release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag (for example, v1.2.3 or v1.2.3-beta.1).
        required: true
        type: string
  push:
    tags:
      - v*.*.*

permissions:
  contents: read

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
  cancel-in-progress: false

env:
  CI: 'true'
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

jobs:
  preflight:
    name: release-preflight
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      tag: ${{ steps.release.outputs.tag }}
      sha: ${{ steps.release.outputs.sha }}
      version: ${{ steps.release.outputs.version }}
      prerelease: ${{ steps.release.outputs.prerelease }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24.18.0'
          package-manager-cache: false

      - name: Resolve and validate release source
        id: release
        env:
          DISPATCH_TAG: ${{ inputs.tag }}
          EVENT_NAME: ${{ github.event_name }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ "${EVENT_NAME}" == 'workflow_dispatch' ]]; then
            release_tag="${DISPATCH_TAG}"
          else
            release_tag="${REF_NAME}"
          fi
          if [[ -z "${release_tag}" ]] || ! git check-ref-format "refs/tags/${release_tag}" >/dev/null; then
            echo 'Release tag is missing or invalid.' >&2
            exit 1
          fi

          git fetch --force --tags origin
          if ! git show-ref --verify --quiet "refs/tags/${release_tag}"; then
            echo "Release tag ${release_tag} does not exist." >&2
            exit 1
          fi
          source_sha="$(git rev-parse --verify "refs/tags/${release_tag}^{commit}")"
          if [[ ! "${source_sha}" =~ ^[a-f0-9]{40}$ ]]; then
            echo 'Release tag did not resolve to an immutable commit SHA.' >&2
            exit 1
          fi

          git fetch --no-tags origin '+refs/heads/main:refs/remotes/origin/main'
          if ! git merge-base --is-ancestor "${source_sha}" origin/main; then
            echo 'Release tags must resolve to commits reachable from origin/main.' >&2
            exit 1
          fi
          git checkout --detach "${source_sha}"

          node scripts/ci/release-preflight.mjs \
            --tag "${release_tag}" \
            --source-sha "${source_sha}" \
            --output-dir release-preflight

          version="$(node -p "JSON.parse(require('fs').readFileSync('release-preflight/release-context.json', 'utf8')).version")"
          prerelease="$(node -p "String(JSON.parse(require('fs').readFileSync('release-preflight/release-context.json', 'utf8')).prerelease)")"
          {
            echo "tag=${release_tag}"
            echo "sha=${source_sha}"
            echo "version=${version}"
            echo "prerelease=${prerelease}"
          } >> "${GITHUB_OUTPUT}"

      - name: Upload release preflight
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: deepchat-release-preflight
          path: |
            release-preflight/release-context.json
            release-preflight/release-notes.md
          if-no-files-found: error
          overwrite: true

  package-windows:
    name: release-windows(${{ matrix.arch }})
    needs: preflight
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        arch: [x64, arm64]
    uses: ./.github/workflows/_package-windows.yml
    with:
      source-sha: ${{ needs.preflight.outputs.sha }}
      arch: ${{ matrix.arch }}
      artifact-purpose: distribution
      enforce-installer-size: true
    secrets:
      RTK_GITHUB_TOKEN: ${{ secrets.RTK_GITHUB_TOKEN }}
      DC_GITHUB_CLIENT_ID: ${{ secrets.DC_GITHUB_CLIENT_ID }}
      DC_GITHUB_CLIENT_SECRET: ${{ secrets.DC_GITHUB_CLIENT_SECRET }}
      DC_GITHUB_REDIRECT_URI: ${{ secrets.DC_GITHUB_REDIRECT_URI }}

  package-linux:
    name: release-linux(${{ matrix.arch }})
    needs: preflight
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        arch: [x64, arm64]
    uses: ./.github/workflows/_package-linux.yml
    with:
      source-sha: ${{ needs.preflight.outputs.sha }}
      arch: ${{ matrix.arch }}
      artifact-purpose: distribution
      enforce-installer-size: true
    secrets:
      RTK_GITHUB_TOKEN: ${{ secrets.RTK_GITHUB_TOKEN }}
      DC_GITHUB_CLIENT_ID: ${{ secrets.DC_GITHUB_CLIENT_ID }}
      DC_GITHUB_CLIENT_SECRET: ${{ secrets.DC_GITHUB_CLIENT_SECRET }}
      DC_GITHUB_REDIRECT_URI: ${{ secrets.DC_GITHUB_REDIRECT_URI }}

  package-macos:
    name: release-macos(${{ matrix.arch }})
    needs: preflight
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        arch: [x64, arm64]
    uses: ./.github/workflows/_package-macos.yml
    with:
      source-sha: ${{ needs.preflight.outputs.sha }}
      arch: ${{ matrix.arch }}
      artifact-purpose: distribution
      enforce-installer-size: true
    secrets:
      RTK_GITHUB_TOKEN: ${{ secrets.RTK_GITHUB_TOKEN }}
      DC_GITHUB_CLIENT_ID: ${{ secrets.DC_GITHUB_CLIENT_ID }}
      DC_GITHUB_CLIENT_SECRET: ${{ secrets.DC_GITHUB_CLIENT_SECRET }}
      DC_GITHUB_REDIRECT_URI: ${{ secrets.DC_GITHUB_REDIRECT_URI }}
      DEEPCHAT_CSC_LINK: ${{ secrets.DEEPCHAT_CSC_LINK }}
      DEEPCHAT_CSC_KEY_PASS: ${{ secrets.DEEPCHAT_CSC_KEY_PASS }}
      DEEPCHAT_APPLE_NOTARY_USERNAME: ${{ secrets.DEEPCHAT_APPLE_NOTARY_USERNAME }}
      DEEPCHAT_APPLE_NOTARY_TEAM_ID: ${{ secrets.DEEPCHAT_APPLE_NOTARY_TEAM_ID }}
      DEEPCHAT_APPLE_NOTARY_PASSWORD: ${{ secrets.DEEPCHAT_APPLE_NOTARY_PASSWORD }}

  assemble:
    name: assemble-release
    needs: [preflight, package-windows, package-linux, package-macos]
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ needs.preflight.outputs.sha }}
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24.18.0'
          package-manager-cache: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Install assembly dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Download Windows x64 package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-package-win32-x64
          path: artifacts/deepchat-package-win32-x64
          digest-mismatch: error

      - name: Download Windows ARM64 package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-package-win32-arm64
          path: artifacts/deepchat-package-win32-arm64
          digest-mismatch: error

      - name: Download Linux x64 package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-package-linux-x64
          path: artifacts/deepchat-package-linux-x64
          digest-mismatch: error

      - name: Download Linux ARM64 package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-package-linux-arm64
          path: artifacts/deepchat-package-linux-arm64
          digest-mismatch: error

      - name: Download macOS x64 package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-package-darwin-x64
          path: artifacts/deepchat-package-darwin-x64
          digest-mismatch: error

      - name: Download macOS ARM64 package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-package-darwin-arm64
          path: artifacts/deepchat-package-darwin-arm64
          digest-mismatch: error

      - name: Assemble fail-closed release assets
        env:
          RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.sha }}
          RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          node scripts/ci/assemble-release.mjs \
            --artifacts-dir artifacts \
            --output-dir release-assets \
            --source-sha "${RELEASE_SOURCE_SHA}" \
            --version "${RELEASE_VERSION}" \
            --workflow-run-id "${GITHUB_RUN_ID}" \
            --workflow-run-attempt "${GITHUB_RUN_ATTEMPT}"

      - name: Upload verified release assets
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: deepchat-release-assets
          path: release-assets/
          if-no-files-found: error
          compression-level: 0
          overwrite: true

  publish:
    name: create-draft-release
    needs: [preflight, assemble]
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          ref: ${{ needs.preflight.outputs.sha }}
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24.18.0'
          package-manager-cache: false

      - name: Download verified release assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-release-assets
          path: release-assets
          digest-mismatch: error

      - name: Download release preflight
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deepchat-release-preflight
          path: release-preflight
          digest-mismatch: error

      - name: Revalidate release context and local assets
        env:
          RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.sha }}
          RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
          RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          node scripts/ci/release-preflight.mjs \
            --tag "${RELEASE_TAG}" \
            --source-sha "${RELEASE_SOURCE_SHA}" \
            --output-dir expected-release-preflight
          cmp expected-release-preflight/release-context.json release-preflight/release-context.json
          cmp expected-release-preflight/release-notes.md release-preflight/release-notes.md
          node scripts/ci/verify-release-assets.mjs local \
            --directory release-assets \
            --source-sha "${RELEASE_SOURCE_SHA}" \
            --version "${RELEASE_VERSION}" \
            --workflow-run-id "${GITHUB_RUN_ID}" \
            --workflow-run-attempt "${GITHUB_RUN_ATTEMPT}"

      - name: Reject unknown assets in an existing draft
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.sha }}
          RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
          RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
          RELEASE_PRERELEASE: ${{ needs.preflight.outputs.prerelease }}
        run: |
          gh api --paginate --slurp \
            -H 'Accept: application/vnd.github+json' \
            -H 'X-GitHub-Api-Version: 2026-03-10' \
            "repos/${GITHUB_REPOSITORY}/releases?per_page=100" > existing-releases.json
          release_count="$(
            jq --arg tag "${RELEASE_TAG}" '[.[][] | select(.tag_name == $tag)] | length' \
              existing-releases.json
          )"
          if [[ "${release_count}" -gt 1 ]]; then
            echo "Found multiple releases for ${RELEASE_TAG}." >&2
            exit 1
          fi
          if [[ "${release_count}" -eq 1 ]]; then
            release_id="$(
              jq -r --arg tag "${RELEASE_TAG}" \
                '.[][] | select(.tag_name == $tag) | .id' existing-releases.json
            )"
            gh api \
              -H 'Accept: application/vnd.github+json' \
              -H 'X-GitHub-Api-Version: 2026-03-10' \
              "repos/${GITHUB_REPOSITORY}/releases/${release_id}" > existing-release.json
            node scripts/ci/verify-release-assets.mjs remote \
              --directory release-assets \
              --source-sha "${RELEASE_SOURCE_SHA}" \
              --version "${RELEASE_VERSION}" \
              --workflow-run-id "${GITHUB_RUN_ID}" \
              --workflow-run-attempt "${GITHUB_RUN_ATTEMPT}" \
              --release-json existing-release.json \
              --tag "${RELEASE_TAG}" \
              --prerelease "${RELEASE_PRERELEASE}" \
              --allow-partial-assets
          fi

      - name: Create draft release
        id: create_release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          token: ${{ github.token }}
          tag_name: ${{ needs.preflight.outputs.tag }}
          target_commitish: ${{ needs.preflight.outputs.sha }}
          name: DeepChat V${{ needs.preflight.outputs.version }}
          draft: true
          prerelease: ${{ needs.preflight.outputs.prerelease == 'true' }}
          files: release-assets/*
          fail_on_unmatched_files: true
          overwrite_files: true
          body_path: release-preflight/release-notes.md

      - name: Verify published draft assets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_SOURCE_SHA: ${{ needs.preflight.outputs.sha }}
          RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
          RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
          RELEASE_PRERELEASE: ${{ needs.preflight.outputs.prerelease }}
          RELEASE_ID: ${{ steps.create_release.outputs.id }}
        run: |
          endpoint="repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}"
          for attempt in 1 2 3 4 5; do
            if gh api \
                -H 'Accept: application/vnd.github+json' \
                -H 'X-GitHub-Api-Version: 2026-03-10' \
                "${endpoint}" > published-release.json &&
              node scripts/ci/verify-release-assets.mjs remote \
              --directory release-assets \
              --source-sha "${RELEASE_SOURCE_SHA}" \
              --version "${RELEASE_VERSION}" \
              --workflow-run-id "${GITHUB_RUN_ID}" \
              --workflow-run-attempt "${GITHUB_RUN_ATTEMPT}" \
              --release-json published-release.json \
              --tag "${RELEASE_TAG}" \
              --prerelease "${RELEASE_PRERELEASE}"
            then
              exit 0
            fi
            if [[ "${attempt}" -lt 5 ]]; then
              sleep "$((attempt * 2))"
            fi
          done
          echo 'Published draft assets did not converge to the release contract.' >&2
          exit 1