desktop-package.yml

name: Desktop Package

on:
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      tag_name:
        description: "Release tag (stable: v1.0.0-beta or v1.0.0, beta: v1.0.0-beta.1)."
        required: false
        type: string
      checkout_ref:
        description: "Commit, branch, or tag to build. Defaults to tag_name, then HEAD."
        required: false
        type: string
      release_channel:
        description: "Immutable update channel compiled into the Desktop artifact."
        required: false
        default: stable
        type: choice
        options:
          - stable
          - beta
      upload_to_release:
        description: "Upload built artifacts to the release specified by tag_name."
        required: false
        default: false
        type: boolean
      artifact_run_ids:
        description: "Finalize from complete verified artifacts in previous Desktop Package runs (comma-separated IDs); skips rebuilding."
        required: false
        type: string
      verification_recovery_run_id:
        description: "Restore a failed Mac verification archive and verify without compiling; select one Mac target."
        required: false
        type: string
      target_platform:
        description: "Build one Desktop platform as signed artifacts only; all retains full release publication."
        required: false
        default: all
        type: choice
        options:
          - all
          - macos-arm64
          - macos-x64
      relay_image_only:
        description: "Publish only the Relay Server image and signed descriptor (no Desktop packages)."
        required: false
        default: false
        type: boolean

permissions:
  actions: read
  contents: write
  packages: write

concurrency:
  group: desktop-package-${{ (github.event.release.prerelease || inputs.release_channel == 'beta') && 'beta' || github.event.release.tag_name || inputs.tag_name || github.sha }}${{ (inputs.target_platform && inputs.target_platform != 'all') && format('-{0}', inputs.target_platform) || '' }}
  cancel-in-progress: false

jobs:
  # ── Resolve version info ───────────────────────────────────────────
  prepare:
    if: github.event_name != 'release' || (!startsWith(github.event.release.tag_name, 'data-tools-v') && !startsWith(github.event.release.tag_name, 'data-migrator-v'))
    name: Prepare
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.meta.outputs.version }}
      release_tag: ${{ steps.meta.outputs.release_tag }}
      upload_to_release: ${{ steps.meta.outputs.upload_to_release }}
      checkout_ref: ${{ steps.meta.outputs.checkout_ref }}
      release_channel: ${{ steps.meta.outputs.release_channel }}
      relay_image_only: ${{ steps.meta.outputs.relay_image_only }}
      target_platform: ${{ inputs.target_platform || 'all' }}
      package_matrix: ${{ steps.platforms.outputs.matrix }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Resolve version metadata
        id: meta
        shell: bash
        env:
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_SHA: ${{ github.sha }}
          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
          INPUT_TAG_NAME: ${{ inputs.tag_name }}
          INPUT_CHECKOUT_REF: ${{ inputs.checkout_ref }}
          INPUT_RELEASE_CHANNEL: ${{ inputs.release_channel }}
          INPUT_UPLOAD_TO_RELEASE: ${{ inputs.upload_to_release }}
          INPUT_RELAY_IMAGE_ONLY: ${{ inputs.relay_image_only }}
        run: |
          set -euo pipefail

          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
            TAG="${RELEASE_TAG_NAME}"
            VERSION="${TAG#v}"
            UPLOAD="true"
            CHECKOUT_REF="${TAG}"
            if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
              CHANNEL="beta"
            else
              CHANNEL="stable"
            fi
          elif [[ -n "${INPUT_TAG_NAME}" ]]; then
            TAG="${INPUT_TAG_NAME}"
            VERSION="${TAG#v}"
            CHANNEL="${INPUT_RELEASE_CHANNEL:-stable}"
            # Image-only rebuilds use the same immutable source tag as their
            # archives. Using the workflow branch breaks the tag/SHA guard and
            # can combine a new Dockerfile with unrelated release binaries.
            if [[ -n "${INPUT_CHECKOUT_REF}" ]]; then
              CHECKOUT_REF="${INPUT_CHECKOUT_REF}"
            else
              CHECKOUT_REF="${TAG}"
            fi
            if [[ "${INPUT_UPLOAD_TO_RELEASE}" == "true" ]]; then
              UPLOAD="true"
            else
              UPLOAD="false"
            fi
          else
            VERSION="$(jq -r '.version' package.json)"
            TAG="v${VERSION}"
            UPLOAD="false"
            CHECKOUT_REF="${GITHUB_SHA}"
            CHANNEL="${INPUT_RELEASE_CHANNEL:-stable}"
          fi

          node --input-type=module -e \
            "import { validateReleaseVersion } from './scripts/release-channel.mjs'; validateReleaseVersion(process.argv[1], process.argv[2]);" \
            "${CHANNEL}" "${VERSION}"

          git fetch origin main --tags --force
          CHECKOUT_SHA="$(git rev-parse "${CHECKOUT_REF}^{commit}")"
          if [[ "${GITHUB_REPOSITORY}" == "GCWing/OpenBitFun" ]] && \
             ! git merge-base --is-ancestor "${CHECKOUT_SHA}" origin/main; then
            echo "Ref ${CHECKOUT_REF} (${CHECKOUT_SHA}) is not part of the protected main history." >&2
            exit 1
          fi
          TAG_SHA="$(git rev-parse --verify --quiet "${TAG}^{commit}" || true)"
          if [[ -n "${TAG_SHA}" && "${TAG_SHA}" != "${CHECKOUT_SHA}" ]]; then
            echo "Existing tag ${TAG} points to ${TAG_SHA}, not requested commit ${CHECKOUT_SHA}." >&2
            exit 1
          fi
          if [[ "${UPLOAD}" == "true" && -z "${TAG_SHA}" ]]; then
            echo "Publishing requires existing tag ${TAG} at ${CHECKOUT_SHA}. Push the tag before dispatching." >&2
            exit 1
          fi
          CHECKOUT_REF="${CHECKOUT_SHA}"

          echo "version=$VERSION"          >> "$GITHUB_OUTPUT"
          echo "release_tag=$TAG"          >> "$GITHUB_OUTPUT"
          echo "upload_to_release=$UPLOAD" >> "$GITHUB_OUTPUT"
          echo "checkout_ref=$CHECKOUT_REF" >> "$GITHUB_OUTPUT"
          echo "release_channel=$CHANNEL"  >> "$GITHUB_OUTPUT"
          echo "relay_image_only=${INPUT_RELAY_IMAGE_ONLY:-false}" >> "$GITHUB_OUTPUT"

      - name: Select Desktop package platforms
        id: platforms
        env:
          TARGET_PLATFORM: ${{ inputs.target_platform || 'all' }}
          RELAY_IMAGE_ONLY: ${{ inputs.relay_image_only }}
          ARTIFACT_RUN_IDS: ${{ inputs.artifact_run_ids }}
          VERIFICATION_RECOVERY_RUN_ID: ${{ inputs.verification_recovery_run_id }}
          UPLOAD_TO_RELEASE: ${{ steps.meta.outputs.upload_to_release }}
        run: |
          node --input-type=module <<'NODE'
          import fs from 'node:fs';
          const all = JSON.parse(fs.readFileSync('scripts/desktop-package-platforms.json', 'utf8'));
          const target = process.env.TARGET_PLATFORM;
          if (process.env.ARTIFACT_RUN_IDS &&
              (!/^\d+(,\d+)*$/.test(process.env.ARTIFACT_RUN_IDS) || target !== 'all' || process.env.RELAY_IMAGE_ONLY === 'true')) {
            throw new Error('Artifact finalization requires run IDs, target all, and no relay_image_only');
          }
          if (!['all', 'macos-arm64', 'macos-x64'].includes(target)) {
            throw new Error(`Unsupported Desktop recovery target: ${target}`);
          }
          if (target !== 'all' && process.env.RELAY_IMAGE_ONLY === 'true') {
            throw new Error('A Desktop recovery target cannot be combined with relay_image_only');
          }
          if (process.env.VERIFICATION_RECOVERY_RUN_ID &&
              (!/^\d+$/.test(process.env.VERIFICATION_RECOVERY_RUN_ID) || target === 'all' ||
               process.env.ARTIFACT_RUN_IDS || process.env.RELAY_IMAGE_ONLY === 'true' ||
               process.env.UPLOAD_TO_RELEASE !== 'true')) {
            throw new Error('Verification recovery requires one Mac target, signing, and no other recovery mode');
          }
          const selected = target === 'all' ? all : all.filter((platform) => platform.name === target);
          if (selected.length === 0) throw new Error('No Desktop package platforms selected');
          fs.appendFileSync(process.env.GITHUB_OUTPUT, `matrix=${JSON.stringify(selected)}\n`);
          NODE

  # ── Build per platform ─────────────────────────────────────────────
  package:
    name: Package (${{ matrix.platform.name }})
    runs-on: ${{ matrix.platform.os }}
    needs: prepare
    if: needs.prepare.outputs.relay_image_only != 'true' && !inputs.artifact_run_ids && !inputs.verification_recovery_run_id
    env:
      NODE_OPTIONS: --max-old-space-size=6144
      OPENBITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }}
      OPENBITFUN_RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }}
      TAURI_UPDATER_ENDPOINT: ${{ github.repository != 'GCWing/OpenBitFun' && (needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-v1-beta/latest-v1.json', github.repository) || format('https://github.com/{0}/releases/latest/download/latest-v1.json', github.repository)) || '' }}
      TAURI_UPDATER_FALLBACK_ENDPOINT: ${{ github.repository != 'GCWing/OpenBitFun' && (needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-v1-beta/latest-v1.json', github.repository) || format('https://github.com/{0}/releases/latest/download/latest-v1.json', github.repository)) || '' }}
      TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
      # Same trust root, compiled into the Desktop binary so one-click relay
      # deploy can verify the signed checksum locally and hand the remote host
      # a hash it does not have to trust the mirror for.
      OPENBITFUN_RELEASE_PUBKEY: ${{ secrets.OPENBITFUN_RELEASE_PUBKEY || secrets.TAURI_UPDATER_PUBKEY }}
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

    strategy:
      fail-fast: false
      matrix:
        platform: ${{ fromJSON(needs.prepare.outputs.package_matrix) }}

    steps:
      # Also preserve bytes when rebuilding an older immutable tag that does
      # not yet pin every hashed source file in .gitattributes.
      - name: Preserve source bytes on Windows
        if: runner.os == 'Windows'
        shell: bash
        run: git config --global core.autocrlf false

      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Check Windows signing configuration
        if: runner.os == 'Windows'
        id: windows-signing
        shell: pwsh
        env:
          CERTUM_USERNAME: ${{ secrets.CERTUM_USERNAME }}
          CERTUM_OTP_URI: ${{ secrets.CERTUM_OTP_URI }}
          CERTUM_KEY_ID: ${{ secrets.CERTUM_KEY_ID }}
          REQUIRE_SIGNING: ${{ needs.prepare.outputs.upload_to_release }}
        run: |
          $ErrorActionPreference = 'Stop'
          $names = @('CERTUM_USERNAME', 'CERTUM_OTP_URI', 'CERTUM_KEY_ID')
          $missing = @($names | Where-Object { [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($_)) })
          if ($missing.Count -eq 3 -and $env:REQUIRE_SIGNING -ne 'true') {
            'enabled=false' >> $env:GITHUB_OUTPUT
            Write-Host 'Artifact-only build without Authenticode signing; Certum secrets are not configured.'
          } elseif ($missing.Count -gt 0) {
            throw "Missing Windows signing secrets: $($missing -join ', '). Release publication requires Authenticode signing."
          } else {
            $thumbprint = ($env:CERTUM_KEY_ID -replace '\s', '').ToUpperInvariant()
            if ($thumbprint -notmatch '^[0-9A-F]{40}$') { throw 'CERTUM_KEY_ID must be a SHA-1 certificate fingerprint.' }
            if (-not $env:CERTUM_OTP_URI.StartsWith('otpauth://totp/')) { throw 'CERTUM_OTP_URI must be a TOTP otpauth URI.' }
            'enabled=true' >> $env:GITHUB_OUTPUT
            "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
          }

      - name: Install NSIS (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          choco install nsis -y --no-progress
          $nsisRoot = "${env:ProgramFiles(x86)}\NSIS"
          $nsisBin = "${env:ProgramFiles(x86)}\NSIS\Bin"
          if (Test-Path $nsisRoot) {
            Add-Content $env:GITHUB_PATH $nsisRoot
          }
          if (Test-Path $nsisBin) {
            Add-Content $env:GITHUB_PATH $nsisBin
          }

      - name: Verify NSIS (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          where.exe makensis
          makensis /VERSION

      - name: Install Linux system dependencies (Tauri bundler)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          sudo apt-get update

          if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then
            WEBKIT_PKG=libwebkit2gtk-4.1-dev
          else
            WEBKIT_PKG=libwebkit2gtk-4.0-dev
          fi

          if apt-cache show libappindicator3-dev >/dev/null 2>&1; then
            APPINDICATOR_PKG=libappindicator3-dev
          else
            APPINDICATOR_PKG=libayatana-appindicator3-dev
          fi

          # Tauri pins AppImage GTK input methods to its bundled cache, so the
          # fcitx5 GTK3 bridge must be present before linuxdeploy builds it.
          sudo apt-get install -y --no-install-recommends \
            pkg-config \
            xdg-utils \
            libglib2.0-dev \
            libgtk-3-dev \
            libgstreamer1.0-dev \
            libgstreamer-plugins-base1.0-dev \
            gstreamer1.0-pipewire \
            gstreamer1.0-plugins-base \
            gstreamer1.0-plugins-good \
            fcitx5-frontend-gtk3 \
            libxdo-dev \
            "$WEBKIT_PKG" \
            "$APPINDICATOR_PKG" \
            librsvg2-dev \
            patchelf \
            fakeroot \
            rpm \
            libleptonica-dev \
            libtesseract-dev \
            tesseract-ocr \
            tesseract-ocr-eng

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: pnpm

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"
          no-cache: true

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform.target }}

      - name: Cache Rust build
        uses: swatinem/rust-cache@v2
        with:
          shared-key: "package-v2-${{ matrix.platform.name }}"
          cache-bin: false

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Configure Apple Developer ID signing and notarization
        if: runner.os == 'macOS'
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          OPENBITFUN_REQUIRE_APPLE_SIGNING: ${{ needs.prepare.outputs.upload_to_release }}
        run: bash scripts/ci/setup-macos-signing.sh

      - name: Project beta build version
        if: needs.prepare.outputs.release_channel == 'beta'
        run: node scripts/set-build-version.mjs --version "${{ needs.prepare.outputs.version }}"

      - name: Verify release version metadata
        run: node scripts/verify-release-version-sync.mjs --version "${{ needs.prepare.outputs.version }}"

      - name: Download and verify target Flashgrep binary
        run: node scripts/prepare-flashgrep-resource.mjs --target "${{ matrix.platform.target }}"

      - name: Select Xcode for macOS Icon Composer assets
        if: runner.os == 'macOS'
        shell: bash
        run: |
          test -d /Applications/Xcode_26.2.app/Contents/Developer
          echo "DEVELOPER_DIR=/Applications/Xcode_26.2.app/Contents/Developer" >> "$GITHUB_ENV"

      - name: Verify native macOS icon bundling
        if: runner.os == 'macOS'
        env:
          OPENBITFUN_TEST_MACOS_BUNDLE: '1'
        run: node --test scripts/macos-icon-bundle.test.mjs

      - name: Build desktop app
        run: ${{ matrix.platform.build_command }}

      - name: Connect Certum SimplySign
        if: runner.os == 'Windows' && steps.windows-signing.outputs.enabled == 'true'
        timeout-minutes: 10
        # Pinned immutable revision; this community action automates the Desktop login.
        uses: dismine/windows-app-signing-setup-action@89ae3b032d4bc7a5b98d1a42a34e61ecb6faad64
        with:
          certum-username: ${{ secrets.CERTUM_USERNAME }}
          certum-otp-uri: ${{ secrets.CERTUM_OTP_URI }}
          certum-key-id: ${{ env.WINDOWS_CERTIFICATE_THUMBPRINT }}
          capture-diagnostics: 'false'

      - name: Bundle Windows updater and verify Authenticode
        if: runner.os == 'Windows'
        timeout-minutes: 20
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          node scripts/desktop-tauri-build.mjs --bundle-only --target x86_64-pc-windows-msvc --bundles nsis --verbose
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          if ($env:WINDOWS_CERTIFICATE_THUMBPRINT) {
            # Tauri restores the unsigned raw EXE after bundling; sign it again
            # before the custom installer snapshots and hashes its payload.
            & ./scripts/ci/sign-windows.ps1 -Path 'target/x86_64-pc-windows-msvc/release/openbitfun-desktop.exe'
            $installers = @(Get-ChildItem 'target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe' -File)
            if ($installers.Count -eq 0) { throw 'NSIS installer was not produced.' }
            foreach ($installer in $installers) {
              & ./scripts/ci/sign-windows.ps1 -Path $installer.FullName -VerifyOnly
            }
          }

      - name: Build and sign custom Windows installer
        if: runner.os == 'Windows'
        timeout-minutes: 60
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          # The payload manifest must hash the already signed desktop executable.
          $env:OPENBITFUN_INSTALLER_APP_EXE = 'target/x86_64-pc-windows-msvc/release/openbitfun-desktop.exe'
          pnpm run installer:build:only
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          if ($env:WINDOWS_CERTIFICATE_THUMBPRINT) {
            & ./scripts/ci/sign-windows.ps1 -Path 'OpenBitFun-Installer/src-tauri/target/release/openbitfun-installer.exe'
          }

      - name: Verify Apple signature and notarization
        id: apple_verification
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euo pipefail
          # Verification policy follows this workflow revision, including
          # rebuilds of immutable tags predating a verification fix.
          verification_dir="$(mktemp -d)"
          trap 'rm -rf "$verification_dir"' EXIT
          git fetch --no-tags --depth=1 origin "${{ github.workflow_sha }}"
          git archive "${{ github.workflow_sha }}" \
            scripts/ci/verify-macos-signing.sh scripts/ci/verify-macos-microphone.sh \
            scripts/ci/macos-ticket-network.sh \
            | tar -x -C "$verification_dir"
          bash "$verification_dir/scripts/ci/verify-macos-signing.sh" "${{ matrix.platform.target }}"

      - name: Verify AppImage fcitx5 GTK module
        if: runner.os == 'Linux'
        shell: bash
        run: bash scripts/ci/verify-appimage-fcitx.sh "${{ matrix.platform.target }}"

      - name: Preserve macOS verification recovery bundles
        if: failure() && runner.os == 'macOS' && steps.apple_verification.outcome == 'failure'
        shell: bash
        run: |
          tar -czf macos-verification-recovery.tar.gz \
            -C "target/${{ matrix.platform.target }}/release" bundle

      - name: Upload macOS verification recovery bundles
        if: failure() && runner.os == 'macOS' && steps.apple_verification.outcome == 'failure'
        uses: actions/upload-artifact@v6
        with:
          name: openbitfun-${{ needs.prepare.outputs.release_tag }}-${{ matrix.platform.name }}-verification-recovery
          path: macos-verification-recovery.tar.gz
          if-no-files-found: error
          retention-days: 7

      - name: Upload bundles
        uses: actions/upload-artifact@v6
        with:
          name: openbitfun-${{ needs.prepare.outputs.release_tag }}-${{ matrix.platform.name }}-bundle
          if-no-files-found: error
          path: |
            target/*/release/bundle
            target/release/bundle
            src/apps/desktop/target/release/bundle
            OpenBitFun-Installer/src-tauri/target/release/openbitfun-installer.exe

  recover-macos:
    name: Package (${{ matrix.platform.name }})
    needs: prepare
    if: inputs.verification_recovery_run_id != ''
    runs-on: ${{ matrix.platform.os }}
    strategy:
      fail-fast: false
      matrix:
        platform: ${{ fromJSON(needs.prepare.outputs.package_matrix) }}
    env:
      GH_TOKEN: ${{ github.token }}
      RECOVERY_RUN: ${{ inputs.verification_recovery_run_id }}
      RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
      RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
      MACOS_PLATFORM: ${{ matrix.platform.name }}
      MACOS_TARGET: ${{ matrix.platform.target }}
      OPENBITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      OPENBITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
      OPENBITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
    steps:
      # Packaging policy comes from this pinned workflow; payload bytes come only
      # from the validated original tag producer. No product build runs here.
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v5
        with:
          node-version: '22.12.0'
          package-manager-cache: false
      - name: Select Xcode notarization tools
        run: |
          test -d /Applications/Xcode_26.2.app/Contents/Developer
          echo "DEVELOPER_DIR=/Applications/Xcode_26.2.app/Contents/Developer" >> "$GITHUB_ENV"
      - name: Restore prior macOS bundles
        run: |
          node scripts/restore-macos-verification-bundle.mjs --repo "$GITHUB_REPOSITORY" \
            --tag "$RELEASE_TAG" --platform "$MACOS_PLATFORM" --run-id "$RECOVERY_RUN"
          test "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' \
            "target/$MACOS_TARGET/release/bundle/macos/OpenBitFun.app/Contents/Info.plist")" = "$RELEASE_VERSION"
          case "$MACOS_TARGET" in
            x86_64-apple-darwin) architecture=x86_64 ;;
            aarch64-apple-darwin) architecture=arm64 ;;
          esac
          lipo "target/$MACOS_TARGET/release/bundle/macos/OpenBitFun.app/Contents/MacOS/openbitfun-desktop" -verify_arch "$architecture"
      - name: Configure Apple Developer ID signing and notarization
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          OPENBITFUN_REQUIRE_APPLE_SIGNING: 'true'
        run: bash scripts/ci/setup-macos-signing.sh
      - name: Repair missing application ticket
        run: bash scripts/ci/repair-macos-stapling.sh "$MACOS_TARGET"
      - name: Verify Apple signature and notarization
        id: apple_verification
        run: bash scripts/ci/verify-macos-signing.sh "$MACOS_TARGET"
      - name: Preserve macOS verification recovery bundles
        if: failure() && steps.apple_verification.outcome == 'failure'
        run: tar -czf macos-verification-recovery.tar.gz -C "target/$MACOS_TARGET/release" bundle
      - name: Upload macOS verification recovery bundles
        if: failure() && steps.apple_verification.outcome == 'failure'
        uses: actions/upload-artifact@v6
        with:
          name: openbitfun-${{ needs.prepare.outputs.release_tag }}-${{ matrix.platform.name }}-verification-recovery
          path: macos-verification-recovery.tar.gz
          if-no-files-found: error
          retention-days: 7
      - name: Upload bundles
        uses: actions/upload-artifact@v6
        with:
          name: openbitfun-${{ needs.prepare.outputs.release_tag }}-${{ matrix.platform.name }}-bundle
          path: target/${{ matrix.platform.target }}/release/bundle/
          if-no-files-found: error

  linux-binaries:
    name: Linux CLI and Relay Server
    needs: prepare
    if: >-
      needs.prepare.outputs.relay_image_only != 'true' &&
      needs.prepare.outputs.target_platform == 'all' &&
      !inputs.artifact_run_ids
    uses: ./.github/workflows/linux-binaries.yml
    secrets:
      release_signing_key: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      release_signing_password: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
      release_pubkey: ${{ secrets.TAURI_UPDATER_PUBKEY }}
    with:
      checkout_ref: ${{ needs.prepare.outputs.checkout_ref }}
      version: ${{ needs.prepare.outputs.version }}
      artifact_prefix: ${{ needs.prepare.outputs.release_tag }}

  # Publish the Relay once, as a multi-platform image. User servers only pull
  # this image; they no longer download an archive and build a runtime image.
  publish-relay-image:
    name: Publish Relay Server Image
    needs: [prepare, linux-binaries]
    if: >-
      always() &&
      needs.prepare.outputs.target_platform == 'all' &&
      !inputs.artifact_run_ids &&
      (needs.prepare.outputs.upload_to_release == 'true' ||
       needs.prepare.outputs.relay_image_only == 'true') &&
      (needs.prepare.outputs.relay_image_only == 'true' ||
       needs.linux-binaries.result == 'success')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - name: Resolve image repository
        shell: bash
        run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/openbitfun-relay-server" >> "$GITHUB_ENV"

      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Download Relay archives from this release run
        if: needs.prepare.outputs.relay_image_only != 'true'
        uses: actions/download-artifact@v7
        with:
          pattern: openbitfun-linux-${{ needs.prepare.outputs.release_tag }}-*
          path: linux-release-assets
          merge-multiple: true

      - name: Download Relay archives from the existing release (image-only backfill)
        if: needs.prepare.outputs.relay_image_only == 'true'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
        run: |
          set -euo pipefail
          mkdir -p linux-release-assets
          gh release download "${RELEASE_TAG}" \
            --repo "${GITHUB_REPOSITORY}" \
            --dir linux-release-assets \
            --pattern 'openbitfun-relay-server-*.tar.gz' \
            --pattern 'openbitfun-relay-server-*.tar.gz.sha256'

      - name: Verify image inputs
        shell: bash
        run: |
          set -euo pipefail
          test -f linux-release-assets/openbitfun-relay-server-x86_64-unknown-linux-gnu.tar.gz
          test -f linux-release-assets/openbitfun-relay-server-aarch64-unknown-linux-gnu.tar.gz
          for archive in linux-release-assets/openbitfun-relay-server-*.tar.gz; do
            (cd linux-release-assets && sha256sum --check "$(basename "${archive}").sha256")
          done
          cp src/apps/relay-server/Dockerfile.release linux-release-assets/Dockerfile.release

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Resolve image tags
        id: image-tags
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
          RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
          IMAGE_ONLY: ${{ needs.prepare.outputs.relay_image_only }}
          RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }}
        run: |
          set -euo pipefail
          asset_version="${RELEASE_VERSION%%+*}"
          {
            echo 'value<<EOF'
            echo "${IMAGE}:${RELEASE_TAG}"
            echo "${IMAGE}:${asset_version}"
            if [[ "${IMAGE_ONLY}" == "true" && "${RELEASE_CHANNEL}" == "stable" ]]; then
              # Backfilling an older release must not roll the floating tag
              # backwards. GitHub's latest endpoint excludes prereleases.
              latest_release="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)"
              if [[ "${RELEASE_TAG}" == "${latest_release}" ]]; then
                echo "${IMAGE}:latest"
              fi
            elif [[ "${RELEASE_CHANNEL}" == "stable" ]]; then
              # The normal release workflow can create the GitHub Release only
              # after packaging, so it cannot rely on /releases/latest yet.
              echo "${IMAGE}:latest"
            fi
            echo EOF
          } >>"$GITHUB_OUTPUT"

      - name: Build and push multi-platform image
        id: image
        uses: docker/build-push-action@v7
        with:
          context: linux-release-assets
          file: linux-release-assets/Dockerfile.release
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          sbom: false
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
            REVISION=${{ needs.prepare.outputs.release_tag }}
          tags: ${{ steps.image-tags.outputs.value }}

      - name: Smoke-test published image on both platforms
        shell: bash
        env:
          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
        run: bash scripts/relay/smoke-image.sh "${IMAGE}@${IMAGE_DIGEST}"

      - name: Verify manifest and generate signed descriptor
        shell: bash
        env:
          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
          RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
          OPENBITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          OPENBITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          OPENBITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
        run: |
          set -euo pipefail
          [[ "${IMAGE_DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]]
          docker buildx imagetools inspect "${IMAGE}@${IMAGE_DIGEST}" --raw >relay-image-manifest.json
          jq -e '
            [.manifests[].platform | .os + "/" + .architecture] as $platforms
            | ($platforms | index("linux/amd64")) != null
            and ($platforms | index("linux/arm64")) != null
          ' relay-image-manifest.json >/dev/null
          jq -n \
            --arg image "${IMAGE}" \
            --arg tag "${RELEASE_TAG}" \
            --arg version "${RELEASE_VERSION}" \
            --arg digest "${IMAGE_DIGEST}" \
            '{
              schema_version: 1,
              image: $image,
              tag: $tag,
              version: $version,
              digest: $digest,
              platforms: ["linux/amd64", "linux/arm64"]
            }' >relay-image.json
          bash scripts/sign-release-assets.sh relay-image.json
          test -s relay-image.json.sig

      - name: Upload signed image descriptor
        uses: actions/upload-artifact@v6
        with:
          name: openbitfun-relay-image-${{ needs.prepare.outputs.release_tag }}
          if-no-files-found: error
          retention-days: 7
          path: |
            relay-image.json
            relay-image.json.sig

      # The package is private on first creation. This deliberately fails until
      # its visibility is changed to public, preventing an apparently green
      # release that anonymous customer servers cannot pull.
      - name: Verify anonymous pull access
        shell: bash
        env:
          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
        run: |
          set -euo pipefail
          docker logout ghcr.io >/dev/null 2>&1 || true
          clean_config="$(mktemp -d)"
          trap 'rm -rf "$clean_config"' EXIT
          DOCKER_CONFIG="$clean_config" docker buildx imagetools inspect \
            "${IMAGE}@${IMAGE_DIGEST}" >/dev/null

      - name: Attach descriptor to an existing release (image-only backfill)
        if: needs.prepare.outputs.relay_image_only == 'true'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.prepare.outputs.release_tag }}
          prerelease: ${{ needs.prepare.outputs.release_channel == 'beta' }}
          make_latest: "false"
          files: |
            relay-image.json
            relay-image.json.sig
          fail_on_unmatched_files: true

  # ── Upload assets to GitHub Release ────────────────────────────────
  upload-release-assets:
    name: Upload Release Assets
    needs: [prepare, package, linux-binaries, publish-relay-image]
    if: >-
      always() &&
      needs.prepare.result == 'success' &&
      needs.prepare.outputs.upload_to_release == 'true' &&
      needs.prepare.outputs.target_platform == 'all' &&
      (inputs.artifact_run_ids ||
       (needs.package.result == 'success' &&
        needs.linux-binaries.result == 'success' &&
        needs.publish-relay-image.result == 'success'))
    runs-on: ubuntu-latest
    env:
      # Bundle-type Linux keys are load-bearing: tauri-plugin-updater on a deb
      # (or rpm) install rejects every non-deb (non-rpm) payload with
      # "invalid updater binary format", so the manifest MUST carry
      # linux-*-deb / linux-*-rpm entries alongside the AppImage keys.
      REQUIRED_UPDATER_PLATFORMS: windows-x86_64,darwin-x86_64,darwin-aarch64,linux-x86_64,linux-aarch64,linux-x86_64-deb,linux-aarch64-deb,linux-x86_64-rpm,linux-aarch64-rpm

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Download bundled artifacts
        if: ${{ !inputs.artifact_run_ids }}
        uses: actions/download-artifact@v7
        with:
          pattern: openbitfun-${{ needs.prepare.outputs.release_tag }}-*-bundle
          path: release-assets
          merge-multiple: true

      - name: Download Linux binary artifacts
        if: ${{ !inputs.artifact_run_ids }}
        uses: actions/download-artifact@v7
        with:
          pattern: openbitfun-linux-${{ needs.prepare.outputs.release_tag }}-*
          path: linux-release-assets
          merge-multiple: true

      - name: Download Relay image descriptor
        if: ${{ !inputs.artifact_run_ids }}
        uses: actions/download-artifact@v7
        with:
          name: openbitfun-relay-image-${{ needs.prepare.outputs.release_tag }}
          path: relay-image-assets

      - name: Download verified artifacts from completed producers
        if: inputs.artifact_run_ids
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          ARTIFACT_RUN_IDS: ${{ inputs.artifact_run_ids }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
        run: |
          node scripts/download-desktop-release-artifacts.mjs \
            --repo "$GITHUB_REPOSITORY" --tag "$RELEASE_TAG" --run-ids "$ARTIFACT_RUN_IDS"

      - name: List release assets
        run: |
          echo "Release assets:"
          find release-assets -type f | sort
          echo "Linux CLI and Relay Server assets:"
          find linux-release-assets -type f | sort
          echo "Relay image descriptor:"
          find relay-image-assets -type f | sort

      - name: Prepare versioned Windows installer
        run: |
          node scripts/prepare-windows-installer-asset.mjs \
            --assets-dir release-assets \
            --version "${{ needs.prepare.outputs.version }}" \
            --out-dir release-manual-assets

      - name: Sign versioned Windows installer
        shell: bash
        env:
          OPENBITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          OPENBITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          OPENBITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
        run: bash scripts/sign-release-assets.sh release-manual-assets/*.exe

      - name: Collect updater assets
        run: |
          node scripts/collect-tauri-updater-assets.mjs \
            --assets-dir release-assets \
            --version "${{ needs.prepare.outputs.version }}" \
            --out-dir release-updater-assets \
            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"

      - name: Generate Linux binaries manifest
        run: |
          node scripts/generate-linux-binaries-manifest.mjs \
            --assets-dir linux-release-assets \
            --version "${{ needs.prepare.outputs.version }}" \
            --tag "${{ needs.prepare.outputs.release_tag }}" \
            --repo "${{ github.repository }}" \
            --out linux-release-assets/linux-binaries-v1.json

      # The Tauri bundler signs the five updater artifacts during `tauri build`,
      # but the installers people download by hand from the release page — dmg,
      # deb, rpm, the Windows installer and the direct AppImages — shipped with
      # no signature at all. Sign them with the same key so every published
      # artifact is verifiable. (This is not OS-level code signing: Gatekeeper
      # and SmartScreen still need Apple/Authenticode certificates.)
      - name: Sign installer packages
        shell: bash
        env:
          OPENBITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          OPENBITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          OPENBITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
        run: |
          set -euo pipefail
          mapfile -t assets < <(
            find release-assets -type f \
              \( -name '*.AppImage' -o -name '*.deb' -o -name '*.rpm' \
                 -o -name '*.dmg' \) | sort
          )
          if [[ "${#assets[@]}" -eq 0 ]]; then
            echo "No installer packages found to sign."
            exit 0
          fi
          bash scripts/sign-release-assets.sh "${assets[@]}"

          # Publish the public key alongside the signatures: a signature nobody
          # can fetch a key for is not verifiable.
          node scripts/write-minisign-public-key.mjs \
            --out release-assets/minisign.pub

      # Runs after the signing step because the manifest declares the macOS
      # .dmg installers, and a manual installer is only declarable once its
      # detached signature exists next to it.
      - name: Generate updater manifest
        run: |
          node scripts/generate-tauri-latest-json.mjs \
            --assets-dir release-updater-assets \
            --manual-assets-dir release-manual-assets \
            --installer-assets-dir release-assets \
            --version "${{ needs.prepare.outputs.version }}" \
            --tag "${{ needs.prepare.outputs.release_tag }}" \
            --repo "${{ github.repository }}" \
            --notes-file "scripts/release-notes/${{ needs.prepare.outputs.version }}.md" \
            --out release-updater-assets/latest-v1.json \
            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"

      - name: Verify updater manifest
        run: |
          node scripts/verify-tauri-latest-json.mjs \
            --manifest release-updater-assets/latest-v1.json \
            --version "${{ needs.prepare.outputs.version }}" \
            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" \
            --required-manual-platforms "windows-x86_64,darwin-aarch64,darwin-x86_64"

      - name: Stage release assets
        shell: bash
        run: |
          set -euo pipefail
          shopt -s globstar
          # AppImage, deb, and rpm files are already copied into the
          # canonical release-updater-assets directory above. Publishing the
          # raw Tauri bundle names as well creates a second public copy of
          # every Linux installer and doubles the signature count.
          node scripts/stage-github-release-assets.mjs \
            --out-dir release-upload-assets \
            release-updater-assets/* \
            release-manual-assets/*.exe \
            release-manual-assets/*.exe.sig \
            release-assets/**/*.dmg \
            release-assets/**/*.dmg.sig \
            release-assets/minisign.pub \
            linux-release-assets/openbitfun-cli-*.tar.gz \
            linux-release-assets/openbitfun-cli-*.tar.gz.sha256 \
            linux-release-assets/openbitfun-relay-server-*.tar.gz \
            linux-release-assets/openbitfun-relay-server-*.tar.gz.sha256 \
            linux-release-assets/*.tar.gz.sig \
            linux-release-assets/*.tar.gz.sha256.sig \
            linux-release-assets/linux-binaries-v1.json \
            relay-image-assets/relay-image.json \
            relay-image-assets/relay-image.json.sig

      # Old Desktop and CLI clients follow GitHub Latest. Keep their feeds on
      # the pinned legacy manifests checked into the repository; only versioned
      # manifests may advertise 1.x.
      - name: Preserve legacy update feeds
        if: needs.prepare.outputs.release_channel == 'stable'
        shell: bash
        run: |
          set -euo pipefail
          cp scripts/fixtures/legacy-update-feeds/latest.json \
            release-upload-assets/latest.json
          cp scripts/fixtures/legacy-update-feeds/linux-binaries.json \
            release-upload-assets/linux-binaries.json
          node -e 'const fs=require("node:fs");for(const f of ["release-upload-assets/latest.json","release-upload-assets/linux-binaries.json"]){const m=JSON.parse(fs.readFileSync(f,"utf8"));if(f.endsWith("latest.json")){if(m.version!=="0.2.20"||typeof m.notes!=="string"||m.notes.length===0)process.exit(1);}else if(m.version!=="0.2.19")process.exit(1);}'

      - name: Upload to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
          RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
          RELEASE_PRERELEASE: ${{ needs.prepare.outputs.release_channel == 'beta' }}
          RELEASE_LATEST: ${{ needs.prepare.outputs.release_channel == 'stable' }}
        run: |
          set -euo pipefail
          # The immutable tag was checked before building. Do not send
          # target_commitish: GitHub can require workflows:write even when the
          # tag already exists. action-gh-release also resends the stored value.
          status="$(curl -sS --retry 5 --retry-delay 3 \
            --output release-state.json --write-out '%{http_code}' \
            -H "Authorization: Bearer ${GH_TOKEN}" \
            -H 'Accept: application/vnd.github+json' \
            "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}")"
          case "${status}" in
            200) ;;
            404)
              gh release create "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" \
                --verify-tag --draft --title "OpenBitFun ${RELEASE_VERSION}" \
                --generate-notes
              ;;
            *)
              echo "Could not inspect release (GitHub API returned ${status})." >&2
              exit 1
              ;;
          esac
          gh release upload "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" \
            --clobber release-upload-assets/*
          MOBILE_VERSION="$(sed -nE 's/.*versionName = "([^"]+)".*/\1/p' \
            src/apps/mobile/android/app/build.gradle.kts 2>/dev/null | head -n1 || true)"
          MOBILE_VERSION="${MOBILE_VERSION:-$RELEASE_VERSION}"
          gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" \
            --json body --jq .body > release-notes.md
          if ! grep -q '<!-- openbitfun-mobile-release -->' release-notes.md; then
            cat >> release-notes.md <<EOF

          <!-- openbitfun-mobile-release -->
          ### Android mobile

          Android mobile version **${MOBILE_VERSION}** is published separately as a prerelease:
          [Download the Android prerelease](https://github.com/${GITHUB_REPOSITORY}/releases/tag/mobile-v${MOBILE_VERSION}).
          The current APK uses the runner-generated debug signing key.
          EOF
          fi
          gh release edit "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" \
            --title "OpenBitFun ${RELEASE_VERSION}" --notes-file release-notes.md \
            --draft=false --prerelease="${RELEASE_PRERELEASE}" --latest="${RELEASE_LATEST}"

      - name: Verify published legacy update feeds
        if: needs.prepare.outputs.release_channel == 'stable'
        shell: bash
        run: |
          set -euo pipefail
          curl -fsSL --retry 5 --retry-delay 3 \
            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/latest.json" \
            -o legacy-latest.json
          cmp release-upload-assets/latest.json legacy-latest.json
          curl -fsSL --retry 5 --retry-delay 3 \
            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
            -o legacy-linux-binaries.json
          cmp release-upload-assets/linux-binaries.json legacy-linux-binaries.json

      - name: Verify published updater manifest
        run: |
          curl -fsSL --retry 5 --retry-delay 3 \
            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/latest-v1.json" \
            -o latest.published.json
          node scripts/verify-tauri-latest-json.mjs \
            --manifest latest.published.json \
            --version "${{ needs.prepare.outputs.version }}" \
            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" \
            --required-manual-platforms "windows-x86_64,darwin-aarch64,darwin-x86_64" \
            --check-urls true

      - name: Verify published Linux binaries manifest
        run: |
          curl -fsSL --retry 5 --retry-delay 3 \
            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries-v1.json" \
            -o linux-binaries.published.json
          test "$(jq -r '.version' linux-binaries.published.json)" = "${{ needs.prepare.outputs.version }}"
          jq -e '.platforms | has("linux-x86_64") and has("linux-aarch64")' linux-binaries.published.json >/dev/null
          while IFS= read -r archive_url; do
            test -n "${archive_url}"
            curl -fsSLI --retry 5 --retry-delay 3 "${archive_url}" -o /dev/null
            curl -fsSL --retry 5 --retry-delay 3 "${archive_url}.sha256" -o /dev/null
            curl -fsSL --retry 5 --retry-delay 3 "${archive_url}.sig" -o /dev/null
            curl -fsSL --retry 5 --retry-delay 3 "${archive_url}.sha256.sig" -o /dev/null
          done < <(jq -r '.platforms[] | .cli.url, .relay.url' linux-binaries.published.json)

      - name: Verify published Relay image descriptor
        shell: bash
        run: |
          curl -fsSL --retry 5 --retry-delay 3 \
            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \
            -o relay-image.published.json
          test "$(jq -r '.tag' relay-image.published.json)" = "${{ needs.prepare.outputs.release_tag }}"
          test "$(jq -r '.version' relay-image.published.json)" = "${{ needs.prepare.outputs.version }}"
          test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/openbitfun-relay-server"
          jq -e '.platforms | sort == ["linux/amd64", "linux/arm64"]' relay-image.published.json >/dev/null
          jq -e '.digest | test("^sha256:[0-9a-f]{64}$")' relay-image.published.json >/dev/null
          curl -fsSL --retry 5 --retry-delay 3 \
            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \
            -o relay-image.published.json.sig
          # These exact bytes were signed in the image job. Detect a stale or
          # crossed upload pair before advertising a release as ready.
          cmp relay-image-assets/relay-image.json relay-image.published.json
          cmp relay-image-assets/relay-image.json.sig relay-image.published.json.sig

      - name: Resolve beta channel promotion
        id: beta-channel
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }}
        run: |
          set -euo pipefail
          channel_status="$(curl -sS --retry 5 --retry-delay 3 \
            --output channel.release.json \
            --write-out '%{http_code}' \
            -H "Authorization: Bearer ${GH_TOKEN}" \
            -H 'Accept: application/vnd.github+json' \
            -H 'X-GitHub-Api-Version: 2022-11-28' \
            "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/channel-v1-beta")"
          case "${channel_status}" in
            200)
              echo "channel_exists=true" >>"$GITHUB_OUTPUT"
              curl -fsSL --retry 5 --retry-delay 3 \
                "https://github.com/${GITHUB_REPOSITORY}/releases/download/channel-v1-beta/latest-v1.json" \
                -o current.beta.json
              ;;
            404)
              echo "channel_exists=false" >>"$GITHUB_OUTPUT"
              if [[ "${RELEASE_CHANNEL}" == "stable" ]]; then
                echo "promote=false" >>"$GITHUB_OUTPUT"
                echo "No beta channel exists; stable release does not need to create one."
                exit 0
              fi
              ;;
            *)
              echo "Could not inspect channel-v1-beta release (GitHub API returned ${channel_status})." >&2
              exit 1
              ;;
          esac
          args=(--candidate latest.published.json --github-output "$GITHUB_OUTPUT")
          if [[ -s current.beta.json ]]; then
            args+=(--current current.beta.json)
          fi
          node scripts/plan-channel-promotion.mjs "${args[@]}"

      - name: Publish beta channel manifest
        if: steps.beta-channel.outputs.promote == 'true'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          CHECKOUT_REF: ${{ needs.prepare.outputs.checkout_ref }}
          CHANNEL_EXISTS: ${{ steps.beta-channel.outputs.channel_exists }}
          CANDIDATE_VERSION: ${{ steps.beta-channel.outputs.candidate_version }}
        run: |
          set -euo pipefail
          if [[ "${CHANNEL_EXISTS}" != "true" ]]; then
            gh release create channel-v1-beta \
              --repo "${GITHUB_REPOSITORY}" \
              --target "${CHECKOUT_REF}" \
              --prerelease \
              --title "OpenBitFun Beta Update Channel" \
              --notes "Mutable updater pointer. Installable beta releases use immutable version tags."
          fi
          mkdir -p beta-channel
          cp latest.published.json beta-channel/latest-v1.json
          gh release upload channel-v1-beta beta-channel/latest-v1.json \
            --repo "${GITHUB_REPOSITORY}" \
            --clobber
          # A successful HTTP response can still contain the previous CDN object.
          # Retry content validation as well as transport failures after replacement.
          # GitHub's release CDN can take several minutes to converge after a
          # clobber, so keep the failure bound at five minutes instead of
          # treating a transient stale object as a failed release.
          max_readback_attempts=60
          for ((attempt = 1; attempt <= max_readback_attempts; attempt++)); do
            if curl -fsSL --max-time 30 \
              "https://github.com/${GITHUB_REPOSITORY}/releases/download/channel-v1-beta/latest-v1.json" \
              -o channel-v1-beta.published.json && \
              jq -e --arg version "${CANDIDATE_VERSION}" \
                '.version == $version' channel-v1-beta.published.json >/dev/null; then
              echo "Beta channel manifest verified: ${CANDIDATE_VERSION}"
              exit 0
            fi
            echo "Beta channel manifest is not ready (attempt ${attempt}/${max_readback_attempts})."
            if [[ "${attempt}" -lt "${max_readback_attempts}" ]]; then sleep 5; fi
          done
          echo "Beta channel manifest did not converge to ${CANDIDATE_VERSION}." >&2
          exit 1

      # Nudge the configured download mirror to sync now instead of on its next
      # 10-minute cron tick. Until the mirror has these bytes, clients have
      # only the GitHub origin to fall back to. Best effort: the cron run is
      # still the source of truth, so a failed or unconfigured ping never fails
      # the release. Receiver: scripts/openbitfun-release-sync.sh.
      - name: Request openbitfun mirror sync
        if: github.repository == 'GCWing/OpenBitFun'
        continue-on-error: true
        env:
          SYNC_WEBHOOK_URL: ${{ secrets.OPENBITFUN_SYNC_WEBHOOK_URL }}
          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
          RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }}
        run: |
          set -euo pipefail
          if [[ -z "${SYNC_WEBHOOK_URL:-}" ]]; then
            echo "OPENBITFUN_SYNC_WEBHOOK_URL is not configured; the mirror will pick this up on its next cron run."
            exit 0
          fi
          curl -fsSL -X POST --retry 3 --retry-delay 5 --max-time 30 \
            -H 'Content-Type: application/json' \
            -d "{\"tag\":\"${RELEASE_TAG}\",\"channel\":\"${RELEASE_CHANNEL}\"}" \
            "${SYNC_WEBHOOK_URL}" >/dev/null
          echo "Mirror sync requested for ${RELEASE_TAG}."