main.yml

name: build, test and release sqlite-sync
on:
  push:
    branches:
      - '**'
    tags-ignore:
      - '**'
    paths-ignore:
      - 'docs/**'
      - '**.md'
      - 'LICENSE*'
  workflow_dispatch:

permissions:
  contents: write
  pages: write
  id-token: write

# Cancel an in-progress run when the same branch is pushed again. This also keeps two
# runs of the same branch from hitting the shared integration tenants concurrently
# (the chunked negative-cache test needs an idle tenant — see the chunked env below).
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    if: ${{ !contains(github.event.head_commit.message, '[auto-update]') }}
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container && matrix.container || '' }}
    name: ${{ matrix.name }}${{ matrix.arch && format('-{0}', matrix.arch) || '' }} build${{ matrix.arch != 'arm64-v8a' && matrix.arch != 'armeabi-v7a' && matrix.name != 'ios-sim' && matrix.name != 'ios' && matrix.name != 'mac-catalyst' && matrix.name != 'apple-xcframework' && matrix.name != 'android-aar' && ( matrix.name != 'macos' || matrix.arch != 'x86_64' ) && ' + test' || ''}}
    timeout-minutes: 20
    # Only this leg receives the shared chunked tenant. Lock it across branches,
    # and queue competing runs instead of canceling a pending PR's validation.
    concurrency:
      group: ${{ (matrix.name == 'linux' && matrix.arch == 'x86_64') && 'cloudsync-chunked-test-tenant' || format('build-{0}-{1}-{2}', github.run_id, matrix.name, matrix.arch) }}
      cancel-in-progress: false
      queue: max
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            arch: x86_64
            name: linux
          - os: ubuntu-22.04-arm
            arch: arm64
            name: linux
          - os: ubuntu-22.04
            arch: x86_64
            name: linux-musl
            container: alpine:latest
          - os: ubuntu-22.04-arm
            arch: arm64
            name: linux-musl
          - os: macos-15
            name: macos
            make: COVERAGE=ON
          - os: macos-15
            arch: x86_64
            name: macos
            make: ARCH=x86_64
          - os: macos-15
            arch: arm64
            name: macos
            make: ARCH=arm64
          - os: windows-2022
            arch: x86_64
            name: windows
          - os: ubuntu-22.04
            arch: arm64-v8a
            name: android
            make: PLATFORM=android ARCH=arm64-v8a
          - os: ubuntu-22.04
            arch: armeabi-v7a
            name: android
            make: PLATFORM=android ARCH=armeabi-v7a
          - os: ubuntu-22.04
            arch: x86_64
            name: android
            make: PLATFORM=android ARCH=x86_64
            sqlite-amalgamation-zip: https://sqlite.org/2025/sqlite-amalgamation-3490100.zip
          - os: macos-15
            name: ios
            make: PLATFORM=ios
          - os: macos-15
            name: ios-sim
            make: PLATFORM=ios-sim
          - os: macos-15
            name: mac-catalyst
            make: PLATFORM=mac-catalyst
          - os: macos-15
            name: apple-xcframework
            make: xcframework
          - os: ubuntu-22.04
            name: android-aar
            make: aar

    defaults:
      run:
        shell: ${{ matrix.container && 'sh' || 'bash' }}

    env:
      INTEGRATION_TEST_DATABASE_ID: ${{ secrets.INTEGRATION_TEST_DATABASE_ID }}
      INTEGRATION_TEST_APIKEY: ${{ secrets.INTEGRATION_TEST_APIKEY }}
      INTEGRATION_TEST_CLOUDSYNC_ADDRESS: ${{ secrets.INTEGRATION_TEST_CLOUDSYNC_ADDRESS }}
      INTEGRATION_TEST_OFFLINE_DATABASE_ID: ${{ secrets.INTEGRATION_TEST_OFFLINE_DATABASE_ID }}
      INTEGRATION_TEST_FAILURE_DATABASE_ID: ${{ secrets.INTEGRATION_TEST_FAILURE_DATABASE_ID }}
      INTEGRATION_TEST_WEBLITE_ADDRESS: ${{ secrets.INTEGRATION_TEST_WEBLITE_ADDRESS }}
      # Chunked tests need an EXCLUSIVE tenant (the negative-cache test's Phase 2 asserts
      # an idle tenant, so concurrent writers from other matrix legs cause false failures).
      # Run them on a single leg only; every other leg gets '' and skips them (treated as
      # unset by test_chunked_pair_open). The chunked network path is platform-agnostic C,
      # so per-OS coverage adds little here.
      INTEGRATION_TEST_CHUNKED_DATABASE_ID: ${{ (matrix.name == 'linux' && matrix.arch == 'x86_64') && secrets.INTEGRATION_TEST_CHUNKED_DATABASE_ID || '' }}

    steps:

      - name: install git for alpine container
        if: matrix.container
        run: apk add --no-cache git

      - uses: actions/checkout@v4.2.2
        with:
          submodules: true

      - name: android setup java
        if: matrix.name == 'android-aar'
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

      - uses: msys2/setup-msys2@v2.27.0
        if: matrix.name == 'windows'
        with:
          msystem: mingw64
          install: mingw-w64-x86_64-cc make

      - name: windows install dependencies
        if: matrix.name == 'windows'
        run: choco install sqlite -y && command -v sqlite3

      - name: macos install dependencies
        if: matrix.name == 'macos'
        run: brew link sqlite --force && brew install lcov
      
      - name: linux-musl x86_64 install dependencies
        if: matrix.name == 'linux-musl' && matrix.arch == 'x86_64'
        run: apk update && apk add --no-cache gcc make curl sqlite openssl-dev musl-dev linux-headers
      
      - name: linux-musl arm64 setup container
        if: matrix.name == 'linux-musl' && matrix.arch == 'arm64'
        run: |
          docker run -d --name alpine \
            --platform linux/arm64 \
            -v ${{ github.workspace }}:/workspace \
            -w /workspace \
            -e INTEGRATION_TEST_DATABASE_ID="${{ env.INTEGRATION_TEST_DATABASE_ID }}" \
            -e INTEGRATION_TEST_APIKEY="${{ env.INTEGRATION_TEST_APIKEY }}" \
            -e INTEGRATION_TEST_CLOUDSYNC_ADDRESS="${{ env.INTEGRATION_TEST_CLOUDSYNC_ADDRESS }}" \
            -e INTEGRATION_TEST_OFFLINE_DATABASE_ID="${{ env.INTEGRATION_TEST_OFFLINE_DATABASE_ID }}" \
            -e INTEGRATION_TEST_FAILURE_DATABASE_ID="${{ env.INTEGRATION_TEST_FAILURE_DATABASE_ID }}" \
            -e INTEGRATION_TEST_CHUNKED_DATABASE_ID="${{ env.INTEGRATION_TEST_CHUNKED_DATABASE_ID }}" \
            -e INTEGRATION_TEST_WEBLITE_ADDRESS="${{ env.INTEGRATION_TEST_WEBLITE_ADDRESS }}" \
            alpine:latest \
            tail -f /dev/null
          docker exec alpine sh -c "apk update && apk add --no-cache gcc make curl sqlite openssl-dev musl-dev linux-headers"

      - name: windows build curl
        if: matrix.name == 'windows'
        run: make curl/windows/libcurl.a
        shell: msys2 {0}

      - name: build sqlite-sync
        run: ${{ matrix.name == 'linux-musl' && matrix.arch == 'arm64' && 'docker exec alpine' || '' }} make extension ${{ matrix.make && matrix.make || ''}}

      - name: create keychain for codesign
        if: matrix.os == 'macos-15'
        run: |
          echo "${{ secrets.APPLE_CERTIFICATE }}" | base64 --decode > certificate.p12
          security create-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" build.keychain
          security import certificate.p12 -k build.keychain -P "${{ secrets.CERTIFICATE_PASSWORD }}" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${{ secrets.KEYCHAIN_PASSWORD }}" build.keychain

      - name: codesign and notarize dylib
        if: matrix.os == 'macos-15' && matrix.name != 'apple-xcframework'
        run: |
          codesign --sign "${{ secrets.APPLE_TEAM_ID }}" --timestamp --options runtime dist/cloudsync.dylib
          ditto -c -k dist/cloudsync.dylib dist/cloudsync.zip
          xcrun notarytool submit dist/cloudsync.zip --apple-id "${{ secrets.APPLE_ID }}" --password "${{ secrets.APPLE_PASSWORD }}" --team-id "${{ secrets.APPLE_TEAM_ID }}" --wait
          rm dist/cloudsync.zip

      - name: codesign and notarize xcframework
        if: matrix.name == 'apple-xcframework'
        run: |
          find dist/CloudSync.xcframework -name "*.framework" -exec echo "Signing: {}" \; -exec codesign --sign "${{ secrets.APPLE_TEAM_ID }}" --timestamp --options runtime {} \; # Sign each individual framework FIRST
          codesign --sign "${{ secrets.APPLE_TEAM_ID }}" --timestamp --options runtime dist/CloudSync.xcframework # Then sign the xcframework wrapper
          ditto -c -k --keepParent dist/CloudSync.xcframework dist/CloudSync.xcframework.zip
          xcrun notarytool submit dist/CloudSync.xcframework.zip --apple-id "${{ secrets.APPLE_ID }}" --password "${{ secrets.APPLE_PASSWORD }}" --team-id "${{ secrets.APPLE_TEAM_ID }}" --wait
          rm -rf dist/CloudSync.xcframework

      - name: cleanup keychain for codesign
        if: matrix.os == 'macos-15'
        run: |
          rm certificate.p12
          security delete-keychain build.keychain

      - name: android setup test environment
        if: matrix.name == 'android' && matrix.arch != 'arm64-v8a' && matrix.arch != 'armeabi-v7a'
        run: |

          echo "::group::enable kvm group perms"
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          echo "::endgroup::"

          echo "::group::download and build sqlite3 without SQLITE_OMIT_LOAD_EXTENSION"
          curl -O ${{ matrix.sqlite-amalgamation-zip }}
          unzip sqlite-amalgamation-*.zip
          export ${{ matrix.make }}
          $ANDROID_NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/${{ matrix.arch }}-linux-android26-clang sqlite-amalgamation-*/shell.c sqlite-amalgamation-*/sqlite3.c -o sqlite3 -ldl
          # remove unused folders to save up space
          rm -rf sqlite-amalgamation-*.zip sqlite-amalgamation-* openssl
          echo "::endgroup::"

          echo "::group::prepare the test script"
          make test PLATFORM=$PLATFORM ARCH=$ARCH || echo "It should fail. Running remaining commands in the emulator"
          cat > commands.sh << EOF
            set -e
            mv -f /data/local/tmp/sqlite3 /system/xbin
            cd /data/local/tmp
            export INTEGRATION_TEST_DATABASE_ID="$INTEGRATION_TEST_DATABASE_ID"
            export INTEGRATION_TEST_APIKEY="$INTEGRATION_TEST_APIKEY"
            export INTEGRATION_TEST_CLOUDSYNC_ADDRESS="$INTEGRATION_TEST_CLOUDSYNC_ADDRESS"
            export INTEGRATION_TEST_OFFLINE_DATABASE_ID="$INTEGRATION_TEST_OFFLINE_DATABASE_ID"
            export INTEGRATION_TEST_FAILURE_DATABASE_ID="$INTEGRATION_TEST_FAILURE_DATABASE_ID"
            export INTEGRATION_TEST_CHUNKED_DATABASE_ID="$INTEGRATION_TEST_CHUNKED_DATABASE_ID"
            export INTEGRATION_TEST_WEBLITE_ADDRESS="$INTEGRATION_TEST_WEBLITE_ADDRESS"
            $(make test PLATFORM=$PLATFORM ARCH=$ARCH -n)
          EOF
          echo "::endgroup::"

      - name: android test sqlite-sync
        if: matrix.name == 'android' && matrix.arch != 'arm64-v8a' && matrix.arch != 'armeabi-v7a'
        uses: reactivecircus/android-emulator-runner@v2.34.0
        with:
          api-level: 26
          arch: ${{ matrix.arch }}
          script: |
            adb root
            adb remount
            adb push ${{ github.workspace }}/. /data/local/tmp/
            adb shell "sh /data/local/tmp/commands.sh; echo EXIT_CODE=\$?" | tee /tmp/adb_output.log
            grep -q "EXIT_CODE=0" /tmp/adb_output.log

      - name: test sqlite-sync
        if: contains(matrix.name, 'linux') || matrix.name == 'windows' || ( matrix.name == 'macos' && matrix.arch != 'x86_64' )
        run: ${{ matrix.name == 'linux-musl' && matrix.arch == 'arm64' && 'docker exec alpine' || '' }} make test ${{ matrix.make && matrix.make || ''}}

      - uses: actions/upload-pages-artifact@v3.0.1
        if: matrix.name == 'macos' && !matrix.arch
        with:
          path: coverage

      - uses: actions/upload-artifact@v4.6.2
        if: always()
        with:
          name: cloudsync-${{ matrix.name }}${{ matrix.arch && format('-{0}', matrix.arch) || '' }}
          path: dist/${{ matrix.name == 'apple-xcframework' && 'CloudSync.*' || 'cloudsync.*'}}
          if-no-files-found: error

  postgres-migration-check:
    if: ${{ !contains(github.event.head_commit.message, '[auto-update]') }}
    runs-on: ubuntu-22.04
    name: postgresql migration script check
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@v4.2.2
        with:
          # Need full history + tags so `git describe` can find the previous
          # release tag that the check script compares against.
          fetch-depth: 0

      - name: verify migration script for current CLOUDSYNC_VERSION
        run: make postgres-check-migration

  postgres-test:
    if: ${{ !contains(github.event.head_commit.message, '[auto-update]') }}
    needs: [postgres-migration-check]
    runs-on: ubuntu-22.04
    name: postgresql ${{ matrix.postgres_tag }} build + test
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        postgres_tag: ['18', '17', '15']

    steps:

      - uses: actions/checkout@v4.2.2
        with:
          submodules: true

      - name: build and start postgresql container
        run: POSTGRES_TAG=${{ matrix.postgres_tag }} make postgres-docker-rebuild

      - name: wait for postgresql to be ready
        run: |
          for i in $(seq 1 30); do
            if docker exec cloudsync-postgres pg_isready -U postgres > /dev/null 2>&1; then
              echo "PostgreSQL is ready"
              exit 0
            fi
            sleep 2
          done
          echo "PostgreSQL failed to start within 60s"
          docker logs cloudsync-postgres
          exit 1

      - name: run postgresql tests
        run: |
          set -o pipefail
          docker exec cloudsync-postgres mkdir -p /tmp/cloudsync/test
          docker cp test/postgresql cloudsync-postgres:/tmp/cloudsync/test/postgresql
          docker exec cloudsync-postgres psql -v ON_ERROR_STOP=on -U postgres -d postgres -f /tmp/cloudsync/test/postgresql/full_test.sql 2>&1 | tee /tmp/pgtest.log
          if grep -q '^\[FAIL\]' /tmp/pgtest.log; then
            echo "::error::PostgreSQL test failures detected"
            exit 1
          fi

  postgres-build:
    if: ${{ !contains(github.event.head_commit.message, '[auto-update]') }}
    needs: [postgres-migration-check]
    runs-on: ${{ matrix.os }}
    name: postgresql${{ matrix.postgres_version }}-${{ matrix.name }}-${{ matrix.arch }} build
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            arch: x86_64
            name: linux
            postgres_version: '18'
          - os: ubuntu-22.04
            arch: x86_64
            name: linux
            postgres_version: '17'
          - os: ubuntu-22.04
            arch: x86_64
            name: linux
            postgres_version: '15'
          - os: ubuntu-22.04-arm
            arch: arm64
            name: linux
            postgres_version: '18'
          - os: ubuntu-22.04-arm
            arch: arm64
            name: linux
            postgres_version: '17'
          - os: ubuntu-22.04-arm
            arch: arm64
            name: linux
            postgres_version: '15'
          - os: macos-15
            arch: arm64
            name: macos
            postgres_version: '18'
          - os: macos-15
            arch: arm64
            name: macos
            postgres_version: '17'
          - os: macos-15
            arch: arm64
            name: macos
            postgres_version: '15'
          - os: macos-15
            arch: x86_64
            name: macos
            postgres_version: '18'
          - os: macos-15
            arch: x86_64
            name: macos
            postgres_version: '17'
          - os: macos-15
            arch: x86_64
            name: macos
            postgres_version: '15'
    steps:

      - uses: actions/checkout@v4.2.2
        with:
          submodules: true

      - name: linux install postgresql dev headers
        if: matrix.name == 'linux'
        run: |
          sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
          curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/postgresql.gpg
          sudo apt-get update
          sudo apt-get install -y postgresql-server-dev-${{ matrix.postgres_version }}

      - name: macos install postgresql
        if: matrix.name == 'macos'
        run: brew install postgresql@${{ matrix.postgres_version }} gettext

      - name: build and package postgresql extension (linux)
        if: matrix.name == 'linux'
        run: make postgres-package PG_CONFIG=/usr/lib/postgresql/${{ matrix.postgres_version }}/bin/pg_config

      - name: build and package postgresql extension (macos)
        if: matrix.name == 'macos'
        run: make postgres-package PG_CONFIG=$(brew --prefix postgresql@${{ matrix.postgres_version }})/bin/pg_config PG_EXTRA_CFLAGS="-I$(brew --prefix gettext)/include ${{ matrix.arch == 'x86_64' && '-arch x86_64' || '' }}"

      - uses: actions/upload-artifact@v4.6.2
        with:
          name: cloudsync-postgresql${{ matrix.postgres_version }}-${{ matrix.name }}-${{ matrix.arch }}
          path: dist/postgresql/
          if-no-files-found: error

  release:
    runs-on: ubuntu-22.04
    name: release
    needs: [build, postgres-test, postgres-build]
    if: github.ref == 'refs/heads/main'
    outputs:
      version: ${{ steps.tag.outputs.version }}

    env:
      GH_TOKEN: ${{ github.token }}

    steps:

      - uses: actions/checkout@v4.2.2

      - uses: actions/download-artifact@v4.2.1
        with:
          path: artifacts

      - name: setup GitHub Pages
        uses: actions/configure-pages@v5

      - name: deploy coverage to GitHub Pages
        uses: actions/deploy-pages@v4.0.5

      - name: zip artifacts
        run: |
          VERSION=$(make version)
          for folder in "artifacts"/*; do
            if [ -d "$folder" ]; then
              name=$(basename "$folder")
              if [[ "$name" != "github-pages" ]]; then
                if [[ "$name" != "cloudsync-apple-xcframework" && "$name" != "cloudsync-android-aar" ]]; then
                  tar -czf "${name}-${VERSION}.tar.gz" -C "$folder" .
                fi
                if [[ "$name" == "cloudsync-apple-xcframework" ]]; then
                  # Use the ditto-created zip that preserves macOS symlinks and extract for other steps
                  cp "$folder/CloudSync.xcframework.zip" "${name}-${VERSION}.zip"
                  unzip -q "$folder/CloudSync.xcframework.zip" -d "$folder/"
                elif [[ "$name" != "cloudsync-android-aar" ]]; then
                  (cd "$folder" && zip -rq "../../${name}-${VERSION}.zip" .)
                else
                  cp "$folder"/*.aar "${name}-${VERSION}.aar"
                fi
              fi
            fi
          done

      - name: release tag version from cloudsync.h
        id: tag
        run: |
          VERSION=$(make version)
          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            LATEST_RELEASE=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/${{ github.repository }}/releases/latest)
            LATEST=$(echo "$LATEST_RELEASE" | jq -r '.name')
            if [[ "$VERSION" != "$LATEST" || "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
              echo "version=$VERSION" >> $GITHUB_OUTPUT
            else
              echo "::warning file=src/cloudsync.h::To release a new version, please update the CLOUDSYNC_VERSION in src/cloudsync.h to be different than the latest $LATEST"
            fi
            exit 0
          fi
          echo "❌ CLOUDSYNC_VERSION not found in cloudsync.h"
          exit 1

      - uses: actions/checkout@v4.2.2
        if: steps.tag.outputs.version != ''
        with:
          repository: sqliteai/sqlite-wasm
          path: sqlite-wasm
          submodules: recursive
          token: ${{ secrets.PAT }}

      - name: release sqlite-wasm
        if: steps.tag.outputs.version != ''
        run: |
          cd sqlite-wasm
          git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
          git config --global user.name "$GITHUB_ACTOR"
          cd modules/sqlite-sync
          git checkout ${{ github.sha }}
          cd ../..
          git add modules/sqlite-sync
          PKG=sqlite-wasm/package.json
          TMP=sqlite-wasm/package.tmp.json
          jq --arg version "$(cat modules/sqlite/VERSION)-sync.$(cd modules/sqlite-sync && make version)-vector.$(cd modules/sqlite-vector && make version)" '.version = $version' "$PKG" > "$TMP" && mv "$TMP" "$PKG"
          git add "$PKG"
          git commit -m "Bump sqlite-sync version to ${{ steps.tag.outputs.version }}"
          git push origin main

      - uses: actions/checkout@v4.2.2
        if: steps.tag.outputs.version != ''
        with:
          repository: sqliteai/sqlite-sync-react-native
          path: sqlite-sync-react-native
          token: ${{ secrets.PAT }}

      - name: release sqlite-sync-react-native
        if: steps.tag.outputs.version != ''
        run: |
          cd sqlite-sync-react-native
          git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
          git config --global user.name "$GITHUB_ACTOR"
          jq --arg version "${{ steps.tag.outputs.version }}" '.version = $version' package.json > package.tmp.json && mv package.tmp.json package.json
          git add package.json
          git commit -m "Bump sqlite-sync version to ${{ steps.tag.outputs.version }}"
          git push origin main

      - uses: actions/setup-java@v4
        if: steps.tag.outputs.version != ''
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: release android aar to maven central
        if: steps.tag.outputs.version != ''
        run: cd packages/android && ./gradlew publishAggregationToCentralPortal -PSIGNING_KEY="${{ secrets.SIGNING_KEY }}" -PSIGNING_PASSWORD="${{ secrets.SIGNING_PASSWORD }}" -PSONATYPE_USERNAME="${{ secrets.MAVEN_CENTRAL_USERNAME }}" -PSONATYPE_PASSWORD="${{ secrets.MAVEN_CENTRAL_TOKEN }}" -PVERSION="${{ steps.tag.outputs.version }}" -PAAR_PATH="../../artifacts/cloudsync-android-aar/cloudsync.aar"

      - uses: actions/setup-node@v4
        if: steps.tag.outputs.version != ''
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'

      - name: build and publish npm packages
        if: steps.tag.outputs.version != ''
        run: |
          cd packages/node

          # Update version in package.json
          echo "Updating versions to ${{ steps.tag.outputs.version }}..."

          # Update package.json
          jq --arg version "${{ steps.tag.outputs.version }}" \
            '.version = $version | .optionalDependencies = (.optionalDependencies | with_entries(.value = $version))' \
            package.json > package.tmp.json && mv package.tmp.json package.json

          echo "✓ Updated package.json to version ${{ steps.tag.outputs.version }}"

          # Generate platform packages
          echo "Generating platform packages..."
          node generate-platform-packages.js "${{ steps.tag.outputs.version }}" "../../artifacts" "./platform-packages"
          echo "✓ Generated 7 platform packages"
          ls -la platform-packages/

          # Build main package
          echo "Building main package..."
          npm install
          npm run build
          npm test
          echo "✓ Main package built and tested"

          # Publish platform packages
          echo "Publishing platform packages to npm..."
          cd platform-packages
          for platform_dir in */; do
            platform_name=$(basename "$platform_dir")
            echo "  Publishing @sqliteai/sqlite-sync-${platform_name}..."
            cd "$platform_dir"
            npm publish --provenance --access public --tag latest
            cd ..
            echo "  ✓ Published @sqliteai/sqlite-sync-${platform_name}"
          done
          cd ..

          # Publish main package
          echo "Publishing main package to npm..."
          npm publish --provenance --access public --tag latest
          echo "✓ Published @sqliteai/sqlite-sync@${{ steps.tag.outputs.version }}"

          echo ""
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "✅ Successfully published 8 packages to npm"
          echo "   Main: @sqliteai/sqlite-sync@${{ steps.tag.outputs.version }}"
          echo "   Platform packages: 7"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

      - name: build and publish expo package
        if: steps.tag.outputs.version != ''
        run: |
          cd packages/expo

          echo "Generating @sqliteai/sqlite-sync-expo package..."
          node generate-expo-package.js "${{ steps.tag.outputs.version }}" "../../artifacts" "./expo-package"

          echo "Publishing @sqliteai/sqlite-sync-expo to npm..."
          cd expo-package
          npm publish --provenance --access public --tag latest
          echo "✓ Published @sqliteai/sqlite-sync-expo@${{ steps.tag.outputs.version }}"

      - name: update Package.swift checksum and version
        if: steps.tag.outputs.version != ''
        run: |
          VERSION=${{ steps.tag.outputs.version }}
          ZIP="cloudsync-apple-xcframework-${VERSION}.zip"
          if [ -f "$ZIP" ]; then
            CHECKSUM=$(swift package compute-checksum "$ZIP")
            URL="https://github.com/sqliteai/sqlite-sync/releases/download/${VERSION}/${ZIP}"
            sed -i "s|url: \".*cloudsync-apple-xcframework.*\"|url: \"${URL}\"|" Package.swift
            sed -i "s|checksum: \".*\"|checksum: \"${CHECKSUM}\"|" Package.swift
            git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
            git config --global user.name "$GITHUB_ACTOR"
            git add Package.swift
            git commit -m "Update Package.swift checksum for ${VERSION} [auto-update]" || true
            git push origin main || true
          fi

      - uses: softprops/action-gh-release@v2.2.1
        if: steps.tag.outputs.version != ''
        with:
          token: ${{ secrets.RELEASE_PAT }}
          body: |
            # Packages

            [**Flutter/Dart**](https://pub.dev/packages/sqlite_sync): `flutter pub add sqlite_sync:${{ steps.tag.outputs.version }}` or `dart pub add sqlite_sync:${{ steps.tag.outputs.version }}`
            [**Node**](https://www.npmjs.com/package/@sqliteai/sqlite-sync): `npm install @sqliteai/sqlite-sync`
            [**WASM**](https://www.npmjs.com/package/@sqliteai/sqlite-wasm): `npm install @sqliteai/sqlite-wasm`
            [**React Native**](https://www.npmjs.com/package/@sqliteai/sqlite-sync-react-native): `npm install @sqliteai/sqlite-sync-react-native`
            [**Expo**](https://www.npmjs.com/package/@sqliteai/sqlite-sync-expo): `npm install @sqliteai/sqlite-sync-expo`
            [**Android**](https://central.sonatype.com/artifact/ai.sqlite/sync): `ai.sqlite:sync:${{ steps.tag.outputs.version }}`
            [**Swift**](https://github.com/sqliteai/sqlite-sync#swift-package): [Installation Guide](https://github.com/sqliteai/sqlite-sync#swift-package)
            [**Docker (PostgreSQL)**](https://hub.docker.com/r/sqlitecloud/sqlite-sync-postgres): `docker pull sqlitecloud/sqlite-sync-postgres:18`, `:17` or `:15`
            [**Docker (Supabase)**](https://hub.docker.com/r/sqlitecloud/sqlite-sync-supabase): `docker pull sqlitecloud/sqlite-sync-supabase:17` or `:15`

            ---

          generate_release_notes: true
          tag_name: ${{ steps.tag.outputs.version }}
          files: |
            cloudsync-*-${{ steps.tag.outputs.version }}.*
            CloudSync-*-${{ steps.tag.outputs.version }}.*
          make_latest: true

  docker-publish:
    runs-on: ubuntu-22.04
    name: docker ${{ matrix.image }} pg${{ matrix.pg_major }}${{ github.ref != 'refs/heads/main' && ' beta' || '' }}
    needs: [build, postgres-test, postgres-build, release]
    # main: publish the versioned release tags, only when the release job cut a new
    # release. Any other branch: release is skipped, publish/overwrite a per-branch
    # beta tag on every green push (the beta build installs the extension from the
    # postgres-build CI artifacts instead of the GitHub release assets).
    if: ${{ !failure() && !cancelled() && (github.ref != 'refs/heads/main' || needs.release.outputs.version != '') }}

    env:
      DOCKERHUB_ORG: sqlitecloud

    strategy:
      fail-fast: false
      matrix:
        include:
          - image: sqlite-sync-postgres
            pg_major: '18'
            dockerfile: docker/postgresql/Dockerfile.release
          - image: sqlite-sync-postgres
            pg_major: '17'
            dockerfile: docker/postgresql/Dockerfile.release
          - image: sqlite-sync-postgres
            pg_major: '15'
            dockerfile: docker/postgresql/Dockerfile.release
          # :<major> tracks whatever base Supabase currently ships for that major.
          # Both lines are on an Alpine userland now (still a glibc Nix postgres,
          # so the same glibc artifact is installed); there are no family suffixes.
          - image: sqlite-sync-supabase
            pg_major: '17'
            dockerfile: docker/postgresql/Dockerfile.supabase.release
            supabase_tag: '17.6.1.170'
          - image: sqlite-sync-supabase
            pg_major: '15'
            dockerfile: docker/postgresql/Dockerfile.supabase.release
            supabase_tag: '15.14.1.170'

    steps:

      - uses: actions/checkout@v4.2.2
        with:
          submodules: true

      - name: get cloudsync version
        id: version
        run: echo "version=$(make version)" >> $GITHUB_OUTPUT

      - name: compute beta tag from branch name
        id: beta
        if: github.ref != 'refs/heads/main'
        run: echo "slug=$(echo "${GITHUB_REF_NAME}" | sed -E 's/[^A-Za-z0-9._-]+/-/g' | cut -c1-100)" >> $GITHUB_OUTPUT

      - name: download postgres-build artifacts for beta build
        if: github.ref != 'refs/heads/main'
        uses: actions/download-artifact@v4.2.1
        with:
          pattern: cloudsync-postgresql${{ matrix.pg_major }}-linux-*
          path: beta-artifacts-raw

      - name: stage beta artifacts into the docker build context
        if: github.ref != 'refs/heads/main'
        run: |
          VERSION=${{ steps.version.outputs.version }}
          for arch in x86_64 arm64; do
            SRC="beta-artifacts-raw/cloudsync-postgresql${{ matrix.pg_major }}-linux-${arch}"
            tar -czf "docker/postgresql/beta-artifacts/cloudsync-postgresql${{ matrix.pg_major }}-linux-${arch}-${VERSION}.tar.gz" -C "$SRC" .
          done
          ls -la docker/postgresql/beta-artifacts/

      - uses: docker/setup-qemu-action@v3

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: set docker tags and build args (standalone)
        if: matrix.image == 'sqlite-sync-postgres'
        id: standalone
        run: |
          VERSION=${{ steps.version.outputs.version }}
          PG=${{ matrix.pg_major }}
          IMAGE=${{ env.DOCKERHUB_ORG }}/${{ matrix.image }}
          BETA="${{ steps.beta.outputs.slug }}"
          {
            if [ -n "$BETA" ]; then
              echo "tags=${IMAGE}:${PG}-beta-${BETA}"
            else
              echo "tags=${IMAGE}:${PG},${IMAGE}:${PG}-${VERSION}"
            fi
            echo "build_args<<EOF"
            echo "POSTGRES_TAG=${PG}"
            echo "CLOUDSYNC_VERSION=${VERSION}"
            echo "EOF"
          } >> $GITHUB_OUTPUT

      - name: set docker tags and build args (supabase)
        if: matrix.image == 'sqlite-sync-supabase'
        id: supabase
        run: |
          VERSION=${{ steps.version.outputs.version }}
          IMAGE=${{ env.DOCKERHUB_ORG }}/${{ matrix.image }}
          SUPABASE_TAG=${{ matrix.supabase_tag }}
          BETA="${{ steps.beta.outputs.slug }}"
          {
            if [ -n "$BETA" ]; then
              echo "tags=${IMAGE}:${{ matrix.pg_major }}-beta-${BETA}"
            else
              echo "tags=${IMAGE}:${{ matrix.pg_major }},${IMAGE}:${{ matrix.pg_major }}-${VERSION},${IMAGE}:${SUPABASE_TAG}"
            fi
            echo "build_args<<EOF"
            echo "SUPABASE_POSTGRES_TAG=${SUPABASE_TAG}"
            echo "CLOUDSYNC_VERSION=${VERSION}"
            echo "EOF"
          } >> $GITHUB_OUTPUT

      # Build amd64 natively first and load it into the daemon, so the extension
      # is proven to load before anything is published. The multi-arch push below
      # reuses these layers from the builder cache.
      - name: build amd64 image for the smoke test
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64
          load: true
          tags: cloudsync-smoke:test
          build-args: ${{ matrix.image == 'sqlite-sync-postgres' && steps.standalone.outputs.build_args || steps.supabase.outputs.build_args }}

      - name: smoke test the extension
        env:
          # the supabase bases ship a `postgres` role that cannot create the
          # extension; their own docs use supabase_admin
          PSQL_USER: ${{ matrix.image == 'sqlite-sync-supabase' && 'supabase_admin' || 'postgres' }}
        run: |
          docker run -d --name cloudsync-smoke -e POSTGRES_PASSWORD=postgres cloudsync-smoke:test
          # the entrypoint's init-time server listens on the unix socket only, so
          # a TCP connection only succeeds once the real server is up
          ready=''
          for _ in $(seq 1 60); do
            if docker exec -e PGPASSWORD=postgres cloudsync-smoke \
                 psql -h 127.0.0.1 -U "$PSQL_USER" -d postgres -tAc 'SELECT 1' >/dev/null 2>&1; then
              ready=1
              break
            fi
            sleep 2
          done
          if [ -z "$ready" ]; then
            echo "::error::postgres never accepted TCP connections"
            docker logs cloudsync-smoke
            exit 1
          fi
          if ! docker exec -e PGPASSWORD=postgres cloudsync-smoke \
                 psql -h 127.0.0.1 -U "$PSQL_USER" -d postgres -v ON_ERROR_STOP=1 \
                 -c 'CREATE EXTENSION IF NOT EXISTS cloudsync;' \
                 -c 'SELECT cloudsync_version();'; then
            echo "::error::cloudsync failed to load in ${{ matrix.image }} pg${{ matrix.pg_major }}"
            docker logs cloudsync-smoke
            exit 1
          fi
          docker rm -f cloudsync-smoke

      - uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ matrix.image == 'sqlite-sync-postgres' && steps.standalone.outputs.tags || steps.supabase.outputs.tags }}
          build-args: ${{ matrix.image == 'sqlite-sync-postgres' && steps.standalone.outputs.build_args || steps.supabase.outputs.build_args }}