release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

# Pipeline shape:
#
#   test, test-pi, test-cli                                (unit tests, parallel)
#          ↓                    ↓
#   e2e-opencode             e2e-pi                           (Docker smoke, respective unit gates)
#   e2e-host-opencode        e2e-host-pi                      (host behavior, respective unit gates)
#   e2e-rust-hermetic-build → e2e-rust-hermetic (4 shards)   (independent Rust build and suite)
#                  ↓
#   publish-npm, publish-npm-pi, publish-npm-cli           (gated by every test and e2e job)
#                  ↓
#   github-release → discord-announce
#
# Two e2e layers cover different concerns:
#   - Docker e2e: fresh-install smoke (plugin loads, doctor clean, one mock turn writes DB
#     rows under the cortexkit path). Catches packaging / install-flow regressions.
#   - Host e2e: behavior suite with byte-level wire assertions, multi-turn cache stability,
#     historian publish behavior, tag-owner collision, synthetic todowrite, cross-harness
#     memory, etc. Spawns real `opencode serve` / Pi subprocesses against the embedded
#     mock provider. Catches cache-stability + correctness regressions that the smoke
#     layer cannot see. The Rust hermetic lane builds from the crate versions and git
#     revisions pinned in Cargo.lock, with a dedicated locked-source ck-subc build.
#
# Prior to v0.21.x the Docker e2e ran in a separate workflow (e2e-docker.yml) on the
# same tag push, so publishes could complete even if e2e failed. Folding both e2e
# layers inline closes that gap.
#
# Discord announcement also lives inline: GitHub Actions suppresses
# workflow cascades from `GITHUB_TOKEN`-authored events, so a separate
# `on: release: published` workflow never fires when `softprops/action-gh-release`
# publishes the release. discord-release.yml is kept as a manual override
# (workflow_dispatch only) for re-announcements and external releases.

jobs:
  test:
    name: Test (plugin)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      # node:sqlite (Pi / OpenCode-Desktop backend) is only reachable under
      # Node; Node 24 also strips the smoke script's inline TS.
      - uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Install dependencies
        run: bun install

      - name: TypeScript typecheck
        run: bun run typecheck

      - name: Lint
        run: bun run lint

      - name: Build
        run: bun run build

      - name: Check compiled TUI freshness
        run: bun run --cwd packages/plugin check:tui-compiled

      - name: Test
        run: bun run test

      # Verify the node:sqlite branch (transaction shim, readonly mapping,
      # #151 array-bind normalization) under real Node before publishing.
      - name: Smoke (node:sqlite backend)
        run: node packages/plugin/scripts/smoke-node-sqlite.ts

      # Smart-note QuickJS sandbox: verify the WASM is embedded in the BUNDLE
      # (not a sibling .wasm file the build never emits — bun test runs from src
      # and cannot see this).
      - name: Smoke (smart-note wasm bundle)
        run: bun packages/plugin/scripts/smoke-smartnote-wasm.ts

      # Verify the raw-TSX ./tui entry imports (OpenTUI/Solid runtime resolves)
      # before publishing — a missing dep ships a TUI that won't load.
      - name: Smoke (TUI entry import)
        run: bun packages/plugin/scripts/smoke-tui-import.ts

      # Packaged-install import — the only check that exercises the published
      # node_modules load path (the v0.31.1 failure class).
      - name: Smoke (TUI packaged install import)
        run: bun packages/plugin/scripts/smoke-tui-pack-install.ts --skip-build

      # Exercise the lazy token-estimate path from the real tarball inside the
      # same compiled-Bun module shape used by OpenCode.
      - name: Smoke (tokenizer packaged install estimate)
        run: bun packages/plugin/scripts/smoke-tokenizer-pack-install.ts --skip-build

  test-pi:
    name: Test (pi-plugin)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: TypeScript typecheck
        run: bun run --cwd packages/pi-plugin typecheck

      - name: Lint
        run: bun run --cwd packages/pi-plugin lint

      - name: Build
        run: bun run --cwd packages/pi-plugin build

      - name: Test
        run: bun run --cwd packages/pi-plugin test

  test-cli:
    name: Test (cli)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: TypeScript typecheck
        run: bun run --cwd packages/cli typecheck

      - name: Lint
        run: bun run --cwd packages/cli lint

      - name: Build
        run: bun run --cwd packages/cli build

      - name: Test
        run: bun run --cwd packages/cli test

  e2e-opencode:
    name: E2E (OpenCode, Docker)
    runs-on: ubuntu-latest
    needs: [test, test-cli]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      - name: Build OpenCode plugin
        run: bun run --cwd packages/plugin build

      - name: Build CLI
        # The CLI is its own package (@cortexkit/magic-context) since
        # v0.16.1; Dockerfile.opencode COPYs packages/cli/dist/ in.
        run: bun run --cwd packages/cli build

      - name: Build E2E image
        run: |
          docker build \
            --platform linux/amd64 \
            -f tests/docker/Dockerfile.opencode \
            -t mc-e2e-opencode \
            .

      - name: Run E2E
        run: docker run --rm --platform linux/amd64 mc-e2e-opencode

  e2e-pi:
    name: E2E (Pi, Docker)
    runs-on: ubuntu-latest
    needs: [test-pi, test-cli]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      - name: Build Pi plugin
        run: bun run --cwd packages/pi-plugin build

      - name: Build CLI
        # The CLI moved to its own package (@cortexkit/magic-context) in
        # v0.16.1. Dockerfile.pi COPYs packages/cli/dist/ in for the
        # `magic-context doctor --harness pi` test invocation.
        run: bun run --cwd packages/cli build

      - name: Build E2E image
        # The Pi Dockerfile installs runtime deps fresh inside the image
        # (better-sqlite3 builds against linux/amd64), so no host-side
        # `npm install` is needed.
        run: |
          docker build \
            --platform linux/amd64 \
            -f tests/docker/Dockerfile.pi \
            -t mc-e2e-pi \
            .

      - name: Run E2E
        run: docker run --rm --platform linux/amd64 mc-e2e-pi

  e2e-host-opencode:
    name: E2E (OpenCode, host behavior)
    runs-on: ubuntu-latest
    needs: [test, test-cli]
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      # Install opencode the same way the Docker image does — the host
      # suite spawns `opencode serve` from PATH.
      - name: Install opencode
        # Float to LATEST (the version users run). See ci.yml for the rationale
        # + re-pin escape hatch for known-bad upstream builds.
        run: |
          OPENCODE_VERSION=latest bash tests/docker/install-opencode.sh
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"

      - name: Verify opencode on PATH
        run: opencode --version

      - name: Build OpenCode plugin
        # Host tests spawn `opencode serve` with a file:// plugin
        # specifier pointing at packages/plugin/, so dist must exist.
        run: bun run --cwd packages/plugin build

      # Strip inherited NODE_ENV=test so the spawned opencode subprocess
      # gets the same logging + runtime behavior as a normal local run
      # (documented in CONTRIBUTING / project memory).
      - name: Run host e2e suite (OpenCode tests only)
        env:
          NODE_ENV: ""
          MC_E2E_MODE: ts
          MC_E2E_HOST: opencode
        run: |
          cd packages/e2e-tests
          # The validated manifest selects canonical scenarios for this host.
          set -o pipefail
          files=$(bun scripts/validate-mode-manifest.ts --mode ts --harness opencode | tr '\n' ' ')
          if [ -z "${files// /}" ]; then echo 'mode manifest selected no files'; exit 1; fi
          echo "Running OpenCode host tests: $files"
          # shellcheck disable=SC2086 # The repository-controlled file list must expand into Bun arguments.
          bun test --timeout 600000 $files
          bun test --timeout 600000 src/cache-analysis.test.ts

  e2e-host-pi:
    name: E2E (Pi, host behavior)
    runs-on: ubuntu-latest
    needs: [test-pi, test-cli]
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      # Pi tests resolve the Pi binary via createRequire against
      # @earendil-works/pi-coding-agent, which is a workspace dep of
      # packages/pi-plugin.
      - name: Install workspace deps
        run: bun install --frozen-lockfile

      # pi-cross-harness.test.ts spawns BOTH a Pi runner and an OpenCode
      # serve to verify cross-harness memory sharing, so this job needs
      # opencode on PATH too. Float to LATEST like the OpenCode host job
      # (see ci.yml for the rationale + re-pin escape hatch).
      - name: Install opencode
        run: |
          OPENCODE_VERSION=latest bash tests/docker/install-opencode.sh
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"

      - name: Verify opencode on PATH
        run: opencode --version

      - name: Build Pi plugin
        run: bun run --cwd packages/pi-plugin build

      # pi-cross-harness also instantiates the OpenCode harness, which
      # spawns `opencode serve` with a file:// plugin specifier pointing
      # at packages/plugin/. That dist must exist.
      - name: Build OpenCode plugin
        run: bun run --cwd packages/plugin build

      - name: Run host e2e suite (Pi tests only)
        env:
          NODE_ENV: ""
          MC_E2E_MODE: ts
          MC_E2E_HOST: pi
        run: |
          cd packages/e2e-tests
          set -o pipefail
          files=$(bun scripts/validate-mode-manifest.ts --mode ts --harness pi | tr '\n' ' ')
          if [ -z "${files// /}" ]; then echo 'mode manifest selected no files'; exit 1; fi
          # shellcheck disable=SC2086 # The repository-controlled file list must expand into Bun arguments.
          bun test --timeout 600000 $files

  e2e-rust-hermetic-build:
    name: E2E (Rust hermetic build)
    runs-on: ubuntu-latest
    timeout-minutes: 120
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Resolve Cargo.lock crate pins
        id: cargo-pins
        shell: bash
        run: |
          set -euo pipefail
          python3 scripts/cargo-lock-pins.py --self-test
          pins="$(python3 scripts/cargo-lock-pins.py)"
          printf '%s\n' "$pins" >> "$GITHUB_OUTPUT"
          locked_crates="$(printf '%s\n' "$pins" | sed -n 's/^locked_crates=//p')"
          echo "Cargo.lock pins: $locked_crates" >> "$GITHUB_STEP_SUMMARY"


      # Cargo builds the locked subc-core library as a dependency but not its daemon
      # binary target. Keep this checkout only in the artifact builder that produces
      # ck-subc; the parallel e2e shards download and execute that binary.
      - name: Check out Cargo.lock-pinned subconscious source for ck-subc
        uses: actions/checkout@v5
        with:
          repository: cortexkit/subconscious
          path: .siblings/subconscious
          ref: ${{ steps.cargo-pins.outputs.subc_revision }}

      - name: Record locked daemon source revision
        id: daemon-source
        shell: bash
        run: |
          set -euo pipefail
          sha="$(git -C "$GITHUB_WORKSPACE/.siblings/subconscious" rev-parse HEAD)"
          expected="${{ steps.cargo-pins.outputs.subc_revision }}"
          if [[ "$sha" != "$expected" ]]; then
            echo "checked out daemon source $sha, expected Cargo.lock revision $expected" >&2
            exit 1
          fi
          summary="ck-subc source pinned by Cargo.lock: $sha"
          echo "$summary"
          echo "$summary" >> "$GITHUB_STEP_SUMMARY"
          echo "sha=$sha" >> "$GITHUB_OUTPUT"

      - name: Derive hermetic Cargo cache key
        id: cargo-cache-key
        shell: bash
        run: |
          set -euo pipefail
          # Include the resolved graph and the exact daemon source revision.
          lock_digest="$(sha256sum Cargo.lock | awk '{print $1}')"
          source_sha="${{ steps.daemon-source.outputs.sha }}"
          digest="$(printf '%s\n%s\n' "$lock_digest" "$source_sha" | sha256sum | awk '{print $1}')"
          echo "key=rust-hermetic-${RUNNER_OS}-${RUNNER_ARCH}-${digest}" >> "$GITHUB_OUTPUT"
      - name: Restore ck-subc and ckdev-mc-e2e Cargo target cache
        uses: actions/cache@v4
        with:
          path: packages/e2e-tests/.cache/rust-e2e-cargo-target
          key: ${{ steps.cargo-cache-key.outputs.key }}
      - name: Build hermetic binary pair (including fault-injection variant)
        shell: bash
        run: |
          set -euo pipefail
          target="$GITHUB_WORKSPACE/packages/e2e-tests/.cache/rust-e2e-cargo-target"
          mkdir -p "$target/prebuilt"
          CARGO_TARGET_DIR="$target" cargo build --release -p mc-module
          cp "$target/release/ck-mc" "$target/prebuilt/ckdev-mc-e2e"
          CARGO_TARGET_DIR="$target" cargo build --release -p mc-module --features drive-fault
          cp "$target/release/ck-mc" "$target/prebuilt/ckdev-mc-e2e-drive-fault"
          (cd "$GITHUB_WORKSPACE/.siblings/subconscious" && CARGO_TARGET_DIR="$target" cargo build --release -p subc-core --bins)
          cp "$target/release/ck-subc" "$target/prebuilt/ckdev-subc"
      - uses: actions/upload-artifact@v4
        with:
          name: rust-hermetic-binaries
          path: packages/e2e-tests/.cache/rust-e2e-cargo-target/prebuilt/
          if-no-files-found: error
          retention-days: 1

  e2e-rust-hermetic:
    name: E2E (Rust hermetic ${{ matrix.shard }}/4)
    runs-on: ubuntu-latest
    needs: [e2e-rust-hermetic-build]
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        shard: [0, 1, 2, 3]
    permissions:
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Install workspace dependencies
        run: bun install --frozen-lockfile
      - name: Download hermetic binaries (retry transient failures and verify digest)
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 scripts/download-ci-artifact.py --artifact-name rust-hermetic-binaries --path packages/e2e-tests/.cache/prebuilt
      - name: Make downloaded binaries executable
        run: |
          if [[ ! -f packages/e2e-tests/.cache/prebuilt/ckdev-mc-e2e || ! -f packages/e2e-tests/.cache/prebuilt/ckdev-mc-e2e-drive-fault || ! -f packages/e2e-tests/.cache/prebuilt/ckdev-subc ]]; then
            echo "::error::artifact not downloaded: missing one or more hermetic binaries" >&2
            exit 1
          fi
          chmod +x packages/e2e-tests/.cache/prebuilt/ckdev-mc-e2e packages/e2e-tests/.cache/prebuilt/ckdev-mc-e2e-drive-fault packages/e2e-tests/.cache/prebuilt/ckdev-subc
      - name: Install pinned OpenCode
        run: |
          OPENCODE_VERSION=1.18.32 bash tests/docker/install-opencode.sh
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"
      - name: Build host plugins
        run: |
          bun run --cwd packages/plugin build
          bun run --cwd packages/pi-plugin build
      - name: Run manifest shard
        env:
          MC_E2E_SHARD: ${{ matrix.shard }}/4
          MC_E2E_CK_MC_PREBUILT_BIN: ${{ github.workspace }}/packages/e2e-tests/.cache/prebuilt/ckdev-mc-e2e
          MC_E2E_CK_MC_DRIVE_FAULT_BIN: ${{ github.workspace }}/packages/e2e-tests/.cache/prebuilt/ckdev-mc-e2e-drive-fault
          MC_E2E_CK_SUBC_BIN: ${{ github.workspace }}/packages/e2e-tests/.cache/prebuilt/ckdev-subc
        run: scripts/run-rust-hermetic-e2e.sh
  publish-npm:
    name: Publish plugin to npm
    runs-on: ubuntu-latest
    # Publishes are gated on the full e2e suite (OpenCode + Pi) so a tag
    # push can never produce a published npm package whose runtime fails
    # the install + first-turn smoke test.
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi, e2e-rust-hermetic-build, e2e-rust-hermetic]
    # Every Rust shard must pass before publishing.
    if: >-
      always() &&
      needs.test.result == 'success' &&
      needs.test-pi.result == 'success' &&
      needs.test-cli.result == 'success' &&
      needs.e2e-opencode.result == 'success' &&
      needs.e2e-pi.result == 'success' &&
      needs.e2e-host-opencode.result == 'success' &&
      needs.e2e-host-pi.result == 'success' &&
      needs.e2e-rust-hermetic-build.result == 'success' &&
      needs.e2e-rust-hermetic.result == 'success'
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure latest npm (for trusted publishing)
        run: npm install -g npm@latest

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Sync version from tag
        run: node scripts/version-sync.mjs --from-tag

      - name: Build plugin
        run: bun run --cwd packages/plugin build

      - name: Generate schema
        run: bun packages/plugin/scripts/build-schema.ts

      - name: Copy README for npm package
        run: cp README.md packages/plugin/README.md

      # Uses npm Trusted Publishing (OIDC) — configured on npmjs.com
      - name: Publish to npm
        run: npm publish --access public --provenance
        working-directory: packages/plugin

  publish-npm-pi:
    name: Publish pi-plugin to npm
    runs-on: ubuntu-latest
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi, e2e-rust-hermetic-build, e2e-rust-hermetic]
    # Every Rust shard must pass before publishing.
    if: >-
      always() &&
      needs.test.result == 'success' &&
      needs.test-pi.result == 'success' &&
      needs.test-cli.result == 'success' &&
      needs.e2e-opencode.result == 'success' &&
      needs.e2e-pi.result == 'success' &&
      needs.e2e-host-opencode.result == 'success' &&
      needs.e2e-host-pi.result == 'success' &&
      needs.e2e-rust-hermetic-build.result == 'success' &&
      needs.e2e-rust-hermetic.result == 'success'
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure latest npm (for trusted publishing)
        run: npm install -g npm@latest

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Sync version from tag
        run: node scripts/version-sync.mjs --from-tag

      - name: Build pi-plugin
        run: bun run --cwd packages/pi-plugin build

      # Uses npm Trusted Publishing (OIDC) — must be configured on npmjs.com
      # for @cortexkit/pi-magic-context before first release.
      - name: Publish to npm
        run: npm publish --access public --provenance
        working-directory: packages/pi-plugin

  publish-npm-cli:
    name: Publish unified CLI to npm
    runs-on: ubuntu-latest
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi, e2e-rust-hermetic-build, e2e-rust-hermetic]
    # Every Rust shard must pass before publishing.
    if: >-
      always() &&
      needs.test.result == 'success' &&
      needs.test-pi.result == 'success' &&
      needs.test-cli.result == 'success' &&
      needs.e2e-opencode.result == 'success' &&
      needs.e2e-pi.result == 'success' &&
      needs.e2e-host-opencode.result == 'success' &&
      needs.e2e-host-pi.result == 'success' &&
      needs.e2e-rust-hermetic-build.result == 'success' &&
      needs.e2e-rust-hermetic.result == 'success'
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure latest npm (for trusted publishing)
        run: npm install -g npm@latest

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Sync version from tag
        run: node scripts/version-sync.mjs --from-tag

      - name: Build cli
        run: bun run --cwd packages/cli build

      # Uses npm Trusted Publishing (OIDC) — must be configured on npmjs.com
      # for @cortexkit/magic-context before first release.
      - name: Publish to npm
        run: npm publish --access public --provenance
        working-directory: packages/cli

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    # Wait for ALL three npm publishes to succeed before tagging the
    # GitHub release. Previously this depended only on test jobs, so a
    # publish timeout or registry failure could leave a published release
    # page on GitHub while one of the @cortexkit/* packages was missing
    # from npm.
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi, publish-npm, publish-npm-pi, publish-npm-cli]
    # Explicit per-need conditions instead of the default success(): the default
    # evaluates the TRANSITIVE needs chain. This keeps the release job governed by
    # the results of its direct needs, including the publish jobs' explicit
    # handling of a tag-scoped Rust-suite skip.
    if: >-
      always() &&
      needs.test.result == 'success' &&
      needs.test-pi.result == 'success' &&
      needs.test-cli.result == 'success' &&
      needs.e2e-opencode.result == 'success' &&
      needs.e2e-pi.result == 'success' &&
      needs.e2e-host-opencode.result == 'success' &&
      needs.e2e-host-pi.result == 'success' &&
      needs.publish-npm.result == 'success' &&
      needs.publish-npm-pi.result == 'success' &&
      needs.publish-npm-cli.result == 'success'
    steps:
      - uses: actions/checkout@v5

      - name: Verify curated release notes exist
        # `.cortexkit/release-notes/<tag>.md` is the source of truth for the
        # release body AND the Discord post. Only public release notes, skills,
        # and rules are tracked under .cortexkit/ — see .gitignore. Fail loudly
        # if the file is missing so we don't ship a release with the bare
        # `**Full Changelog**: ...` GitHub auto-generated body.
        run: |
          notes_file=".cortexkit/release-notes/${GITHUB_REF_NAME}.md"
          if [ ! -f "$notes_file" ]; then
            echo "::error::Curated release notes missing: $notes_file"
            echo "Draft them under .cortexkit/release-notes/ before tagging the release."
            exit 1
          fi
          # Release-note drafts are often checked against the code in an audit
          # appendix. That audit is for the maintainer; it must never become
          # the public release body (it did once, in v0.49.0).
          if grep -n -i -E '^#{1,6} .*(appendix|commit audit)' "$notes_file"; then
            echo "::error::$notes_file contains an internal audit section. Remove it before tagging."
            exit 1
          fi
          echo "Using $notes_file as the release body."
          wc -l "$notes_file"

      - name: Unwrap hard-wrapped release notes
        # GitHub release bodies render single newlines as hard line breaks,
        # so editor-wrapped source markdown displays as ragged short lines.
        # Join continuation lines inside paragraphs and list items; keep
        # headings, blank lines, and code fences verbatim.
        run: |
          python3 - "$GITHUB_REF_NAME" <<'PY'
          import re, sys
          path = f".cortexkit/release-notes/{sys.argv[1]}.md"
          src = open(path).read()
          out, in_fence = [], False
          for line in src.splitlines():
              s = line.rstrip()
              if s.lstrip().startswith("```"):
                  in_fence = not in_fence
                  out.append(s)
                  continue
              structural = (
                  in_fence
                  or not s.strip()
                  or s.startswith("#")
                  or re.match(r"^\s*([-*+]|\d+\.)\s", s)
                  or s.lstrip().startswith("|")
              )
              if structural or not out or not out[-1].strip() \
                      or out[-1].startswith("#") or out[-1].lstrip().startswith("```") \
                      or out[-1].lstrip().startswith("|"):
                  out.append(s)
              else:
                  out[-1] = out[-1].rstrip() + " " + s.strip()
          open(path, "w").write("\n".join(out) + "\n")
          PY

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          body_path: .cortexkit/release-notes/${{ github.ref_name }}.md

  # Announce on Discord after the GitHub release is created.
  #
  # Why this lives here (not in discord-release.yml as `on: release: published`):
  # GitHub Actions intentionally suppresses event-triggered workflow cascades
  # from `GITHUB_TOKEN`-authored events. `softprops/action-gh-release@v2` uses
  # the default `GITHUB_TOKEN`, so the `release: published` event it emits does
  # not trigger downstream workflows. Inlining the Discord post here is the
  # cleanest fix (vs rotating PATs for release creation).
  #
  # `continue-on-error: true` keeps Discord failures from rolling back a
  # successful release — if the webhook is down, the announcement can be
  # retried via `gh workflow run discord-release.yml ...`.
  discord-announce:
    name: Announce on Discord
    runs-on: ubuntu-latest
    needs: github-release
    # always() + explicit result check for the same transitive-skip reason as
    # github-release above — a skipped upstream leg must not eat the announcement.
    if: always() && needs.github-release.result == 'success'
    continue-on-error: true
    steps:
      - uses: actions/checkout@v5

      - name: Read curated release notes
        id: notes
        run: |
          notes_file=".cortexkit/release-notes/${GITHUB_REF_NAME}.md"
          if [ ! -f "$notes_file" ]; then
            echo "::error::Curated release notes missing: $notes_file"
            exit 1
          fi
          {
            echo "body<<DISCORD_EOF"
            cat "$notes_file"
            echo "DISCORD_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Post to Discord
        uses: SethCohen/github-releases-to-discord@v1
        with:
          webhook_url: ${{ secrets.DISCORD_RELEASE_WEBHOOK_URL }}
          # Cortexkit teal — decimal value of #2C4A7C.
          color: "2902140"
          username: "Magic Context Releases"
          # Reduce h1/h2 headings to fit Discord embed limits comfortably.
          reduce_headings: true
          # Keep PR/issue links — useful context in Discord.
          remove_github_reference_links: false
          footer_title: "Changelog"
          footer_timestamp: true
          release_name: ${{ github.ref_name }}
          release_body: ${{ steps.notes.outputs.body }}
          release_html_url: https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }}