publish.yml

name: publish
run-name: "${{ format('release {0}', inputs.bump) }}"

on:
  push:
    branches:
      - main
    # Pushing (or moving) a vX.Y.Z tag releases that version.
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      bump:
        description: "Bump major, minor, or patch"
        required: false
        type: choice
        options:
          - major
          - minor
          - patch
      version:
        description: "Override version (optional)"
        required: false
        type: string
      qualification_run_id:
        description: "Completed candidate-SHA qualification run carrying release-qualification-v2 (required for release GO)"
        required: false
        type: string

# main, tag and manual runs share the same release draft and refs.
concurrency:
  group: publish-${{ github.repository }}
  cancel-in-progress: false

permissions:
  actions: read
  id-token: write
  contents: write
  packages: write

jobs:
  version:
    runs-on: ubuntu-24.04
    if: github.repository == 'deepagent-ltd/deepagent-code'
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup-bun

      - name: Resolve the committed release version
        id: version-input
        run: bun script/resolve-publish-version.ts
        env:
          DAC_PUBLISH_REF: ${{ github.ref }}
          DAC_PUBLISH_VERSION: ${{ inputs.version }}
          DAC_PUBLISH_BUMP: ${{ inputs.bump }}

      - name: Setup git committer
        id: committer
        # Use the job token here: generated candidate/tag refs must not start another publish run.
        uses: ./.github/actions/setup-git-committer

      - id: version
        run: |
          ./script/version.ts
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
          DEEPAGENT_CODE_BUMP: ${{ steps.version-input.outputs.bump }}
          DEEPAGENT_CODE_VERSION: ${{ steps.version-input.outputs.version }}
          DEEPAGENT_CODE_CHANNEL: ${{ steps.version-input.outputs.channel }}
          DEEPAGENT_CODE_API_KEY: ${{ secrets.DEEPAGENT_CODE_API_KEY }}
          GH_REPO: ${{ (github.ref_name == 'beta' && 'deepagent-ltd/deepagent-code-beta') || github.repository }}
    outputs:
      version: ${{ steps.version.outputs.version }}
      release: ${{ steps.version.outputs.release }}
      tag: ${{ steps.version.outputs.tag }}
      repo: ${{ steps.version.outputs.repo }}
      candidate_commit: ${{ steps.version.outputs.candidate_commit }}
      candidate_tree: ${{ steps.version.outputs.candidate_tree }}
      channel: ${{ steps.version.outputs.channel }}

  build-cli:
    needs: version
    runs-on: ubuntu-24.04
    if: github.repository == 'deepagent-ltd/deepagent-code'
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ needs.version.outputs.candidate_commit }}
          fetch-tags: true

      - uses: ./.github/actions/setup-bun

      - name: Setup git committer
        id: committer
        uses: ./.github/actions/setup-git-committer
        with:
          deepagent-code-app-id: ${{ vars.DEEPAGENT_CODE_APP_ID }}
          deepagent-code-app-secret: ${{ secrets.DEEPAGENT_CODE_APP_SECRET }}

      # Owner authorization (2026-09-11 ruling): mint with a ONE-TIME Ed25519 pair BEFORE the
      # binaries build — the public half is pinned into this exact build via the
      # DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY define and the private half dies with the mint
      # process. No signing secret exists anywhere. The row never expires (no forced updates).
      - name: Mint V2 owner authorization (ephemeral per-release)
        id: mint-owner
        working-directory: packages/deepagent-code
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
        run: |
          bun install
          bun script/mint-owner-campaign.ts --ephemeral \
            --build-identity "$DEEPAGENT_CODE_VERSION" \
            --db "$RUNNER_TEMP/mint.db" \
            --export "$RUNNER_TEMP/owner-authorization.json" \
            | tee "$RUNNER_TEMP/mint-result.json"
          jq -r '.public_key_pem' "$RUNNER_TEMP/mint-result.json" > "$RUNNER_TEMP/release-owner-public-key.pem"
          test -s "$RUNNER_TEMP/release-owner-public-key.pem"

      - name: Prepare Linux CLI Rust targets and musl linker
        run: |
          rustup target add x86_64-unknown-linux-gnu x86_64-unknown-linux-musl
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends musl-tools
          test -x /usr/bin/musl-gcc
          rustup target list --installed

      - name: Build (release identity pinned)
        id: build
        run: |
          ./packages/deepagent-code/script/build.ts --exclude-win32 --exclude-darwin ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
          ./packages/cli/script/build.ts ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
          # Ship the authorization row at every binary's appRoot (dirname of the executable —
          # V2OwnerSeed.defaultOwnerAuthorizationAppRoot) so default installs self-qualify.
          for dir in packages/deepagent-code/dist/deepagent-code-*/bin packages/cli/dist/*/bin; do
            [ -d "$dir" ] && cp "$RUNNER_TEMP/owner-authorization.json" "$dir/owner-authorization.json"
          done
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
          DEEPAGENT_CODE_CHANNEL: ${{ needs.version.outputs.channel }}
          DEEPAGENT_CODE_RELEASE: ${{ needs.version.outputs.release }}
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: /usr/bin/musl-gcc
          DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE: ${{ runner.temp }}/owner-authorization.json
          DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY: ${{ runner.temp }}/release-owner-public-key.pem
          GH_REPO: ${{ needs.version.outputs.repo }}
          GH_TOKEN: ${{ steps.committer.outputs.token }}

      - name: Verify frozen CLI release candidate
        if: needs.version.outputs.release
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}" \
            --package-dir packages/deepagent-code/dist/deepagent-code-linux-x64

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: owner-authorization
          path: ${{ runner.temp }}/owner-authorization.json
          if-no-files-found: warn

      # Public half of the ephemeral release owner key: the native Windows build job pins the
      # same key into its binaries via DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY, keeping one
      # build identity across every platform artifact. Public material — safe as an artifact.
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: release-owner-public-key
          path: ${{ runner.temp }}/release-owner-public-key.pem
          if-no-files-found: warn

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: deepagent-code-cli
          path: |
            packages/deepagent-code/dist/deepagent-code-linux*
            packages/deepagent-code/dist/deepagent-code-linux*.tar.gz

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: deepagent-code-preview-cli
          path: packages/cli/dist/cli-*

    outputs:
      version: ${{ needs.version.outputs.version }}

  build-cli-macos:
    needs:
      - version
      - build-cli
    if: github.repository == 'deepagent-ltd/deepagent-code'
    strategy:
      fail-fast: false
      matrix:
        include:
          - host: macos-15-intel
            arch: x64
            rust_target: x86_64-apple-darwin
          - host: macos-26
            arch: arm64
            rust_target: aarch64-apple-darwin
    runs-on: ${{ matrix.host }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ needs.version.outputs.candidate_commit }}
          fetch-tags: true

      - name: Validate macOS release signing credentials
        if: needs.version.outputs.release != ''
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_CSC_NAME: ${{ secrets.APPLE_CSC_NAME }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_CSC_NAME APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
            if [[ -z "${!name}" ]]; then
              echo "::error::Missing macOS release signing credential: $name"
              exit 1
            fi
          done

      - uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
        if: needs.version.outputs.release != ''
        with:
          keychain: build
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - uses: ./.github/actions/setup-bun
        with:
          install-flags: --os=darwin --cpu=${{ matrix.arch }}

      - name: Prepare matching Apple Rust target
        env:
          DAC_CLI_ARCH: ${{ matrix.arch }}
          DAC_CLI_RUST_TARGET: ${{ matrix.rust_target }}
        run: |
          test "$(bun -p 'process.arch')" = "$DAC_CLI_ARCH"
          xcrun --find clang
          rustup target add "$DAC_CLI_RUST_TARGET"

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: owner-authorization
          path: ${{ runner.temp }}/owner-auth

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release-owner-public-key
          path: ${{ runner.temp }}/owner-key

      - name: Prepare this job's Native CLI publisher
        run: bun packages/desktop/scripts/native-publisher.ts prepare
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
          DAC_NATIVE_APPLE_SIGNED: ${{ needs.version.outputs.release != '' && '1' || '0' }}
          CSC_NAME: ${{ secrets.APPLE_CSC_NAME }}

      - name: Build native macOS CLI and sign final executable bytes
        run: |
          bun packages/deepagent-code/script/build.ts --single --baseline ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
          if [[ -n "$DEEPAGENT_CODE_NATIVE_ASSET_SIGN_IDENTITY" ]]; then
            for file in packages/deepagent-code/dist/deepagent-code-darwin-*/bin/deepagent-code; do
              /usr/bin/codesign --force --sign "$DEEPAGENT_CODE_NATIVE_ASSET_SIGN_IDENTITY" --options runtime \
                --entitlements packages/deepagent-code/script/native-command-entitlements.plist --timestamp "$file"
              /usr/bin/codesign --verify --strict "$file"
            done
          fi
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
          DEEPAGENT_CODE_CHANNEL: ${{ needs.version.outputs.channel }}
          DEEPAGENT_CODE_RELEASE: ${{ needs.version.outputs.release }}
          DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE: ${{ runner.temp }}/owner-auth/owner-authorization.json
          DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY: ${{ runner.temp }}/owner-key/release-owner-public-key.pem

      - name: Seal and verify final macOS CLI Native receipts
        run: |
          bun packages/desktop/scripts/native-publisher.ts seal-cli
          for file in packages/deepagent-code/dist/deepagent-code-darwin-*/bin/deepagent-code; do
            "$file" --version
            dir="${file%/bin/deepagent-code}"
            if [[ -n "$DEEPAGENT_CODE_RELEASE" ]]; then
              (cd "$dir/bin" && zip -r -FS "../../$(basename "$dir").zip" .)
            fi
          done
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
          DEEPAGENT_CODE_RELEASE: ${{ needs.version.outputs.release }}
          DEEPAGENT_CODE_CANDIDATE_COMMIT: ${{ needs.version.outputs.candidate_commit }}
          DEEPAGENT_CODE_CANDIDATE_TREE: ${{ needs.version.outputs.candidate_tree }}

      - name: Destroy this job's private Native CLI publisher
        if: always()
        run: bun packages/desktop/scripts/native-publisher.ts cleanup

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: deepagent-code-cli-darwin-${{ matrix.arch }}
          path: packages/deepagent-code/dist/deepagent-code-darwin*
          if-no-files-found: error

  # Windows binaries build NATIVELY on a Windows runner: bun cross-compilation with the large
  # embedded web UI produced non-starting Windows PEs when the build host was macOS (verified on
  # the acceptance box), and native builds have been validated end-to-end there dozens of times.
  # The build script's own smoke test actually executes the exe here, so a broken build fails CI.
  build-cli-windows:
    needs:
      - version
      - build-cli
    runs-on: windows-2025
    if: github.repository == 'deepagent-ltd/deepagent-code'
    env:
      HAS_TRUSTED_SIGNING: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT != '' && secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME != '' && secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE != '' && secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_TENANT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID != '' }}
      AZURE_CLIENT_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}
      AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
      AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
      AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ needs.version.outputs.candidate_commit }}
          fetch-tags: true

      - uses: ./.github/actions/setup-bun

      - name: Setup git committer
        id: committer
        uses: ./.github/actions/setup-git-committer
        with:
          deepagent-code-app-id: ${{ vars.DEEPAGENT_CODE_APP_ID }}
          deepagent-code-app-secret: ${{ secrets.DEEPAGENT_CODE_APP_SECRET }}

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: owner-authorization
          path: ${{ runner.temp }}/owner-auth

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release-owner-public-key
          path: ${{ runner.temp }}/owner-key

      - name: Prepare this job's Native CLI publisher
        run: bun packages/desktop/scripts/native-publisher.ts prepare
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}

      - name: Build (release identity pinned, native)
        shell: bash
        run: |
          cd packages/deepagent-code
          bun script/build.ts --single --baseline ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
          for dir in dist/deepagent-code-*/bin; do
            [ -d "$dir" ] && cp "$RUNNER_TEMP/owner-auth/owner-authorization.json" "$dir/owner-authorization.json"
          done
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
          DEEPAGENT_CODE_CHANNEL: ${{ needs.version.outputs.channel }}
          DEEPAGENT_CODE_RELEASE: ${{ needs.version.outputs.release }}
          DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE: ${{ runner.temp }}/owner-auth/owner-authorization.json
          DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY: ${{ runner.temp }}/owner-key/release-owner-public-key.pem
          GH_REPO: ${{ needs.version.outputs.repo }}
          GH_TOKEN: ${{ steps.committer.outputs.token }}

      - name: Azure login
        if: env.HAS_TRUSTED_SIGNING == 'true'
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ env.AZURE_CLIENT_ID }}
          tenant-id: ${{ env.AZURE_TENANT_ID }}
          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}

      - uses: azure/artifact-signing-action@b443cf8ea4124818d2ea9f043cba29fc3ec47b16 # v1.2.0
        if: env.HAS_TRUSTED_SIGNING == 'true'
        with:
          endpoint: ${{ env.AZURE_TRUSTED_SIGNING_ENDPOINT }}
          signing-account-name: ${{ env.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ env.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
          files: |
            ${{ github.workspace }}\packages\deepagent-code\dist\deepagent-code-windows-x64\bin\deepagent-code.exe
            ${{ github.workspace }}\packages\deepagent-code\dist\deepagent-code-windows-x64-baseline\bin\deepagent-code.exe
          exclude-environment-credential: true
          exclude-workload-identity-credential: true
          exclude-managed-identity-credential: true
          exclude-shared-token-cache-credential: true
          exclude-visual-studio-credential: true
          exclude-visual-studio-code-credential: true
          exclude-azure-cli-credential: false
          exclude-azure-powershell-credential: true
          exclude-azure-developer-cli-credential: true
          exclude-interactive-browser-credential: true

      - name: Verify Windows CLI signatures
        if: env.HAS_TRUSTED_SIGNING == 'true'
        shell: pwsh
        run: |
          $files = @(
            "${{ github.workspace }}\packages\deepagent-code\dist\deepagent-code-windows-x64\bin\deepagent-code.exe",
            "${{ github.workspace }}\packages\deepagent-code\dist\deepagent-code-windows-x64-baseline\bin\deepagent-code.exe"
          )

          foreach ($file in $files) {
            $sig = Get-AuthenticodeSignature $file
            if ($sig.Status -ne "Valid") {
              throw "Invalid signature for ${file}: $($sig.Status)"
            }
          }

      - name: Report unsigned Windows artifacts
        if: env.HAS_TRUSTED_SIGNING != 'true'
        shell: pwsh
        run: Write-Host "Azure Trusted Signing is not configured; using unsigned Windows artifacts"

      - name: Seal and verify final Windows CLI Native receipts
        shell: pwsh
        run: |
          bun packages/desktop/scripts/native-publisher.ts seal-cli
          if ($LASTEXITCODE -ne 0) { throw "Native CLI issuance failed" }
          foreach ($file in Get-ChildItem packages/deepagent-code/dist/deepagent-code-windows-*/bin/deepagent-code.exe) {
            & $file.FullName --version
            if ($LASTEXITCODE -ne 0) { throw "Final Windows CLI startup failed" }
          }
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
          DEEPAGENT_CODE_CANDIDATE_COMMIT: ${{ needs.version.outputs.candidate_commit }}
          DEEPAGENT_CODE_CANDIDATE_TREE: ${{ needs.version.outputs.candidate_tree }}

      - name: Destroy this job's private Native CLI publisher
        if: always()
        run: bun packages/desktop/scripts/native-publisher.ts cleanup

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: deepagent-code-cli-windows
          path: packages/deepagent-code/dist/deepagent-code-windows*

  sign-cli-windows:
    needs:
      - build-cli-windows
      - version
    runs-on: windows-2025
    if: github.repository == 'deepagent-ltd/deepagent-code'
    env:
      HAS_TRUSTED_SIGNING: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT != '' && secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME != '' && secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE != '' && secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_TENANT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID != '' }}
      AZURE_CLIENT_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}
      AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
      AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
      AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ needs.version.outputs.candidate_commit }}

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: deepagent-code-cli-windows
          path: packages/deepagent-code/dist

      - name: Setup git committer
        id: committer
        uses: ./.github/actions/setup-git-committer
        with:
          deepagent-code-app-id: ${{ vars.DEEPAGENT_CODE_APP_ID }}
          deepagent-code-app-secret: ${{ secrets.DEEPAGENT_CODE_APP_SECRET }}

      - name: Verify Windows CLI signatures
        if: env.HAS_TRUSTED_SIGNING == 'true'
        shell: pwsh
        run: |
          $files = @(
            "${{ github.workspace }}\packages\deepagent-code\dist\deepagent-code-windows-x64\bin\deepagent-code.exe",
            "${{ github.workspace }}\packages\deepagent-code\dist\deepagent-code-windows-x64-baseline\bin\deepagent-code.exe"
          )

          foreach ($file in $files) {
            $sig = Get-AuthenticodeSignature $file
            if ($sig.Status -ne "Valid") {
              throw "Invalid signature for ${file}: $($sig.Status)"
            }
          }

      - name: Report unsigned Windows artifacts
        if: env.HAS_TRUSTED_SIGNING != 'true'
        shell: pwsh
        run: Write-Host "Azure Trusted Signing is not configured; using unsigned Windows artifacts"

      - name: Repack Windows CLI archives
        working-directory: packages/deepagent-code/dist
        shell: pwsh
        run: |
          Compress-Archive -Path "deepagent-code-windows-x64\bin\*" -DestinationPath "deepagent-code-windows-x64.zip" -Force
          Compress-Archive -Path "deepagent-code-windows-x64-baseline\bin\*" -DestinationPath "deepagent-code-windows-x64-baseline.zip" -Force

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: deepagent-code-cli-signed-windows
          path: |
            packages/deepagent-code/dist/deepagent-code-windows-x64
            packages/deepagent-code/dist/deepagent-code-windows-x64-baseline

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: needs.version.outputs.release
        with:
          name: deepagent-code-cli-signed-windows-archives
          path: packages/deepagent-code/dist/deepagent-code-windows*.zip

  build-electron:
    needs:
      - build-cli
      - build-cli-windows
      - version
    if: github.repository == 'deepagent-ltd/deepagent-code'
    continue-on-error: false
    env:
      HAS_TRUSTED_SIGNING: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT != '' && secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME != '' && secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE != '' && secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_TENANT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID != '' }}
      AZURE_CLIENT_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}
      AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
      AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
      AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
    strategy:
      fail-fast: false
      matrix:
        settings:
          - host: macos-15-intel
            target: x86_64-apple-darwin
            platform_flag: --mac --x64
            bun_install_flags: --os=darwin --cpu=x64
          - host: macos-26
            target: aarch64-apple-darwin
            platform_flag: --mac --arm64
            bun_install_flags: --os=darwin --cpu=arm64
          - host: "windows-2025"
            target: x86_64-pc-windows-msvc
            platform_flag: --win
          - host: "ubuntu-24.04"
            target: x86_64-unknown-linux-gnu
            platform_flag: --linux
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ needs.version.outputs.candidate_commit }}

      - name: Validate macOS release signing credentials
        if: runner.os == 'macOS' && needs.version.outputs.release != ''
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_CSC_NAME: ${{ secrets.APPLE_CSC_NAME }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_CSC_NAME APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
            if [[ -z "${!name}" ]]; then
              echo "::error::Missing macOS release signing credential: $name"
              exit 1
            fi
          done

      - uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
        if: runner.os == 'macOS' && needs.version.outputs.release != ''
        with:
          keychain: build
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - uses: ./.github/actions/setup-bun
        with:
          install-flags: ${{ matrix.settings.bun_install_flags }}
        env:
          ELECTRON_SKIP_BINARY_DOWNLOAD: ${{ matrix.settings.target == 'aarch64-apple-darwin' && '1' || '' }}

      - name: Azure login
        if: runner.os == 'Windows' && env.HAS_TRUSTED_SIGNING == 'true'
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ env.AZURE_CLIENT_ID }}
          tenant-id: ${{ env.AZURE_TENANT_ID }}
          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24"

      - name: Download Electron runtime for macOS arm64
        if: matrix.settings.target == 'aarch64-apple-darwin'
        working-directory: packages/desktop
        shell: bash
        run: |
          for attempt in 1 2 3; do
            echo "Electron download attempt $attempt/3"
            if node node_modules/electron/install.js &&
               node -e 'require("node:fs").accessSync(require("electron"))'; then
              exit 0
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "::error::Electron runtime download failed after 3 attempts; check access to Electron release assets"
              exit 1
            fi
            sleep $((attempt * 15))
          done

      - name: Cache apt packages
        if: contains(matrix.settings.host, 'ubuntu')
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/apt-cache
          key: ${{ runner.os }}-${{ matrix.settings.target }}-apt-electron-${{ hashFiles('.github/workflows/publish.yml') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.settings.target }}-apt-electron-

      - name: Install dependencies (ubuntu only)
        if: contains(matrix.settings.host, 'ubuntu')
        run: |
          mkdir -p ~/apt-cache && chmod -R a+rw ~/apt-cache
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends -o dir::cache::archives="$HOME/apt-cache" rpm
          sudo chmod -R a+rw ~/apt-cache

      - name: Setup git committer
        id: committer
        uses: ./.github/actions/setup-git-committer
        with:
          deepagent-code-app-id: ${{ vars.DEEPAGENT_CODE_APP_ID }}
          deepagent-code-app-secret: ${{ secrets.DEEPAGENT_CODE_APP_SECRET }}

      - name: Verify Windows browser file stages
        if: runner.os == 'Windows'
        shell: pwsh
        timeout-minutes: 5
        run: ./.github/scripts/test-windows-browser-file-stages.ps1

      # Reuse the release's single owner issuance pair across every Desktop target.
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: owner-authorization
          path: ${{ runner.temp }}/owner-auth

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release-owner-public-key
          path: ${{ runner.temp }}/owner-key

      - name: Build, package and verify Desktop Native assets
        uses: ./.github/actions/package-desktop
        timeout-minutes: 90
        with:
          version: ${{ needs.version.outputs.version }}
          channel: ${{ (needs.version.outputs.channel == 'beta' && 'beta') || 'prod' }}
          platform-flags: ${{ matrix.settings.platform_flag }}
          prepare: "true"
          macos-signed: ${{ runner.os == 'macOS' && needs.version.outputs.release != '' }}
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ vars.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ vars.WEB_SENTRY_PROJECT }}
          SENTRY_RELEASE: desktop@${{ needs.version.outputs.version }}
          VITE_SENTRY_DSN: ${{ vars.WEB_SENTRY_DSN }}
          VITE_SENTRY_ENVIRONMENT: ${{ (github.ref_name == 'beta' && 'beta') || 'production' }}
          VITE_SENTRY_RELEASE: desktop@${{ needs.version.outputs.version }}
          DEEPAGENT_CODE_CLI_ARTIFACT: ${{ (runner.os == 'Windows' && 'deepagent-code-cli-windows') || 'deepagent-code-cli' }}
          DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE: ${{ runner.temp }}/owner-auth/owner-authorization.json
          DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY: ${{ runner.temp }}/owner-key/release-owner-public-key.pem
          RUST_TARGET: ${{ matrix.settings.target }}
          GH_TOKEN: ${{ steps.committer.outputs.token }}
          DEEPAGENT_CODE_ALLOW_UNSIGNED: ${{ runner.os == 'Windows' && env.HAS_TRUSTED_SIGNING != 'true' && '1' || '0' }}
          # Match desktop-build: use the imported Developer ID and the existing
          # Apple ID notarization secrets, without creating an empty API-key file.
          CSC_NAME: ${{ runner.os == 'macOS' && needs.version.outputs.release != '' && secrets.APPLE_CSC_NAME || '' }}
          APPLE_ID: ${{ runner.os == 'macOS' && needs.version.outputs.release != '' && secrets.APPLE_ID || '' }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ runner.os == 'macOS' && needs.version.outputs.release != '' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
          APPLE_TEAM_ID: ${{ runner.os == 'macOS' && needs.version.outputs.release != '' && secrets.APPLE_TEAM_ID || '' }}

      # Keep these functional gates identical to desktop-build: the shared action
      # has already verified this job's packaged Native cohort, and no package is
      # uploaded unless its existing platform smoke also succeeds.
      - name: Smoke test packaged macOS app
        if: runner.os == 'macOS'
        working-directory: packages/desktop
        shell: bash
        run: |
          executable=$(find dist -maxdepth 5 -type f -path '*/Contents/MacOS/DeepAgent Code*' -perm +111 -print -quit)
          test -n "$executable"
          DEEPAGENT_CODE_DESKTOP_EXECUTABLE="$executable" bun run test:subagents-cold-start

      - name: Smoke test packaged Windows sidecar health
        if: runner.os == 'Windows'
        working-directory: packages/desktop
        shell: pwsh
        run: |
          # win-unpacked holds the x64 app. Wildcard matches both prod ("DeepAgent Code.exe")
          # and beta ("DeepAgent Code Beta.exe") artifact names so the beta build
          # cannot silently fail this smoke because of an exact name filter.
          $exe = Get-ChildItem -Path "dist/win-unpacked" -Filter "*DeepAgent Code*.exe" -Recurse -File | Select-Object -First 1
          if (-not $exe) {
            Write-Error "Packaged executable not found under dist/win-unpacked"
            exit 1
          }
          $env:DEEPAGENT_CODE_DESKTOP_EXECUTABLE = $exe.FullName
          $env:DEEPAGENT_CODE_SMOKE_PORT = "3188"
          bun run test:sidecar-health-smoke

      - name: Create macOS .app.tar.gz
        if: runner.os == 'macOS' && needs.version.outputs.release
        working-directory: packages/desktop/dist
        run: |
          if [[ "${{ matrix.settings.target }}" == "x86_64-apple-darwin" ]]; then
            APP_DIR="mac"
            OUT_NAME="deepagent-code-desktop-mac-x64.app.tar.gz"
          elif [[ "${{ matrix.settings.target }}" == "aarch64-apple-darwin" ]]; then
            APP_DIR="mac-arm64"
            OUT_NAME="deepagent-code-desktop-mac-arm64.app.tar.gz"
          else
            echo "Unknown macOS target: ${{ matrix.settings.target }}"
            exit 1
          fi
          APP_PATH=$(find "$APP_DIR" -maxdepth 1 -name "*.app" -type d | head -1)
          if [ -z "$APP_PATH" ]; then
            echo "No .app bundle found in $APP_DIR"
            exit 1
          fi
          tar -czf "$OUT_NAME" -C "$(dirname "$APP_PATH")" "$(basename "$APP_PATH")"

      - name: Verify signed Windows Electron artifacts
        if: runner.os == 'Windows' && env.HAS_TRUSTED_SIGNING == 'true'
        shell: pwsh
        run: |
          $files = @()
          $files += Get-ChildItem "${{ github.workspace }}\packages\desktop\dist\*.exe" | Select-Object -ExpandProperty FullName
          $files += Get-ChildItem "${{ github.workspace }}\packages\desktop\dist\*unpacked\*.exe" | Select-Object -ExpandProperty FullName
          $files += Get-ChildItem "${{ github.workspace }}\packages\desktop\dist\*unpacked\resources\deepagent-code-cli.exe" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName

          foreach ($file in $files | Select-Object -Unique) {
            $sig = Get-AuthenticodeSignature $file
            if ($sig.Status -ne "Valid") {
              throw "Invalid signature for ${file}: $($sig.Status)"
            }
          }

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: deepagent-code-desktop-${{ matrix.settings.target }}
          path: packages/desktop/dist/*

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: needs.version.outputs.release
        with:
          name: latest-yml-${{ matrix.settings.target }}
          path: packages/desktop/dist/latest*.yml

  publish:
    needs:
      - version
      - build-cli
      - build-cli-windows
      - build-cli-macos
      - sign-cli-windows
      - build-electron
    if: always() && !failure() && !cancelled() && needs.version.outputs.channel != 'beta'
    runs-on: ubuntu-24.04
    env:
      GH_REPO: ${{ needs.version.outputs.repo }}
      DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
      DEEPAGENT_CODE_RELEASE: ${{ needs.version.outputs.release }}
      DEEPAGENT_CODE_CANDIDATE_COMMIT: ${{ needs.version.outputs.candidate_commit }}
      DEEPAGENT_CODE_CANDIDATE_TREE: ${{ needs.version.outputs.candidate_tree }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          ref: ${{ needs.version.outputs.candidate_commit }}

      - uses: ./.github/actions/setup-bun

      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: deepagent-code-cli
          path: packages/deepagent-code/dist

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          pattern: deepagent-code-cli-darwin-*
          path: packages/deepagent-code/dist
          merge-multiple: true

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: deepagent-code-cli-windows
          path: packages/deepagent-code/dist

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: deepagent-code-cli-signed-windows
          path: packages/deepagent-code/dist

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        if: needs.version.outputs.release
        with:
          name: deepagent-code-cli-signed-windows-archives
          path: /tmp/signed-cli-windows

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: deepagent-code-preview-cli
          path: packages/cli/dist

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        continue-on-error: true
        with:
          name: owner-authorization
          path: /tmp/owner-authorization

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        if: needs.version.outputs.release
        with:
          pattern: latest-yml-*
          path: /tmp/latest-yml

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        if: needs.version.outputs.release
        with:
          pattern: deepagent-code-desktop-*
          path: /tmp/desktop
          merge-multiple: true

      - name: Setup git committer
        id: committer
        uses: ./.github/actions/setup-git-committer
        with:
          deepagent-code-app-id: ${{ vars.DEEPAGENT_CODE_APP_ID }}
          deepagent-code-app-secret: ${{ secrets.DEEPAGENT_CODE_APP_SECRET }}

      - name: Build SDK from frozen release candidate
        if: needs.version.outputs.release
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          ./packages/sdk/js/script/build.ts
          bun packages/sdk/js/script/verify-build.ts
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}" \
            --package-dir packages/deepagent-code/dist/deepagent-code-linux-x64

      - name: Probe frozen packaged runtime
        if: needs.version.outputs.release
        run: |
          mkdir -p "$RUNNER_TEMP/ri51-probe"
          DEEPAGENT_CODE_OWNER_AUTHORIZATION="$PWD/packages/deepagent-code/dist/deepagent-code-linux-x64/bin/owner-authorization.json" \
            bun packages/core/script/evidence-ledger/probe-packaged-runs.ts \
              "$PWD/packages/deepagent-code/dist/deepagent-code-linux-x64/bin/deepagent-code" \
              "$RUNNER_TEMP/ri51-probe/runs.json" \
              "$RUNNER_TEMP/ri51-probe/home" \
              "$RUNNER_TEMP/ri51-probe/evidence.json"

      - name: Download reviewed G0-G8 qualification
        if: needs.version.outputs.release && inputs.qualification_run_id != ''
        env:
          GH_TOKEN: ${{ github.token }}
          QUALIFICATION_RUN_ID: ${{ inputs.qualification_run_id }}
          GH_REPO: ${{ needs.version.outputs.repo }}
          CANDIDATE_COMMIT: ${{ needs.version.outputs.candidate_commit }}
          CANDIDATE_TREE: ${{ needs.version.outputs.candidate_tree }}
        run: |
          [[ "$QUALIFICATION_RUN_ID" =~ ^[0-9]+$ ]]
          mkdir -p "$RUNNER_TEMP/ri51-qualification"
          gh run download "$QUALIFICATION_RUN_ID" --repo "$GH_REPO" \
            --name release-qualification-v2 --dir "$RUNNER_TEMP/ri51-qualification"
          gh api "repos/$GH_REPO/actions/runs/$QUALIFICATION_RUN_ID" \
            > "$RUNNER_TEMP/ri51-qualification/source-run.json"
          bun packages/core/script/evidence-ledger/verify-qualification-bundle.ts \
            --dir "$RUNNER_TEMP/ri51-qualification" \
            --commit "$CANDIDATE_COMMIT" --tree "$CANDIDATE_TREE" \
            --run-id "$QUALIFICATION_RUN_ID" --repo "$GH_REPO"

      - name: Verify existing checks for this exact main source
        if: needs.version.outputs.release && github.ref == 'refs/heads/main' && inputs.qualification_run_id == ''
        timeout-minutes: 35
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ needs.version.outputs.repo }}
          RELEASE_SOURCE_COMMIT: ${{ github.sha }}
          RELEASE_CANDIDATE_COMMIT: ${{ needs.version.outputs.candidate_commit }}
          RELEASE_CANDIDATE_TREE: ${{ needs.version.outputs.candidate_tree }}
          RELEASE_CHECKS_RECEIPT: ${{ runner.temp }}/ri51-source-checks.json
        run: bun script/verify-release-checks.ts

      - name: Stage and verify final release archives
        if: needs.version.outputs.release
        run: |
          bun script/release-assets.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --version "${{ needs.version.outputs.version }}" \
            --cli-dist "$PWD/packages/deepagent-code/dist" \
            --windows-archives /tmp/signed-cli-windows \
            --desktop-dir /tmp/desktop \
            --assets-dir "$RUNNER_TEMP/release-assets" \
            --manifest "$RUNNER_TEMP/ri51-probe/release-assets.json"

      - name: Cache apt packages (AUR)
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: /var/cache/apt/archives
          key: ${{ runner.os }}-apt-aur-${{ hashFiles('.github/workflows/publish.yml') }}
          restore-keys: |
            ${{ runner.os }}-apt-aur-

      - name: Setup SSH for AUR
        run: |
          sudo apt-get update
          sudo apt-get install -y pacman-package-manager
          mkdir -p ~/.ssh
          echo "${{ secrets.AUR_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          git config --global user.email "deepagent-ai@deepagent.ltd"
          git config --global user.name "deepagent-ai"
          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts || true

      # Standard main distribution binds successful existing source checks, actual packaged
      # runtime and final assets. An explicitly supplied RI-51 review remains strictly required
      # to claim complete G0-G8 qualification; standard distribution keeps those gates pending.
      - name: Verify distribution integrity and archive qualification status
        if: needs.version.outputs.release
        env:
          QUALIFICATION_RUN_ID: ${{ inputs.qualification_run_id }}
          RELEASE_REF: ${{ github.ref }}
          GH_REPO: ${{ needs.version.outputs.repo }}
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}" \
            --package-dir packages/deepagent-code/dist/deepagent-code-linux-x64
          mkdir -p /tmp/authoritative-ledger
          args=(--out /tmp/authoritative-ledger/ledger.json \
            --package-dir "$PWD/packages/deepagent-code/dist/deepagent-code-linux-x64" \
            --runs "$RUNNER_TEMP/ri51-probe/runs.json" \
            --evidence "$RUNNER_TEMP/ri51-probe/evidence.json" \
            --asset-manifest "$RUNNER_TEMP/ri51-probe/release-assets.json" \
            --assets-dir "$RUNNER_TEMP/release-assets")
          if [[ -n "$QUALIFICATION_RUN_ID" ]]; then
            args+=(--qualification-dir "$RUNNER_TEMP/ri51-qualification" \
              --qualification-run-id "$QUALIFICATION_RUN_ID" --qualification-repo "$GH_REPO")
          elif [[ "$RELEASE_REF" == 'refs/heads/main' ]]; then
            args+=(--standard-distribution --source-checks "$RUNNER_TEMP/ri51-source-checks.json")
          else
            echo "Non-main release requires an explicit reviewed qualification run" >&2
            exit 1
          fi
          (cd packages/core && bun run script/evidence-ledger/release-gate.ts "${args[@]}")
          if [[ -z "$QUALIFICATION_RUN_ID" ]]; then
            echo "Standard main distribution: existing source checks and package integrity passed; RI-51 G0-G8 not reviewed." >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Upload authoritative ledger release asset
        if: needs.version.outputs.release && success()
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}"
          bun packages/core/script/evidence-ledger/verify-ledger-products.ts \
            --ledger /tmp/authoritative-ledger/ledger.json \
            --artifact-dir /tmp/authoritative-ledger/release-evidence-products
          tar -czf /tmp/authoritative-ledger/release-evidence-products.tar.gz \
            -C /tmp/authoritative-ledger \
            ledger.json release-evidence-manifest.json release-evidence-products release-evidence
          bun script/upload-release-asset.ts \
            /tmp/authoritative-ledger/ledger.json \
            /tmp/authoritative-ledger/release-evidence-products.tar.gz

      - name: Upload CLI release assets
        if: needs.version.outputs.release
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}"
          mapfile -t names < <(jq -r '.assets[] | select(.kind == "cli") | .name' "$RUNNER_TEMP/ri51-probe/release-assets.json")
          files=()
          for name in "${names[@]}"; do files+=("$RUNNER_TEMP/release-assets/$name"); done
          bun script/upload-release-asset.ts "${files[@]}"

      - name: Upload desktop release assets
        if: needs.version.outputs.release
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}"
          mapfile -t names < <(jq -r '.assets[] | select(.kind == "desktop") | .name' "$RUNNER_TEMP/ri51-probe/release-assets.json")
          files=()
          for name in "${names[@]}"; do files+=("$RUNNER_TEMP/release-assets/$name"); done
          bun script/upload-release-asset.ts "${files[@]}"

      # W0.5: deliver the signed owner-authorization.json with the release artifacts. The runtime
      # seed (v2-owner-seed.ts) reads it from the install root; if it is missing the release still
      # stands and operations must deliver the line for this version.
      - name: Upload owner authorization release asset
        if: needs.version.outputs.release
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}"
          bun script/upload-release-asset.ts "$RUNNER_TEMP/release-assets/owner-authorization.json"

      - name: Read back final release asset bytes
        if: needs.version.outputs.release
        env:
          GH_TOKEN: ${{ steps.committer.outputs.token }}
        run: |
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}"
          mkdir -p "$RUNNER_TEMP/release-readback"
          gh release download "v${{ needs.version.outputs.version }}" \
            --repo "${{ needs.version.outputs.repo }}" \
            --dir "$RUNNER_TEMP/release-readback" --pattern '*'
          bun script/release-assets.ts --verify --allow-ledger-assets \
            --manifest "$RUNNER_TEMP/ri51-probe/release-assets.json" \
            --assets-dir "$RUNNER_TEMP/release-readback" \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}"
          cmp -s "$RUNNER_TEMP/release-readback/ledger.json" /tmp/authoritative-ledger/ledger.json
          cmp -s "$RUNNER_TEMP/release-readback/release-evidence-products.tar.gz" \
            /tmp/authoritative-ledger/release-evidence-products.tar.gz
          bun script/assert-release-candidate.ts \
            --commit "${{ needs.version.outputs.candidate_commit }}" \
            --tree "${{ needs.version.outputs.candidate_tree }}" \
            --tag "v${{ needs.version.outputs.version }}" \
            --release-id "${{ needs.version.outputs.release }}" \
            --release-repo "${{ needs.version.outputs.repo }}"

      - run: ./script/publish.ts
        env:
          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
          DEEPAGENT_CODE_CHANNEL: ${{ needs.version.outputs.channel }}
          DEEPAGENT_CODE_RELEASE: ${{ needs.version.outputs.release }}
          DEEPAGENT_CODE_CANDIDATE_COMMIT: ${{ needs.version.outputs.candidate_commit }}
          DEEPAGENT_CODE_CANDIDATE_TREE: ${{ needs.version.outputs.candidate_tree }}
          AUR_KEY: ${{ secrets.AUR_KEY }}
          GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
          GH_REPO: ${{ needs.version.outputs.repo }}
          NPM_CONFIG_PROVENANCE: false
          LATEST_YML_DIR: /tmp/latest-yml
          RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
          RELEASE_LEDGER_PATH: /tmp/authoritative-ledger/ledger.json
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}