release.yml

name: Release

# Default-branch, tag-signalled cross-platform release:
#   build (unsigned) → macOS finalize (adaptive icon + inside-out Developer ID
#   sign + notarize + staple + repackage updater/dmg) → collect → publish a
#   GitHub Release with the Tauri updater manifest (latest.json).
#
# Required `release` environment secrets (never repository/org secrets):
#   APPLE_CERTIFICATE            base64 of your "Developer ID Application" .p12
#   APPLE_CERTIFICATE_PASSWORD   password for that .p12
#   APPLE_SIGNING_IDENTITY       "Developer ID Application: NAME (TEAMID)"
#   KEYCHAIN_PASSWORD            any throwaway password for the temp keychain
#   AC_API_KEY_ID                App Store Connect API key id
#   AC_API_ISSUER_ID             App Store Connect issuer id
#   AC_API_KEY_BASE64            base64 of the AuthKey_XXXX.p8
#   TAURI_SIGNING_PRIVATE_KEY            updater private key (string)
#   TAURI_SIGNING_PRIVATE_KEY_PASSWORD   its password (empty if none)
#   IMMUTABLE_RELEASES_READ_TOKEN         fine-grained token with repository
#                                           Administration: read-only
#   MANAGER_R2_S3_ENDPOINT / MANAGER_R2_PROMOTION_ACCESS_KEY_ID /
#     MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY
#                                           R2 S3-compatible read/write access
#   vars.MANAGER_IHEP_S3_ENDPOINT / vars.MANAGER_IHEP_S3_BUCKET /
#     vars.MANAGER_IHEP_S3_REGION / vars.MANAGER_IHEP_S3_PREFIX
#   MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID /
#     MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY
#                                           IHEP S3-compatible read/write access
# Both mirror backends are required for stable publication and must already
# contain a valid latest.json baseline. R2 is the sole CAS authority and must
# enforce conditional PutObject plus HeadObject metadata round trips. IHEP is an
# unconditional single-writer follower and only needs PutObject + metadata
# round trips; promotion never relies on its ignored conditional headers.
# GitHub Immutable Releases must be enabled before any release starts; the
# workflow verifies the repository setting with IMMUTABLE_RELEASES_READ_TOKEN.
# Separate active tag rulesets must restrict refs/tags/v* creation to the named
# release publisher and forbid every update/deletion; the same read-only token
# verifies those policies and the live peeled SHA.
# Every reused asset is also pinned to the API-provided sha256 digest.
# Configure the `release` environment for the protected default branch only;
# never allow v* tags. A tagged revision may change release-source.yml, but it
# cannot claim this environment and the signal itself has no credentials.
# The old MANAGER_*_ACCESS_KEY_ID / SECRET_ACCESS_KEY names must stay deleted;
# otherwise a historical workflow revision could still perform unconditional writes.
#
# Optional Windows Authenticode signing (non-blocking until configured; see
# docs/windows-signing.md and docs/code-signing-policy.md). Provider-agnostic:
# scripts/sign-windows-authenticode.ps1 is wired as Tauri's
# bundle.windows.signCommand and dispatches on vars.WINDOWS_SIGNING_PROVIDER,
# so the main exe, the generated uninstaller, and the final installer are all
# signed in one pass during `tauri build`. win-installer-check.yml's PR-time
# NSIS build never sets the repo variable vars.WINDOWS_SIGNING_PROVIDER — a PR
# cannot select or reach a real provider here — but it does hardcode
# WINDOWS_SIGNING_PROVIDER=local-pfx with a throwaway self-signed certificate
# generated fresh in that same job, purely to prove this signCommand hook is
# actually wired up end to end (see docs/windows-signing.md). That throwaway
# certificate is never trusted by anything, so it does not change whether a
# release build here would be considered "signed" in any way that matters.
#   vars.WINDOWS_SIGNING_PROVIDER  "" (default/unsigned) | "esigner" (recommended,
#                                   SSL.com eSigner CKA) | "certum" (fallback,
#                                   Certum SimplySign) | "local-pfx" (testing)
#   ESIGNER_USERNAME / ESIGNER_PASSWORD / ESIGNER_TOTP_SECRET
#                                   SSL.com account credentials (provider=esigner)
#   CERTUM_USERNAME / CERTUM_TOTP_SECRET
#                                   Certum SimplySign credentials (provider=certum)
#   vars.CERTUM_ACTION_AUDITED     must be "true" before provider=certum will run
#                                   (see docs/windows-signing.md#certum-action-audit —
#                                   jay0lee/certum-cloud-code-sign is a third-party
#                                   action that receives real account credentials
#                                   and must be independently audited or vendored
#                                   first; a deliberate second opt-in, separate
#                                   from selecting the provider itself)
#   WINDOWS_CERTIFICATE / WINDOWS_CERTIFICATE_PASSWORD
#                                   base64 PFX + password (provider=local-pfx only;
#                                   legacy scaffold, kept for testing/fallback)
#   vars.AUTHENTICODE_REQUIRED     set to "true" to fail release when a PE is
#                                   unsigned — flip only after a real provider
#                                   has been verified end to end (3 PE layers,
#                                   both archs; see docs/code-signing-policy.md)
#   vars.WINDOWS_TIMESTAMP_URL     optional RFC3161 timestamp URL override

on:
  # `workflow_run` always loads this credentialed workflow from the repository
  # default branch. Never put credentials in release-source.yml: tag-triggered
  # workflow definitions are loaded from the tagged commit.
  workflow_run:
    workflows: ["Release source"]
    types: [completed]
  workflow_dispatch:
    inputs:
      target_tag:
        description: "Existing vX.Y.Z release to republish through the current protected workflow"
        required: true
        type: string
      allow_mirror_downgrade:
        description: "Emergency only: allow this tag to replace a newer mirror latest.json"
        required: false
        default: false
        type: boolean
      mirror_downgrade_reason:
        description: "Required audit reason when emergency mirror downgrade is enabled"
        required: false
        default: ""
        type: string

permissions:
  contents: read

env:
  AUTHORIZED_RELEASE_ACTOR_LOGIN: Wangnov
  AUTHORIZED_RELEASE_ACTOR_ID: "48670012"
  RELEASE_TAG: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || inputs.target_tag }}
  RELEASE_SOURCE_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || '' }}
  TRUSTED_RELEASE_INVOCATION: ${{ github.event_name == 'workflow_run' && 'tag-signal' || 'manual-recovery' }}

# Serialize every credentialed mirror writer through one release lane. This is a
# correctness boundary for the unconditional IHEP follower, not an optimization.
# R2 CAS plus pre/post ownership fencing handles a losing or accidentally
# overlapping writer, but there is no cross-provider atomic transaction.
concurrency:
  group: release-latest-${{ github.repository }}
  cancel-in-progress: false
  queue: max

jobs:
  # This is the only path from the unprivileged tag signal to credentialed jobs.
  # It deliberately has no checkout, environment, write permission, or secrets.
  # Every field is copied through the environment so event data is never
  # interpolated into shell source.
  preflight:
    runs-on: ubuntu-latest
    permissions: {}
    outputs:
      release_tag: ${{ steps.validate.outputs.release_tag }}
      release_source_sha: ${{ steps.validate.outputs.release_source_sha }}
      trusted_invocation: ${{ steps.validate.outputs.trusted_invocation }}
    steps:
      - name: Validate release invocation without secrets
        id: validate
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }}
          DISPATCH_REF: ${{ github.ref }}
          DISPATCH_ACTOR_LOGIN: ${{ github.actor }}
          DISPATCH_ACTOR_ID: ${{ github.actor_id }}
          DISPATCH_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }}
          EVENT_NAME: ${{ github.event_name }}
          REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }}
          UPSTREAM_ACTOR_LOGIN: ${{ github.event.workflow_run.actor.login || '' }}
          UPSTREAM_ACTOR_ID: ${{ github.event.workflow_run.actor.id || '' }}
          UPSTREAM_CONCLUSION: ${{ github.event.workflow_run.conclusion || '' }}
          UPSTREAM_EVENT: ${{ github.event.workflow_run.event || '' }}
          UPSTREAM_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch || '' }}
          UPSTREAM_HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name || '' }}
          UPSTREAM_HEAD_SHA: ${{ github.event.workflow_run.head_sha || '' }}
          UPSTREAM_PATH: ${{ github.event.workflow_run.path || '' }}
          UPSTREAM_REPOSITORY: ${{ github.event.workflow_run.repository.full_name || '' }}
          UPSTREAM_TRIGGERING_ACTOR_LOGIN: ${{ github.event.workflow_run.triggering_actor.login || '' }}
          UPSTREAM_TRIGGERING_ACTOR_ID: ${{ github.event.workflow_run.triggering_actor.id || '' }}
          UPSTREAM_WORKFLOW_NAME: ${{ github.event.workflow_run.name || '' }}
        run: |
          set -euo pipefail
          [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || {
            echo "::error::release workflow rerun actor is not the authorized publisher"
            exit 1
          }
          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
            [[ "$UPSTREAM_WORKFLOW_NAME" == "Release source" ]] || {
              echo "::error::unexpected upstream workflow: $UPSTREAM_WORKFLOW_NAME"
              exit 1
            }
            [[ "$UPSTREAM_PATH" == ".github/workflows/release-source.yml" ]] || {
              echo "::error::unexpected upstream workflow path: $UPSTREAM_PATH"
              exit 1
            }
            [[ "$UPSTREAM_EVENT" == "push" && "$UPSTREAM_CONCLUSION" == "success" ]] || {
              echo "::error::release source must be a successful push workflow"
              exit 1
            }
            [[ "$UPSTREAM_REPOSITORY" == "$GITHUB_REPOSITORY" && "$UPSTREAM_HEAD_REPOSITORY" == "$GITHUB_REPOSITORY" ]] || {
              echo "::error::release source must originate in $GITHUB_REPOSITORY"
              exit 1
            }
            [[ "$UPSTREAM_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" && "$UPSTREAM_ACTOR_ID" == "$AUTHORIZED_RELEASE_ACTOR_ID" ]] || {
              echo "::error::release source actor is not the authorized publisher"
              exit 1
            }
            [[ "$UPSTREAM_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" && "$UPSTREAM_TRIGGERING_ACTOR_ID" == "$AUTHORIZED_RELEASE_ACTOR_ID" ]] || {
              echo "::error::release source rerun actor is not the authorized publisher"
              exit 1
            }
            [[ "$UPSTREAM_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] || {
              echo "::error::release source head_sha must be a full commit SHA"
              exit 1
            }
            RELEASE_TAG="$UPSTREAM_HEAD_BRANCH"
            RELEASE_SOURCE_SHA="$UPSTREAM_HEAD_SHA"
            TRUSTED_RELEASE_INVOCATION="tag-signal"
          elif [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            [[ "$DISPATCH_REF" == "refs/heads/$DEFAULT_BRANCH" ]] || {
              echo "::error::workflow_dispatch must run from refs/heads/$DEFAULT_BRANCH, not $DISPATCH_REF"
              exit 1
            }
            [[ "$DISPATCH_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" && "$DISPATCH_ACTOR_ID" == "$AUTHORIZED_RELEASE_ACTOR_ID" && "$DISPATCH_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || {
              echo "::error::workflow_dispatch actor is not the authorized publisher"
              exit 1
            }
            [[ -n "$REQUESTED_TARGET_TAG" ]] || {
              echo "::error::workflow_dispatch requires a non-empty target_tag"
              exit 1
            }
            RELEASE_TAG="$REQUESTED_TARGET_TAG"
            RELEASE_SOURCE_SHA=""
            TRUSTED_RELEASE_INVOCATION="manual-recovery"
          else
            echo "::error::unsupported release event: $EVENT_NAME"
            exit 1
          fi
          if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::release tag must be a semantic vX.Y.Z tag: $RELEASE_TAG"
            exit 1
          fi
          printf 'release_tag=%s\n' "$RELEASE_TAG" >> "$GITHUB_OUTPUT"
          printf 'release_source_sha=%s\n' "$RELEASE_SOURCE_SHA" >> "$GITHUB_OUTPUT"
          printf 'trusted_invocation=%s\n' "$TRUSTED_RELEASE_INVOCATION" >> "$GITHUB_OUTPUT"

  prepare:
    needs: preflight
    if: ${{ needs.preflight.result == 'success' }}
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: read
    outputs:
      release_reusable: ${{ steps.lookup.outputs.release_reusable }}
      release_asset_digests: ${{ steps.lookup.outputs.release_asset_digests }}
      release_source_sha: ${{ steps.tag_source.outputs.release_source_sha }}
    steps:
      - name: Authorize credentialed job rerun actor
        shell: bash
        env:
          CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }}
        run: |
          set -euo pipefail
          [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || {
            echo "::error::credentialed release job rerun actor is not the authorized publisher"
            exit 1
          }

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24

      # Resolve the live tag through the API before any tag checkout. A
      # workflow_run must still point at the exact SHA carried by the successful
      # signal; an authorized manual recovery may resolve the immutable tag here.
      - name: Resolve protected immutable release tag
        id: tag_source
        env:
          ALLOW_RELEASE_SHA_RESOLUTION: ${{ needs.preflight.outputs.trusted_invocation == 'manual-recovery' && '1' || '0' }}
          GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}
          RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.release_source_sha }}
        run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA"

      # The root checkout contains only the trusted default-branch workflow and
      # release scripts. Check out application source separately by the already
      # verified commit SHA, never by a mutable tag name.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.tag_source.outputs.release_source_sha }}
          path: release-source
          persist-credentials: false
          fetch-depth: 0

      - name: Match release tag to every application version declaration
        shell: bash
        env:
          EXPECTED_RELEASE_SOURCE_SHA: ${{ steps.tag_source.outputs.release_source_sha }}
        run: |
          set -euo pipefail
          node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source
          release_source_sha="$(git -C release-source rev-parse HEAD)"
          if [[ "$release_source_sha" != "$EXPECTED_RELEASE_SOURCE_SHA" ]]; then
            echo "::error::release checkout differs from verified commit $EXPECTED_RELEASE_SOURCE_SHA"
            exit 1
          fi
          echo "RELEASE_SOURCE_SHA=$release_source_sha" >> "$GITHUB_ENV"

      - name: Require release source merged into live default branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          VERIFIED_RELEASE_SOURCE_SHA: ${{ steps.tag_source.outputs.release_source_sha }}
        run: bash scripts/check-release-source-ancestor.sh release-source "$VERIFIED_RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH"

      - name: Require GitHub Immutable Releases
        env:
          GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}
        run: node scripts/check-immutable-releases.mjs

      - name: Check for an existing immutable release
        id: lookup
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }}
        run: |
          set -euo pipefail
          if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::release tag must be a semantic vX.Y.Z tag: $RELEASE_TAG"
            exit 1
          fi
          lookup_error="$RUNNER_TEMP/release-lookup-error.txt"
          release_json="$RUNNER_TEMP/release.json"
          if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" >"$release_json" 2>"$lookup_error"; then
            REQUESTED_TARGET_TAG="$REQUESTED_TARGET_TAG" \
              node scripts/check-release-reuse.mjs "$RELEASE_TAG" "$release_json"
          elif grep -q 'HTTP 404' "$lookup_error"; then
            if [[ -n "$REQUESTED_TARGET_TAG" ]]; then
              echo "::error::target_tag $REQUESTED_TARGET_TAG must already exist as a GitHub Release"
              exit 1
            fi
            echo "release_reusable=false" >> "$GITHUB_OUTPUT"
          else
            cat "$lookup_error" >&2
            echo "::error::could not determine whether release $RELEASE_TAG already exists"
            exit 1
          fi

  build:
    needs: [preflight, prepare]
    if: ${{ needs.prepare.result == 'success' && needs.prepare.outputs.release_reusable != 'true' && needs.preflight.outputs.trusted_invocation == 'tag-signal' }}
    # All signing secrets live only in the default-branch-restricted release
    # environment. Never duplicate them as repository or organization secrets.
    environment: release
    env:
      RELEASE_SOURCE_SHA: ${{ needs.prepare.outputs.release_source_sha }}
    permissions:
      contents: read
    defaults:
      run:
        working-directory: release-source
    strategy:
      fail-fast: false
      matrix:
        include:
          - { platform: macos-latest, target: aarch64-apple-darwin, os: macos }
          # Intel build on GitHub's current x86_64 image — macos-13 retired
          # 2025-12; macos-15-intel is the last Intel image (until ~2027-08).
          - { platform: macos-15-intel, target: x86_64-apple-darwin, os: macos }
          - {
              platform: windows-latest,
              target: x86_64-pc-windows-msvc,
              os: windows,
            }
          - {
              platform: windows-latest,
              target: aarch64-pc-windows-msvc,
              os: windows,
            }
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Authorize credentialed job rerun actor
        shell: bash
        # Job-level defaults point later build commands at release-source, but
        # that checkout does not exist until the following actions run.
        working-directory: ${{ github.workspace }}
        env:
          CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }}
        run: |
          set -euo pipefail
          [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || {
            echo "::error::credentialed release job rerun actor is not the authorized publisher"
            exit 1
          }

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.prepare.outputs.release_source_sha }}
          path: release-source
          persist-credentials: false
          fetch-depth: 0

      # A successful prepare may belong to an earlier attempt. Re-fetch the live
      # default branch before executing application-controlled build code or
      # exposing signing credentials to later steps.
      - name: Re-check release source before build
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          set -euo pipefail
          [[ "$(git rev-parse HEAD)" == "$RELEASE_SOURCE_SHA" ]] || {
            echo "::error::release checkout differs from verified commit $RELEASE_SOURCE_SHA"
            exit 1
          }
          node ../scripts/check-release-version.mjs source "$RELEASE_TAG" .
          bash ../scripts/check-release-source-ancestor.sh . "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH"

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: release-source/package-lock.json

      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: release-source -> target

      - run: npm ci

      # ── macOS: vendor the Sparkle BinaryDelta helper BEFORE the build so it
      #    ships in Resources/. Without it the manager can't apply deltas and
      #    every macOS update silently falls back to the full-package download
      #    (the 0.1.x releases up to 0.1.12 shipped without it). The script
      #    pins Sparkle 2.9.1 by SHA-256; see scripts/vendor-binary-delta.sh.
      - name: Vendor Sparkle BinaryDelta (macOS delta updates)
        if: matrix.os == 'macos'
        run: bash scripts/vendor-binary-delta.sh

      # ── macOS: import the Developer ID cert into a throwaway keychain ──────
      - name: Import Apple Developer ID certificate
        if: matrix.os == 'macos'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          KC="$RUNNER_TEMP/build.keychain-db"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KC"
          security set-keychain-settings -lut 21600 "$KC"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KC"
          echo "$APPLE_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/cert.p12"
          security import "$RUNNER_TEMP/cert.p12" -k "$KC" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KC"
          security list-keychains -d user -s "$KC" $(security list-keychains -d user | sed s/\"//g)

      # ── Windows: assert the manual-approval gate before any signing secret is used ─
      #    docs/code-signing-policy.md requires per-request human approval
      #    (a required-reviewers rule on the `release` Environment) before an
      #    automated cloud-HSM login may sign anything. That rule is repository
      #    configuration, not workflow code, so without this step forgetting to
      #    configure it would silently sign with a stored credential and no
      #    approval. Only runs when a cloud provider is selected — never in
      #    today's unsigned default. Best effort by construction, and likely
      #    INERT with the default token: GITHUB_TOKEN has no `environments`
      #    permission, so this call is expected to fail and only warn (rule
      #    not verified) - it is a tripwire, not the control. The real control
      #    is the manual checklist in docs/windows-signing.md (step 2). Only a
      #    readable answer with no required_reviewers rule (including no
      #    protection rules at all) is a hard failure.
      - name: Assert release environment requires reviewers (cloud signing)
        if: matrix.os == 'windows' && (vars.WINDOWS_SIGNING_PROVIDER == 'esigner' || vars.WINDOWS_SIGNING_PROVIDER == 'certum')
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
          WINDOWS_SIGNING_PROVIDER: ${{ vars.WINDOWS_SIGNING_PROVIDER }}
        run: |
          $raw = & gh api "repos/$env:GITHUB_REPOSITORY/environments/release" 2>&1
          if ($LASTEXITCODE -ne 0) {
            Write-Host "::warning::Could not read the release environment's protection rules with the workflow token, so the required-reviewers gate is NOT verified by this run. Confirm it manually (docs/windows-signing.md, step 2)."
            return
          }
          $rules = @((($raw | Out-String) | ConvertFrom-Json).protection_rules)
          if (-not ($rules | Where-Object { $_.type -eq "required_reviewers" })) {
            Write-Host "::error::WINDOWS_SIGNING_PROVIDER=$env:WINDOWS_SIGNING_PROVIDER but the release environment has no required-reviewers rule (rules seen: $($rules.Count)). docs/code-signing-policy.md requires per-request human approval before a cloud signing credential is used; add a required reviewer (Settings > Environments > release) first."
            exit 1
          }
          Write-Host "release environment has a required-reviewers rule."

      # ── Windows: provision the eSigner CKA certificate (recommended provider) ─
      #    Only runs when vars.WINDOWS_SIGNING_PROVIDER == 'esigner'. No-op
      #    (and no secrets touched) for every other value, including the
      #    default empty string — matching today's unsigned release exactly.
      #    Authenticates to SSL.com and installs a CNG-backed certificate into
      #    the runner's CurrentUser certificate store *before* `tauri build`
      #    runs, so the signCommand hook (scripts/sign-windows-authenticode.ps1)
      #    can sign with plain signtool.exe. Only the resulting certificate
      #    thumbprint — not a secret — is exported to WINDOWS_SIGNING_THUMBPRINT.
      #    Flags follow SSL.com's published eSigner CKA CI/CD guide; validate
      #    against a real SSL.com account before relying on this in production
      #    (see docs/windows-signing.md).
      #    The downloaded release archive's SHA-256 is pinned and verified
      #    before extraction: this step runs in the credentialed `release`
      #    environment (ESIGNER_* secrets), so a replaced/compromised GitHub
      #    release asset must not be able to execute inside it unnoticed.
      #    Download/verify/extract/rename is factored into
      #    scripts/resolve-esigner-cka-installer.ps1 (shared with the
      #    secret-free CI dry run in win-installer-check.yml) — see that
      #    script's header for why the extracted installer must be renamed.
      #    Update its -Version / -ExpectedSha256 defaults together in a
      #    reviewed PR when bumping the eSigner CKA release.
      - name: Provision eSigner CKA certificate
        if: matrix.os == 'windows' && vars.WINDOWS_SIGNING_PROVIDER == 'esigner'
        shell: pwsh
        env:
          ESIGNER_USERNAME: ${{ secrets.ESIGNER_USERNAME }}
          ESIGNER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }}
          ESIGNER_TOTP_SECRET: ${{ secrets.ESIGNER_TOTP_SECRET }}
        run: |
          $ErrorActionPreference = "Stop"
          if ([string]::IsNullOrWhiteSpace($env:ESIGNER_USERNAME) -or [string]::IsNullOrWhiteSpace($env:ESIGNER_PASSWORD) -or [string]::IsNullOrWhiteSpace($env:ESIGNER_TOTP_SECRET)) {
            Write-Host "::error::WINDOWS_SIGNING_PROVIDER=esigner but ESIGNER_USERNAME/ESIGNER_PASSWORD/ESIGNER_TOTP_SECRET are not fully configured on the release environment"
            exit 1
          }
          $installDir = Join-Path $env:RUNNER_TEMP "eSignerCKA"
          $installer = & ./scripts/resolve-esigner-cka-installer.ps1 -DestinationDir $installDir -Stage "esigner-provision"
          & $installer /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES "/DIR=$installDir" | Out-Null
          $tool = Join-Path $installDir "eSignerCKATool.exe"
          $masterKey = Join-Path $installDir "master.key"
          & $tool config -mode "product" -user "$env:ESIGNER_USERNAME" -pass "$env:ESIGNER_PASSWORD" -totp "$env:ESIGNER_TOTP_SECRET" -key "$masterKey" -r
          & $tool unload
          # Identify the certificate THIS step loads by diffing the store
          # before/after `load`, rather than blindly taking the first
          # CurrentUser\My code-signing cert — a runner (self-hosted, or a
          # future change that provisions another cert earlier in the job)
          # could otherwise have an unrelated code-signing certificate
          # already present, silently signing the release with the wrong
          # publisher.
          $beforeThumbprints = @(Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert -ErrorAction SilentlyContinue | ForEach-Object Thumbprint)
          & $tool load
          $afterCerts = @(Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert -ErrorAction SilentlyContinue)
          $newCerts = @($afterCerts | Where-Object { $beforeThumbprints -notcontains $_.Thumbprint })
          if ($newCerts.Count -eq 0) {
            Write-Host "::error::eSigner CKA load did not add a new code-signing certificate to CurrentUser\My (pre-existing: $($beforeThumbprints -join ', '))"
            exit 1
          }
          if ($newCerts.Count -gt 1) {
            Write-Host "::error::eSigner CKA load added more than one code-signing certificate to CurrentUser\My; cannot unambiguously pick one ($((($newCerts | ForEach-Object Thumbprint)) -join ', '))"
            exit 1
          }
          $cert = $newCerts[0]
          Write-Host "eSigner CKA certificate loaded: thumbprint=$($cert.Thumbprint) subject=$($cert.Subject)"
          "WINDOWS_SIGNING_THUMBPRINT=$($cert.Thumbprint)" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

      # ── Windows: provision the Certum SimplySign certificate (fallback) ────
      #    Only runs when vars.WINDOWS_SIGNING_PROVIDER == 'certum'. Uses the
      #    community-maintained, SHA-pinned jay0lee/certum-cloud-code-sign
      #    action to authenticate to SimplySign and install the certificate.
      #    Only its cert-thumbprint output (not a secret) feeds the signCommand
      #    hook. See docs/windows-signing.md for setup and the risk note about
      #    depending on a third-party action.
      #
      #    That action is a single-author, unaudited-by-us repository that
      #    GUI-automates the SimplySign Desktop client via its own
      #    install/auth/verify scripts, and it receives the real Certum
      #    account credentials (CERTUM_USERNAME + CERTUM_TOTP_SECRET), not a
      #    scoped signing token. SHA-pinning stops the pinned commit from
      #    changing under us, but it does not substitute for actually
      #    reading that commit's scripts. Require an explicit, separate
      #    opt-in (vars.CERTUM_ACTION_AUDITED=true) so enabling the certum
      #    fallback is a deliberate decision made only after a maintainer
      #    has read jay0lee/certum-cloud-code-sign@a3324503 (or vendored a
      #    reviewed fork of it) — see docs/windows-signing.md#certum-action-audit.
      - name: Require Certum action audit acknowledgment
        if: matrix.os == 'windows' && vars.WINDOWS_SIGNING_PROVIDER == 'certum' && vars.CERTUM_ACTION_AUDITED != 'true'
        shell: pwsh
        run: |
          Write-Host "::error::WINDOWS_SIGNING_PROVIDER=certum requires vars.CERTUM_ACTION_AUDITED=true. jay0lee/certum-cloud-code-sign is a third-party action that receives real Certum account credentials; read docs/windows-signing.md#certum-action-audit and audit (or vendor) that action before setting this variable."
          exit 1

      # GitHub 在执行 if 之前校验所有外部 action。尚未启用的 Certum action
      # 不在本仓库允许列表中，直接引用也会阻止默认的未签名发布启动。
      # 保留 provider 的明确错误，待供应商接入完成审核后再加入本地实现。
      - name: Require reviewed local Certum provisioning
        if: matrix.os == 'windows' && vars.WINDOWS_SIGNING_PROVIDER == 'certum'
        shell: pwsh
        run: |
          Write-Host "::error::Certum 备用方案尚未接入：本仓库 action 策略禁止直接调用外部 Certum action。请先审核并接入本地证书预配实现，再启用 certum provider。"
          exit 1

      # ── Build (macOS: signed inside-out after; Windows: signed inline via ──
      #    the signCommand hook — scripts/sign-windows-authenticode.ps1 — when
      #    vars.WINDOWS_SIGNING_PROVIDER selects a provider; unsigned no-op
      #    otherwise, which is today's exact default behavior) ────────────────
      - name: Build (Tauri)
        shell: bash
        # These are only ever read by signCommand on the Windows legs (see
        # scripts/sign-windows-authenticode.ps1). Gate every value on
        # matrix.os == 'windows' — not just the provider selector — so the
        # code-signing PFX and its password never land in the macOS build
        # process's environment, where a compromised npm/cargo build-time
        # script (postinstall hook, build.rs, etc.) could read and exfiltrate
        # them even though that leg never uses them. The PFX secrets are
        # further limited to provider local-pfx (which signs with them) and
        # to an unset/"none" provider (so the migration guard in the signing
        # script can still see a leftover WINDOWS_CERTIFICATE and fail loudly);
        # with esigner/certum a retained legacy PFX is never exposed to the
        # build process.
        env:
          WINDOWS_SIGNING_PROVIDER: ${{ matrix.os == 'windows' && vars.WINDOWS_SIGNING_PROVIDER || '' }}
          WINDOWS_CERTIFICATE: ${{ matrix.os == 'windows' && contains(fromJSON('["","none","local-pfx"]'), vars.WINDOWS_SIGNING_PROVIDER) && secrets.WINDOWS_CERTIFICATE || '' }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ matrix.os == 'windows' && contains(fromJSON('["","none","local-pfx"]'), vars.WINDOWS_SIGNING_PROVIDER) && secrets.WINDOWS_CERTIFICATE_PASSWORD || '' }}
          WINDOWS_TIMESTAMP_URL: ${{ matrix.os == 'windows' && vars.WINDOWS_TIMESTAMP_URL || '' }}
          # The signing script writes this file when signing fails (see
          # Write-FailureMarker in scripts/sign-windows-authenticode.ps1) so the
          # retry loop below can tell a deterministic signing failure from a
          # transient toolchain download failure.
          WINDOWS_SIGNING_FAILURE_MARKER: ${{ matrix.os == 'windows' && format('{0}/signing-failed.marker', runner.temp) || '' }}
        # Bundling downloads toolchains on the fly (e.g. the NSIS archive from
        # GitHub) which occasionally 504s and fails the whole release. Retry a
        # few times so a transient download hiccup doesn't sink the run — cargo
        # output is cached, so a retry mostly just re-runs the bundling step.
        run: |
          marker=""
          if [ -n "${WINDOWS_SIGNING_FAILURE_MARKER:-}" ]; then
            marker="$(cygpath -u "$WINDOWS_SIGNING_FAILURE_MARKER" 2>/dev/null || printf '%s' "$WINDOWS_SIGNING_FAILURE_MARKER")"
          fi
          for attempt in 1 2 3; do
            [ -z "$marker" ] || rm -f "$marker"
            npm run tauri build -- --target ${{ matrix.target }} && exit 0
            # Authenticode signing failed: deterministic, and each repeat would
            # re-run (and, with a cloud provider, re-bill) every signing call.
            # Do not retry; surface the real error instead.
            if [ -n "$marker" ] && [ -e "$marker" ]; then
              echo "::error::tauri build failed during Windows signing (not retrying): $(cat "$marker")"
              exit 1
            fi
            echo "::warning::tauri build attempt ${attempt} failed (often a transient NSIS/toolchain download, e.g. HTTP 504) — retrying in 20s"
            sleep 20
          done
          echo "::error::tauri build failed after 3 attempts"
          exit 1

      # Regression gate: losing the helper is otherwise SILENT — updates still
      # succeed, they just always download the full ~400MB package instead of
      # the ~40MB delta. Fail the release loudly instead.
      - name: Assert BinaryDelta inside the bundle
        if: matrix.os == 'macos'
        run: |
          APP="$(find "target/${{ matrix.target }}/release/bundle/macos" -maxdepth 1 -name '*.app' | head -1)"
          BD="$APP/Contents/Resources/resources/BinaryDelta"
          [ -x "$BD" ] || { echo "::error::BinaryDelta missing or not executable at $BD — macOS delta updates would silently fall back to full downloads"; exit 1; }
          arches="$(lipo -archs "$BD")"
          case "$arches" in
            *x86_64*arm64*|*arm64*x86_64*) echo "BinaryDelta OK ($arches): $BD" ;;
            *) echo "::error::BinaryDelta is not universal (arches: $arches)"; exit 1 ;;
          esac

      # ── macOS: adaptive icon → sign → notarize → staple → repackage ───────
      - name: Finalize macOS bundle
        if: matrix.os == 'macos'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          AC_API_KEY_ID: ${{ secrets.AC_API_KEY_ID }}
          AC_API_ISSUER_ID: ${{ secrets.AC_API_ISSUER_ID }}
          AC_API_KEY_BASE64: ${{ secrets.AC_API_KEY_BASE64 }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          echo "$AC_API_KEY_BASE64" | base64 --decode > "$RUNNER_TEMP/AuthKey.p8"
          export AC_API_KEY="$RUNNER_TEMP/AuthKey.p8"
          bash scripts/finalize-macos.sh "${{ matrix.target }}"

      # ── Windows: PE architecture diagnostic (especially ARM64 cross-build) ─
      #    windows-latest is x64; aarch64-pc-windows-msvc is cross-compiled.
      #    Hard-assert the main PE machine type (0xAA64 / 0x8664). The NSIS
      #    outer -setup.exe is an x86/x64 stub that embeds the payload, so we
      #    assert machine type on the app binary, not the setup wrapper.
      #    Cross-compilation ≠ runtime verification. See docs/windows-signing.md.
      #    Invoke scripts in-process (`& .\scripts\…`); nested `pwsh -File` breaks
      #    array parameter binding for -Path on GitHub-hosted Windows runners.
      - name: Windows PE architecture diagnostic
        if: matrix.os == 'windows'
        shell: pwsh
        run: |
          $target = "${{ matrix.target }}"
          $main = "target/$target/release/codex-app-manager.exe"
          $setup = @(Get-ChildItem "target/$target/release/bundle/nsis/*-setup.exe" -ErrorAction SilentlyContinue)
          if (-not (Test-Path -LiteralPath $main)) {
            Write-Host "::error::[build] missing main PE: $main"
            exit 1
          }
          $expect = if ($target -like "aarch64-*") { "0xAA64" } else { "0x8664" }
          # Hard assert on the app binary only (setup is a host stub).
          & .\scripts\windows-pe-arch.ps1 -Path $main -ExpectMachine $expect
          if ($setup.Count -gt 0) {
            # Report-only for the installer wrapper (no ExpectMachine).
            & .\scripts\windows-pe-arch.ps1 -Path @($setup | ForEach-Object { $_.FullName })
          }
          if ($target -like "aarch64-*") {
            Write-Host "::notice::ARM64 main PE asserted machine=0xAA64 (cross-build on x64). Full Manager installer smoke remains x64-only; native ARM64 portable MSIX extraction and cua_node module resolution run in windows-portable-msix-e2e.yml."
          }

      # ── Windows: verify Authenticode on the final NSIS installer ───────────
      #    Signing itself already happened inline during `tauri build` via the
      #    signCommand hook (scripts/sign-windows-authenticode.ps1), covering
      #    the main binary, the generated uninstaller (via NSIS
      #    !uninstfinalize), and the final -setup.exe — see
      #    src-tauri/tauri.conf.json bundle.windows.signCommand.
      #    Only the installer is checked here, deliberately NOT
      #    target/<target>/release/codex-app-manager.exe: tauri-bundler
      #    signs a copy of the main exe for embedding and then restores that
      #    on-disk file to its unsigned, unpatched original after each bundle
      #    type (tauri-cli 2.11.5, tauri-bundler bundle.rs, "Restore unsigned
      #    and unpatched binary"), so that path is NotSigned even on a fully
      #    signed release. The signed main exe and the uninstaller exist as
      #    files only once the installer is installed — the next step verifies
      #    them (x64). ARM64 cannot install on an x64 runner, so its main exe
      #    and uninstaller stay on the manual checklist in
      #    docs/windows-signing.md.
      #    Optional until vars.AUTHENTICODE_REQUIRED=true; unsigned
      #    (NotSigned) is expected and non-blocking while no
      #    WINDOWS_SIGNING_PROVIDER is configured.
      #    -ExpectedThumbprint pins the check to the specific certificate the
      #    esigner/certum provisioning step loaded and exported as
      #    WINDOWS_SIGNING_THUMBPRINT (see docs/code-signing-policy.md's "from
      #    the expected publisher" requirement) — Valid + timestamp alone
      #    would still pass for a trusted certificate belonging to someone
      #    else. Empty for local-pfx/no provider, matching today's behavior.
      - name: Verify Authenticode on Windows installer
        if: matrix.os == 'windows'
        shell: pwsh
        env:
          AUTHENTICODE_MODE: ${{ vars.AUTHENTICODE_REQUIRED == 'true' && 'required' || 'optional' }}
        run: |
          $setup = Get-ChildItem "target/${{ matrix.target }}/release/bundle/nsis/*-setup.exe" -ErrorAction Stop
          & .\scripts\verify-windows-authenticode.ps1 `
            -Path @($setup.FullName) `
            -Mode $env:AUTHENTICODE_MODE `
            -ExpectedThumbprint $env:WINDOWS_SIGNING_THUMBPRINT `
            -Stage "sign-verify"

      # ── Windows (x64 only): installed main exe + uninstaller Authenticode
      #    gate on the real, signed release artifact ──────────────────────────
      #    docs/code-signing-policy.md requires all three project-owned PE
      #    layers (main exe, uninstaller, installer) to verify before
      #    publication. The signed main exe and the uninstaller only exist as
      #    files once the installer has been installed (NSIS writes the
      #    uninstaller during install; the on-disk build-output main exe is
      #    restored to unsigned by tauri-bundler), so this reuses the packaged
      #    lifecycle smoke script win-installer-check.yml already proves on
      #    PRs (throwaway-cert builds there) — here against the just-built
      #    -setup.exe, before this job publishes anything. It runs whenever a
      #    cloud provider is selected (mode optional/required follows
      #    AUTHENTICODE_REQUIRED), so the recommended "run 1-2 releases in
      #    optional mode first" rollout still hard-checks that every layer
      #    carries the provider's certificate, while a default unsigned
      #    release (no provider, enforcement off) skips this extra
      #    install/launch/upgrade/uninstall pass entirely, exactly as today.
      #    A failure here blocks the release. windows-latest is x64, so a
      #    cross-built ARM64 installer cannot install/run here — see
      #    docs/windows-signing.md's ARM64 runtime-verification checklist
      #    (item 6) for the manual check that covers that architecture.
      - name: Installed main exe + uninstaller Authenticode gate (x64)
        if: matrix.os == 'windows' && matrix.target == 'x86_64-pc-windows-msvc' && (vars.AUTHENTICODE_REQUIRED == 'true' || vars.WINDOWS_SIGNING_PROVIDER == 'esigner' || vars.WINDOWS_SIGNING_PROVIDER == 'certum')
        shell: pwsh
        env:
          AUTHENTICODE_MODE: ${{ vars.AUTHENTICODE_REQUIRED == 'true' && 'required' || 'optional' }}
        run: |
          $setup = Get-ChildItem "target/${{ matrix.target }}/release/bundle/nsis/*-setup.exe" -ErrorAction Stop
          & .\scripts\windows-packaged-smoke.ps1 `
            -Installer $setup.FullName `
            -AuthenticodeMode $env:AUTHENTICODE_MODE `
            -ExpectedThumbprint $env:WINDOWS_SIGNING_THUMBPRINT

      # ── Windows: sign the NSIS installer for the updater ──────────────────
      #    Tauri never emits an updater `.sig` on its own during build; this is
      #    unrelated to whether Authenticode signing is configured. In Tauri 2
      #    the Windows updater ships the `-setup.exe` itself, so signing it here
      #    with the updater key — exactly what finalize-macos.sh does for the
      #    .app.tar.gz — is equivalent to `createUpdaterArtifacts` and is what
      #    gets windows-x86_64 and windows-aarch64 into latest.json. Without it
      #    the manifest has macOS platforms only and Windows in-app self-update
      #    never sees new versions.
      #    NOTE: updater signature ≠ Authenticode ≠ SmartScreen reputation.
      - name: Sign Windows updater artifact
        if: matrix.os == 'windows'
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          echo "::group::[sign] Tauri updater signature (.sig)"
          B="target/${{ matrix.target }}/release/bundle"
          shopt -s nullglob
          signed=0
          for exe in "$B"/nsis/*-setup.exe; do
            npx tauri signer sign "$exe"
            signed=$((signed + 1))
          done
          if [ "$signed" -eq 0 ]; then
            echo "::error::[sign] no NSIS -setup.exe found to sign under $B/nsis" >&2
            exit 1
          fi
          echo "::endgroup::"

      # ── Collect artifacts (rename macOS updater tarball with its arch so the
      #    two macOS jobs don't collide when merged) ──────────────────────────
      - name: Collect artifacts
        shell: bash
        run: |
          echo "::group::[build] collect final publishable artifacts"
          DST="$GITHUB_WORKSPACE/dist-artifacts"; mkdir -p "$DST"
          B="target/${{ matrix.target }}/release/bundle"
          ARCH="${{ matrix.target }}"; ARCH="${ARCH%%-*}"
          shopt -s nullglob
          if [ "${{ matrix.os }}" = "macos" ]; then
            for f in "$B"/macos/*.app.tar.gz;      do cp "$f" "$DST/CodexAppManager_${ARCH}.app.tar.gz"; done
            for f in "$B"/macos/*.app.tar.gz.sig;  do cp "$f" "$DST/CodexAppManager_${ARCH}.app.tar.gz.sig"; done
            for f in "$B"/dmg/*.dmg;               do cp "$f" "$DST/CodexAppManager_${ARCH}.dmg"; done
          else
            # Strip spaces from the NSIS filenames (productName is "Codex App
            # Manager"). GitHub rewrites spaces to dots in uploaded asset names,
            # but gen-updater-manifest.mjs builds the URL from the pre-upload
            # filename — so a spaced name yields a %20 URL that 404s against the
            # dotted asset. Renaming space-free here keeps asset name == manifest
            # URL (the macOS branch already renames for the same reason).
            for f in "$B"/nsis/*-setup.exe "$B"/nsis/*-setup.exe.sig \
                     "$B"/nsis/*.nsis.zip "$B"/nsis/*.nsis.zip.sig; do
              n="$(basename "$f")"; cp "$f" "$DST/${n// /}"
            done
          fi
          ls -la "$DST"
          # Gate on final publishable names (not intermediate target/ paths).
          if [ "${{ matrix.os }}" = "windows" ]; then
            setup_count=$(ls -1 "$DST"/*-setup.exe 2>/dev/null | wc -l | tr -d ' ')
            sig_count=$(ls -1 "$DST"/*-setup.exe.sig 2>/dev/null | wc -l | tr -d ' ')
            if [ "$setup_count" -lt 1 ]; then
              echo "::error::[build] no final *-setup.exe in dist-artifacts" >&2
              exit 1
            fi
            if [ "$sig_count" -lt 1 ]; then
              echo "::error::[sign] no final *-setup.exe.sig in dist-artifacts (updater signature missing)" >&2
              exit 1
            fi
          else
            dmg_count=$(ls -1 "$DST"/*.dmg 2>/dev/null | wc -l | tr -d ' ')
            if [ "$dmg_count" -lt 1 ]; then
              echo "::error::[build] no final *.dmg in dist-artifacts" >&2
              exit 1
            fi
          fi
          echo "::endgroup::"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: bundle-${{ matrix.target }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: dist-artifacts/*
          if-no-files-found: error

  # Signing and notarization are intentionally non-deterministic. Keep every
  # successful matrix artifact under an attempt-qualified name, then select the
  # earliest successful artifact for each target. A release/stage rerun therefore
  # reuses the exact first bytes instead of creating a second immutable payload.
  select_artifacts:
    needs: [prepare, build]
    if: ${{ always() && needs.prepare.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    outputs:
      artifact_names: ${{ steps.select.outputs.artifact_names }}
    steps:
      - name: Select canonical build artifacts
        id: select
        if: ${{ needs.prepare.outputs.release_reusable != 'true' }}
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          targets=(
            aarch64-apple-darwin
            x86_64-apple-darwin
            x86_64-pc-windows-msvc
            aarch64-pc-windows-msvc
          )
          names_file="$RUNNER_TEMP/canonical-artifact-names.txt"
          : > "$names_file"
          for poll in 1 2 3 4 5; do
            gh api --paginate \
              "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" \
              --jq '.artifacts[].name' > "$RUNNER_TEMP/run-artifacts.txt"
            : > "$names_file"
            complete=true
            for target in "${targets[@]}"; do
              selected=""
              for attempt in $(seq 1 "$GITHUB_RUN_ATTEMPT"); do
                candidate="bundle-${target}-${GITHUB_RUN_ID}-${attempt}"
                if grep -Fxq "$candidate" "$RUNNER_TEMP/run-artifacts.txt"; then
                  selected="$candidate"
                  break
                fi
              done
              if [[ -z "$selected" ]]; then
                complete=false
                break
              fi
              echo "$selected" >> "$names_file"
            done
            [[ "$complete" == "true" ]] && break
            sleep 5
          done
          [[ "$complete" == "true" ]] || {
            echo "::error::no complete canonical release artifact set exists for this run"
            exit 1
          }
          artifact_names="$(jq -Rsc 'split("\n") | map(select(length > 0))' "$names_file")"
          echo "artifact_names=$artifact_names" >> "$GITHUB_OUTPUT"
          echo "Canonical artifacts: $artifact_names"

  release:
    if: ${{ always() && needs.preflight.result == 'success' && needs.prepare.result == 'success' && needs.select_artifacts.result == 'success' }}
    needs: [preflight, prepare, build, select_artifacts]
    # All mirror credentials live only in the default-branch-restricted release
    # environment. Never duplicate them as repository or organization secrets.
    environment: release
    env:
      TRUSTED_WORKFLOW_SHA: ${{ github.workflow_sha }}
      TRUSTED_WORKFLOW_SOURCE_SHA: ${{ github.sha }}
    permissions:
      contents: write
      actions: write # dispatch winget.yml after publishing (release events from GITHUB_TOKEN don't cascade)
      id-token: write # provenance attestations
      attestations: write
    runs-on: ubuntu-latest
    steps:
      - name: Authorize credentialed job rerun actor
        shell: bash
        env:
          CURRENT_TRIGGERING_ACTOR_LOGIN: ${{ github.triggering_actor }}
        run: |
          set -euo pipefail
          [[ "$CURRENT_TRIGGERING_ACTOR_LOGIN" == "$AUTHORIZED_RELEASE_ACTOR_LOGIN" ]] || {
            echo "::error::credentialed release job rerun actor is not the authorized publisher"
            exit 1
          }

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Historical workflow revisions used the legacy credential names and wrote
      # latest.json unconditionally. Keeping those secrets deleted is the storage
      # authorization boundary that makes an old run's "Re-run all jobs" fail
      # before it can mutate either mirror.
      - name: Enforce legacy mirror credential revocation
        shell: bash
        env:
          LEGACY_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_ACCESS_KEY_ID }}
          LEGACY_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_SECRET_ACCESS_KEY }}
          LEGACY_IHEP_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_ACCESS_KEY_ID }}
          LEGACY_IHEP_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_SECRET_ACCESS_KEY }}
        run: |
          if [[ -n "$LEGACY_R2_ACCESS_KEY_ID$LEGACY_R2_SECRET_ACCESS_KEY$LEGACY_IHEP_ACCESS_KEY_ID$LEGACY_IHEP_SECRET_ACCESS_KEY" ]]; then
            echo "::error::legacy mirror write secrets are still configured; move credentials to the *_PROMOTION_* names and delete all four legacy access-key secrets"
            exit 1
          fi

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24

      # Re-resolve tag policy on every release-job attempt. For manual recovery
      # this independently resolves the immutable tag; a signal run must still
      # match the SHA carried by the original successful push workflow.
      - name: Re-resolve protected immutable release tag
        id: tag_source
        env:
          ALLOW_RELEASE_SHA_RESOLUTION: ${{ needs.preflight.outputs.trusted_invocation == 'manual-recovery' && '1' || '0' }}
          GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}
          RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.release_source_sha }}
        run: node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA"

      # Re-run this gate inside every release-job attempt. GitHub's "Re-run
      # failed jobs" does not re-run prepare, and no immutable publication may
      # rely only on a previous attempt's source or ancestry decision.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.tag_source.outputs.release_source_sha }}
          path: release-source
          persist-credentials: false
          fetch-depth: 0

      - name: Re-check release tag against application versions
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          EXPECTED_RELEASE_SOURCE_SHA: ${{ steps.tag_source.outputs.release_source_sha }}
        run: |
          set -euo pipefail
          node scripts/check-release-version.mjs source "$RELEASE_TAG" release-source
          release_source_sha="$(git -C release-source rev-parse HEAD)"
          if [[ "$release_source_sha" != "$EXPECTED_RELEASE_SOURCE_SHA" ]]; then
            echo "::error::release checkout differs from verified commit $EXPECTED_RELEASE_SOURCE_SHA"
            exit 1
          fi
          bash scripts/check-release-source-ancestor.sh release-source "$release_source_sha" "$DEFAULT_BRANCH"
          echo "RELEASE_SOURCE_SHA=$release_source_sha" >> "$GITHUB_ENV"

      # Re-check on every release-job attempt. `prepare` is not rerun by
      # "Re-run failed jobs", and publishing a resumed draft while the setting is
      # disabled would create a mutable canonical source.
      - name: Re-check GitHub Immutable Releases
        env:
          GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}
        run: node scripts/check-immutable-releases.mjs

      # `prepare` may belong to an earlier run attempt when the operator chooses
      # "Re-run failed jobs". Refresh the release state inside this job so a
      # GitHub Release published by the failed attempt becomes the canonical,
      # immutable byte source instead of being uploaded a second time.
      - name: Refresh immutable release state
        id: live_release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          REQUESTED_TARGET_TAG: ${{ inputs.target_tag || '' }}
        run: |
          set -euo pipefail
          lookup_error="$RUNNER_TEMP/live-release-lookup-error.txt"
          release_json="$RUNNER_TEMP/live-release.json"
          if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" >"$release_json" 2>"$lookup_error"; then
            REQUESTED_TARGET_TAG="$REQUESTED_TARGET_TAG" \
              node scripts/check-release-reuse.mjs "$RELEASE_TAG" "$release_json"
          elif grep -q 'HTTP 404' "$lookup_error"; then
            if [[ -n "$REQUESTED_TARGET_TAG" ]]; then
              echo "::error::target_tag $REQUESTED_TARGET_TAG must already exist as a GitHub Release"
              exit 1
            fi
            echo "release_reusable=false" >> "$GITHUB_OUTPUT"
            echo "release_asset_digests={}" >> "$GITHUB_OUTPUT"
          else
            cat "$lookup_error" >&2
            echo "::error::could not refresh release state for $RELEASE_TAG"
            exit 1
          fi

      # A target_tag dispatch intentionally checks out the protected default
      # branch so historical workflow code cannot run. The updater trust root is
      # release data, however, and must come from the target tag: a later key
      # rotation must not make valid immutable historical artifacts unverifiable.
      - name: Resolve updater trust root for release tag
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          release_config="$RUNNER_TEMP/release-tauri.conf.json"
          gh api --method GET \
            -H "Accept: application/vnd.github.raw+json" \
            "repos/$GITHUB_REPOSITORY/contents/src-tauri/tauri.conf.json" \
            -f ref="$RELEASE_SOURCE_SHA" >"$release_config"
          if ! updater_public_key="$(
            jq -er '
              .plugins.updater.pubkey
              | select(type == "string" and length > 0)
              | select((contains("\n") or contains("\r")) | not)
              | select(test("^[A-Za-z0-9+/]+={0,2}$"))
            ' "$release_config"
          )"; then
            echo "::error::release tag $RELEASE_TAG has no valid single-line updater public key"
            exit 1
          fi
          printf 'RELEASE_TAURI_CONFIG=%s\n' "$release_config" >> "$GITHUB_ENV"
          printf 'MIRROR_UPDATER_PUBLIC_KEY=%s\n' "$updater_public_key" >> "$GITHUB_ENV"

      - name: Download canonical build artifacts
        if: ${{ steps.live_release.outputs.release_reusable != 'true' }}
        shell: bash
        env:
          ARTIFACT_NAMES_JSON: ${{ needs.select_artifacts.outputs.artifact_names }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          rm -rf dist
          rm -f release-binding.json
          mkdir -p dist
          jq -er '.[]' <<<"$ARTIFACT_NAMES_JSON" | while IFS= read -r artifact; do
            gh run download "$GITHUB_RUN_ID" \
              --repo "$GITHUB_REPOSITORY" \
              --name "$artifact" \
              --dir dist
          done

      # A same-tag rerun or emergency downgrade must use the bytes already
      # published for that tag. Rebuilding signed/notarized artifacts is
      # intentionally non-reproducible and would conflict with immutable keys.
      - name: Resolve immutable release artifact source
        id: release_source
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_ASSET_DIGESTS: ${{ steps.live_release.outputs.release_asset_digests }}
        run: |
          set -euo pipefail
          if [[ "${{ steps.live_release.outputs.release_reusable }}" == "true" ]]; then
            published="$RUNNER_TEMP/published-release-artifacts"
            rm -rf "$published"
            mkdir -p "$published"
            gh release download "$RELEASE_TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --dir "$published" \
              --pattern 'CodexAppManager*' \
              --pattern 'latest.json' \
              --pattern 'release-binding.json'
            test -f "$published/latest.json" || {
              echo "::error::published $RELEASE_TAG has no latest.json"
              exit 1
            }
            jq -e 'type == "object" and length > 0' <<<"$RELEASE_ASSET_DIGESTS" >/dev/null || {
              echo "::error::immutable release digest evidence is missing"
              exit 1
            }
            while IFS=$'\t' read -r name expected_digest; do
              file="$published/$name"
              test -f "$file" || {
                echo "::error::immutable release asset is missing after download: $name"
                exit 1
              }
              actual_digest="sha256:$(sha256sum "$file" | cut -d' ' -f1)"
              if [[ "$actual_digest" != "$expected_digest" ]]; then
                echo "::error::immutable release digest mismatch for $name"
                exit 1
              fi
              echo "Verified immutable release digest: $name"
            done < <(jq -r 'to_entries[] | [.key, .value] | @tsv' <<<"$RELEASE_ASSET_DIGESTS")
            cp "$published/latest.json" "$RUNNER_TEMP/published-latest.json"
            rm "$published/latest.json"
            cp "$published/release-binding.json" release-binding.json
            rm "$published/release-binding.json"
            rm -rf dist
            mv "$published" dist
            echo "existing=true" >> "$GITHUB_OUTPUT"
            echo "source=github-release" >> "$GITHUB_OUTPUT"
            echo "Reusing immutable artifacts from existing release $RELEASE_TAG"
          else
            test -d dist || {
              echo "::error::no build artifacts are available for new release $RELEASE_TAG"
              exit 1
            }
            echo "existing=false" >> "$GITHUB_OUTPUT"
            echo "source=canonical-actions-artifacts" >> "$GITHUB_OUTPUT"
          fi

      # Validate the merged *publishable* tree (renamed final names), not the
      # per-target intermediate build directories from the matrix jobs.
      - name: Validate final release artifacts
        shell: bash
        run: |
          echo "::group::[build] validate final publishable artifacts"
          set -euo pipefail
          node scripts/check-release-version.mjs artifacts "$RELEASE_TAG" dist
          ls -la dist
          missing=0
          require() {
            local pattern="$1"
            local matches
            # shellcheck disable=SC2086
            matches="$(compgen -G "dist/$pattern" || true)"
            if [[ -z "$matches" ]]; then
              echo "::error::[build] missing final artifact matching: $pattern"
              missing=1
            else
              while IFS= read -r file; do
                if [[ ! -s "$file" ]]; then
                  echo "::error::[build] empty final artifact: $file"
                  missing=1
                fi
              done <<<"$matches"
              echo "OK $pattern → $(tr '\n' ' ' <<<"$matches")"
            fi
          }
          require "CodexAppManager_aarch64.dmg"
          require "CodexAppManager_x86_64.dmg"
          require "CodexAppManager_aarch64.app.tar.gz"
          require "CodexAppManager_x86_64.app.tar.gz"
          require "CodexAppManager_aarch64.app.tar.gz.sig"
          require "CodexAppManager_x86_64.app.tar.gz.sig"
          # Windows NSIS names after space-stripping (see Collect artifacts).
          require "*x64*-setup.exe"
          require "*arm64*-setup.exe"
          require "*x64*-setup.exe.sig"
          require "*arm64*-setup.exe.sig"
          if [ "$missing" -ne 0 ]; then
            echo "::error::[build] final artifact validation failed"
            exit 1
          fi
          echo "::endgroup::"

      - name: Generate updater manifest (latest.json)
        env:
          ALLOW_PARTIAL_RELEASE: ${{ vars.ALLOW_PARTIAL_RELEASE }}
        run: |
          node scripts/gen-updater-manifest.mjs "$RELEASE_TAG" dist
          cp latest.json "$RUNNER_TEMP/artifact-derived-latest.json"
          if [[ "${{ steps.release_source.outputs.existing }}" == "true" ]]; then
            cp "$RUNNER_TEMP/published-latest.json" latest.json
          fi
          node scripts/validate-release-manifest.mjs \
            "$RELEASE_TAG" \
            latest.json \
            "$RUNNER_TEMP/artifact-derived-latest.json"

      # A wrong private/public updater-key pairing cannot be repaired after an
      # immutable GitHub Release is published. Verify the exact local payloads
      # (including manifest/sidecar equality) before either mirror staging or
      # draft publication. This also protects prereleases, which skip mirrors.
      - name: Verify local updater signatures before immutable publication
        run: |
          node scripts/verify-release-artifacts.mjs \
            latest.json \
            dist \
            "$RELEASE_TAURI_CONFIG"

      # A workflow_run attestation identifies the trusted default-branch
      # release.yml, not the tag ref. Bind the separately verified tag commit to
      # the exact subject digests in a custom, immutable predicate.
      - name: Resolve signed release binding
        id: binding
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          subjects=(dist/* latest.json)
          if [[ "${{ steps.release_source.outputs.existing }}" != "true" ]]; then
            node scripts/release-binding.mjs create \
              release-binding.json \
              "$RELEASE_TAG" \
              "$RELEASE_SOURCE_SHA" \
              "$GITHUB_REPOSITORY" \
              "$DEFAULT_BRANCH" \
              "$TRUSTED_WORKFLOW_SHA" \
              "$TRUSTED_WORKFLOW_SOURCE_SHA" \
              "${subjects[@]}"
          fi
          node scripts/release-binding.mjs verify \
            release-binding.json \
            "$RELEASE_TAG" \
            "$RELEASE_SOURCE_SHA" \
            "$GITHUB_REPOSITORY" \
            "$DEFAULT_BRANCH" \
            "${subjects[@]}"

      # Create provenance only for bytes produced by this release run, before a
      # draft can become immutable. A later failed-job rerun must never mint a
      # new statement that falsely attributes already-published bytes to the
      # rerun's OIDC identity.
      - name: Attest fresh build provenance
        id: attest_fresh
        if: ${{ steps.release_source.outputs.existing != 'true' }}
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            dist/*
            latest.json

      - name: Attest fresh release source binding
        id: attest_binding
        if: ${{ steps.release_source.outputs.existing != 'true' }}
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: |
            dist/*
            latest.json
          predicate-type: https://codexapp.agentsmirror.com/attestations/release-binding/v1
          predicate-path: release-binding.json

      # Verify the just-created bundle before any draft upload. The standard
      # workflow_run identity is the trusted main workflow/source; the custom
      # predicate and exact subject set provide the independent tag binding.
      - name: Verify fresh release source binding
        id: verify_fresh_binding
        if: ${{ steps.release_source.outputs.existing != 'true' }}
        shell: bash
        env:
          ATTESTATION_BUNDLE: ${{ steps.attest_binding.outputs.bundle-path }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          signer_workflow="$GITHUB_REPOSITORY/.github/workflows/release.yml"
          verification="$RUNNER_TEMP/fresh-release-binding-verification.json"
          gh attestation verify latest.json \
            --bundle "$ATTESTATION_BUNDLE" \
            --repo "$GITHUB_REPOSITORY" \
            --signer-workflow "$signer_workflow" \
            --signer-digest "$TRUSTED_WORKFLOW_SHA" \
            --source-ref "refs/heads/$DEFAULT_BRANCH" \
            --source-digest "$TRUSTED_WORKFLOW_SOURCE_SHA" \
            --predicate-type "https://codexapp.agentsmirror.com/attestations/release-binding/v1" \
            --deny-self-hosted-runners \
            --format json > "$verification"
          node scripts/release-binding.mjs attestation "$verification" release-binding.json

      # Existing immutable releases are accepted only when their downloaded,
      # API-digest-pinned bytes already carry provenance from this repository's
      # trusted default-branch release workflow revision. The custom predicate
      # separately binds the immutable tag and peeled source SHA to every digest.
      # This is verification, not a new OIDC statement; missing historical
      # provenance or binding fails closed.
      - name: Verify existing immutable release provenance
        id: verify_existing_provenance
        if: ${{ steps.release_source.outputs.existing == 'true' }}
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ github.token }}
          RELEASE_SIGNER_SHA: ${{ steps.binding.outputs.signer_sha }}
          RELEASE_WORKFLOW_SOURCE_SHA: ${{ steps.binding.outputs.source_sha }}
        run: |
          set -euo pipefail
          signer_workflow="$GITHUB_REPOSITORY/.github/workflows/release.yml"
          predicate_type="https://codexapp.agentsmirror.com/attestations/release-binding/v1"
          gh release verify "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --format json > "$RUNNER_TEMP/immutable-release-attestation.json"
          for file in dist/* latest.json release-binding.json; do
            gh release verify-asset "$RELEASE_TAG" "$file" \
              --repo "$GITHUB_REPOSITORY" >/dev/null
          done
          for file in dist/* latest.json; do
            gh attestation verify "$file" \
              --repo "$GITHUB_REPOSITORY" \
              --signer-workflow "$signer_workflow" \
              --signer-digest "$RELEASE_SIGNER_SHA" \
              --source-ref "refs/heads/$DEFAULT_BRANCH" \
              --source-digest "$RELEASE_WORKFLOW_SOURCE_SHA" \
              --deny-self-hosted-runners >/dev/null
            custom_json="$RUNNER_TEMP/release-binding-$(basename "$file").json"
            gh attestation verify "$file" \
              --repo "$GITHUB_REPOSITORY" \
              --signer-workflow "$signer_workflow" \
              --signer-digest "$RELEASE_SIGNER_SHA" \
              --source-ref "refs/heads/$DEFAULT_BRANCH" \
              --source-digest "$RELEASE_WORKFLOW_SOURCE_SHA" \
              --predicate-type "$predicate_type" \
              --deny-self-hosted-runners \
              --format json > "$custom_json"
            node scripts/release-binding.mjs attestation "$custom_json" release-binding.json
            echo "Verified existing provenance and release binding: $(basename "$file")"
          done

      - name: Resolve provenance gate
        id: provenance
        shell: bash
        env:
          FRESH_ATTESTATION_OUTCOME: ${{ steps.attest_fresh.outcome }}
          FRESH_BINDING_ATTESTATION_OUTCOME: ${{ steps.attest_binding.outcome }}
          FRESH_BINDING_VERIFICATION_OUTCOME: ${{ steps.verify_fresh_binding.outcome }}
          EXISTING_PROVENANCE_OUTCOME: ${{ steps.verify_existing_provenance.outcome }}
          RELEASE_REUSED: ${{ steps.release_source.outputs.existing }}
        run: |
          set -euo pipefail
          if [[ "$RELEASE_REUSED" == "true" ]]; then
            [[ "$FRESH_ATTESTATION_OUTCOME" == "skipped" ]]
            [[ "$FRESH_BINDING_ATTESTATION_OUTCOME" == "skipped" ]]
            [[ "$FRESH_BINDING_VERIFICATION_OUTCOME" == "skipped" ]]
            [[ "$EXISTING_PROVENANCE_OUTCOME" == "success" ]]
            echo "mode=verified-existing-immutable-release" >> "$GITHUB_OUTPUT"
          else
            [[ "$FRESH_ATTESTATION_OUTCOME" == "success" ]]
            [[ "$FRESH_BINDING_ATTESTATION_OUTCOME" == "success" ]]
            [[ "$FRESH_BINDING_VERIFICATION_OUTCOME" == "success" ]]
            [[ "$EXISTING_PROVENANCE_OUTCOME" == "skipped" ]]
            echo "mode=fresh-build-attested-before-publication" >> "$GITHUB_OUTPUT"
          fi
          echo "ready=true" >> "$GITHUB_OUTPUT"

      # Stable releases stage immutable versioned assets before GitHub Release
      # publication, verify them separately, then promote latest.json only after
      # the GitHub Release succeeds. Pre-releases still skip the mirror entirely.
      - name: Stage CDN mirror candidate (R2 + IHEP S3)
        id: mirror_stage
        if: ${{ steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }}
        env:
          MIRROR_PHASE: stage
          MIRROR_REQUIRED_BACKENDS: r2,ihep
          MIRROR_CANDIDATE_ID: ${{ github.run_id }}-${{ github.run_attempt }}
          MIRROR_ALLOW_DOWNGRADE: ${{ inputs.allow_mirror_downgrade && '1' || '0' }}
          MIRROR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          MIRROR_DOWNGRADE_REASON: ${{ inputs.mirror_downgrade_reason || '' }}
          MIRROR_WORKFLOW_REF_NAME: ${{ github.ref_name }}
          MANAGER_R2_S3_ENDPOINT: ${{ secrets.MANAGER_R2_S3_ENDPOINT }}
          MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }}
          MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }}
          MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }}
          MANAGER_IHEP_S3_ENDPOINT: ${{ vars.MANAGER_IHEP_S3_ENDPOINT }}
          MANAGER_IHEP_S3_BUCKET: ${{ vars.MANAGER_IHEP_S3_BUCKET }}
          MANAGER_IHEP_S3_REGION: ${{ vars.MANAGER_IHEP_S3_REGION }}
          MANAGER_IHEP_S3_PREFIX: ${{ vars.MANAGER_IHEP_S3_PREFIX }}
          MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }}
          MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }}
        run: |
          [ -f dist/latest.json ] || cp latest.json dist/latest.json
          bash scripts/sync-mirror.sh dist
          # The GitHub Release uploads the root latest.json exactly once. Recreate
          # dist/latest.json later for promotion instead of giving the upload
          # action two paths with the same asset basename.
          rm -f dist/latest.mirror.json dist/latest.json

      # Complete a direct readback from both object stores and force separate
      # readbacks through the Worker's R2 and mainland-China IHEP branches. This
      # is a verify-only phase: latest.json cannot be changed here. Both public
      # branches must pass before GitHub publication becomes immutable.
      - name: Verify staged CDN mirror before immutable publication
        id: mirror_verify
        if: ${{ steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }}
        env:
          MIRROR_PHASE: verify
          MIRROR_REQUIRED_BACKENDS: r2,ihep
          MIRROR_CANDIDATE_ID: ${{ github.run_id }}-${{ github.run_attempt }}
          MIRROR_ALLOW_DOWNGRADE: ${{ inputs.allow_mirror_downgrade && '1' || '0' }}
          MIRROR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          MIRROR_DOWNGRADE_REASON: ${{ inputs.mirror_downgrade_reason || '' }}
          MIRROR_WORKFLOW_REF_NAME: ${{ github.ref_name }}
          MANAGER_R2_S3_ENDPOINT: ${{ secrets.MANAGER_R2_S3_ENDPOINT }}
          MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }}
          MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }}
          MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }}
          MANAGER_IHEP_S3_ENDPOINT: ${{ vars.MANAGER_IHEP_S3_ENDPOINT }}
          MANAGER_IHEP_S3_BUCKET: ${{ vars.MANAGER_IHEP_S3_BUCKET }}
          MANAGER_IHEP_S3_REGION: ${{ vars.MANAGER_IHEP_S3_REGION }}
          MANAGER_IHEP_S3_PREFIX: ${{ vars.MANAGER_IHEP_S3_PREFIX }}
          MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }}
          MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }}
        run: |
          [ -f dist/latest.json ] || cp latest.json dist/latest.json
          bash scripts/sync-mirror.sh dist
          rm -f dist/latest.mirror.json dist/latest.json

      # ── release notes: the hand-written file from the version-bump PR
      #    (docs/releases/<tag>.md, see docs/releases/TEMPLATE.md) wins;
      #    otherwise the minimal install table keeps the body from ever being
      #    empty. GitHub's auto "What's Changed" section is appended either way.
      - name: Prepare release notes
        run: |
          NOTES="release-source/docs/releases/$RELEASE_TAG.md"
          if [ -f "$NOTES" ]; then
            cp "$NOTES" "$RUNNER_TEMP/release-notes.md"
          else
            echo "::warning::$NOTES not found — publishing with fallback notes"
            cp docs/releases/FALLBACK.md "$RUNNER_TEMP/release-notes.md"
          fi

      - name: Generate SHA256SUMS
        shell: bash
        run: |
          (
            cd dist
            sha256sum * | sort -k2
          ) > SHA256SUMS
          if [ ! -f dist/latest.json ]; then
            sha256sum latest.json >> SHA256SUMS
          fi
          sha256sum release-binding.json >> SHA256SUMS
          cat SHA256SUMS

      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable

      - name: Generate SBOMs
        id: sbom
        continue-on-error: true
        shell: bash
        run: |
          mkdir -p release-assets
          status=0
          : > release-assets/sbom-status.txt

          if (cd release-source && npm sbom --package-lock-only --sbom-format cyclonedx) > release-assets/sbom-npm.cdx.json; then
            echo "npm SBOM: generated" >> release-assets/sbom-status.txt
          else
            echo "::warning::npm SBOM generation failed"
            echo "npm SBOM: failed" >> release-assets/sbom-status.txt
            rm -f release-assets/sbom-npm.cdx.json
            status=1
          fi

          if cargo metadata --manifest-path release-source/src-tauri/Cargo.toml --format-version=1 > "$RUNNER_TEMP/cargo-metadata.json" \
            && node scripts/cargo-metadata-to-cyclonedx.mjs "$RUNNER_TEMP/cargo-metadata.json" release-assets/sbom-cargo.cdx.json; then
            echo "cargo SBOM: generated" >> release-assets/sbom-status.txt
          else
            echo "::warning::cargo SBOM generation failed"
            echo "cargo SBOM: failed" >> release-assets/sbom-status.txt
            rm -f release-assets/sbom-cargo.cdx.json
            status=1
          fi

          exit "$status"

      # The repository-level ruleset closes the long validation-to-publication
      # window by forbidding v* tag updates/deletions. Re-read both the policy and
      # the peeled commit immediately before creating the canonical draft.
      - name: Re-check protected release source before draft upload
        if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }}
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}
        run: |
          bash scripts/check-release-source-ancestor.sh release-source "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH"
          node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA"

      # Explicit draft-first publication keeps asset upload ahead of publication
      # for both stable and prerelease tags. This is required when GitHub immutable
      # releases are enabled: a published release can no longer accept assets.
      - name: Upload GitHub Release draft
        id: upload_release_draft
        if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }}
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          draft: true
          # Tags carrying a pre-release identifier (e.g. v0.1.2-rc1) publish as a
          # prerelease, so GitHub's `releases/latest` — and the updater endpoint
          # pointing at it — keep resolving to the last stable build instead of
          # serving a release-candidate to real users.
          prerelease: ${{ contains(env.RELEASE_TAG, '-') }}
          body_path: ${{ runner.temp }}/release-notes.md
          generate_release_notes: true
          files: |
            dist/*
            latest.json
            release-binding.json
            SHA256SUMS
            release-assets/*

      # Upload can take long enough for a repository policy regression to matter.
      # Fence the transition from mutable draft to immutable publication again.
      - name: Re-check protected release source before publication
        if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }}
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}
        run: |
          bash scripts/check-release-source-ancestor.sh release-source "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH"
          node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA"

      # Omitting `draft` tells action-gh-release v3 to publish the existing draft
      # after all uploads succeeded while retaining its stable/prerelease metadata.
      - name: Publish GitHub Release
        id: publish_release
        if: ${{ steps.provenance.outputs.ready == 'true' && steps.release_source.outputs.existing != 'true' }}
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ env.RELEASE_TAG }}

      - name: Verify published immutable Release and asset digests
        if: ${{ steps.release_source.outputs.existing != 'true' }}
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          release_json="$RUNNER_TEMP/published-release.json"
          verification_log="$RUNNER_TEMP/published-release-verification.log"
          verification_output="$RUNNER_TEMP/published-release-verification-output.txt"
          verified=false
          for attempt in 1 2 3 4 5; do
            : > "$verification_log"
            : > "$verification_output"
            if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" >"$release_json" 2>"$verification_log" \
              && REQUESTED_TARGET_TAG="$RELEASE_TAG" GITHUB_OUTPUT="$verification_output" \
                node scripts/check-release-reuse.mjs "$RELEASE_TAG" "$release_json" >>"$verification_log" 2>&1; then
              verified=true
              break
            fi
            sleep 3
          done
          if [[ "$verified" != "true" ]]; then
            cat "$verification_log" >&2
            echo "::error::published $RELEASE_TAG did not become immutable with canonical asset digests"
            exit 1
          fi
          cat "$verification_log"
          release_attestation="$RUNNER_TEMP/immutable-release-attestation.json"
          release_attestation_verified=false
          for attempt in 1 2 3 4 5; do
            if gh release verify "$RELEASE_TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --format json > "$release_attestation"; then
              release_attestation_verified=true
              break
            fi
            sleep 3
          done
          if [[ "$release_attestation_verified" != "true" ]]; then
            echo "::error::published $RELEASE_TAG has no valid GitHub immutable release attestation"
            exit 1
          fi
          release_asset_digests="$(sed -n 's/^release_asset_digests=//p' "$verification_output")"
          jq -e 'type == "object" and length > 0' <<<"$release_asset_digests" >/dev/null || {
            echo "::error::published immutable digest evidence is missing"
            exit 1
          }
          for file in dist/* latest.json release-binding.json; do
            name="$(basename "$file")"
            gh release verify-asset "$RELEASE_TAG" "$file" \
              --repo "$GITHUB_REPOSITORY" >/dev/null
            expected_digest="$(jq -er --arg name "$name" '.[$name]' <<<"$release_asset_digests")"
            actual_digest="sha256:$(sha256sum "$file" | cut -d' ' -f1)"
            if [[ "$actual_digest" != "$expected_digest" ]]; then
              echo "::error::published immutable digest does not match attested local bytes: $name"
              exit 1
            fi
            echo "Verified published attested digest: $name"
          done

      # Existing immutable releases skip draft publication, so fence the final
      # credentialed mirror promotion for both fresh and recovery paths.
      - name: Re-check protected release source before final promotion
        if: ${{ success() && steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }}
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ secrets.IMMUTABLE_RELEASES_READ_TOKEN }}
        run: |
          bash scripts/check-release-source-ancestor.sh release-source "$RELEASE_SOURCE_SHA" "$DEFAULT_BRANCH"
          node scripts/check-release-tag-protection.mjs "$RELEASE_TAG" "$RELEASE_SOURCE_SHA"

      - name: Promote CDN mirror latest (R2 + IHEP S3)
        id: mirror_promote
        if: ${{ success() && steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }}
        env:
          MIRROR_PHASE: promote
          MIRROR_REQUIRED_BACKENDS: r2,ihep
          MIRROR_CANDIDATE_ID: ${{ github.run_id }}-${{ github.run_attempt }}
          MIRROR_ALLOW_DOWNGRADE: ${{ inputs.allow_mirror_downgrade && '1' || '0' }}
          MIRROR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          MIRROR_DOWNGRADE_REASON: ${{ inputs.mirror_downgrade_reason || '' }}
          MIRROR_WORKFLOW_REF_NAME: ${{ github.ref_name }}
          MANAGER_R2_S3_ENDPOINT: ${{ secrets.MANAGER_R2_S3_ENDPOINT }}
          MANAGER_R2_BUCKET: ${{ vars.MANAGER_R2_BUCKET }}
          MANAGER_R2_ACCESS_KEY_ID: ${{ secrets.MANAGER_R2_PROMOTION_ACCESS_KEY_ID }}
          MANAGER_R2_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_R2_PROMOTION_SECRET_ACCESS_KEY }}
          MANAGER_IHEP_S3_ENDPOINT: ${{ vars.MANAGER_IHEP_S3_ENDPOINT }}
          MANAGER_IHEP_S3_BUCKET: ${{ vars.MANAGER_IHEP_S3_BUCKET }}
          MANAGER_IHEP_S3_REGION: ${{ vars.MANAGER_IHEP_S3_REGION }}
          MANAGER_IHEP_S3_PREFIX: ${{ vars.MANAGER_IHEP_S3_PREFIX }}
          MANAGER_IHEP_S3_ACCESS_KEY_ID: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_ACCESS_KEY_ID }}
          MANAGER_IHEP_S3_SECRET_ACCESS_KEY: ${{ secrets.MANAGER_IHEP_S3_PROMOTION_SECRET_ACCESS_KEY }}
        run: |
          [ -f dist/latest.json ] || cp latest.json dist/latest.json
          bash scripts/sync-mirror.sh dist

      # The release above is created with GITHUB_TOKEN, which by design does not
      # trigger other workflows — so winget.yml's `on: release` never fires.
      # Dispatch it explicitly (stable releases only). winget.yml no-ops cleanly
      # without WINGET_TOKEN, and Komac checks for an existing version or PR, so
      # a re-run is harmless.
      - name: Trigger winget submission
        id: winget
        if: ${{ success() && steps.provenance.outputs.ready == 'true' && !contains(env.RELEASE_TAG, '-') }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh workflow run winget.yml -f release-tag="$RELEASE_TAG" --repo "${{ github.repository }}"; then
            echo "status=dispatched" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::winget dispatch failed"
            echo "status=dispatch_failed" >> "$GITHUB_OUTPUT"
          fi

      - name: Write release summary
        if: always()
        env:
          PUBLISH_OUTCOME: ${{ steps.release_source.outputs.existing == 'true' && 'reused' || steps.publish_release.outcome }}
          MIRROR_STAGE_OUTCOME: ${{ steps.mirror_stage.outcome }}
          MIRROR_VERIFY_OUTCOME: ${{ steps.mirror_verify.outcome }}
          MIRROR_PROMOTE_OUTCOME: ${{ steps.mirror_promote.outcome }}
          WINGET_OUTCOME: ${{ steps.winget.outputs.status || steps.winget.outcome }}
          SBOM_OUTCOME: ${{ steps.sbom.outcome }}
          ATTESTATION_OUTCOME: ${{ steps.attest_fresh.outcome }}
          BINDING_ATTESTATION_OUTCOME: ${{ steps.attest_binding.outcome }}
          PROVENANCE_MODE: ${{ steps.provenance.outputs.mode }}
        run: node scripts/write-release-summary.mjs

      - name: Upload release audit records
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: release-audit-${{ env.RELEASE_TAG }}-${{ github.run_attempt }}
          path: |
            manifest-summary.json
            updater-signature-verification.json
            mirror-stage-summary.json
            mirror-verification-summary.json
            mirror-promotion-summary.json
            SHA256SUMS
            release-binding.json
          if-no-files-found: warn
          retention-days: 90