release.yml

name: release

# Builds the official Velopack-managed portable artifacts:
#   Windows: framework-dependent VPK Portable.zip (`--noInst`) with a repository-owned C# prerequisite launcher.
#   Linux:   AppImage (Velopack's portable Linux format).
# Matrix jobs build and retain assets; protected serialized jobs prepare/verify the draft, then promote it separately.
# Artifacts are currently unsigned. Publication therefore requires the dated
# unsigned-risk decision in docs/compliance/release-authority-register.json.
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  # One repository-wide lane: different tags must not publish out of order or derive deltas from the same predecessor.
  group: official-release-${{ github.repository }}
  cancel-in-progress: false

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  VPK_VERSION: "1.2.0"

jobs:
  # A reusable-workflow call cannot carry `timeout-minutes` — the timeouts (and the
  # release-script lint) live on the jobs inside build-and-test.yml, and apply here too.
  validate:
    uses: ./.github/workflows/build-and-test.yml
    permissions:
      contents: read

  version:
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      pack-version: ${{ steps.compose.outputs.pack-version }}
      is-prerelease: ${{ steps.compose.outputs.is-prerelease }}
      update-channel: ${{ steps.compose.outputs.update-channel }}
      source-sha: ${{ steps.compose.outputs.source-sha }}
    steps:
      - name: Checkout immutable release source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Verify supported .NET runtime floor
        run: scripts/compliance/verify-dotnet-runtime-floor.py

      - name: Compose and bind release identity
        id: compose
        shell: bash
        run: |
          set -euo pipefail
          PACK_VERSION="$(scripts/read-release-version.py)"
          if [[ "$GITHUB_REF" != refs/tags/v* ]]; then
            echo "ERROR: official releases must run from an existing v* tag, including workflow_dispatch runs." >&2
            exit 1
          fi
          TAG="${GITHUB_REF#refs/tags/}"
          if [[ "$TAG" != "v$PACK_VERSION" ]]; then
            echo "ERROR: tag '$TAG' does not match release manifest version 'v$PACK_VERSION'." >&2
            exit 1
          fi
          if [[ "$(git rev-parse "$TAG^{commit}")" != "$GITHUB_SHA" ]]; then
            echo "ERROR: tag '$TAG' is not bound to checked-out commit '$GITHUB_SHA'." >&2
            exit 1
          fi
          echo "pack-version=$PACK_VERSION" >> "$GITHUB_OUTPUT"
          echo "source-sha=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
          if [[ "$PACK_VERSION" == *-* ]]; then
            echo "is-prerelease=true" >> "$GITHUB_OUTPUT"
            echo "update-channel=tester" >> "$GITHUB_OUTPUT"
          else
            echo "is-prerelease=false" >> "$GITHUB_OUTPUT"
            echo "update-channel=main" >> "$GITHUB_OUTPUT"
          fi

      - name: Install git-cliff (pinned)
        shell: bash
        env:
          GIT_CLIFF_VERSION: "2.13.1"
          GIT_CLIFF_SHA256: "9a1263f24e59a2f508c7b3d3283c9dea94a8bf697f96dbc18cc783cac6284546"
        run: |
          set -euo pipefail
          TARBALL="git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          URL="https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/${TARBALL}"
          curl -fsSL "$URL" -o "$TARBALL"
          echo "${GIT_CLIFF_SHA256}  ${TARBALL}" | sha256sum -c -
          tar xzf "$TARBALL"
          sudo install -m 0755 "git-cliff-${GIT_CLIFF_VERSION}/git-cliff" /usr/local/bin/git-cliff
          git-cliff --version

      - name: Generate release notes
        run: scripts/generate-release-notes.sh "${{ steps.compose.outputs.pack-version }}" RELEASE_NOTES.md

      - name: Retain release notes
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-notes
          path: RELEASE_NOTES.md
          retention-days: 30
          if-no-files-found: error

  build-pack:
    needs: [validate, version]
    uses: ./.github/workflows/package-velopack.yml
    permissions:
      contents: read
    with:
      pack-version: ${{ needs.version.outputs.pack-version }}
      update-channel: ${{ needs.version.outputs.update-channel }}
      is-prerelease: ${{ needs.version.outputs.is-prerelease }}
      source-sha: ${{ needs.version.outputs.source-sha }}
      require-tag-binding: true

  prepare-release-draft:
    needs: [version, build-pack]
    runs-on: ubuntu-latest
    timeout-minutes: 45
    environment: open-source-release
    permissions:
      contents: write
    outputs:
      release-id: ${{ steps.draft.outputs.release-id }}
      checksum-digest: ${{ steps.final.outputs.checksum-digest }}
    steps:
      - name: Checkout immutable release source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup .NET 8 runtime for pinned release tooling
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 8.0.x

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json

      - name: Download Windows Velopack evidence
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: velopack-win
          path: release/win

      - name: Download Linux Velopack evidence
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: velopack-linux
          path: release/linux

      - name: Verify retained hashes and exact portable asset policy
        shell: bash
        run: |
          set -euo pipefail
          (cd release/win && sha256sum --check CHECKSUMS.sha256)
          (cd release/linux && sha256sum --check CHECKSUMS.sha256)
          test "$(find release/win -maxdepth 1 -type f -iname '*Portable.zip' | wc -l)" -eq 1
          test "$(find release/win -maxdepth 1 -type f -iname '*Setup.exe' | wc -l)" -eq 0
          test "$(find release/linux -maxdepth 1 -type f -iname '*.AppImage' | wc -l)" -eq 1

      - name: Install pinned Velopack CLI
        run: dotnet tool install -g vpk --version "${{ env.VPK_VERSION }}"

      - name: Create one draft and merge both Velopack channels
        shell: bash
        run: |
          set -euo pipefail
          PACK_VERSION="${{ needs.version.outputs.pack-version }}"
          PRE_ARGS=()
          if [[ "${{ needs.version.outputs.is-prerelease }}" == "true" ]]; then
            PRE_ARGS+=(--pre)
          fi
          # Upload order is load-bearing: win (the default channel) goes FIRST and UNMERGED, so its unsuffixed legacy
          # Squirrel `RELEASES` feed is the one published; linux then merges in and publishes no legacy feed.
          # scripts/compliance/verify_remote_velopack_assets.py encodes this (win legacy published, linux not) — do not
          # reorder these two uploads (or make win --merge) without updating that policy, or the reconciler can pass a
          # release whose asset set is wrong.
          vpk upload github \
            --outputDir release/win \
            --repoUrl "https://github.com/${{ github.repository }}" \
            --token "${{ secrets.GITHUB_TOKEN }}" \
            --channel win \
            --tag "v$PACK_VERSION" \
            --targetCommitish "$GITHUB_SHA" \
            "${PRE_ARGS[@]}"
          vpk upload github \
            --outputDir release/linux \
            --repoUrl "https://github.com/${{ github.repository }}" \
            --token "${{ secrets.GITHUB_TOKEN }}" \
            --channel linux \
            --tag "v$PACK_VERSION" \
            --targetCommitish "$GITHUB_SHA" \
            --merge \
            "${PRE_ARGS[@]}"

      - name: Download and verify complete remote draft primary assets
        id: draft
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PACK_VERSION: ${{ needs.version.outputs.pack-version }}
        run: |
          set -euo pipefail
          TAG="v${{ needs.version.outputs.pack-version }}"
          gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" \
            | jq -s --arg tag "$TAG" \
              'add | map(select(.tag_name == $tag)) | if length == 1 then .[0] else error("expected exactly one release for tag") end' \
              > draft.json
          jq -e --arg sha "$GITHUB_SHA" '.draft == true and .target_commitish == $sha' draft.json >/dev/null
          echo "release-id=$(jq -r .id draft.json)" >> "$GITHUB_OUTPUT"
          mkdir remote-primary
          jq -r '.assets[] | [.url, .name] | @tsv' draft.json \
            | while IFS=$'\t' read -r asset_url asset_name; do
                gh api -H 'Accept: application/octet-stream' "$asset_url" > "remote-primary/$asset_name"
              done
          scripts/compliance/verify_remote_velopack_assets.py \
            --version "$PACK_VERSION" \
            --local win=release/win \
            --local linux=release/linux \
            --remote-dir remote-primary

      - name: Generate detached release envelope from verified remote bytes
        shell: bash
        env:
          PACK_VERSION: ${{ needs.version.outputs.pack-version }}
        run: |
          set -euo pipefail
          dotnet tool restore --tool-manifest dotnet-tools.json
          # sbom-tool's -m (ManifestDirPath) must already exist; it writes _manifest/ under it but does not create the
          # root. Unlike the build-pack SBOM step (which omits -m and defaults under -b), this envelope uses a distinct
          # manifest dir, so create it first.
          mkdir -p release-envelope
          scripts/compliance/sbom-tool.sh Generate \
            -b remote-primary \
            -bc remote-primary \
            -m release-envelope \
            -pn XE-Local-AI-Engine-portable-release \
            -pv "$PACK_VERSION" \
            -ps "XE Local AI Engine contributors" \
            -pm true \
            -D true
          scripts/compliance/sbom-tool.sh Validate \
            -b remote-primary \
            -m release-envelope \
            -n true \
            -mi SPDX:2.2 \
            -o "$RUNNER_TEMP/release-envelope-validation.json"
          cp release-envelope/_manifest/spdx_2.2/manifest.spdx.json remote-primary/RELEASE.spdx.json
          python3 - <<'PY'
          from hashlib import sha256
          from pathlib import Path
          import json
          import os

          root = Path("remote-primary")
          assets = []
          for path in sorted(root.iterdir(), key=lambda item: item.name):
              if path.is_file() and path.name not in {"RELEASE-MANIFEST.json", "CHECKSUMS.sha256"}:
                  data = path.read_bytes()
                  assets.append({"name": path.name, "size": len(data), "sha256": sha256(data).hexdigest()})
          manifest = {
              "schemaVersion": 1,
              "tag": f"v{os.environ['PACK_VERSION']}",
              "sourceSha": os.environ["GITHUB_SHA"],
              "assets": assets,
              "signing": {
                  "state": "unsigned",
                  "decisionGate": "signing-risk-decision",
                  "certificatePlanned": True,
              },
              "selfExclusions": ["RELEASE-MANIFEST.json", "CHECKSUMS.sha256"],
          }
          (root / "RELEASE-MANIFEST.json").write_text(
              json.dumps(manifest, indent=2, sort_keys=True) + "\n", encoding="utf-8"
          )
          PY

      - name: Add checksums derived from verified remote bytes
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TAG="v${{ needs.version.outputs.pack-version }}"
          (cd remote-primary && find . -maxdepth 1 -type f ! -name 'CHECKSUMS.sha256' -print0 | sort -z | xargs -0 sha256sum > CHECKSUMS.sha256)
          gh release upload "$TAG" \
            remote-primary/RELEASE.spdx.json \
            remote-primary/RELEASE-MANIFEST.json \
            remote-primary/CHECKSUMS.sha256 \
            --repo "$GITHUB_REPOSITORY"

      - name: Download and verify complete remote draft including metadata
        id: final
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TAG="v${{ needs.version.outputs.pack-version }}"
          gh api "repos/$GITHUB_REPOSITORY/releases/${{ steps.draft.outputs.release-id }}" > final-draft.json
          jq -e --arg tag "$TAG" --arg sha "$GITHUB_SHA" \
            '.draft == true and .tag_name == $tag and .target_commitish == $sha' final-draft.json >/dev/null
          mkdir remote-final
          jq -r '.assets[] | [.url, .name] | @tsv' final-draft.json \
            | while IFS=$'\t' read -r asset_url asset_name; do
                gh api -H 'Accept: application/octet-stream' "$asset_url" > "remote-final/$asset_name"
              done
          test -f remote-final/CHECKSUMS.sha256
          test -f remote-final/RELEASE.spdx.json
          test -f remote-final/RELEASE-MANIFEST.json
          test "$(find remote-final -maxdepth 1 -type f | wc -l)" -eq \
               "$(( $(wc -l < remote-final/CHECKSUMS.sha256) + 1 ))"
          (cd remote-final && sha256sum --check CHECKSUMS.sha256)
          python3 scripts/release/verify-release-envelope.py \
            --directory remote-final \
            --tag "$TAG" \
            --source-sha "$GITHUB_SHA"
          CHECKSUM_DIGEST="$(sha256sum remote-final/CHECKSUMS.sha256 | cut -d ' ' -f1)"
          echo "checksum-digest=$CHECKSUM_DIGEST" >> "$GITHUB_OUTPUT"

  publish-release:
    needs: [version, prepare-release-draft]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: open-source-release
    permissions:
      contents: write
    steps:
      - name: Checkout immutable release source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Verify release authority and unsigned-risk decision again
        run: python3 scripts/release/verify-release-authority.py

      - name: Verify anonymous repository availability before promotion
        shell: bash
        run: |
          set -euo pipefail
          curl -fsSL \
            -H 'Accept: application/vnd.github+json' \
            "https://api.github.com/repos/$GITHUB_REPOSITORY" \
            > anonymous-repository.json
          jq -e --arg repository "$GITHUB_REPOSITORY" \
            '.private == false and .full_name == $repository' anonymous-repository.json >/dev/null
          curl -fsSL \
            -H 'Accept: application/vnd.github+json' \
            "https://api.github.com/repos/$GITHUB_REPOSITORY/releases?per_page=1" \
            > anonymous-releases.json
          jq -e 'type == "array"' anonymous-releases.json >/dev/null

      - name: Re-download and verify the protected draft
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.prepare-release-draft.outputs.release-id }}
          EXPECTED_CHECKSUM_DIGEST: ${{ needs.prepare-release-draft.outputs.checksum-digest }}
        run: |
          set -euo pipefail
          TAG="v${{ needs.version.outputs.pack-version }}"
          gh api "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID" > protected-draft.json
          jq -e --arg tag "$TAG" --arg sha "$GITHUB_SHA" \
            '.draft == true and .tag_name == $tag and .target_commitish == $sha' protected-draft.json >/dev/null
          mkdir protected-remote
          jq -r '.assets[] | [.url, .name] | @tsv' protected-draft.json \
            | while IFS=$'\t' read -r asset_url asset_name; do
                gh api -H 'Accept: application/octet-stream' "$asset_url" > "protected-remote/$asset_name"
              done
          test -f protected-remote/CHECKSUMS.sha256
          test -f protected-remote/RELEASE.spdx.json
          test -f protected-remote/RELEASE-MANIFEST.json
          test "$(find protected-remote -maxdepth 1 -type f | wc -l)" -eq \
               "$(( $(wc -l < protected-remote/CHECKSUMS.sha256) + 1 ))"
          (cd protected-remote && sha256sum --check CHECKSUMS.sha256)
          python3 scripts/release/verify-release-envelope.py \
            --directory protected-remote \
            --tag "$TAG" \
            --source-sha "$GITHUB_SHA"
          ACTUAL_CHECKSUM_DIGEST="$(sha256sum protected-remote/CHECKSUMS.sha256 | cut -d ' ' -f1)"
          if [[ "$ACTUAL_CHECKSUM_DIGEST" != "$EXPECTED_CHECKSUM_DIGEST" ]]; then
            echo "ERROR: protected draft checksum digest changed; expected \"$EXPECTED_CHECKSUM_DIGEST\"." >&2
            exit 1
          fi

      - name: Publish the already verified draft without replacing assets
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.prepare-release-draft.outputs.release-id }}
        run: |
          set -euo pipefail
          PRERELEASE="${{ needs.version.outputs.is-prerelease }}"
          gh api --method PATCH \
            "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID" \
            -F draft=false \
            -F prerelease="$PRERELEASE" \
            > published.json
          jq -e --arg tag "v${{ needs.version.outputs.pack-version }}" --arg sha "$GITHUB_SHA" \
            '.draft == false and .tag_name == $tag and .target_commitish == $sha' published.json >/dev/null

      - name: Verify anonymous canonical release and feeds
        shell: bash
        run: |
          set -euo pipefail
          TAG="v${{ needs.version.outputs.pack-version }}"
          curl -fsSL "https://api.github.com/repos/$GITHUB_REPOSITORY/releases/tags/$TAG" > public-release.json
          jq -e '.draft == false' public-release.json >/dev/null
          for channel in win linux; do
            feed_url=$(jq -r --arg name "releases.$channel.json" '.assets[] | select(.name == $name) | .browser_download_url' public-release.json)
            test -n "$feed_url"
            curl -fsSL "$feed_url" | grep -F "${{ needs.version.outputs.pack-version }}" >/dev/null
          done

      - name: Record publication summary
        shell: bash
        run: |
          {
            echo "## Portable release published"
            echo "- Tag: v${{ needs.version.outputs.pack-version }}"
            echo "- Source: $GITHUB_SHA"
            echo "- Windows: framework-dependent Velopack Portable.zip (ASP.NET Core Runtime 10.0.11+ x64 required; no Setup.exe)"
            echo "- Linux: Velopack AppImage"
            echo "- Signing: unsigned; approved risk record required by publication gate"
          } >> "$GITHUB_STEP_SUMMARY"