publish-native-android.yml

name: Publish tested native Android build

on:
  workflow_dispatch:
    inputs:
      source_run:
        description: Successful native Android candidate run to release
        required: true
        type: string

permissions:
  actions: read
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      GH_TOKEN: ${{ github.token }}
      SOURCE_RUN: ${{ inputs.source_run }}
      OPENCODE_VERSION: "2.2.5"
      RELEASE_TAG: "v2.2.5-bun144.1"
      ASSET: "opencode-2.2.5-android-aarch64-source-bun144-sourcegraph"
    steps:
      - name: Fetch release workflow commit without broken submodules
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/$GITHUB_REPOSITORY.git"
          git fetch --depth=20 origin "$GITHUB_SHA"
          git checkout --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"

      - name: Confirm tested build provenance
        run: |
          set -euo pipefail
          case "$SOURCE_RUN" in ''|*[!0-9]*) echo 'source_run must be a numeric Actions run ID' >&2; exit 1 ;; esac
          META="$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$SOURCE_RUN")"
          test "$(jq -r .conclusion <<<"$META")" = success
          test "$(jq -r .name <<<"$META")" = 'Build locked OpenCode v2 for native Android'
          test "$(jq -r .event <<<"$META")" = workflow_dispatch
          SOURCE_SHA="$(jq -r .head_sha <<<"$META")"
          test "${#SOURCE_SHA}" -eq 40
          git merge-base --is-ancestor "$SOURCE_SHA" HEAD
          git diff --quiet "$SOURCE_SHA" HEAD -- \
            .github/workflows/build-native-android.yml \
            scripts/ci/build-opencode-source-bun144-sourcegraph.sh \
            tools/transplant \
            tools/patch-opencode-source-bun140.py \
            tools/patch-opencode-config-guards.py \
            tools/patch-opentui-0.6.6.py \
            tools/patch-opentui-0.8.0.py \
            tools/remap-binary-prefix.py \
            tools/supply-chain-lock.json \
            patches/opentui

      - name: Download and verify the successful CI artifact
        run: |
          set -euo pipefail
          mkdir dist
          gh run download "$SOURCE_RUN" --repo "$GITHUB_REPOSITORY" \
            --name "opencode-$OPENCODE_VERSION-android-aarch64-source-bun144-sourcegraph-candidate" --dir dist
          (cd dist && sha256sum -c SHA256SUMS)
          test "$(awk -v name="$ASSET" '$2 == name && length($1) == 64 { count++ } END { print count+0 }' dist/SHA256SUMS)" -eq 1
          file "dist/$ASSET" | grep -q 'ARM aarch64'
          grep -aFq "raw/$RELEASE_TAG/install.sh" "dist/$ASSET"
          python3 - <<'PY'
          import json
          from pathlib import Path

          version = "2.2.5"
          variant = json.loads(Path("dist/build-variant.json").read_text())
          lock = json.loads(Path("dist/supply-chain-lock.json").read_text())
          report = json.loads(Path("dist/transplant-report.json").read_text())
          assert variant["candidate"] == "runtime-test", variant
          assert variant["opencode_version"] == version, variant
          assert variant["android_runtime"] == "1.4.4 aarch64 Bionic", variant
          assert variant["bytecode"] is False, variant
          assert variant["termux_release_tag"] == "v2.2.5-bun144.1", variant
          assert variant["opencode_commit"] == lock["opencode"][version]["commit"], variant
          assert report["ver"] == version, report
          assert report["prediction"]["verdict"] == "OK", report
          assert report["prediction"]["base"] == "1.4.4", report
          assert report["steps"]["detect"]["module_count"] == 669, report
          assert report["steps"]["revive"]["status"] == "ok", report
          assert report["steps"]["swap"]["status"] == "ok", report
          assert report["steps"]["tui_probe"]["verdict"] == "skipped(no-aarch64)", report
          PY

      - name: Make bandwidth-saving archive
        run: |
          set -euo pipefail
          tar -C dist -czf "dist/$ASSET.tar.gz" "$ASSET"
          (cd dist && sha256sum "$ASSET.tar.gz" >> SHA256SUMS)

      - name: Install hash-pinned cosign
        run: |
          set -euo pipefail
          readarray -t cosign < <(python3 - <<'PY'
          import json

          lock = json.load(open("tools/supply-chain-lock.json", encoding="utf-8"))
          version, pin = next(iter(lock["cosign"].items()))
          print(version)
          print(pin["linux_amd64_sha256"])
          PY
          )
          cosign_version="${cosign[0]}"
          cosign_sha256="${cosign[1]}"
          mkdir -p "$RUNNER_TEMP/cosign-bin"
          curl -fsSL --retry 3 \
            -o "$RUNNER_TEMP/cosign-bin/cosign" \
            "https://github.com/sigstore/cosign/releases/download/v$cosign_version/cosign-linux-amd64"
          printf '%s  %s\n' "$cosign_sha256" "$RUNNER_TEMP/cosign-bin/cosign" | sha256sum -c -
          chmod 755 "$RUNNER_TEMP/cosign-bin/cosign"
          echo "$RUNNER_TEMP/cosign-bin" >> "$GITHUB_PATH"

      - name: Sign release artifacts with cosign keyless
        run: |
          set -euo pipefail
          cosign version
          cosign sign-blob --yes --oidc-provider github-actions \
            --bundle "dist/SHA256SUMS.cosign.bundle" \
            dist/SHA256SUMS
          cosign sign-blob --yes --oidc-provider github-actions \
            --bundle "dist/$ASSET.tar.gz.cosign.bundle" \
            "dist/$ASSET.tar.gz"

      - name: Publish release from CI
        run: |
          set -euo pipefail
          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $RELEASE_TAG already exists; refusing to overwrite it" >&2
            exit 1
          fi
          gh release create "$RELEASE_TAG" \
            "dist/$ASSET.tar.gz" "dist/$ASSET.tar.gz.cosign.bundle" \
            dist/SHA256SUMS dist/SHA256SUMS.cosign.bundle \
            dist/supply-chain-lock.json \
            dist/transplant-report.json dist/build-variant.json \
            --repo "$GITHUB_REPOSITORY" \
            --target "$GITHUB_SHA" \
            --title 'OpenCode 2.2.5 native Termux (Bun 1.4.4)' \
            --notes-file RELEASE_NOTES.md \
            --latest

      - name: Mark previous releases as rollback builds
        run: |
          set -euo pipefail
          for tag in v2.2.2-bun144.1 v2.2.0-bun144.1 v2.1.4-bun144.2 v2.1.3-bun144.1 v2.1.3; do
            gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json body --jq .body \
              > "dist/$tag-original-notes.md"
            case "$tag" in
              v2.2.2-bun144.1)
                version='2.2.2'
                title='OpenCode 2.2.2 native Termux (Bun 1.4.4 rollback)'
                runtime='Bun 1.4.4'
                ;;
              v2.2.0-bun144.1)
                version='2.2.0'
                title='OpenCode 2.2.0 native Termux (Bun 1.4.4 rollback)'
                runtime='Bun 1.4.4'
                ;;
              v2.1.4-bun144.2)
                version='2.1.4'
                title='OpenCode 2.1.4 native Termux (Bun 1.4.4 rollback)'
                runtime='Bun 1.4.4'
                ;;
              v2.1.3-bun144.1)
                version='2.1.3'
                title='OpenCode 2.1.3 native Termux (Bun 1.4.4 rollback)'
                runtime='Bun 1.4.4'
                ;;
              v2.1.3)
                version='2.1.3'
                title='OpenCode 2.1.3 native Termux (Bun 1.4.0 rollback)'
                runtime='Bun 1.4.0'
                ;;
            esac
            {
              cat <<EOF
          > **Rollback build:** This OpenCode $version $runtime release is retained for rollback from [OpenCode 2.2.5](https://github.com/murafdev/opencode-termux/releases/tag/v2.2.5-bun144.1).
          > Reinstall it in Termux with \`curl -fsSL https://github.com/murafdev/opencode-termux/raw/$tag/install.sh | sh\`.

          ---

          EOF
              cat "dist/$tag-original-notes.md"
            } > "dist/$tag-rollback-notes.md"
            gh release edit "$tag" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$title" \
              --notes-file "dist/$tag-rollback-notes.md"
          done