release.yml

name: Release

# Release is triggered by pushing a vX.Y.Z tag.
#
# PREREQUISITE: Before tagging, merge develop → main via PR.
# The tag must point to a commit on main, NOT develop.
# GitFlow: develop (default) → PR → main → tag → release.
#
# This workflow does NOT sync main — main must already be up to date.

on:
  push:
    tags:
      - 'v*'

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  ORT_VERSION: "1.24.4"

jobs:
  verify-main:
    name: Verify tag is on main
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Check tag is on main
        run: |
          git fetch origin main
          TAG_SHA=$(git rev-parse "${{ github.ref }}^{commit}")
          MAIN_SHA=$(git rev-parse origin/main)
          echo "Tag: $TAG_SHA"
          echo "main: $MAIN_SHA"
          if [ "$TAG_SHA" = "$MAIN_SHA" ]; then
            echo "✅ Tag is main HEAD"
          elif git merge-base --is-ancestor "$TAG_SHA" origin/main 2>/dev/null; then
            echo "✅ Tag commit $TAG_SHA is in main history"
          else
            echo "::error::Tag commit $TAG_SHA is NOT on main."
            echo "Merge develop → main via PR before tagging."
            exit 1
          fi

  build-ort-legacy:
    name: Build legacy ORT (SSE4.2, no AVX2)
    needs: [verify-main]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout onnxruntime source
        uses: actions/checkout@v7
        with:
          repository: microsoft/onnxruntime
          ref: v${{ env.ORT_VERSION }}
          path: onnxruntime-src

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake build-essential python3

      - name: Cache legacy ORT build
        id: cache-ort
        uses: actions/cache@v6
        with:
          path: onnxruntime-build/lib/libonnxruntime.so*
          key: ort-legacy-sse42-${{ env.ORT_VERSION }}-v1

      - name: Build ONNX Runtime (SSE4.2 only)
        if: steps.cache-ort.outputs.cache-hit != 'true'
        run: |
          mkdir -p onnxruntime-build
          cmake -S onnxruntime-src/cmake -B onnxruntime-build \
            -Donnxruntime_BUILD_SHARED_LIB=ON \
            -Donnxruntime_BUILD_UNIT_TESTS=OFF \
            -Donnxruntime_ENABLE_PYTHON=OFF \
            -Donnxruntime_ENABLE_CPUINFO=OFF \
            -Donnxruntime_USE_AVX=OFF \
            -Donnxruntime_USE_AVX2=OFF \
            -Donnxruntime_USE_AVX512=OFF \
            -Donnxruntime_BUILD_BENCHMARKS=OFF \
            -Donnxruntime_BUILD_OBJC=OFF \
            -Donnxruntime_BUILD_CSHARP=OFF \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_INSTALL_PREFIX=onnxruntime-install

          cmake --build onnxruntime-build --config Release --parallel $(nproc)

      - name: Package legacy ORT
        run: |
          mkdir -p ort-legacy
          cp onnxruntime-build/lib/libonnxruntime.so* ort-legacy/ || true
          # Also look for the sonamed lib
          find onnxruntime-build -name 'libonnxruntime.so*' -type f -exec cp {} ort-legacy/ \;
          ls -lh ort-legacy/

      - name: Upload legacy ORT artifact
        uses: actions/upload-artifact@v7
        with:
          name: ort-legacy-linux-x64
          path: ort-legacy/

  build-release:
    name: Build ${{ matrix.target }}
    needs: [verify-main]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64 — ubuntu-24.04 provides GCC 14 (needed for numkong
          # 7.7.0 SIMD probes: AVX512-FP16, AMX, AVX10.2). GLIBC 2.39.
          # Compatibility: Ubuntu 24.04+, Debian 13+, RHEL 10+.
          # For older distros, use the Docker image (based on Debian 12).
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
            artifact: uteke-x86_64-unknown-linux-gnu
            ext: tar.gz
          # Linux ARM64 — same ubuntu-24.04 baseline
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            artifact: uteke-aarch64-unknown-linux-gnu
            ext: tar.gz
          # macOS Apple Silicon
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: uteke-aarch64-apple-darwin
            ext: tar.gz
          # Windows x86_64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: uteke-x86_64-pc-windows-msvc
            ext: zip

    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Download prebuilt ORT shared library
        shell: bash
        run: |
          ORT_VER="${ORT_VERSION}"
          case "${{ runner.os }}" in
            Linux)
              if [ "${{ matrix.target }}" = "x86_64-unknown-linux-gnu" ]; then
                ORT_PKG="onnxruntime-linux-x64-${ORT_VER}.tgz"
              else
                ORT_PKG="onnxruntime-linux-aarch64-${ORT_VER}.tgz"
              fi
              curl -sL "https://github.com/microsoft/onnxruntime/releases/download/v${ORT_VER}/${ORT_PKG}" | tar xz
              mkdir -p ort-lib
              # Copy actual .so files AND symlinks (needed for dlopen)
              find onnxruntime-*/lib -name 'libonnxruntime.so*' \( -type f -o -type l \) -exec cp -a {} ort-lib/ \;
              find onnxruntime-*/lib -name 'libonnxruntime_providers_shared.so*' \( -type f -o -type l \) -exec cp -a {} ort-lib/ \;
              echo "ORT_LIB_DIR=ort-lib" >> $GITHUB_ENV
              ;;
            macOS)
              ORT_PKG="onnxruntime-osx-arm64-${ORT_VER}.tgz"
              curl -sL "https://github.com/microsoft/onnxruntime/releases/download/v${ORT_VER}/${ORT_PKG}" | tar xz
              mkdir -p ort-lib
              find onnxruntime-*/lib -name 'libonnxruntime*.dylib' \( -type f -o -type l \) -exec cp -a {} ort-lib/ \;
              echo "ORT_LIB_DIR=ort-lib" >> $GITHUB_ENV
              ;;
            Windows)
              ORT_PKG="onnxruntime-win-x64-${ORT_VER}.zip"
              curl -sL "https://github.com/microsoft/onnxruntime/releases/download/v${ORT_VER}/${ORT_PKG}" -o ort.zip
              mkdir -p ort-lib
              unzip -j ort.zip 'onnxruntime-win-x64-*/lib/*.dll' -d ort-lib/ 2>/dev/null || true
              unzip -j ort.zip 'onnxruntime-win-x64-*/lib/*.lib' -d ort-lib/ 2>/dev/null || true
              echo "ORT_LIB_DIR=ort-lib" >> $GITHUB_ENV
              ;;
          esac
          echo "Downloaded ORT libraries:"
          ls -lh "${ORT_LIB_DIR:-ort-lib}/" || true

      - name: Build release binaries
        run: cargo build --release --target ${{ matrix.target }} -p uteke-cli -p uteke-server -p uteke-mcp

      - name: Strip binaries (Unix)
        if: runner.os != 'Windows'
        run: |
          BIN_DIR="target/${{ matrix.target }}/release"
          strip "$BIN_DIR/uteke" || true
          strip "$BIN_DIR/uteke-serve" || true
          strip "$BIN_DIR/uteke-mcp" || true

      - name: Verify GLIBC requirement (Linux only)
        if: runner.os == 'Linux'
        run: |
          BIN_DIR="target/${{ matrix.target }}/release"
          echo "=== GLIBC version requirement ==="
          objdump -T "$BIN_DIR/uteke" | grep -oP 'GLIBC_[\d.]+' | sort -V -u
          echo ""
          MAX_GLIBC=$(objdump -T "$BIN_DIR/uteke" | grep -oP 'GLIBC_[\d.]+' | sort -V -u | tail -1)
          FLOOR="GLIBC_2.39"
          echo "Highest GLIBC requirement: ${MAX_GLIBC:-<none>}"
          echo "Floor:                     $FLOOR"
          if [ -z "$MAX_GLIBC" ]; then
            echo "::error::No GLIBC symbols found."
            exit 1
          fi
          if [[ "$(echo -e "$MAX_GLIBC\n$FLOOR" | sort -V | tail -1)" != "$FLOOR" ]]; then
            echo "::warning::Binary requires $MAX_GLIBC > $FLOOR. Compatibility limited to newer distros."
          fi
          echo "✅ Binary built on ubuntu-24.04 (GLIBC 2.39, GCC 14)"

      - name: Extract version
        id: version
        shell: bash
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Package (Unix)
        if: runner.os != 'Windows'
        run: |
          BIN_DIR="target/${{ matrix.target }}/release"
          mkdir -p release
          ls -la "$BIN_DIR/uteke" "$BIN_DIR/uteke-serve" "$BIN_DIR/uteke-mcp"
          cp "$BIN_DIR/uteke" release/uteke
          cp "$BIN_DIR/uteke-serve" release/uteke-serve
          cp "$BIN_DIR/uteke-mcp" release/uteke-mcp
          # Include ORT shared library
          if [ -d "${ORT_LIB_DIR}" ]; then
            cp -r "${ORT_LIB_DIR}"/* release/
            echo "✅ ORT libraries included in package"
          else
            echo "⚠️ No ORT libraries found"
          fi
          cd release
          tar czf "${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }}" *

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          mkdir release
          Copy-Item "target/${{ matrix.target }}/release/uteke.exe" release/
          Copy-Item "target/${{ matrix.target }}/release/uteke-serve.exe" release/
          Copy-Item "target/${{ matrix.target }}/release/uteke-mcp.exe" release/
          # Include ORT DLLs
          if (Test-Path $env:ORT_LIB_DIR) {
            Copy-Item "$env:ORT_LIB_DIR/*" release/
            Write-Host "✅ ORT libraries included in package"
          } else {
            Write-Host "⚠️ No ORT libraries found"
          }
          cd release
          7z a "${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }}" *

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}
          path: release/${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }}

  publish-crates:
    name: Publish to crates.io
    needs: [verify-main]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - name: Publish uteke-core
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} -p uteke-core --allow-dirty
        continue-on-error: true

      - name: Wait for crates.io index propagation
        run: sleep 60

      - name: Publish uteke-mcp
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} -p uteke-mcp --allow-dirty
        continue-on-error: true

      - name: Wait for crates.io index propagation
        run: sleep 30

      - name: Publish uteke-cli
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} -p uteke-cli --allow-dirty
        continue-on-error: true

      - name: Wait for crates.io index propagation
        run: sleep 30

      - name: Publish uteke-server
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} -p uteke-server --allow-dirty
        continue-on-error: true

      - name: Wait for crates.io index
        run: sleep 30

      - name: Verify crates.io versions
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          fail=0
          for crate in uteke-core uteke-mcp uteke-cli uteke-server; do
            for attempt in 1 2 3 4 5; do
              MAX=$(curl -sf -A "uteke-release-verify" "https://crates.io/api/v1/crates/$crate" | jq -r '.crate.max_version') || MAX=""
              [ "$MAX" = "$VERSION" ] && break
              echo "attempt $attempt: $crate at $MAX (want $VERSION), waiting..."
              sleep 30
            done
            if [ "$MAX" = "$VERSION" ]; then
              echo "✓ $crate $VERSION live on crates.io"
            else
              echo "::error::$crate not at $VERSION on crates.io (found: $MAX) — publish step failed silently"
              fail=1
            fi
          done
          exit $fail

  package-legacy:
    name: Package Linux x64 legacy bundle
    needs: [build-release, build-ort-legacy]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Extract version
        id: version
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Download standard Linux x64 artifact
        uses: actions/download-artifact@v8
        with:
          name: uteke-x86_64-unknown-linux-gnu-${{ steps.version.outputs.VERSION }}
          path: standard-artifact

      - name: Download legacy ORT artifact
        uses: actions/download-artifact@v8
        with:
          name: ort-legacy-linux-x64
          path: ort-legacy

      - name: Create legacy bundle
        run: |
          mkdir -p legacy-release
          tar xzf standard-artifact/uteke-x86_64-unknown-linux-gnu-${{ steps.version.outputs.VERSION }}.tar.gz -C legacy-release/
          # Replace standard ORT with legacy ORT in ort-legacy/ subdirectory
          mkdir -p legacy-release/ort-legacy
          cp ort-legacy/libonnxruntime.so* legacy-release/ort-legacy/
          # Verify
          echo "Standard ORT libs:"
          ls -lh legacy-release/libonnxruntime.so* 2>/dev/null || echo "  (none at root)"
          echo "Legacy ORT libs:"
          ls -lh legacy-release/ort-legacy/
          echo ""
          echo "Full bundle contents:"
          ls -lh legacy-release/
          cd legacy-release
          tar czf "uteke-x86_64-unknown-linux-gnu-legacy-${{ steps.version.outputs.VERSION }}.tar.gz" *

      - name: Upload legacy artifact
        uses: actions/upload-artifact@v7
        with:
          name: uteke-x86_64-unknown-linux-gnu-legacy-${{ steps.version.outputs.VERSION }}
          path: legacy-release/uteke-x86_64-unknown-linux-gnu-legacy-${{ steps.version.outputs.VERSION }}.tar.gz

  release:
    name: Create GitHub Release
    needs: [build-release, package-legacy]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write # keyless cosign signing (#1327)

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Extract version
        id: version
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          path: release-artifacts
          pattern: uteke-*
          merge-multiple: true

      - name: List artifacts
        run: ls -la release-artifacts/

      - name: Generate SHA256 checksums
        run: |
          cd release-artifacts
          sha256sum * > checksums-sha256.txt
          cat checksums-sha256.txt

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      # Keyless signature over the checksums file (#1327). It covers every
      # asset through its SHA256, and the certificate in the bundle is bound to
      # this workflow's identity, so there is no signing key to manage.
      - name: Sign checksums with cosign (keyless)
        working-directory: release-artifacts
        run: |
          cosign sign-blob --yes \
            --bundle checksums-sha256.txt.bundle \
            checksums-sha256.txt

      - name: Extract changelog for this version
        id: changelog
        run: |
          VER="${{ steps.version.outputs.VERSION }}"
          CLEAN_VER="${VER#v}"
          awk "/^## \[${CLEAN_VER}\]/{found=1; next} /^## \[/{found=0} found && !/^\[.*\]: https:/" CHANGELOG.md > changelog-body.md
          if [ ! -s changelog-body.md ]; then
            echo "::warning::No CHANGELOG section found for [${CLEAN_VER}]"
            echo "No changelog entry found for this version." > changelog-body.md
          fi
          echo "CLEAN_VER=${CLEAN_VER}" >> $GITHUB_OUTPUT

      - name: Generate release notes
        run: |
          VER="${{ steps.version.outputs.VERSION }}"
          # Prefer committed RELEASE_NOTES.md (copywriting quality, manual curation)
          if [ -f RELEASE_NOTES.md ]; then
            # Guard: reject template with unresolved placeholders
            if grep -qE 'vX\.Y\.Z|#NNN|N (bug|new|passing)|@user' RELEASE_NOTES.md; then
              echo "::error::RELEASE_NOTES.md contains unresolved placeholders (vX.Y.Z, #NNN, etc). Edit it before tagging, or delete the file to use auto-generation."
              exit 1
            fi
            # Guard: reject stale notes from a previous release
            if ! grep -q "## v${VER}" RELEASE_NOTES.md; then
              echo "::error::RELEASE_NOTES.md does not mention v${VER} — it is stale from a previous release. Update it or delete it to use auto-generation."
              exit 1
            fi
            echo "Using committed RELEASE_NOTES.md"
            cp RELEASE_NOTES.md release-notes.md
          else
            echo "::notice::No RELEASE_NOTES.md found, auto-generating from CHANGELOG"
            {
              echo "## What's New in ${VER}"
              echo ""
              cat changelog-body.md
              echo ""
              # Static tail (downloads table + quick start) lives in a plain template
              # file — NEVER inline it in a heredoc. Unquoted heredoc bodies undergo
              # shell expansion: markdown backticks become command substitutions and
              # get EXECUTED (v0.14.3: installer curl|sh ran on the runner, then
              # uteke-serve blocked forever). Template file = zero expansion.
              sed "s/__VER__/${VER}/g" scripts/release-notes-template.md
            } > release-notes.md
          fi

      - name: Append contributor credits
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          {
            echo ""
            echo ""
            echo "## Community contributors"
            echo ""
          } >> release-notes.md
          FOUND=0
          for PR in $(grep -oE '#[0-9]+' changelog-body.md 2>/dev/null | sort -u); do
            NUM="${PR#\#}"
            LOGIN="$(gh pr view "${NUM}" --repo "${GITHUB_REPOSITORY}" --json author --jq '.author.login' 2>/dev/null || true)"
            [ -z "${LOGIN}" ] && continue
            case "${LOGIN}" in ajianaz|codecoradev|app/*|*"[bot]") continue ;; esac
            ASSOC="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${NUM}" --jq '.author_association' 2>/dev/null || true)"
            case "${ASSOC}" in MEMBER|COLLABORATOR|OWNER) continue ;; esac
            TITLE="$(gh pr view "${NUM}" --repo "${GITHUB_REPOSITORY}" --json title --jq '.title' 2>/dev/null || true)"
            echo "- @${LOGIN} — ${TITLE} (${PR})" >> release-notes.md
            FOUND=1
          done
          if [ "${FOUND}" -eq 0 ]; then
            echo "(No external contributions in this cycle. Full contributor list: https://github.com/${GITHUB_REPOSITORY}/graphs/contributors)" >> release-notes.md
          fi
          echo "--- release-notes.md tail ---"
          tail -n 10 release-notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.VERSION }}
          name: ${{ steps.version.outputs.VERSION }}
          body_path: release-notes.md
          files: release-artifacts/*
          draft: false
          prerelease: ${{ contains(steps.version.outputs.VERSION, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  update-tap:
    name: Update homebrew-tap formula
    needs: [release]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tap repository
        uses: actions/checkout@v7
        with:
          repository: codecoradev/homebrew-tap
          ref: main
          token: ${{ secrets.TAP_TOKEN }}
          path: tap

      - name: Download published checksums
        env:
          REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          curl -fsSL -o checksums-sha256.txt \
            "https://github.com/${REPO}/releases/download/${TAG}/checksums-sha256.txt"
          cat checksums-sha256.txt

      - name: Regenerate formula
        run: |
          VER="${GITHUB_REF_NAME#v}"
          python3 tap/scripts/update_formula.py \
            --version "$VER" \
            --checksums checksums-sha256.txt \
            --out tap/Formula/uteke.rb
          cat tap/Formula/uteke.rb

      - name: Verify formula checksums against the release
        env:
          TAG: ${{ github.ref_name }}
        run: |
          # Every url/sha256 pair in the generated formula must point at THIS
          # release and carry the SHA256 published in checksums-sha256.txt, so the
          # PR description's "verified" claim is checked, not asserted.
          python3 - <<'PY'
          import os, re, sys

          tag = os.environ["TAG"]
          formula = open("tap/Formula/uteke.rb").read()
          sums = {}
          for line in open("checksums-sha256.txt"):
              parts = line.split()
              if len(parts) == 2:
                  sums[parts[1].lstrip("*")] = parts[0]

          pairs = re.findall(r'url "([^"]+)"\s*\n\s*sha256 "([0-9a-f]{64})"', formula)
          if not pairs:
              sys.exit("::error::no url/sha256 pairs found in the generated formula")
          bad = 0
          for url, sha in pairs:
              name = url.rsplit("/", 1)[-1]
              if f"/download/{tag}/" not in url:
                  print(f"::error::{name}: URL does not point at release {tag}")
                  bad += 1
              elif name not in sums:
                  print(f"::error::{name} is not listed in checksums-sha256.txt")
                  bad += 1
              elif sums[name] != sha:
                  print(f"::error::{name}: formula has {sha}, release publishes {sums[name]}")
                  bad += 1
              else:
                  print(f"ok  {name}")
          sys.exit(1 if bad else 0)
          PY

      - name: Create update branch and pull request
        working-directory: tap
        env:
          VERSION: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.TAP_TOKEN }}
        run: |
          # The tap enforces Conventional Commits on the PR title, a branch prefix
          # and "## What / ## Why / ## Testing" in the body (pr-checks.yml), so the
          # PR is generated to pass them without manual edits.
          TITLE="chore: update formula for uteke ${VERSION#v}"
          git config user.name "uteke-release-bot"
          git config user.email "bot@codecora.dev"
          BRANCH="chore/formula-${VERSION}"
          git checkout -b "$BRANCH"
          git add Formula/uteke.rb
          if git diff --cached --quiet; then
            echo "Formula unchanged — nothing to update."
            exit 0
          fi
          git commit --no-verify -m "$TITLE"
          git push origin "$BRANCH"
          cat > "$RUNNER_TEMP/pr-body.md" <<EOF
          ## What
          Update Formula/uteke.rb for uteke ${VERSION}: the release URLs and SHA256 values for every supported platform (macOS arm64, Linux arm64, Linux x86_64) and the version in the unsupported-platform messages.

          ## Why
          Automated formula update from the uteke release workflow: https://github.com/${REPO}/releases/tag/${VERSION}

          ## Testing
          - Every SHA256 in this formula was re-verified against checksums-sha256.txt of the published ${VERSION} release before this PR was opened (the job fails otherwise).
          - CI on this PR: brew audit (macOS), brew install + test on Linux x86_64 and macOS ARM.
          - Merge manually once the checks pass (no auto-merge). Cora may return an empty result on formula-only diffs; accept it only after confirming the checksum verification above.
          EOF
          gh pr create \
            --repo codecoradev/homebrew-tap \
            --base main \
            --head "$BRANCH" \
            --title "$TITLE" \
            --body-file "$RUNNER_TEMP/pr-body.md"
          echo "PR created for ${VERSION}"


  docker:
    name: Build & Push Docker Image
    needs: [build-release]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        id: dockerhub
        continue-on-error: true
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Download Linux binaries from build artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: uteke-*-${{ github.ref_name }}
          path: release-artifacts

      - name: Extract binaries for Docker context
        run: |
          # binaries/ MUST be at workspace root — Dockerfile copies it: COPY binaries/ ./
          mkdir -p binaries binaries-amd64 binaries-arm64
          AMD64=$(find release-artifacts -name "uteke-x86_64-unknown-linux-gnu-${{ github.ref_name }}.tar.gz" | head -1)
          ARM64=$(find release-artifacts -name "uteke-aarch64-unknown-linux-gnu-${{ github.ref_name }}.tar.gz" | head -1)
          if [ -z "$AMD64" ] || [ -z "$ARM64" ]; then
            echo "::error::Linux binary artifacts not found"
            echo "Available files:" && find release-artifacts -type f | head -20
            exit 1
          fi
          # Extract amd64 → rename binaries, keep .so in amd64 subfolder
          tar xzf "$AMD64" -C binaries-amd64
          mv binaries-amd64/uteke binaries/uteke-amd64
          mv binaries-amd64/uteke-serve binaries/uteke-serve-amd64
          mv binaries-amd64/uteke-mcp binaries/uteke-mcp-amd64
          # Keep ORT .so files in arch-specific subfolder for Dockerfile
          mkdir -p binaries/ort-amd64
          cp binaries-amd64/libonnxruntime*.so* binaries/ort-amd64/ 2>/dev/null || true
          # Extract arm64 → same pattern
          tar xzf "$ARM64" -C binaries-arm64
          mv binaries-arm64/uteke binaries/uteke-arm64
          mv binaries-arm64/uteke-serve binaries/uteke-serve-arm64
          mv binaries-arm64/uteke-mcp binaries/uteke-mcp-arm64
          mkdir -p binaries/ort-arm64
          cp binaries-arm64/libonnxruntime*.so* binaries/ort-arm64/ 2>/dev/null || true
          chmod +x binaries/uteke-* binaries/uteke-serve-* binaries/uteke-mcp-*
          echo "=== Docker context ==="
          ls -lh binaries/
          ls -lh binaries/ort-amd64/ 2>/dev/null || true
          ls -lh binaries/ort-arm64/ 2>/dev/null || true

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/${{ github.repository }}
            ${{ steps.dockerhub.outcome == 'success' && 'docker.io/codecoradev/uteke' || '' }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64/v8
          build-args: |
            VERSION=${{ github.ref_name }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}