$(sha256sum artifacts/jcode-linux-aarch64/jcode-linux-aarch64.tar.gz | cut -d' ' -f1)
          MACOS_ARM_SHA=$(sha256sum artifacts/jcode-macos-aarch64/jcode-macos-aarch64.tar.gz | cut -d' ' -f1)
          MACOS_INTEL_SHA=$(sha256sum artifacts/jcode-macos-x86_64/jcode-macos-x86_64.tar.gz | cut -d' ' -f1)

          mkdir -p ~/.ssh
          echo "$HOMEBREW_DEPLOY_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          export GIT_SSH_COMMAND="ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no"

          git clone git@github.com:1jehuang/homebrew-jcode.git /tmp/homebrew-jcode

          cat > /tmp/homebrew-jcode/Formula/jcode.rb << FORMULA
          class Jcode < Formula
            desc "AI coding agent powered by Claude and ChatGPT"
            homepage "https://github.com/1jehuang/jcode"
            version "${VERSION_NUM}"
            license "MIT"

            on_macos do
              on_arm do
                url "https://github.com/1jehuang/jcode/releases/download/${VERSION}/jcode-macos-aarch64.tar.gz"
                sha256 "${MACOS_ARM_SHA}"

                def install
                  bin.install "jcode-macos-aarch64" => "jcode"
                end
              end

              on_intel do
                url "https://github.com/1jehuang/jcode/releases/download/${VERSION}/jcode-macos-x86_64.tar.gz"
                sha256 "${MACOS_INTEL_SHA}"

                def install
                  bin.install "jcode-macos-x86_64" => "jcode"
                end
              end
            end

            on_linux do
              on_intel do
                url "https://github.com/1jehuang/jcode/releases/download/${VERSION}/jcode-linux-x86_64.tar.gz"
                sha256 "${LINUX_SHA}"

                def install
                  libexec.install "jcode-linux-x86_64", "jcode-linux-x86_64.bin"
                  libexec.install Dir["libssl.so*"], Dir["libcrypto.so*"] unless Dir["libssl.so*", "libcrypto.so*"].empty?
                  (bin/"jcode").write <<~SH
                    #!/bin/sh
                    exec "#{libexec}/jcode-linux-x86_64" "\$@"
                  SH
                end
              end

              on_arm do
                url "https://github.com/1jehuang/jcode/releases/download/${VERSION}/jcode-linux-aarch64.tar.gz"
                sha256 "${LINUX_ARM_SHA}"

                def install
                  bin.install "jcode-linux-aarch64" => "jcode"
                end
              end
            end

            test do
              assert_match "jcode", shell_output("#{bin}/jcode --version")
            end
          end
          FORMULA

          sed -i 's/^          //' /tmp/homebrew-jcode/Formula/jcode.rb

          cd /tmp/homebrew-jcode
          git config user.name "jcode-release-bot"
          git config user.email "release@jcode.dev"
          git add Formula/jcode.rb
          git commit -m "Update to ${VERSION}" || echo "No changes"
          git push

      - name: Update AUR package
        env:
          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
        if: env.AUR_SSH_KEY != '' && env.AUR_READY == 'true'
        run: |
          set -euo pipefail

          retry() {
            local attempts="$1"
            local delay="$2"
            shift 2
            local try=1

            until "$@"; do
              local exit_code=$?
              if [ "$try" -ge "$attempts" ]; then
                return "$exit_code"
              fi
              echo "Attempt ${try}/${attempts} failed; retrying in ${delay}s..."
              sleep "$delay"
              try=$((try + 1))
            done
          }

          VERSION="${RELEASE_TAG}"
          VERSION_NUM="${VERSION#v}"

          LINUX_SHA=$(sha256sum artifacts/jcode-linux-x86_64/jcode-linux-x86_64.tar.gz | cut -d' ' -f1)
          LINUX_URL="https://github.com/1jehuang/jcode/releases/download/${VERSION}/jcode-linux-x86_64.tar.gz"

          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "$AUR_SSH_KEY" > ~/.ssh/aur_key
          chmod 600 ~/.ssh/aur_key
          touch ~/.ssh/known_hosts
          chmod 644 ~/.ssh/known_hosts
          retry 3 5 bash -lc 'ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts'

          export GIT_SSH_COMMAND="ssh -i ~/.ssh/aur_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o ConnectTimeout=10 -o ConnectionAttempts=3"

          retry 3 5 bash -lc 'rm -rf /tmp/jcode-aur && git clone --depth 1 ssh://aur@aur.archlinux.org/jcode-bin.git /tmp/jcode-aur'
          cd /tmp/jcode-aur
          git remote set-url origin ssh://aur@aur.archlinux.org/jcode-bin.git

          cat > PKGBUILD << 'PKGBUILD_END'
          # Maintainer: Jeremy Huang <jeremyhuang55555@gmail.com>
          pkgname=jcode-bin
          pkgver=VERSION_PLACEHOLDER
          pkgrel=1
          pkgdesc="AI coding agent powered by Claude and ChatGPT"
          arch=('x86_64')
          url="https://github.com/1jehuang/jcode"
          license=('MIT')
          provides=('jcode')
          conflicts=('jcode')
          source=("URL_PLACEHOLDER")
          sha256sums=('SHA_PLACEHOLDER')

          package() {
              install -Dm755 "${srcdir}/jcode-linux-x86_64" "${pkgdir}/usr/lib/jcode/jcode-linux-x86_64"
              install -Dm755 "${srcdir}/jcode-linux-x86_64.bin" "${pkgdir}/usr/lib/jcode/jcode-linux-x86_64.bin"
              if compgen -G "${srcdir}/libssl.so*" >/dev/null; then
                  install -Dm644 "${srcdir}"/libssl.so* "${pkgdir}/usr/lib/jcode/"
              fi
              if compgen -G "${srcdir}/libcrypto.so*" >/dev/null; then
                  install -Dm644 "${srcdir}"/libcrypto.so* "${pkgdir}/usr/lib/jcode/"
              fi
              mkdir -p "${pkgdir}/usr/bin"
              ln -s /usr/lib/jcode/jcode-linux-x86_64 "${pkgdir}/usr/bin/jcode"
          }
          PKGBUILD_END

          sed -i "s|VERSION_PLACEHOLDER|${VERSION_NUM}|" PKGBUILD
          sed -i "s|URL_PLACEHOLDER|${LINUX_URL}|" PKGBUILD
          sed -i "s|SHA_PLACEHOLDER|${LINUX_SHA}|" PKGBUILD
          sed -i 's/^          //' PKGBUILD

          # Generate .SRCINFO without makepkg (AUR uses tab indentation)
          printf 'pkgbase = jcode-bin\n' > .SRCINFO
          printf '\tpkgdesc = AI coding agent powered by Claude and ChatGPT\n' >> .SRCINFO
          printf '\tpkgver = %s\n' "${VERSION_NUM}" >> .SRCINFO
          printf '\tpkgrel = 1\n' >> .SRCINFO
          printf '\turl = https://github.com/1jehuang/jcode\n' >> .SRCINFO
          printf '\tarch = x86_64\n' >> .SRCINFO
          printf '\tlicense = MIT\n' >> .SRCINFO
          printf '\tprovides = jcode\n' >> .SRCINFO
          printf '\tconflicts = jcode\n' >> .SRCINFO
          printf '\tsource = %s\n' "${LINUX_URL}" >> .SRCINFO
          printf '\tsha256sums = %s\n' "${LINUX_SHA}" >> .SRCINFO
          printf '\npkgname = jcode-bin\n' >> .SRCINFO

          git config user.name "Jeremy Huang"
          git config user.email "jeremyhuang55555@gmail.com"
          git add PKGBUILD .SRCINFO
          git commit -m "Update to ${VERSION}" || echo "No changes"
          retry 3 5 git push origin master

      - name: Close issues included in the published release
        if: github.event_name != 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          label='triage: fixed-pending-release'
          repo="${GITHUB_REPOSITORY}"
          gh issue list --label "$label" --state open --json number --jq '.[].number' | while read -r issue; do
            [ -n "$issue" ] || continue
            gh issue close "$issue" \
              --comment "Released in [${RELEASE_TAG}](https://github.com/${repo}/releases/tag/${RELEASE_TAG}). Run \`jcode update\` to get it." \
              --reason completed
            gh issue edit "$issue" --remove-label "$label" || true
          done

      - name: Report Discord announcement queue failure
        if: always() && steps.discord_announcement.outcome == 'failure'
        run: |
          echo "The release was published, but its Discord announcement could not be queued." >&2
          exit 1