release.yml

name: Release app builds

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing version tag to publish
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-${{ github.event.inputs.tag || github.ref_name }}
  cancel-in-progress: false

env:
  RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}

jobs:
  verify:
    if: ${{ github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    outputs:
      source_sha: ${{ steps.source.outputs.source_sha }}
      version: ${{ steps.source.outputs.version }}
    steps:
      - name: Check out trusted release-control source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve immutable release source
        id: source
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          TRUSTED_CONTROL_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          git fetch --force --no-tags origin "refs/heads/main:refs/remotes/origin/main"
          git fetch --force origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
          source_sha=$(git rev-parse "${RELEASE_TAG}^{commit}")
          tag_version=$(git show "${source_sha}:package.json" | jq -er '.version')
          expected_tag="v${tag_version}"
          if [[ "$RELEASE_TAG" != "$expected_tag" ]]; then
            echo "release tag ${RELEASE_TAG} does not match its package version ${expected_tag}" >&2
            exit 1
          fi
          if ! git merge-base --is-ancestor "$source_sha" refs/remotes/origin/main; then
            echo "release tag source is not reachable from main" >&2
            exit 1
          fi
          if [[ "$EVENT_NAME" == "workflow_dispatch" && "$TRUSTED_CONTROL_SHA" != "$(git rev-parse HEAD)" ]]; then
            echo "manual releases must run from the checked-out main commit" >&2
            exit 1
          fi
          if [[ "$EVENT_NAME" == "push" && "$TRUSTED_CONTROL_SHA" != "$source_sha" ]]; then
            echo "pushed release tag no longer resolves to the triggering commit" >&2
            exit 1
          fi
          printf 'source_sha=%s\nversion=%s\n' "$source_sha" "$tag_version" >> "$GITHUB_OUTPUT"

      - name: Check out immutable release source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ steps.source.outputs.source_sha }}
          path: .release-source
          persist-credentials: false

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1

      - name: Verify tag, packages, clients, docs, and downloads agree
        run: node scripts/check-release-consistency.mjs --tag "$RELEASE_TAG" --repo-root .release-source

  ci-authority:
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 50
    permissions:
      actions: read
      contents: read
    steps:
      - name: Check out trusted CI-authority source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          # Manual repair must use current trusted release-control code even
          # when the immutable artifact source predates the CI waiter.
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1

      - name: Require successful exact-SHA main CI
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_SHA: ${{ needs.verify.outputs.source_sha }}
        run: >-
          node scripts/wait-for-exact-ci.mjs
          --commit "$SOURCE_SHA"
          --timeout-ms 2700000
          --interval-ms 5000

  build-linux:
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    steps:
      - name: Check out verified release source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.verify.outputs.source_sha }}
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Bun for the T4 host binary
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build Linux packages
        run: pnpm package:linux

      - name: Inspect Linux packages
        run: pnpm inspect:package -- release/*.deb release/*.AppImage

      - name: Inspect Linux updater metadata
        env:
          VERSION: ${{ needs.verify.outputs.version }}
        run: >-
          node scripts/inspect-linux-update.mjs
          --version "$VERSION"
          --metadata release/latest-linux.yml
          --artifact "release/T4-Code-${VERSION}-linux-amd64.deb"
          --artifact "release/T4-Code-${VERSION}-linux-x86_64.AppImage"

      - name: Stage Linux artifacts
        shell: bash
        run: |
          mkdir -p artifacts
          cp release/T4-Code-*.deb release/T4-Code-*.AppImage release/latest-linux.yml artifacts/
          (cd artifacts && sha256sum T4-Code-* > SHA256SUMS-linux.txt)
          (cd artifacts && sha256sum latest-linux.yml >> SHA256SUMS-linux.txt)

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: linux-release
          path: artifacts/*
          if-no-files-found: error
          retention-days: 7

  build-android:
    needs: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    steps:
      - name: Check out verified release source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.verify.outputs.source_sha }}
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Java
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: temurin
          java-version: "21"
          cache: gradle

      - name: Install Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3

      - name: Install pinned Android platform and build tools
        run: sdkmanager --install "platforms;android-36" "build-tools;36.0.0"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build web application for Android
        run: pnpm build:web

      - name: Verify unsigned Android application
        run: pnpm --filter @t4-code/mobile check:android:debug

      - name: Restore and validate Android release signing key
        shell: bash
        env:
          T4_ANDROID_KEYSTORE_BASE64: ${{ secrets.T4_ANDROID_KEYSTORE_BASE64 }}
          T4_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.T4_ANDROID_KEYSTORE_PASSWORD }}
          T4_ANDROID_KEY_ALIAS: ${{ secrets.T4_ANDROID_KEY_ALIAS }}
          T4_ANDROID_KEY_PASSWORD: ${{ secrets.T4_ANDROID_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          for name in \
            T4_ANDROID_KEYSTORE_BASE64 \
            T4_ANDROID_KEYSTORE_PASSWORD \
            T4_ANDROID_KEY_ALIAS \
            T4_ANDROID_KEY_PASSWORD
          do
            if [[ -z "${!name:-}" ]]; then
              echo "required GitHub Actions secret ${name} is not configured" >&2
              exit 1
            fi
          done
          keystore_path="$RUNNER_TEMP/t4-code-release.jks"
          printf '%s' "$T4_ANDROID_KEYSTORE_BASE64" | base64 --decode > "$keystore_path"
          chmod 600 "$keystore_path"
          keytool -list \
            -keystore "$keystore_path" \
            -storepass "$T4_ANDROID_KEYSTORE_PASSWORD" \
            -alias "$T4_ANDROID_KEY_ALIAS" >/dev/null

      - name: Build signed Android APK
        env:
          T4_ANDROID_KEYSTORE_PATH: ${{ runner.temp }}/t4-code-release.jks
          T4_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.T4_ANDROID_KEYSTORE_PASSWORD }}
          T4_ANDROID_KEY_ALIAS: ${{ secrets.T4_ANDROID_KEY_ALIAS }}
          T4_ANDROID_KEY_PASSWORD: ${{ secrets.T4_ANDROID_KEY_PASSWORD }}
        run: |
          pnpm --filter @t4-code/mobile build:android:release

      - name: Inspect signed Android APK
        shell: bash
        run: |
          set -euo pipefail
          apk="apps/mobile/android/app/build/outputs/apk/release/app-release.apk"
          metadata="apps/mobile/android/app/build/outputs/apk/release/output-metadata.json"
          build_tools="${ANDROID_SDK_ROOT:-$ANDROID_HOME}/build-tools/36.0.0"
          node scripts/inspect-android-release.mjs \
            --apk "$apk" \
            --metadata "$metadata" \
            --aapt "$build_tools/aapt" \
            --apksigner "$build_tools/apksigner"

      - name: Stage Android artifact
        shell: bash
        env:
          VERSION: ${{ needs.verify.outputs.version }}
        run: |
          mkdir -p artifacts
          cp \
            apps/mobile/android/app/build/outputs/apk/release/app-release.apk \
            "artifacts/T4-Code-${VERSION}-android.apk"
          (cd artifacts && sha256sum T4-Code-* > SHA256SUMS-android.txt)

      - name: Upload Android artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: android-release
          path: artifacts/*
          if-no-files-found: error
          retention-days: 7

  build-macos:
    needs: verify
    runs-on: macos-15
    timeout-minutes: 40
    steps:
      - name: Check out verified release source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.verify.outputs.source_sha }}
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: 11.10.0

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1
          cache: pnpm

      - name: Install Bun for the T4 host binary
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Restore notarization API key
        shell: bash
        env:
          T4_APPLE_API_KEY_BASE64: ${{ secrets.T4_APPLE_API_KEY_BASE64 }}
        run: |
          set -euo pipefail
          if [[ -z "${T4_APPLE_API_KEY_BASE64:-}" ]]; then
            echo "required GitHub Actions secret T4_APPLE_API_KEY_BASE64 is not configured" >&2
            exit 1
          fi
          key_path="$RUNNER_TEMP/AuthKey.p8"
          printf '%s' "$T4_APPLE_API_KEY_BASE64" | openssl base64 -d -A -out "$key_path"
          chmod 600 "$key_path"

      - name: Build signed and notarized macOS packages
        env:
          CSC_LINK: ${{ secrets.T4_MACOS_CERTIFICATE_BASE64 }}
          CSC_KEY_PASSWORD: ${{ secrets.T4_MACOS_CERTIFICATE_PASSWORD }}
          APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
          APPLE_API_KEY_ID: ${{ secrets.T4_APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.T4_APPLE_API_ISSUER_ID }}
          APPLE_TEAM_ID: ${{ secrets.T4_APPLE_TEAM_ID }}
        run: pnpm package:mac

      - name: Inspect macOS packages
        run: |
          pnpm inspect:package -- release/*.zip
          pnpm inspect:dmg -- release/*.dmg

      - name: Verify Developer ID identity and notarization
        env:
          VERSION: ${{ needs.verify.outputs.version }}
        run: >-
          node scripts/inspect-macos-release.mjs
          "release/T4-Code-${VERSION}-mac-arm64.zip"
          "release/T4-Code-${VERSION}-mac-arm64.dmg"
          .github/macos-release-identity.json

      - name: Stage macOS artifacts
        shell: bash
        run: |
          mkdir -p artifacts
          cp release/T4-Code-*.dmg release/T4-Code-*.zip artifacts/
          (cd artifacts && shasum -a 256 T4-Code-* > SHA256SUMS-macos.txt)

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: macos-release
          path: artifacts/*
          if-no-files-found: error
          retention-days: 7

  publish:
    needs: [verify, ci-authority, build-android, build-linux, build-macos]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Check out trusted publication-control source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: Check out verified release content
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ needs.verify.outputs.source_sha }}
          path: .release-source
          fetch-depth: 0
          persist-credentials: false

      - name: Confirm the release tag still resolves to the verified source
        shell: bash
        working-directory: .release-source
        env:
          SOURCE_SHA: ${{ needs.verify.outputs.source_sha }}
        run: |
          set -euo pipefail
          git fetch --force origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
          test "$(git rev-parse "${RELEASE_TAG}^{commit}")" = "$SOURCE_SHA"

      - name: Download built artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: "*-release"
          path: artifacts
          merge-multiple: true

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1

      - name: Assemble checksums
        shell: bash
        run: cat artifacts/SHA256SUMS-android.txt artifacts/SHA256SUMS-linux.txt artifacts/SHA256SUMS-macos.txt | sort -k2 > artifacts/SHA256SUMS.txt

      - name: Verify exact public release bundle
        shell: bash
        env:
          VERSION: ${{ needs.verify.outputs.version }}
        run: |
          set -euo pipefail
          expected=$(printf '%s\n' \
            "SHA256SUMS.txt" \
            "T4-Code-${VERSION}-android.apk" \
            "T4-Code-${VERSION}-linux-amd64.deb" \
            "T4-Code-${VERSION}-linux-x86_64.AppImage" \
            "T4-Code-${VERSION}-mac-arm64.dmg" \
            "T4-Code-${VERSION}-mac-arm64.zip" \
            "latest-linux.yml" | sort)
          actual=$(find artifacts -maxdepth 1 -type f ! -name 'SHA256SUMS-*.txt' -printf '%f\n' | sort)
          [[ "$actual" == "$expected" ]]
          [[ $(wc -l < artifacts/SHA256SUMS.txt) == 6 ]]
          (cd artifacts && sha256sum --check SHA256SUMS.txt)

      - name: Preserve an exact release or prepare an incomplete release for repair
        id: release-assets
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.verify.outputs.version }}
        run: node scripts/reconcile-release-assets.mjs --mode prepare --version "$VERSION"

      - name: Publish GitHub release
        if: steps.release-assets.outputs.publish_required == 'true'
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          generate_release_notes: true
          fail_on_unmatched_files: true
          body_path: .release-source/docs/CURRENT_RELEASE_NOTES.md
          files: |
            artifacts/T4-Code-*.apk
            artifacts/T4-Code-*.deb
            artifacts/T4-Code-*.AppImage
            artifacts/T4-Code-*.dmg
            artifacts/T4-Code-*.zip
            artifacts/latest-linux.yml
            artifacts/SHA256SUMS.txt

      - name: Verify the exact remote release bundle
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.verify.outputs.version }}
        run: node scripts/reconcile-release-assets.mjs --mode verify --version "$VERSION"

  dispatch-site:
    name: Deploy and verify the production site after release publication
    needs: [verify, publish]
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      actions: write
      contents: read
    steps:
      - name: Check out trusted release-control source for site dispatch
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24.13.1

      - name: Resolve trusted site-control source
        id: site-control
        shell: bash
        run: |
          set -euo pipefail
          git fetch --force --no-tags origin "refs/heads/main:refs/remotes/origin/main"
          control_sha=$(git rev-parse refs/remotes/origin/main)
          if [[ ! "$control_sha" =~ ^[0-9a-f]{40}$ ]]; then
            echo "main must resolve to an immutable commit SHA" >&2
            exit 1
          fi
          printf 'control_sha=%s\n' "$control_sha" >> "$GITHUB_OUTPUT"

      - name: Dispatch and await the exact immutable production deployment
        env:
          CONTROL_SHA: ${{ steps.site-control.outputs.control_sha }}
          GH_TOKEN: ${{ github.token }}
          SOURCE_SHA: ${{ needs.verify.outputs.source_sha }}
        run: >-
          node scripts/dispatch-site-deployment.mjs
          --tag "$RELEASE_TAG"
          --commit "$SOURCE_SHA"
          --control-commit "$CONTROL_SHA"