verify-devpack-scripts.yml

name: Verify DevPack scripts

on:
  schedule:
    # 07:17 UTC+8 daily, away from the top-of-hour queue.
    - cron: "17 23 * * *"
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      release_tag:
        description: "DevPack release tag to verify (blank selects newest published DevPack)"
        required: false
        type: string
      install_source:
        description: "Installation source"
        required: true
        default: release
        type: choice
        options:
          - release
          - aka
          - brew
          - winget
          - all
      telemetry:
        description: "Send installer telemetry during this validation run"
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: verify-devpack-scripts-${{ github.event_name == 'schedule' && 'daily' || github.event.release.tag_name || inputs.release_tag || 'latest' }}-${{ inputs.install_source || 'release' }}-telemetry-${{ inputs.telemetry || false }}
  cancel-in-progress: false

env:
  TELEMETRY_ENABLED: ${{ inputs.telemetry || false }}
  FOUNDRY_DEVPACK_COLLECT_TELEMETRY: ${{ inputs.telemetry && '1' || '0' }}
  GITHUB_TOKEN: ${{ github.token }}
  GH_TOKEN: ${{ github.token }}

jobs:
  prepare:
    if: ${{ github.event_name != 'release' || startsWith(github.event.release.tag_name, 'devpack-installer-') }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      release_tag: ${{ steps.target.outputs.release_tag }}
      windows_sources: ${{ steps.target.outputs.windows_sources }}
      linux_sources: ${{ steps.target.outputs.linux_sources }}
      macos_sources: ${{ steps.target.outputs.macos_sources }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'release' && github.event.repository.default_branch || github.ref }}
          persist-credentials: false
      - name: Test smoke assertions and scheduling
        run: node --test .github/scripts/verify_devpack_smoke.test.mjs .github/scripts/devpack_smoke_schedule.test.mjs
      - name: Select release and source matrices
        id: target
        env:
          INPUT_TAG: ${{ inputs.release_tag }}
          INPUT_SOURCE: ${{ inputs.install_source || 'release' }}
          EVENT_RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: node .github/scripts/devpack_smoke_schedule.mjs prepare

  windows:
    needs: prepare
    if: ${{ needs.prepare.outputs.windows_sources != '[]' }}
    name: windows ${{ matrix.platform.arch }} ${{ matrix.scenario }} (${{ matrix.source }}, telemetry=${{ inputs.telemetry || false }})
    runs-on: ${{ matrix.platform.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        source: ${{ fromJSON(needs.prepare.outputs.windows_sources) }}
        scenario: [baseline, no-az, with-code]
        platform:
          - { os: windows-latest, arch: x64 }
          - { os: windows-11-arm, arch: arm64 }

    env:
      RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
      INSTALL_SOURCE: ${{ matrix.source }}
      SCENARIO: ${{ matrix.scenario }}

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'release' && github.event.repository.default_branch || github.ref }}
          persist-credentials: false

      - name: Test smoke assertions
        shell: pwsh
        run: |
          node --test .github/scripts/verify_devpack_smoke.test.mjs
          if ($LASTEXITCODE -ne 0) { throw 'Smoke assertion tests failed' }

      - name: Verify release tag
        shell: pwsh
        run: |
          if ($env:RELEASE_TAG -notmatch '^devpack-installer-[0-9A-Za-z][0-9A-Za-z.-]*$') {
            throw "invalid release tag: $env:RELEASE_TAG"
          }
          $expected = if ($env:TELEMETRY_ENABLED -eq 'true') { '1' } else { '0' }
          if ($env:FOUNDRY_DEVPACK_COLLECT_TELEMETRY -ne $expected) {
            throw 'telemetry input was not mapped to the installer environment correctly'
          }
          Write-Host "Testing $env:RELEASE_TAG from $env:INSTALL_SOURCE on windows ${{ matrix.platform.arch }} (${{ matrix.scenario }}), telemetry=$env:TELEMETRY_ENABLED"

      - name: Ensure winget
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $links = Join-Path $env:LOCALAPPDATA 'Microsoft\WinGet\Links'
          if (-not (Get-Command winget -ErrorAction SilentlyContinue)) {
            Install-PSResource -Name Microsoft.WinGet.Client -Repository PSGallery -TrustRepository -Reinstall
            Import-Module Microsoft.WinGet.Client
            Repair-WinGetPackageManager -Latest -Force
            $env:Path = "$links;$env:Path"
            Add-Content -Path $env:GITHUB_PATH -Value $links
          }
          winget --version

      - name: Remove Azure CLI
        if: matrix.scenario == 'no-az'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          winget uninstall --silent --disable-interactivity --accept-source-agreements --id Microsoft.AzureCLI
          $machine = [Environment]::GetEnvironmentVariable('Path', 'Machine')
          $user = [Environment]::GetEnvironmentVariable('Path', 'User')
          $env:Path = "$machine;$user"
          if (Get-Command az -ErrorAction SilentlyContinue) {
            throw 'Azure CLI is still available after removal'
          }

      - name: Install VS Code, Copilot CLI, and Claude shim
        if: matrix.scenario == 'with-code'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          winget install --silent --disable-interactivity `
            --accept-package-agreements --accept-source-agreements `
            --id Microsoft.VisualStudioCode
          if ($LASTEXITCODE -ne 0) { throw "VS Code install exited $LASTEXITCODE" }
          winget install --silent --disable-interactivity `
            --accept-package-agreements --accept-source-agreements `
            --id GitHub.Copilot
          if ($LASTEXITCODE -ne 0) { throw "Copilot CLI install exited $LASTEXITCODE" }

          $vscodeBin = Join-Path $env:LOCALAPPDATA 'Programs\Microsoft VS Code\bin'
          Add-Content -Path $env:GITHUB_PATH -Value $vscodeBin
          # MSI and portable installs publish different locations through PATH.
          $machine = [Environment]::GetEnvironmentVariable('Path', 'Machine')
          $user = [Environment]::GetEnvironmentVariable('Path', 'User')
          $env:Path = "$machine;$user;$env:Path"
          $copilot = Get-Command copilot -CommandType Application -ErrorAction Stop
          Add-Content -Path $env:GITHUB_PATH -Value (Split-Path -Parent $copilot.Source)

          $claudeBin = Join-Path $env:RUNNER_TEMP 'claude-bin'
          New-Item -ItemType Directory -Force -Path $claudeBin | Out-Null
          Set-Content -Path (Join-Path $claudeBin 'claude.cmd') -Value "@echo off`r`nexit /b 0`r`n" -NoNewline
          Add-Content -Path $env:GITHUB_PATH -Value $claudeBin

      - name: Confirm Copilot CLI is absent
        if: matrix.scenario != 'with-code'
        shell: pwsh
        run: |
          if (Get-Command copilot -ErrorAction SilentlyContinue) {
            throw 'Copilot CLI unexpectedly present; Canvas skip path cannot be tested'
          }

      - name: Download and verify signed bootstrap
        if: env.INSTALL_SOURCE != 'winget'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $script = Join-Path $env:RUNNER_TEMP 'foundry-devpack.ps1'
          $url = if ($env:INSTALL_SOURCE -eq 'aka') {
            'https://aka.ms/foundry-devpack-install.ps1'
          } else {
            "https://github.com/${{ github.repository }}/releases/download/$env:RELEASE_TAG/foundry-devpack.ps1"
          }
          Invoke-WebRequest $url -OutFile $script -UseBasicParsing

          $content = Get-Content $script -Raw
          if ($content -notmatch "(?m)^\`$releaseTag\s*=\s*'([^']+)'") {
            throw 'release tag not found in PowerShell bootstrap'
          }
          if ($Matches[1] -ne $env:RELEASE_TAG) {
            throw "PowerShell bootstrap targets $($Matches[1]), expected $env:RELEASE_TAG"
          }

          $signature = Get-AuthenticodeSignature $script
          if ($signature.Status -ne 'Valid') {
            throw "invalid PowerShell signature: $($signature.Status) $($signature.StatusMessage)"
          }
          if ($signature.SignerCertificate.Subject -notlike 'CN=Microsoft Corporation,*') {
            throw "unexpected PowerShell signer: $($signature.SignerCertificate.Subject)"
          }

          $store = [Security.Cryptography.X509Certificates.X509Store]::new('TrustedPublisher', 'CurrentUser')
          $store.Open([Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
          try {
            $wasTrusted = $store.Certificates.Find(
              [Security.Cryptography.X509Certificates.X509FindType]::FindByThumbprint,
              $signature.SignerCertificate.Thumbprint,
              $false).Count -gt 0
            if (-not $wasTrusted) { $store.Add($signature.SignerCertificate) }
          }
          finally {
            $store.Dispose()
          }

          "DEVPACK_SCRIPT=$script" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "SIGNER_THUMBPRINT=$($signature.SignerCertificate.Thumbprint)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "SIGNER_WAS_TRUSTED=$wasTrusted" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Install DevPack
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $temp = Join-Path $env:RUNNER_TEMP 'devpack-bootstrap-temp'
          New-Item -ItemType Directory -Path $temp -Force | Out-Null
          $env:TEMP = $temp
          $env:TMP = $temp
          $installerLog = Join-Path $env:RUNNER_TEMP 'foundry-devpack.log'
          $consoleOutput = Join-Path $env:RUNNER_TEMP 'foundry-devpack-output.txt'

          if ($env:INSTALL_SOURCE -eq 'aka') {
            & powershell.exe -ExecutionPolicy AllSigned -Command `
              "Invoke-RestMethod 'https://aka.ms/foundry-devpack-install.ps1' | Invoke-Expression" `
              2>&1 | Tee-Object -FilePath $consoleOutput
          } elseif ($env:INSTALL_SOURCE -eq 'winget') {
            $expectedVersion = $env:RELEASE_TAG -replace '^devpack-installer-', ''
            winget install --exact --id Microsoft.FoundryDevPack `
              --version $expectedVersion --source winget --force --silent `
              --disable-interactivity --accept-package-agreements --accept-source-agreements `
              --log $installerLog
          } else {
            & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy AllSigned `
              -File $env:DEVPACK_SCRIPT --verbose --log $installerLog
          }
          if ($LASTEXITCODE -ne 0) { throw "DevPack install exited $LASTEXITCODE" }
          $format = if ($env:INSTALL_SOURCE -eq 'aka') { 'console' } else { 'log' }
          $resultFile = if ($format -eq 'console') { $consoleOutput } else { $installerLog }
          node .github/scripts/verify_devpack_smoke.mjs run $env:RELEASE_TAG $env:SCENARIO $format $resultFile
          if ($LASTEXITCODE -ne 0) { throw 'DevPack install verification failed' }
          $leaked = @(Get-ChildItem $temp -Directory -Filter 'foundry-devpack-*' -ErrorAction SilentlyContinue)
          if ($leaked.Count) {
            throw "bootstrap left temporary directories: $($leaked.FullName -join ', ')"
          }

      - name: Verify winget repair
        if: env.INSTALL_SOURCE == 'winget'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $repairLog = Join-Path $env:RUNNER_TEMP 'foundry-devpack-repair.log'
          $expectedVersion = $env:RELEASE_TAG -replace '^devpack-installer-', ''
          winget repair --exact --id Microsoft.FoundryDevPack `
            --version $expectedVersion --source winget --force --silent `
            --disable-interactivity --accept-package-agreements --accept-source-agreements `
            --log $repairLog
          if ($LASTEXITCODE -ne 0) { throw "winget repair exited $LASTEXITCODE" }
          node .github/scripts/verify_devpack_smoke.mjs run $env:RELEASE_TAG $env:SCENARIO log $repairLog
          if ($LASTEXITCODE -ne 0) { throw 'DevPack repair verification failed' }

      - name: Verify installed components
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $machine = [Environment]::GetEnvironmentVariable('Path', 'Machine')
          $user = [Environment]::GetEnvironmentVariable('Path', 'User')
          $env:Path = "$machine;$user;$env:Path"

          az version | Out-Host
          if ($LASTEXITCODE -ne 0) { throw "az version exited $LASTEXITCODE" }
          $azdVersion = Join-Path $env:RUNNER_TEMP 'azd-version.txt'
          azd version | Tee-Object -FilePath $azdVersion | Out-Host
          if ($LASTEXITCODE -ne 0) { throw "azd version exited $LASTEXITCODE" }
          $extensions = azd ext list --installed -o json | Out-String
          if ($LASTEXITCODE -ne 0) { throw "azd extension list exited $LASTEXITCODE" }
          $extensions | Write-Host
          $extensionsPath = Join-Path $env:RUNNER_TEMP 'azd-extensions.json'
          Set-Content -LiteralPath $extensionsPath -Value $extensions -Encoding utf8
          node .github/scripts/verify_devpack_smoke.mjs dependencies $env:RELEASE_TAG $azdVersion $extensionsPath
          if ($LASTEXITCODE -ne 0) { throw 'DevPack dependency verification failed' }

          $skill = Join-Path $env:USERPROFILE '.agents\skills\microsoft-foundry\SKILL.md'
          if (-not (Test-Path $skill -PathType Leaf)) { throw "microsoft-foundry skill not found at $skill" }

      - name: Verify VS Code extension and Copilot plugin
        if: matrix.scenario == 'with-code'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $machine = [Environment]::GetEnvironmentVariable('Path', 'Machine')
          $user = [Environment]::GetEnvironmentVariable('Path', 'User')
          $vscodeBin = Join-Path $env:LOCALAPPDATA 'Programs\Microsoft VS Code\bin'
          $env:Path = "$vscodeBin;$machine;$user;$env:Path"

          if (-not (code --list-extensions | Select-String -Quiet -Pattern 'ms-windows-ai-studio.windows-ai-studio')) {
            throw 'Foundry Toolkit VS Code extension not installed'
          }
          copilot --version | Out-Host
          if ($LASTEXITCODE -ne 0) { throw "Copilot version exited $LASTEXITCODE" }
          $plugins = copilot --no-color plugin list | Out-String
          if ($LASTEXITCODE -ne 0) { throw "Copilot plugin list exited $LASTEXITCODE" }
          Write-Host $plugins
          if ($plugins -notmatch 'microsoft-foundry') {
            throw 'Foundry Copilot plugin not installed'
          }

          $canonicalSkill = Join-Path $env:USERPROFILE '.agents\skills\microsoft-foundry'
          $claudeSkill = Join-Path $env:USERPROFILE '.claude\skills\microsoft-foundry'
          $item = Get-Item -LiteralPath $claudeSkill -Force
          if (-not $item.LinkType) { throw 'Claude Code skill is not a link' }
          $resolved = $item.ResolveLinkTarget($true)
          if (-not $resolved -or -not $resolved.FullName.Equals($canonicalSkill, [StringComparison]::OrdinalIgnoreCase)) {
            throw "Claude Code skill link does not target $canonicalSkill"
          }
          if (Test-Path (Join-Path $claudeSkill '.foundry-devpack-copy')) {
            throw 'Claude Code skill unexpectedly used the copy fallback'
          }

      - name: Collect dependency inventory
        if: always()
        shell: pwsh
        env:
          SMOKE_JOB_STATUS: ${{ job.status }}
        run: |
          $env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' +
            [Environment]::GetEnvironmentVariable('Path', 'User') + ';' + $env:Path
          node .github/scripts/devpack_smoke_schedule.mjs collect
          if ($LASTEXITCODE -ne 0) { throw 'Diagnostic collection failed' }

      - name: Verify ARP and uninstall
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $key = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft.FoundryDevPack'
          if (-not (Test-Path $key)) { throw 'Foundry DevPack ARP entry not found' }
          $entry = Get-ItemProperty $key
          if (-not (Test-Path $entry.InstallLocation -PathType Container)) { throw 'ARP install location not found' }
          if (-not (Test-Path $entry.DisplayIcon -PathType Leaf)) { throw 'persisted installer not found' }
          $binarySignature = Get-AuthenticodeSignature $entry.DisplayIcon
          if ($binarySignature.Status -ne 'Valid') {
            throw "invalid installer signature: $($binarySignature.Status) $($binarySignature.StatusMessage)"
          }
          if ($binarySignature.SignerCertificate.Subject -notlike 'CN=Microsoft Corporation,*') {
            throw "unexpected installer signer: $($binarySignature.SignerCertificate.Subject)"
          }
          $expectedVersion = $env:RELEASE_TAG -replace '^devpack-installer-', ''
          if ($entry.DisplayVersion -ne $expectedVersion) {
            throw "ARP version $($entry.DisplayVersion), expected $expectedVersion"
          }
          Write-Host "ARP: $($entry.DisplayName) $($entry.DisplayVersion)"

          $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
          $principal = [Security.Principal.WindowsPrincipal]::new($identity)
          $isElevated = $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
          if ($env:INSTALL_SOURCE -eq 'winget' -and -not $isElevated) {
            winget uninstall --exact --id Microsoft.FoundryDevPack --source winget `
              --silent --disable-interactivity --accept-source-agreements
          } else {
            if ($env:INSTALL_SOURCE -eq 'winget') {
              Write-Host 'Runner is elevated; using the persisted uninstaller for this user-scope package.'
            }
            & $entry.DisplayIcon uninstall
          }
          if ($LASTEXITCODE -ne 0) { throw "uninstall exited $LASTEXITCODE" }
          if (Test-Path $key) { throw 'ARP entry still present after uninstall' }

      - name: Remove trusted publisher and bootstrap
        if: always() && env.INSTALL_SOURCE != 'winget'
        shell: pwsh
        run: |
          if ($env:SIGNER_THUMBPRINT -and $env:SIGNER_WAS_TRUSTED -eq 'False') {
            $store = [Security.Cryptography.X509Certificates.X509Store]::new('TrustedPublisher', 'CurrentUser')
            $store.Open([Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
            try {
              $certificates = $store.Certificates.Find(
                [Security.Cryptography.X509Certificates.X509FindType]::FindByThumbprint,
                $env:SIGNER_THUMBPRINT,
                $false)
              foreach ($certificate in $certificates) { $store.Remove($certificate) }
            }
            finally {
              $store.Dispose()
            }
          }
          if ($env:DEVPACK_SCRIPT -and (Test-Path -LiteralPath $env:DEVPACK_SCRIPT)) {
            Remove-Item -LiteralPath $env:DEVPACK_SCRIPT -Force
          }

      - name: Upload smoke diagnostics
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: devpack-smoke-windows-${{ matrix.platform.arch }}-${{ matrix.scenario }}-${{ matrix.source }}
          path: |
            ${{ runner.temp }}/devpack-diagnostics/
            ${{ runner.temp }}/foundry-devpack*.log
            ${{ runner.temp }}/foundry-devpack-output.txt
            ${{ runner.temp }}/azd-version.txt
            ${{ runner.temp }}/azd-extensions.json
          retention-days: 7
          if-no-files-found: warn

  linux:
    needs: prepare
    if: ${{ needs.prepare.outputs.linux_sources != '[]' }}
    name: linux ${{ matrix.platform.arch }} ${{ matrix.scenario }} (${{ matrix.source }}, telemetry=${{ inputs.telemetry || false }})
    runs-on: ${{ matrix.platform.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        source: ${{ fromJSON(needs.prepare.outputs.linux_sources) }}
        scenario: [baseline, no-az, with-code]
        platform:
          - { os: ubuntu-latest, arch: x64 }
          - { os: ubuntu-24.04-arm, arch: arm64 }

    env:
      RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
      INSTALL_SOURCE: ${{ matrix.source }}
      SCENARIO: ${{ matrix.scenario }}

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'release' && github.event.repository.default_branch || github.ref }}
          persist-credentials: false

      - name: Test smoke assertions
        shell: bash
        run: node --test .github/scripts/verify_devpack_smoke.test.mjs

      - name: Verify release tag
        shell: bash
        run: |
          set -euo pipefail
          [[ "$RELEASE_TAG" =~ ^devpack-installer-[0-9A-Za-z][0-9A-Za-z.-]*$ ]]
          expected=0
          if [ "$TELEMETRY_ENABLED" = "true" ]; then expected=1; fi
          [ "$FOUNDRY_DEVPACK_COLLECT_TELEMETRY" = "$expected" ]
          echo "Testing $RELEASE_TAG from $INSTALL_SOURCE on linux ${{ matrix.platform.arch }} (${{ matrix.scenario }}), telemetry=$TELEMETRY_ENABLED"

      - name: Remove Azure CLI
        if: matrix.scenario == 'no-az'
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt-get remove -y azure-cli || true
          if command -v az >/dev/null 2>&1; then
            echo 'Azure CLI is still available after removal' >&2
            exit 1
          fi

      - name: Install VS Code, Copilot CLI, and Claude shim
        if: matrix.scenario == 'with-code'
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt-get update
          sudo apt-get install -y wget gpg apt-transport-https
          wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /usr/share/keyrings/packages.microsoft.gpg >/dev/null
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/code stable main" | sudo tee /etc/apt/sources.list.d/vscode.list
          sudo apt-get update
          sudo apt-get install -y code
          curl -fsSL https://gh.io/copilot-install | bash
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          mkdir -p "$RUNNER_TEMP/claude-bin"
          printf '#!/bin/sh\nexit 0\n' > "$RUNNER_TEMP/claude-bin/claude"
          chmod +x "$RUNNER_TEMP/claude-bin/claude"
          echo "$RUNNER_TEMP/claude-bin" >> "$GITHUB_PATH"

      - name: Confirm Copilot CLI is absent
        if: matrix.scenario != 'with-code'
        shell: bash
        run: |
          if command -v copilot >/dev/null 2>&1; then
            echo 'Copilot CLI unexpectedly present; Canvas skip path cannot be tested' >&2
            exit 1
          fi

      - name: Download and verify bootstrap syntax
        shell: bash
        run: |
          set -euo pipefail
          script="$RUNNER_TEMP/foundry-devpack.sh"
          if [ "$INSTALL_SOURCE" = "aka" ]; then
            url="https://aka.ms/foundry-devpack-install.sh"
          else
            url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${RELEASE_TAG}/foundry-devpack.sh"
          fi
          curl -fsSL "$url" -o "$script"
          bash -n "$script"
          grep -Fx "release_tag=\"$RELEASE_TAG\"" "$script"
          echo "DEVPACK_SCRIPT=$script" >> "$GITHUB_ENV"

      - name: Install through shell bootstrap
        shell: bash
        run: |
          set -euo pipefail
          temp="$RUNNER_TEMP/devpack-bootstrap-temp"
          mkdir -p "$temp"
          export TMPDIR="$temp"

          if [ "$INSTALL_SOURCE" = "aka" ]; then
            curl -fsSL https://aka.ms/foundry-devpack-install.sh | bash 2>&1 | tee "$RUNNER_TEMP/foundry-devpack-output.txt"
            node .github/scripts/verify_devpack_smoke.mjs run "$RELEASE_TAG" "$SCENARIO" console "$RUNNER_TEMP/foundry-devpack-output.txt"
          else
            bash "$DEVPACK_SCRIPT" --verbose --log "$RUNNER_TEMP/foundry-devpack.log"
            node .github/scripts/verify_devpack_smoke.mjs run "$RELEASE_TAG" "$SCENARIO" log "$RUNNER_TEMP/foundry-devpack.log"
          fi
          if find "$temp" -mindepth 1 -maxdepth 1 -type d -name 'foundry-devpack-*' -print -quit | grep -q .; then
            echo "error: bootstrap left temporary directories under $temp" >&2
            find "$temp" -mindepth 1 -maxdepth 1 -type d -name 'foundry-devpack-*' -print >&2
            exit 1
          fi

      - name: Verify installed components
        shell: bash
        run: |
          set -euxo pipefail
          export PATH="$HOME/.local/bin:$PATH"
          az version
          azd version | tee "$RUNNER_TEMP/azd-version.txt"
          azd ext list --installed -o json | tee "$RUNNER_TEMP/azd-extensions.json"
          node .github/scripts/verify_devpack_smoke.mjs dependencies "$RELEASE_TAG" "$RUNNER_TEMP/azd-version.txt" "$RUNNER_TEMP/azd-extensions.json"
          test -f "$HOME/.agents/skills/microsoft-foundry/SKILL.md"

      - name: Verify VS Code extension and Copilot plugin
        if: matrix.scenario == 'with-code'
        shell: bash
        run: |
          set -euxo pipefail
          export PATH="$HOME/.local/bin:$PATH"
          code --list-extensions | grep -qi 'ms-windows-ai-studio.windows-ai-studio'
          copilot --version
          copilot --no-color plugin list | tee "$RUNNER_TEMP/copilot-plugins.txt"
          grep -qi 'microsoft-foundry' "$RUNNER_TEMP/copilot-plugins.txt"
          test -L "$HOME/.claude/skills/microsoft-foundry"
          test "$(readlink "$HOME/.claude/skills/microsoft-foundry")" = "$HOME/.agents/skills/microsoft-foundry"
          test ! -e "$HOME/.claude/skills/microsoft-foundry/.foundry-devpack-copy"

      - name: Collect dependency inventory
        if: always()
        shell: bash
        env:
          SMOKE_JOB_STATUS: ${{ job.status }}
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          node .github/scripts/devpack_smoke_schedule.mjs collect

      - name: Remove bootstrap
        if: always()
        shell: bash
        run: rm -f "$DEVPACK_SCRIPT"

      - name: Upload smoke diagnostics
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: devpack-smoke-linux-${{ matrix.platform.arch }}-${{ matrix.scenario }}-${{ matrix.source }}
          path: |
            ${{ runner.temp }}/devpack-diagnostics/
            ${{ runner.temp }}/foundry-devpack*.log
            ${{ runner.temp }}/foundry-devpack-output.txt
            ${{ runner.temp }}/azd-version.txt
            ${{ runner.temp }}/azd-extensions.json
            ${{ runner.temp }}/copilot-plugins.txt
          retention-days: 7
          if-no-files-found: warn

  macos:
    needs: prepare
    if: ${{ needs.prepare.outputs.macos_sources != '[]' }}
    name: macos ${{ matrix.platform.arch }} ${{ matrix.scenario }} (${{ matrix.source }}, telemetry=${{ inputs.telemetry || false }})
    runs-on: ${{ matrix.platform.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        source: ${{ fromJSON(needs.prepare.outputs.macos_sources) }}
        scenario: [baseline, no-az, with-code]
        platform:
          - { os: macos-15-intel, arch: x64 }
          - { os: macos-latest, arch: arm64 }
        # Fresh Azure CLI installs on Intel now build dependencies from source
        # without Homebrew bottle support. Retain baseline/with-code coverage.
        exclude:
          - platform: { os: macos-15-intel, arch: x64 }
            scenario: no-az

    env:
      RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
      INSTALL_SOURCE: ${{ matrix.source }}
      SCENARIO: ${{ matrix.scenario }}
      HOMEBREW_NO_AUTO_UPDATE: "1"
      HOMEBREW_NO_ANALYTICS: "1"

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'release' && github.event.repository.default_branch || github.ref }}
          persist-credentials: false

      - name: Test smoke assertions
        shell: bash
        run: node --test .github/scripts/verify_devpack_smoke.test.mjs

      - name: Verify release tag
        shell: bash
        run: |
          set -euo pipefail
          [[ "$RELEASE_TAG" =~ ^devpack-installer-[0-9A-Za-z][0-9A-Za-z.-]*$ ]]
          expected=0
          if [ "$TELEMETRY_ENABLED" = "true" ]; then expected=1; fi
          [ "$FOUNDRY_DEVPACK_COLLECT_TELEMETRY" = "$expected" ]
          echo "Testing $RELEASE_TAG from $INSTALL_SOURCE on macos ${{ matrix.platform.arch }} (${{ matrix.scenario }}), telemetry=$TELEMETRY_ENABLED"

      - name: Refresh Homebrew metadata
        if: github.event_name == 'schedule' || inputs.install_source == 'all' || matrix.source == 'brew'
        shell: bash
        run: brew update

      - name: Remove Azure CLI
        if: matrix.scenario == 'no-az'
        shell: bash
        run: |
          set -euxo pipefail
          formulae="$(brew list --formula)"
          casks="$(brew list --cask)"
          if grep -Fxq azure-cli <<< "$casks"; then
            brew uninstall --cask azure-cli
          fi
          if grep -Fxq azure-cli <<< "$formulae"; then
            brew uninstall --formula --force --ignore-dependencies azure-cli
          fi
          hash -r
          if command -v az >/dev/null 2>&1; then
            echo 'Azure CLI is still available after removal' >&2
            type -a az >&2
            exit 1
          fi

      - name: Install VS Code, Copilot CLI, and Claude shim
        if: matrix.scenario == 'with-code'
        shell: bash
        run: |
          set -euxo pipefail
          brew install --cask visual-studio-code
          brew install --cask copilot-cli
          sudo mkdir -p /usr/local/bin
          sudo ln -sf '/Applications/Visual Studio Code.app/Contents/Resources/app/bin/code' /usr/local/bin/code
          mkdir -p "$RUNNER_TEMP/claude-bin"
          printf '#!/bin/sh\nexit 0\n' > "$RUNNER_TEMP/claude-bin/claude"
          chmod +x "$RUNNER_TEMP/claude-bin/claude"
          echo "$RUNNER_TEMP/claude-bin" >> "$GITHUB_PATH"

      - name: Confirm Copilot CLI is absent
        if: matrix.scenario != 'with-code'
        shell: bash
        run: |
          if command -v copilot >/dev/null 2>&1; then
            echo 'Copilot CLI unexpectedly present; Canvas skip path cannot be tested' >&2
            exit 1
          fi

      - name: Download and verify bootstrap syntax
        if: env.INSTALL_SOURCE != 'brew'
        shell: bash
        run: |
          set -euo pipefail
          script="$RUNNER_TEMP/foundry-devpack.sh"
          if [ "$INSTALL_SOURCE" = "aka" ]; then
            url="https://aka.ms/foundry-devpack-install.sh"
          else
            url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${RELEASE_TAG}/foundry-devpack.sh"
          fi
          curl -fsSL "$url" -o "$script"
          bash -n "$script"
          grep -Fx "release_tag=\"$RELEASE_TAG\"" "$script"
          echo "DEVPACK_SCRIPT=$script" >> "$GITHUB_ENV"

      - name: Install DevPack
        shell: bash
        run: |
          set -euo pipefail
          temp="$RUNNER_TEMP/devpack-bootstrap-temp"
          mkdir -p "$temp"
          export TMPDIR="$temp"

          case "$INSTALL_SOURCE" in
            aka)
              curl -fsSL https://aka.ms/foundry-devpack-install.sh | bash 2>&1 | tee "$RUNNER_TEMP/foundry-devpack-output.txt"
              node .github/scripts/verify_devpack_smoke.mjs run "$RELEASE_TAG" "$SCENARIO" console "$RUNNER_TEMP/foundry-devpack-output.txt"
              ;;
            brew)
              brew untap microsoft/foundry 2>/dev/null || true
              brew install --cask microsoft/foundry/devpack
              foundry-devpack install 2>&1 | tee "$RUNNER_TEMP/foundry-devpack-output.txt"
              node .github/scripts/verify_devpack_smoke.mjs run "$RELEASE_TAG" "$SCENARIO" console "$RUNNER_TEMP/foundry-devpack-output.txt"
              expected_version="${RELEASE_TAG#devpack-installer-}"
              foundry-devpack --version | grep -F "$expected_version"
              ;;
            release)
              bash "$DEVPACK_SCRIPT" --verbose --log "$RUNNER_TEMP/foundry-devpack.log"
              node .github/scripts/verify_devpack_smoke.mjs run "$RELEASE_TAG" "$SCENARIO" log "$RUNNER_TEMP/foundry-devpack.log"
              ;;
            *)
              echo "error: unsupported install source: $INSTALL_SOURCE" >&2
              exit 1
              ;;
          esac
          if find "$temp" -mindepth 1 -maxdepth 1 -type d -name 'foundry-devpack-*' -print -quit | grep -q .; then
            echo "error: bootstrap left temporary directories under $temp" >&2
            find "$temp" -mindepth 1 -maxdepth 1 -type d -name 'foundry-devpack-*' -print >&2
            exit 1
          fi

      - name: Verify installed components
        shell: bash
        run: |
          set -euxo pipefail
          export PATH="$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
          az version
          azd version | tee "$RUNNER_TEMP/azd-version.txt"
          azd ext list --installed -o json | tee "$RUNNER_TEMP/azd-extensions.json"
          node .github/scripts/verify_devpack_smoke.mjs dependencies "$RELEASE_TAG" "$RUNNER_TEMP/azd-version.txt" "$RUNNER_TEMP/azd-extensions.json"
          test -f "$HOME/.agents/skills/microsoft-foundry/SKILL.md"

      - name: Verify VS Code extension and Copilot plugin
        if: matrix.scenario == 'with-code'
        shell: bash
        run: |
          set -euxo pipefail
          export PATH="$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
          code --list-extensions | grep -qi 'ms-windows-ai-studio.windows-ai-studio'
          copilot --version
          copilot --no-color plugin list | tee "$RUNNER_TEMP/copilot-plugins.txt"
          grep -qi 'microsoft-foundry' "$RUNNER_TEMP/copilot-plugins.txt"
          test -L "$HOME/.claude/skills/microsoft-foundry"
          test "$(readlink "$HOME/.claude/skills/microsoft-foundry")" = "$HOME/.agents/skills/microsoft-foundry"
          test ! -e "$HOME/.claude/skills/microsoft-foundry/.foundry-devpack-copy"

      - name: Collect dependency inventory
        if: always()
        shell: bash
        env:
          SMOKE_JOB_STATUS: ${{ job.status }}
        run: |
          export PATH="$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
          node .github/scripts/devpack_smoke_schedule.mjs collect

      - name: Uninstall Homebrew cask
        if: env.INSTALL_SOURCE == 'brew'
        shell: bash
        run: |
          set -euxo pipefail
          brew uninstall --zap --cask microsoft/foundry/devpack
          ! command -v foundry-devpack
          test -f "$HOME/.agents/skills/microsoft-foundry/SKILL.md"

      - name: Remove bootstrap
        if: always() && env.INSTALL_SOURCE != 'brew'
        shell: bash
        run: rm -f "$DEVPACK_SCRIPT"

      - name: Upload smoke diagnostics
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: devpack-smoke-macos-${{ matrix.platform.arch }}-${{ matrix.scenario }}-${{ matrix.source }}
          path: |
            ${{ runner.temp }}/devpack-diagnostics/
            ${{ runner.temp }}/foundry-devpack*.log
            ${{ runner.temp }}/foundry-devpack-output.txt
            ${{ runner.temp }}/azd-version.txt
            ${{ runner.temp }}/azd-extensions.json
            ${{ runner.temp }}/copilot-plugins.txt
          retention-days: 7
          if-no-files-found: warn

  report:
    name: Report daily smoke
    needs: [prepare, windows, linux, macos]
    if: ${{ always() && (github.event_name == 'schedule' || inputs.install_source == 'all') }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      actions: read
      issues: write
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v4
        with:
          pattern: devpack-smoke-*
          path: ${{ runner.temp }}/smoke-artifacts
      - name: Summarize results and update tracking issue
        if: always()
        env:
          SMOKE_RESULTS: ${{ toJSON(needs) }}
          SMOKE_ARTIFACTS: ${{ runner.temp }}/smoke-artifacts
          REPORT_ISSUE: ${{ github.event_name == 'schedule' }}
        run: node .github/scripts/devpack_smoke_schedule.mjs report