release.yml

name: Deploy Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to publish
        required: true
        type: string
      desktop_only:
        description: Rebuild and publish only signed desktop CLI assets
        required: false
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: deploy-release-${{ github.event.release.tag_name || inputs.tag }}
  cancel-in-progress: false

jobs:
  verify:
    name: Verify release artifact
    if: ${{ github.repository == 'verbeux-ai/code' && (github.event_name == 'workflow_dispatch' || !github.event.release.draft) }}
    runs-on: blacksmith-4vcpu-ubuntu-2404
    outputs:
      tag: ${{ steps.release.outputs.tag }}
    permissions:
      contents: read
    steps:
      - name: Resolve release tag
        id: release
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
        run: |
          case "$RELEASE_TAG" in
            v[0-9]*.[0-9]*.[0-9]*) ;;
            *)
              echo "Release tag must use the vMAJOR.MINOR.PATCH format; got: $RELEASE_TAG" >&2
              exit 1
              ;;
          esac
          echo "tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"

      - name: Check out release tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ steps.release.outputs.tag }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .bun-version

      - name: Validate release version
        env:
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
        run: |
          # shellcheck disable=SC2016 # JavaScript expands its own template literals.
          node -e 'const version = require("./package.json").version; const tag = process.env.RELEASE_TAG; if (`v${version}` !== tag) { console.error(`package.json is ${version}, but the published release is ${tag}`); process.exit(1) }'

      - name: Install dependencies
        run: bun install --frozen-lockfile

  cli-quality:
    needs: verify
    uses: ./.github/workflows/cli-quality.yml
    with:
      ref: ${{ needs.verify.outputs.tag }}

  publish-npm:
    name: Publish npm package
    needs: [verify, cli-quality]
    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.desktop_only) }}
    # npm provenance only supports GitHub-hosted runners.
    runs-on: ubuntu-latest
    environment:
      name: release
      url: https://www.npmjs.com/package/@verboo/code
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Check out release tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.verify.outputs.tag }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Download the tested npm artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: tested-npm-package
          path: .artifacts/package

      - name: Verify tested artifact checksum
        run: node scripts/prepare-cli-package.mjs --verify-only

      - name: Clear token auth for trusted publishing
        run: |
          unset NODE_AUTH_TOKEN
          echo "NODE_AUTH_TOKEN=" >> "$GITHUB_ENV"

      - name: Publish to npm
        working-directory: .artifacts/package
        run: npm publish ./verboo-code-*.tgz --ignore-scripts --access public --provenance

      - name: Release summary
        env:
          RELEASE_TAG: ${{ needs.verify.outputs.tag }}
        run: |
          {
            echo "## Released $RELEASE_TAG"
            echo
            echo "- npm: https://www.npmjs.com/package/@verboo/code"
            echo "- GitHub: https://github.com/verbeux-ai/code/releases/tag/$RELEASE_TAG"
          } >> "$GITHUB_STEP_SUMMARY"

  docker:
    name: Build and push Docker image
    needs: [verify, cli-quality]
    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.desktop_only) }}
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
      packages: write
    steps:
      - name: Check out release tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.verify.outputs.tag }}

      - name: Set up Docker Buildx
        uses: useblacksmith/setup-docker-builder@v1
        with:
          max-cache-size-mb: "20480"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}},value=${{ needs.verify.outputs.tag }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.verify.outputs.tag }}
            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}

      - name: Build and load locally
        uses: useblacksmith/build-push-action@v2
        with:
          context: .
          load: true
          tags: verboo:smoke

      - name: Smoke test
        run: |
          docker run --rm verboo:smoke --version
          docker run --rm verboo:smoke --internal-protocol-self-test

      - name: Build and push
        uses: useblacksmith/build-push-action@v2
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  desktop-cli-artifacts:
    name: Build desktop CLI (${{ matrix.target }})
    needs: [verify, cli-quality]
    if: ${{ github.repository == 'verbeux-ai/code' }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            runner: macos-15
          - target: x86_64-apple-darwin
            runner: macos-15-intel
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-22.04
    permissions:
      contents: read

    steps:
      - name: Check out release tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.verify.outputs.tag }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .bun-version

      - name: Install production dependency closure
        run: bun install --frozen-lockfile --production

      - name: Build and test desktop distribution
        run: |
          bun run build
          bun run desktop:test

      - name: Package native desktop CLI
        run: bun run desktop:package -- --target "${{ matrix.target }}" --output-dir .artifacts/desktop-cli --node-executable node

      - name: Upload native archive
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: desktop-cli-${{ matrix.target }}
          path: .artifacts/desktop-cli/verboo-cli-*
          if-no-files-found: error
          retention-days: 7

  publish-desktop-cli:
    name: Sign and publish desktop CLI assets
    needs:
      - verify
      - cli-quality
      - desktop-cli-artifacts
    if: ${{ github.repository == 'verbeux-ai/code' }}
    runs-on: ubuntu-22.04
    environment:
      name: release
      url: https://github.com/verbeux-ai/code/releases/tag/${{ needs.verify.outputs.tag }}
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64: ${{ secrets.VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64 }}
      VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY: ${{ secrets.VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY }}

    steps:
      - name: Check out release tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.verify.outputs.tag }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: .bun-version

      - name: Download native archives
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: desktop-cli-*
          path: .artifacts/desktop-cli
          merge-multiple: true

      - name: Install pinned Minisign
        env:
          MINISIGN_VERSION: "0.12"
          MINISIGN_LINUX_SHA256: 9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73
        run: |
          ARCHIVE="$RUNNER_TEMP/minisign-linux.tar.gz"
          BIN_DIR="$RUNNER_TEMP/minisign-bin"
          curl --fail --location --retry 3 --silent --show-error \
            "https://github.com/jedisct1/minisign/releases/download/${MINISIGN_VERSION}/minisign-${MINISIGN_VERSION}-linux.tar.gz" \
            --output "$ARCHIVE"
          printf '%s  %s\n' "$MINISIGN_LINUX_SHA256" "$ARCHIVE" | sha256sum --check --strict -
          mkdir -p "$BIN_DIR"
          tar -xzf "$ARCHIVE" -C "$BIN_DIR" --strip-components=2 minisign-linux/x86_64/minisign
          chmod 0755 "$BIN_DIR/minisign"
          echo "$BIN_DIR" >> "$GITHUB_PATH"
          "$BIN_DIR/minisign" -v

      - name: Require protected signing configuration
        run: |
          if [ -z "$VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64" ] || [ -z "$VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY" ]; then
            echo "Protected desktop CLI signing configuration is missing" >&2
            exit 1
          fi
          printf '%s' "$VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64" | base64 --decode > "$RUNNER_TEMP/verboo-desktop-cli.key"
          printf '%s\n' "$VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY" > "$RUNNER_TEMP/verboo-desktop-cli.pub"

      - name: Generate, sign, and verify manifest
        env:
          RELEASE_TAG: ${{ needs.verify.outputs.tag }}
        run: |
          SOURCE_DATE=$(git log -1 --format=%cI "$RELEASE_TAG")
          RELEASED_AT=$(node -e 'console.log(new Date(process.argv[1]).toISOString())' "$SOURCE_DATE")
          SIGNING_KEY_ID=$(node -e 'const crypto = require("node:crypto"); console.log(crypto.createHash("sha256").update(process.env.VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY.trim(), "utf8").digest("hex").slice(0, 16))')
          bun run desktop:manifest -- \
            --assets-dir .artifacts/desktop-cli \
            --repository verbeux-ai/code \
            --tag "$RELEASE_TAG" \
            --released-at "$RELEASED_AT" \
            --signing-key-id "$SIGNING_KEY_ID"
          minisign -Sm .artifacts/desktop-cli/verboo-cli-manifest.json \
            -s "$RUNNER_TEMP/verboo-desktop-cli.key" \
            -x .artifacts/desktop-cli/verboo-cli-manifest.minisig \
            -t "Verboo desktop CLI $RELEASE_TAG"
          bun run desktop:verify -- \
            --assets-dir .artifacts/desktop-cli \
            --public-key "$RUNNER_TEMP/verboo-desktop-cli.pub"

      - name: Upload signed desktop CLI release assets
        env:
          RELEASE_TAG: ${{ needs.verify.outputs.tag }}
        run: |
          gh release upload "$RELEASE_TAG" \
            .artifacts/desktop-cli/verboo-cli-*.tar.gz \
            .artifacts/desktop-cli/verboo-cli-manifest.json \
            .artifacts/desktop-cli/verboo-cli-manifest.minisig

      - name: Remove signing key from runner
        if: always()
        run: rm -f "$RUNNER_TEMP/verboo-desktop-cli.key" "$RUNNER_TEMP/verboo-desktop-cli.pub"