ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches: [main, master, dev, 'repro/**']
    tags: ['v*']
  pull_request:
    branches: [main, master]

env:
  NODE_VERSION_PRIMARY: '24'
  NODE_VERSION_SERVER: '22'
  IMCODES_REQUIRE_COMPUTER_USE_HELPER: '1'

jobs:
  # ── Lint ──────────────────────────────────────────────────────────────────

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - run: npm run lint

  # ── Typecheck (daemon + server) ───────────────────────────────────────────

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - name: Install server deps
        run: ./scripts/ci-npm-ci.sh server
      - name: Daemon
        run: npx tsc --noEmit
      - name: Server
        run: npx tsc --noEmit
        working-directory: server

  # ── Secret scanning ────────────────────────────────────────────────────────

  secret-scan:
    name: Secret Scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ── Daemon unit tests ─────────────────────────────────────────────────────

  unit-tests:
    name: Unit Tests (Node ${{ matrix.node }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node: ['22', '24']
    steps:
      - name: Checkout
        id: checkout_1
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 2
        if: steps.checkout_1.outcome == 'failure'
        run: |
          echo "::warning::actions/checkout failed on attempt 1; retrying in 15s"
          sleep 15

      - name: Checkout (retry 2)
        id: checkout_2
        if: steps.checkout_1.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 3
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
        run: |
          echo "::warning::actions/checkout failed on attempt 2; retrying in 30s"
          sleep 30

      - name: Checkout (retry 3)
        id: checkout_3
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 4
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
        run: |
          echo "::warning::actions/checkout failed on attempt 3; retrying in 60s"
          sleep 60

      - name: Checkout (retry 4)
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - run: npm run build
      - run: npm run test:unit

  preview-dist-smoke:
    name: Preview Dist Smoke
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - run: npm run test:preview-dist

  embedding-real-tests:
    name: Embedding Integration Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - name: Cache embedding model
        uses: actions/cache@v4
        with:
          path: .cache/imcodes-embeddings
          key: embedding-${{ runner.os }}-${{ env.NODE_VERSION_PRIMARY }}-${{ hashFiles('package-lock.json', 'shared/embedding-config.ts') }}
      - name: Run real transformers.js embedding integration test
        run: npx vitest run test/context/embedding-real.test.ts
        env:
          RUN_REAL_EMBEDDING_TESTS: '1'
          IMCODES_EMBEDDING_CACHE_DIR: ${{ github.workspace }}/.cache/imcodes-embeddings

  # ── macOS daemon unit tests ─────────────────────────────────────────────

  macos-unit-tests:
    name: Unit Tests (macOS)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - name: Install tmux
        run: brew install tmux
      - name: Prime tmux server
        run: tmux new-session -d -s init && tmux kill-session -t init
      - run: ./scripts/ci-npm-ci.sh .
      - run: npm run build
      - run: npm run test:unit

  # ── Windows unit tests (WezTerm backend) ──────────────────────────────────

  windows-unit-tests:
    name: Unit Tests (Windows)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: bash ./scripts/ci-npm-ci.sh .
      - run: npm run build
      - name: Run Windows hook server send tests
        shell: bash
        run: |
          set -euo pipefail
          cmd=(npx vitest run test/daemon/hook-send.test.ts --pool=threads --poolOptions.threads.singleThread=true --minWorkers=1 --maxWorkers=1)
          "${cmd[@]}" || "${cmd[@]}"
        env:
          IMCODES_MUX: wezterm
      - name: Run Windows-specific unit tests
        run: npx vitest run test/agent/wezterm.test.ts test/daemon/env-injection.test.ts test/cli/send.test.ts test/util/windows-daemon.test.ts test/util/windows-upgrade-script.test.ts test/util/windows-upgrade-runner.test.ts test/util/windows-launch-artifacts.test.ts test/util/windows-launch-artifacts.cmd-parse.test.ts test/util/postinstall-sharp-repair.test.ts test/util/sharp-repair-script.test.ts test/util/restart-daemon-cmd.test.ts
        env:
          IMCODES_MUX: wezterm
      - name: Run Windows process-cleanup regression tests
        run: npx vitest run test/util/windows-stale-watchdog-cleanup.test.ts
        env:
          IMCODES_MUX: wezterm

  windows-conpty-tests:
    name: Unit Tests (Windows ConPTY)
    runs-on: windows-latest
    steps:
      - name: Checkout
        id: checkout_1
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 2
        if: steps.checkout_1.outcome == 'failure'
        shell: bash
        run: |
          echo "::warning::actions/checkout failed on attempt 1; retrying in 15s"
          sleep 15

      - name: Checkout (retry 2)
        id: checkout_2
        if: steps.checkout_1.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 3
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
        shell: bash
        run: |
          echo "::warning::actions/checkout failed on attempt 2; retrying in 30s"
          sleep 30

      - name: Checkout (retry 3)
        id: checkout_3
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 4
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
        shell: bash
        run: |
          echo "::warning::actions/checkout failed on attempt 3; retrying in 60s"
          sleep 60

      - name: Checkout (retry 4)
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: bash ./scripts/ci-npm-ci.sh .
      - run: npm run build
      - name: Run Windows ConPTY / startup regression tests
        run: npx vitest run test/agent/conpty.test.ts test/agent/drivers/drivers.test.ts test/util/windows-daemon.test.ts test/util/windows-upgrade-script.test.ts test/util/windows-upgrade-runner.test.ts test/util/windows-launch-artifacts.test.ts test/util/windows-launch-artifacts.cmd-parse.test.ts test/util/sharp-repair-script.test.ts test/util/restart-daemon-cmd.test.ts
      - name: Run Windows ConPTY process-cleanup regression tests
        run: npx vitest run test/util/windows-stale-watchdog-cleanup.test.ts
  # ── Web frontend tests ────────────────────────────────────────────────────

  web-tests-unit:
    name: Web Tests (Unit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - run: ./scripts/ci-npm-ci.sh web
      - run: cd web && npx vitest run --config vitest.unit.config.ts

  web-tests-components:
    name: Web Tests (Components)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - run: ./scripts/ci-npm-ci.sh web
      - run: cd web && npx vitest run --config vitest.components.config.ts

  web-chat-perf:
    name: Web Chat Timeline Perf Guard
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - run: ./scripts/ci-npm-ci.sh web
      # The chat's per-update cost must not scale with how long the conversation
      # is. That is a shape, and only a real browser can measure it — jsdom
      # performs no layout, so the work this guards is largely invisible there.
      # The assertion is a ratio of one session length against another, which
      # normalises away how fast the CI host happens to be.
      - run: cd web && npx playwright install --with-deps chromium
      - run: cd web && npm run test:browser:perf
      - name: Upload perf report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: web-chat-perf-report
          path: web/playwright-report
          retention-days: 7
          if-no-files-found: ignore

  # FileBrowser component test skipped in CI (OOM — renders full 1300-line component in jsdom).
  # Run locally: cd web && npx vitest run --config vitest.filebrowser.config.ts

  # ── Server unit tests ─────────────────────────────────────────────────────

  server-tests:
    name: Server Unit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_SERVER }}
          cache: 'npm'
          cache-dependency-path: package-lock.json
      - run: ./scripts/ci-npm-ci.sh .
      - run: ./scripts/ci-npm-ci.sh server
      - run: npm run test:server
      - name: Run server-native tests (auth-flow, proxy-addr — require server/node_modules)
        run: npm test
        working-directory: server
      - name: Build server for runtime check
        run: npm run build
        working-directory: server
      - name: Runtime import smoke test (catches import path errors that tsc misses)
        run: node -e "import('./dist/server/src/index.js').then(() => { console.log('Server module loaded OK'); process.exit(0); }).catch(e => { console.error('IMPORT FAILED:', e.message); process.exit(1); })"
        working-directory: server

  # ── Server DB integration tests (testcontainers + real PostgreSQL) ─────────

  server-db-tests:
    name: Server DB Integration Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
          cache-dependency-path: |
            package-lock.json
            server/package-lock.json
      # The cross-layer suite intentionally executes daemon MCP code as well as
      # server code, so both dependency trees must be present in this job.
      - run: ./scripts/ci-npm-ci.sh .
      - run: ./scripts/ci-npm-ci.sh server
      - name: Warm DB test container image
        shell: bash
        run: |
          set -euo pipefail
          for attempt in 1 2 3; do
            if docker pull pgvector/pgvector:pg18; then
              exit 0
            fi
            if [ "$attempt" -lt 3 ]; then
              echo "::warning::Docker image pull failed on attempt ${attempt}; retrying..."
              sleep $((attempt * 10))
            fi
          done
          echo "Docker image pull failed after 3 attempts."
          exit 1
      - name: Run DB integration tests
        shell: bash
        run: |
          set -euo pipefail
          for attempt in 1 2; do
            if npm run test:integration; then
              exit 0
            fi
            if [ "$attempt" -lt 2 ]; then
              echo "::warning::DB integration tests failed on attempt ${attempt}; retrying..."
              sleep 15
            fi
          done
          echo "DB integration tests failed after 2 attempts."
          exit 1
        working-directory: server
        env:
          TESTCONTAINERS_RYUK_DISABLED: 'true'

  # ── E2E tests (tmux installed — tests run for real) ──────────────────────

  e2e-tests:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: [unit-tests]
    steps:
      - name: Checkout
        id: checkout_1
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 2
        if: steps.checkout_1.outcome == 'failure'
        shell: bash
        run: |
          echo "::warning::actions/checkout failed on attempt 1; retrying in 15s"
          sleep 15

      - name: Checkout (retry 2)
        id: checkout_2
        if: steps.checkout_1.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 3
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
        shell: bash
        run: |
          echo "::warning::actions/checkout failed on attempt 2; retrying in 30s"
          sleep 30

      - name: Checkout (retry 3)
        id: checkout_3
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 4
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
        shell: bash
        run: |
          echo "::warning::actions/checkout failed on attempt 3; retrying in 60s"
          sleep 60

      - name: Checkout (retry 4)
        id: checkout_4
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
        continue-on-error: true
        uses: actions/checkout@v4

      - name: Wait before checkout retry 5
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure' && steps.checkout_4.outcome == 'failure'
        shell: bash
        run: |
          echo "::warning::actions/checkout failed on attempt 4; retrying in 90s"
          sleep 90

      - name: Checkout (retry 5)
        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure' && steps.checkout_4.outcome == 'failure'
        uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - name: Install tmux
        run: sudo apt-get install -y tmux
      - name: Prime tmux server (ensures socket dir exists)
        run: tmux new-session -d -s init && tmux kill-session -t init
      - run: ./scripts/ci-npm-ci.sh .
      - name: Install web deps (active timeline refresh e2e wrapper invokes web vitest)
        run: ./scripts/ci-npm-ci.sh web
      - name: Run pipe-pane e2e tests
        run: npx vitest run test/e2e/pipe-pane-stream.test.ts
      - name: Run other e2e tests
        run: npm run test:e2e

  # ── Repo provider integration tests (gh/glab against public repos) ────────

  repo-integration-tests:
    name: Repo Provider Integration Tests
    runs-on: ubuntu-latest
    needs: [unit-tests]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - run: ./scripts/ci-npm-ci.sh .
      - name: Install & authenticate glab (optional — tests skip if unavailable)
        continue-on-error: true
        run: |
          curl -fsSL "https://gitlab.com/gitlab-org/cli/-/releases/v1.89.0/downloads/glab_1.89.0_linux_amd64.deb" -o glab.deb
          sudo dpkg -i glab.deb
          if [ -n "$GITLAB_TOKEN" ]; then
            glab auth login --hostname gitlab.com --token "$GITLAB_TOKEN"
          fi
        env:
          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
      - name: Run integration tests
        run: npm run test:integration
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ── Coverage ──────────────────────────────────────────────────────────────

  coverage:
    name: Coverage Report
    runs-on: ubuntu-latest
    needs: [unit-tests, web-tests-unit, web-tests-components]
    env:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      # tmux is no longer needed here: `test:coverage` skips the e2e project
      # (which spawns real tmux + agent processes), saving ~1 min per run.
      #
      # `npm run build` IS still needed: although most tests resolve from
      # `src/` via vitest's tsx transform, two suites assert against the
      # built output and FAIL without `dist/`:
      #   - test/packaging.test.ts             (verifies bin/main/files paths)
      #   - test/util/postinstall-sharp-repair.test.ts (executes dist/.../postinstall-sharp-repair.js)
      # Both run in the `daemon` project, which is included in coverage. They
      # pass in the regular Unit Tests jobs because those run `npm run build`
      # first; coverage must do the same.
      - run: ./scripts/ci-npm-ci.sh .
      - name: Install web deps (needed for tsx component tests)
        run: ./scripts/ci-npm-ci.sh web
      - name: Install server deps (needed for server route tests)
        run: ./scripts/ci-npm-ci.sh server
      - run: npm run build
      - run: npm run test:coverage
      - name: Upload coverage artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: |
            coverage/
            !coverage/tmp/
          if-no-files-found: error
      - name: Upload to Codecov
        if: ${{ env.CODECOV_TOKEN != '' }}
        uses: codecov/codecov-action@v4
        with:
          token: ${{ env.CODECOV_TOKEN }}
          fail_ci_if_error: false
      - name: Skip Codecov upload when token is unavailable
        if: ${{ env.CODECOV_TOKEN == '' }}
        run: echo "Skipping Codecov upload because CODECOV_TOKEN is not configured for this workflow context."
      - name: Comment PR with coverage diff
        if: github.event_name == 'pull_request'
        uses: davelosert/vitest-coverage-report-action@v2

  # ── Publish to npm ────────────────────────────────────────────────────────

  publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    needs: [docker]
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev'
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'
      - name: Remove deprecated always-auth from setup-node npmrc
        run: |
          if [ -n "${NPM_CONFIG_USERCONFIG:-}" ] && [ -f "$NPM_CONFIG_USERCONFIG" ]; then
            sed -i '/^always-auth=/d' "$NPM_CONFIG_USERCONFIG"
          fi
      - run: npm install -g npm@11.11.1
      - run: ./scripts/ci-npm-ci.sh .
      - name: Install web deps
        run: ./scripts/ci-npm-ci.sh web
      - name: Install server deps
        run: ./scripts/ci-npm-ci.sh server
      - name: Set version
        run: npm version ${{ needs.docker.outputs.npm_version }} --no-git-tag-version
      - run: npm run build
      - name: Pack the already-tested release
        run: |
          set -euo pipefail
          VERSION=${{ needs.docker.outputs.npm_version }}
          npm pack --pack-destination "$RUNNER_TEMP"
          test -f "$RUNNER_TEMP/imcodes-${VERSION}.tgz"
      - name: Publish (skip if version already on npm)
        run: |
          set -euo pipefail
          VERSION=${{ needs.docker.outputs.npm_version }}
          PACKAGE_TARBALL="$RUNNER_TEMP/imcodes-${VERSION}.tgz"
          PUBLISH_ARGS=(--access public)
          if [ "${{ github.ref }}" = "refs/heads/dev" ]; then
            PUBLISH_ARGS=(--tag dev "${PUBLISH_ARGS[@]}")
          fi

          if npm view "imcodes@${VERSION}" version >/dev/null 2>&1; then
            echo "::warning::Version ${VERSION} already published — skipping"
            exit 0
          fi

          set +e
          # Docker already depends on daemon/server/web/E2E green jobs. Publish
          # the tarball produced above so npm does not rerun prepublishOnly's
          # entire test matrix on one contended worker. npm pack still ran the
          # load-bearing prepack/postpack artifact transformation.
          npm publish "$PACKAGE_TARBALL" "${PUBLISH_ARGS[@]}" --provenance --ignore-scripts 2>&1 | tee npm-publish.log
          publish_status=${PIPESTATUS[0]}
          set -e

          if [ "${publish_status}" -eq 0 ]; then
            exit 0
          fi

          if npm view "imcodes@${VERSION}" version >/dev/null 2>&1; then
            echo "::warning::Version ${VERSION} was published despite npm publish exiting ${publish_status}; treating as success"
            exit 0
          fi

          if grep -q 'TLOG_CREATE_ENTRY_ERROR' npm-publish.log; then
            echo "::warning::npm provenance transparency-log entry already exists, but ${VERSION} is not published; retrying once without --provenance"
            npm publish "$PACKAGE_TARBALL" "${PUBLISH_ARGS[@]}" --ignore-scripts
            exit 0
          fi

          exit "${publish_status}"

  # ── Controlled-node executables for the production image ─────────────────

  release_version:
    name: Resolve release version
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev'
    runs-on: ubuntu-latest
    outputs:
      app_version: ${{ steps.version.outputs.app_version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Resolve one version for server and all native node artifacts
        id: version
        run: |
          set -euo pipefail
          COMMIT_COUNT=$(( $(git rev-list --count HEAD) + 620 ))
          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
            APP_VERSION="$(date -u +%Y).$(date -u +%-m).${COMMIT_COUNT}-dev.${GITHUB_RUN_NUMBER}"
          else
            APP_VERSION="$(date -u +%Y.%-m).${COMMIT_COUNT}"
          fi
          echo "app_version=${APP_VERSION}" >> "$GITHUB_OUTPUT"

  controlled-node-executables:
    name: Controlled Node Executable (${{ matrix.key }})
    needs: [release_version]
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev'
    runs-on: ${{ matrix.runner }}
    env:
      IMCODES_BUILD_VERSION: ${{ needs.release_version.outputs.app_version }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - key: linux
            runner: ubuntu-latest
            artifact: imcodes-node-linux
          - key: macos
            runner: macos-15
            artifact: imcodes-node-macos
          - key: windows
            # Windows 2025 no longer includes the WDK/Inf2Cat tool required to
            # produce the signed IddCx catalog. Keep the release toolchain on
            # the current GitHub image that publishes WDK 10.1.26100.4202.
            runner: windows-2022
            artifact: imcodes-node.exe
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: 'npm'
      - name: Install dependencies
        shell: bash
        run: ./scripts/ci-npm-ci.sh .
      - name: Verify thin-node dependency boundary
        run: npm run check:node-exe-deps
      - name: Import Windows release-signing certificate
        if: runner.os == 'Windows'
        shell: powershell
        env:
          IMCODES_WINDOWS_SIGNING_PFX_BASE64: ${{ secrets.IMCODES_WINDOWS_SIGNING_PFX_BASE64 }}
          IMCODES_WINDOWS_SIGNING_PFX_PASSWORD: ${{ secrets.IMCODES_WINDOWS_SIGNING_PFX_PASSWORD }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:IMCODES_WINDOWS_SIGNING_PFX_BASE64) -or
              [string]::IsNullOrWhiteSpace($env:IMCODES_WINDOWS_SIGNING_PFX_PASSWORD)) {
            throw 'Windows release-signing secrets are required.'
          }
          $pfxPath = Join-Path $env:RUNNER_TEMP 'imcodes-windows-release-signing.pfx'
          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:IMCODES_WINDOWS_SIGNING_PFX_BASE64))
          $password = ConvertTo-SecureString $env:IMCODES_WINDOWS_SIGNING_PFX_PASSWORD -AsPlainText -Force
          $certificate = Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $password
          if (-not $certificate -or -not $certificate.HasPrivateKey) { throw 'Imported signing certificate has no private key.' }
          Remove-Item -LiteralPath $pfxPath -Force
          $publicCertificatePath = Join-Path $env:RUNNER_TEMP 'imcodes-windows-release-signing.cer'
          Export-Certificate -Cert $certificate -FilePath $publicCertificatePath -Force | Out-Null
          Import-Certificate -FilePath $publicCertificatePath -CertStoreLocation Cert:\LocalMachine\TrustedPeople | Out-Null
          Import-Certificate -FilePath $publicCertificatePath -CertStoreLocation Cert:\LocalMachine\TrustedPublisher | Out-Null
          "IMCODES_WINDOWS_SIGNING_CERT_THUMBPRINT=$($certificate.Thumbprint)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          $sha256 = [System.Security.Cryptography.SHA256]::Create()
          try { $signerSha256 = [BitConverter]::ToString($sha256.ComputeHash($certificate.RawData)).Replace('-', '').ToLowerInvariant() } finally { $sha256.Dispose() }
          "IMCODES_WINDOWS_SIGNING_CERT_SHA256=$signerSha256" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
      - name: Build controlled-node executable
        run: npm run build:node-exe
      - name: Resolve fixed libwebrtc SDK release
        if: runner.os == 'Windows'
        id: libwebrtc_sdk
        run: node scripts/resolve-libwebrtc-sdk-release.mjs --wait-seconds 15000
      - name: Restore fixed libwebrtc foundation SDK
        if: runner.os == 'Windows'
        id: libwebrtc_sdk_cache
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/imcodes-libwebrtc-sdk
          key: imcodes-libwebrtc-foundation-${{ runner.os }}-${{ steps.libwebrtc_sdk.outputs.sha256 }}-v1
      - name: Download fixed libwebrtc foundation SDK
        if: runner.os == 'Windows' && steps.libwebrtc_sdk_cache.outputs.cache-hit != 'true'
        id: libwebrtc_sdk_download
        shell: powershell
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $download = Join-Path $env:RUNNER_TEMP 'imcodes-libwebrtc-sdk-download'
          New-Item -ItemType Directory -Force -Path $download | Out-Null
          gh release download '${{ steps.libwebrtc_sdk.outputs.release_tag }}' `
            --repo '${{ steps.libwebrtc_sdk.outputs.repository }}' `
            --pattern '${{ steps.libwebrtc_sdk.outputs.asset_name }}' `
            --dir $download `
            --clobber
          if ($LASTEXITCODE -ne 0) { throw 'Fixed libwebrtc SDK download failed.' }
          node scripts/install-libwebrtc-sdk.mjs `
            (Join-Path $download '${{ steps.libwebrtc_sdk.outputs.asset_name }}') `
            (Join-Path $env:RUNNER_TEMP 'imcodes-libwebrtc-sdk')
      - name: Verify cached fixed libwebrtc foundation SDK
        if: runner.os == 'Windows'
        run: >-
          node scripts/libwebrtc-sdk-artifacts.mjs verify-sdk-lock
          native/windows-remote-desktop/libwebrtc-sdk.lock.json
          "${{ runner.temp }}\imcodes-libwebrtc-sdk"
      - name: Build and test current remote-desktop sources from SDK
        if: runner.os == 'Windows'
        timeout-minutes: 30
        shell: powershell
        run: |
          $buildArguments = @{
            SdkRoot = "$env:RUNNER_TEMP\imcodes-libwebrtc-sdk"
            ArtifactRoot = 'dist-node-exe\remote-desktop-worker\win32-x64'
            WorkerVersion = $env:IMCODES_BUILD_VERSION
            CodeSigningCertificateThumbprint = $env:IMCODES_WINDOWS_SIGNING_CERT_THUMBPRINT
            ExpectedSignerSha256 = $env:IMCODES_WINDOWS_SIGNING_CERT_SHA256
            CodeSigningTimestampUrl = 'http://timestamp.digicert.com'
            RequireAuthenticodeSignature = $true
            RunNativeTests = $true
          }
          & .\native\windows-remote-desktop\build-worker-from-sdk.ps1 @buildArguments
      - name: Verify production remote-desktop worker artifact
        if: runner.os == 'Windows'
        run: node scripts/remote-desktop-worker-artifacts.mjs verify dist-node-exe "${{ env.IMCODES_BUILD_VERSION }}"
      - name: Verify every Windows release binary uses one publisher
        if: runner.os == 'Windows'
        shell: powershell
        run: |
          $virtualDisplayVerify = Join-Path $env:RUNNER_TEMP 'imcodes-virtual-display-signature-verification'
          Remove-Item -LiteralPath $virtualDisplayVerify -Recurse -Force -ErrorAction SilentlyContinue
          Expand-Archive -LiteralPath 'dist-node-exe\remote-desktop-worker\win32-x64\imcodes-virtual-display.zip' -DestinationPath $virtualDisplayVerify -Force
          $artifacts = @(
            'dist-node-exe\imcodes-node.exe',
            'dist-node-exe\computer-use-helper\win32-x64\open-computer-use.exe',
            'dist-node-exe\remote-desktop-worker\win32-x64\imcodes-remote-desktop-worker.exe',
            (Join-Path $virtualDisplayVerify 'imcodes-virtual-display.dll'),
            (Join-Path $virtualDisplayVerify 'imcodes-virtual-display.cat')
          )
          try {
            foreach ($artifact in $artifacts) {
              & .\scripts\windows-sign-release-artifact.ps1 -Mode Verify -ArtifactPath $artifact -ExpectedSignerSha256 $env:IMCODES_WINDOWS_SIGNING_CERT_SHA256
            }
            node scripts/node-exe-artifacts.mjs verify-set dist-node-exe imcodes-node.exe
          } finally {
            Remove-Item -LiteralPath $virtualDisplayVerify -Recurse -Force -ErrorAction SilentlyContinue
          }
      - name: Qualify signed Windows self-upgrade and rollback
        if: runner.os == 'Windows'
        run: npx tsx scripts/qualify-windows-self-upgrade.ts
      - name: Upload controlled-node executable
        uses: actions/upload-artifact@v4
        with:
          name: controlled-node-${{ matrix.key }}
          path: |
            dist-node-exe/${{ matrix.artifact }}
            dist-node-exe/${{ matrix.artifact }}.manifest.json
            dist-node-exe/computer-use-helper/**
            dist-node-exe/remote-desktop-worker/**
          if-no-files-found: error
          retention-days: 30
      - name: Remove Windows release-signing material
        if: always() && runner.os == 'Windows'
        shell: powershell
        run: |
          $certificatePaths = @()
          if ($env:IMCODES_WINDOWS_SIGNING_CERT_THUMBPRINT) {
            $certificatePaths = @(
              "Cert:\CurrentUser\My\$env:IMCODES_WINDOWS_SIGNING_CERT_THUMBPRINT",
              "Cert:\LocalMachine\TrustedPeople\$env:IMCODES_WINDOWS_SIGNING_CERT_THUMBPRINT",
              "Cert:\LocalMachine\TrustedPublisher\$env:IMCODES_WINDOWS_SIGNING_CERT_THUMBPRINT"
            )
            $certificatePaths | ForEach-Object { Remove-Item -LiteralPath $_ -Force -ErrorAction SilentlyContinue }
          }
          $materialPaths = @(
            (Join-Path $env:RUNNER_TEMP 'imcodes-windows-release-signing.pfx'),
            (Join-Path $env:RUNNER_TEMP 'imcodes-windows-release-signing.cer')
          )
          $materialPaths | ForEach-Object { Remove-Item -LiteralPath $_ -Force -ErrorAction SilentlyContinue }
          $leftovers = @(($certificatePaths + $materialPaths) | Where-Object { Test-Path -LiteralPath $_ })
          if ($leftovers.Count -gt 0) { throw 'Windows release-signing material cleanup was incomplete.' }

  # ── Build & push Docker image ─────────────────────────────────────────────

  docker:
    name: Docker Build & Push
    runs-on: ubuntu-latest
    needs: [lint, typecheck, secret-scan, unit-tests, macos-unit-tests, windows-unit-tests, windows-conpty-tests, web-tests-unit, web-tests-components, web-chat-perf, server-tests, server-db-tests, e2e-tests, release_version, controlled-node-executables]
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev'
    outputs:
      npm_version: ${{ needs.release_version.outputs.app_version }}
    permissions:
      contents: write
      packages: write
    env:
      IMAGE: ghcr.io/im4codes/imcodes
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # full history needed for git rev-list --count

      - name: Download controlled-node executables
        uses: actions/download-artifact@v4
        with:
          pattern: controlled-node-*
          path: server/controlled-node-artifacts
          merge-multiple: true

      - name: Verify controlled-node executable set
        env:
          IMCODES_BUILD_VERSION: ${{ needs.release_version.outputs.app_version }}
        run: >-
          node scripts/node-exe-artifacts.mjs verify-set server/controlled-node-artifacts
          imcodes-node-linux imcodes-node-macos imcodes-node.exe

      - name: Verify remote-desktop worker artifact
        env:
          IMCODES_BUILD_VERSION: ${{ needs.release_version.outputs.app_version }}
        run: >-
          node scripts/remote-desktop-worker-artifacts.mjs verify
          server/controlled-node-artifacts "$IMCODES_BUILD_VERSION"

      - name: Get build timestamp
        id: ts
        run: echo "value=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve tags
        id: tags
        run: |
          set -euo pipefail
          DATE_TAG="v$(date -u +%Y.%-m.%-d)"
          SHA_SHORT="${GITHUB_SHA::7}"
          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
            TAGS="${IMAGE}:dev"
            TAGS="${TAGS},${IMAGE}:dev-${DATE_TAG#v}"
            TAGS="${TAGS},${IMAGE}:dev-${DATE_TAG#v}-${SHA_SHORT}"
            TAGS="${TAGS},${IMAGE}:dev-sha-${SHA_SHORT}"
          else
            TAGS="${IMAGE}:latest"
            TAGS="${TAGS},${IMAGE}:${DATE_TAG}"
            TAGS="${TAGS},${IMAGE}:${DATE_TAG}-${SHA_SHORT}"
            TAGS="${TAGS},${IMAGE}:sha-${SHA_SHORT}"
          fi
          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
          echo "date_tag=${DATE_TAG}" >> "$GITHUB_OUTPUT"

      - name: Get OTA version (commit count) and app version (semver)
        id: ota
        run: |
          COMMIT_COUNT=$(( $(git rev-list --count HEAD) + 620 ))
          echo "version=${COMMIT_COUNT}" >> "$GITHUB_OUTPUT"
          echo "app_version=$(date -u +%Y.%-m).${COMMIT_COUNT}" >> "$GITHUB_OUTPUT"

      # Build the image into the local docker daemon first so we can smoke-test
      # it BEFORE pushing. Without this step, an image whose Node process
      # crashes on startup (e.g. ERR_MODULE_NOT_FOUND from a missing prod dep)
      # would still get pushed and auto-deployed to production.
      - name: Build (load to local docker for smoke test)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: server/Dockerfile
          platforms: linux/amd64
          tags: imcodes-smoke:test
          build-args: |
            BUILD_TIME=${{ steps.ts.outputs.value }}
            OTA_VERSION=${{ steps.ota.outputs.version }}
            APP_VERSION=${{ needs.release_version.outputs.app_version }}
            IMCODES_EMBEDDING_PRELOAD_SOFT_FAIL=1
          cache-from: type=gha
          cache-to: type=gha,mode=max
          load: true
          push: false

      - name: Container startup smoke test
        run: |
          set -euo pipefail
          # Override entrypoint to run an import-only check inside the actual
          # production image. index.ts has an isMain guard so the import
          # resolves all static deps (including all routes/* modules) without
          # binding ports or hitting the database. Any ERR_MODULE_NOT_FOUND or
          # other top-level eval failure surfaces here, before the image ships.
          docker run --rm --entrypoint node imcodes-smoke:test \
            -e "import('./dist/server/src/index.js').then(() => { console.log('OK: image loads cleanly'); process.exit(0); }).catch(e => { console.error('FAIL:', e.message); console.error(e.stack); process.exit(1); })"
          docker run --rm --entrypoint node imcodes-smoke:test \
            scripts/node-exe-artifacts.mjs verify-set /app/controlled-node-executables \
            imcodes-node-linux imcodes-node-macos imcodes-node.exe
          docker run --rm --entrypoint node imcodes-smoke:test \
            scripts/remote-desktop-worker-artifacts.mjs verify \
            /app/controlled-node-executables "${{ needs.release_version.outputs.app_version }}"

      - name: Build and push (cache hit — only pushes layers)
        id: build_push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: server/Dockerfile
          platforms: linux/amd64
          tags: ${{ steps.tags.outputs.tags }}
          build-args: |
            BUILD_TIME=${{ steps.ts.outputs.value }}
            OTA_VERSION=${{ steps.ota.outputs.version }}
            APP_VERSION=${{ needs.release_version.outputs.app_version }}
            IMCODES_EMBEDDING_PRELOAD_SOFT_FAIL=1
          cache-from: type=gha
          cache-to: type=gha,mode=max
          push: true

      - name: Write immutable release metadata
        env:
          COMMIT_SHA: ${{ github.sha }}
          IMAGE_REPOSITORY: ${{ env.IMAGE }}
          IMAGE_DIGEST: ${{ steps.build_push.outputs.digest }}
        run: |
          set -euo pipefail
          [[ "$COMMIT_SHA" =~ ^[0-9a-f]{40}$ ]]
          [[ "$IMAGE_REPOSITORY" == ghcr.io/*/* ]]
          [[ "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
          mkdir -p release-metadata
          printf 'COMMIT_SHA=%s\nIMAGE_REPOSITORY=%s\nIMAGE_DIGEST=%s\n' \
            "$COMMIT_SHA" "$IMAGE_REPOSITORY" "$IMAGE_DIGEST" \
            > release-metadata/release.env

      - name: Upload immutable release metadata
        uses: actions/upload-artifact@v4
        with:
          name: release-metadata
          path: release-metadata/release.env
          if-no-files-found: error
          retention-days: 30

      - name: Create git tag
        id: git_tag
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git fetch --tags
          NPM_VERSION="${{ needs.release_version.outputs.app_version }}"
          GIT_TAG="v${NPM_VERSION}"
          # Skip if this exact tag already exists (idempotent)
          if ! git rev-parse "$GIT_TAG" >/dev/null 2>&1; then
            git tag "$GIT_TAG"
            git push origin "$GIT_TAG"
          fi

  # ── Android APK Build ────────────────────────────────────────────────────

  android-release:
    name: Android Release Build
    runs-on: ubuntu-latest
    needs: [lint, typecheck, secret-scan, unit-tests, web-tests-unit, web-tests-components, server-tests, e2e-tests]
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev'
    permissions:
      contents: write
    env:
      KEYSTORE_FILE: ${{ github.workspace }}/web/android/app/release.keystore
      KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
      KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
      KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION_PRIMARY }}
          cache: npm
          cache-dependency-path: |
            package-lock.json
            web/package-lock.json

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - uses: android-actions/setup-android@v3
        with:
          # The action defaults to "tools platform-tools"; the legacy "tools"
          # package now resolves to the deprecated sdk-tools archive and can
          # fail before our explicit modern SDK install step below runs.
          packages: ''

      - name: Install Android SDK packages
        run: |
          yes | sdkmanager --licenses
          sdkmanager "platforms;android-36" "build-tools;36.0.0" "platform-tools"

      - name: Warm Gradle wrapper distribution
        shell: bash
        run: |
          set -euo pipefail
          for attempt in 1 2 3; do
            if (cd web/android && ./gradlew --version --no-daemon); then
              exit 0
            fi
            if [ "$attempt" -lt 3 ]; then
              echo "Gradle wrapper download failed on attempt ${attempt}; retrying..."
              sleep $((attempt * 10))
            fi
          done
          echo "Gradle wrapper download failed after 3 attempts."
          exit 1

      - run: ./scripts/ci-npm-ci.sh .

      - run: npm ci
        working-directory: web

      - name: Restore optional Android secrets
        shell: bash
        run: |
          set -euo pipefail
          if [ -n "${GOOGLE_SERVICES_JSON_BASE64:-}" ]; then
            printf '%s' "$GOOGLE_SERVICES_JSON_BASE64" | base64 --decode > web/android/app/google-services.json
            echo "Decoded google-services.json from secret."
          else
            echo "GOOGLE_SERVICES_JSON_BASE64 not set; Firebase push notifications will remain disabled in this build."
          fi

          if [ -n "${ANDROID_KEYSTORE_BASE64:-}" ]; then
            printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > web/android/app/release.keystore
            echo "Decoded Android keystore from secret."
          else
            echo "ANDROID_KEYSTORE_BASE64 not set; assembleRelease will build without production signing."
          fi
        env:
          GOOGLE_SERVICES_JSON_BASE64: ${{ secrets.GOOGLE_SERVICES_JSON_BASE64 }}
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}

      - name: Write JPush key into web/android/local.properties (china flavor only)
        shell: bash
        run: |
          set -euo pipefail
          if [ -n "${JPUSH_APP_KEY:-}" ]; then
            : > web/android/local.properties
            {
              echo "JPUSH_APP_KEY=${JPUSH_APP_KEY}"
              [ -n "${XIAOMI_APPID:-}" ]  && echo "XIAOMI_APPID=${XIAOMI_APPID}"
              [ -n "${XIAOMI_APPKEY:-}" ] && echo "XIAOMI_APPKEY=${XIAOMI_APPKEY}"
              [ -n "${VIVO_APPID:-}" ]    && echo "VIVO_APPID=${VIVO_APPID}"
              [ -n "${VIVO_APPKEY:-}" ]   && echo "VIVO_APPKEY=${VIVO_APPKEY}"
            } >> web/android/local.properties
            echo "Wrote JPush + vendor keys to local.properties (china flavor will pick them up)."
          else
            echo "JPUSH_APP_KEY not set; china flavor will build but the JPush SDK will refuse to init at runtime."
          fi
        env:
          JPUSH_APP_KEY:  ${{ secrets.JPUSH_APP_KEY }}
          XIAOMI_APPID:   ${{ secrets.XIAOMI_APPID }}
          XIAOMI_APPKEY:  ${{ secrets.XIAOMI_APPKEY }}
          VIVO_APPID:     ${{ secrets.VIVO_APPID }}
          VIVO_APPKEY:    ${{ secrets.VIVO_APPKEY }}

      # The web bundle differs per flavor (compile-time VITE_REGION picks the
      # push transport: FCM vs JPush). We therefore build web → cap sync →
      # gradle assemble for each flavor in turn, rather than relying on
      # gradle's default `assembleRelease` task that walks all flavors with a
      # single set of web assets.

      - name: Build web (global flavor) + sync + assemble globalRelease
        working-directory: web
        run: |
          npm run build:global
          npx cap sync android
          (cd android && ./gradlew assembleGlobalRelease bundleGlobalRelease --stacktrace)

      - name: Build web (china flavor) + sync + assemble chinaRelease
        working-directory: web
        run: |
          npm run build:china
          npx cap sync android
          (cd android && ./gradlew assembleChinaRelease bundleChinaRelease --stacktrace)

      - name: Get version info
        id: version
        run: |
          VERSION=$(grep versionName web/android/app/build.gradle | head -1 | sed 's/.*"\(.*\)".*/\1/')
          COMMIT_SHORT=$(git rev-parse --short HEAD)
          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
            echo "tag=android-dev-v${VERSION}-${COMMIT_SHORT}" >> "$GITHUB_OUTPUT"
            echo "name=Android Dev v${VERSION} (${COMMIT_SHORT})" >> "$GITHUB_OUTPUT"
          else
            echo "tag=android-v${VERSION}-${COMMIT_SHORT}" >> "$GITHUB_OUTPUT"
            echo "name=Android v${VERSION} (${COMMIT_SHORT})" >> "$GITHUB_OUTPUT"
          fi

      - name: Rename artifacts with version + flavor
        run: |
          set -euo pipefail
          GLOBAL_APK=$(ls web/android/app/build/outputs/apk/global/release/*.apk | head -1)
          CHINA_APK=$(ls  web/android/app/build/outputs/apk/china/release/*.apk  | head -1)
          GLOBAL_AAB=$(ls web/android/app/build/outputs/bundle/globalRelease/*.aab | head -1)
          CHINA_AAB=$(ls  web/android/app/build/outputs/bundle/chinaRelease/*.aab  | head -1)
          cp "$GLOBAL_APK" "imcodes-global-${{ steps.version.outputs.tag }}.apk"
          cp "$CHINA_APK"  "imcodes-china-${{ steps.version.outputs.tag }}.apk"
          cp "$GLOBAL_AAB" "imcodes-global-${{ steps.version.outputs.tag }}.aab"
          cp "$CHINA_AAB"  "imcodes-china-${{ steps.version.outputs.tag }}.aab"

      - name: Upload release APK artifacts
        uses: actions/upload-artifact@v4
        with:
          name: imcodes-android-release-apk
          path: imcodes-*-${{ steps.version.outputs.tag }}.apk
          if-no-files-found: error

      - name: Upload release AAB artifacts
        uses: actions/upload-artifact@v4
        with:
          name: imcodes-android-release-aab
          path: imcodes-*-${{ steps.version.outputs.tag }}.aab
          if-no-files-found: error

      - name: Create GitHub Release
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: ${{ steps.version.outputs.name }}
          body: |
            ## Android — Pick the edition that matches your region

            - **`imcodes-global-*.apk`** — **International edition**. Push notifications via Firebase FCM (Google Play Services required). Use this everywhere outside Mainland China.
            - **`imcodes-china-*.apk`** — **Mainland China edition**. Push notifications via 极光推送 JPush, which fans out to the on-device vendor channels (Huawei / Xiaomi / OPPO / vivo / Honor) so they work without Google Play Services.

            Both APKs share the same applicationId (`com.im.codes`) and cannot coexist on a single device — install only one.
          files: |
            imcodes-*-${{ steps.version.outputs.tag }}.apk
            imcodes-*-${{ steps.version.outputs.tag }}.aab
          generate_release_notes: true
          prerelease: ${{ github.ref == 'refs/heads/dev' }}
          make_latest: ${{ github.ref == 'refs/heads/master' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}