release.yml

name: release

"on":
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Optional tag to build/release (e.g. v1.23.0). If empty, uses the current ref."
        required: false
        default: ""

permissions:
  contents: write

concurrency:
  group: release-${{ github.workflow }}-${{ github.event.inputs.tag || github.ref }}
  cancel-in-progress: false

jobs:
  build-release:
    name: build (${{ matrix.vixos }} / ${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            vixos: linux
            arch: x86_64

          - os: ubuntu-24.04-arm
            vixos: linux
            arch: aarch64

          - os: macos-15-intel
            vixos: macos
            arch: x86_64

          - os: macos-14
            vixos: macos
            arch: aarch64

          - os: windows-2022
            vixos: windows
            arch: x86_64

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Checkout tag (manual input)
        if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag != '' }}
        shell: bash
        run: |
          set -euxo pipefail
          git fetch --tags --force
          git checkout "tags/${{ github.event.inputs.tag }}"

      # -------------------------
      # Linux deps (native x86_64)
      # -------------------------
      - name: Install deps (Linux x86_64)
        if: runner.os == 'Linux' && matrix.arch == 'x86_64'
        shell: bash
        run: |
          set -euxo pipefail

          sudo apt-get update

          sudo apt-get install -y --no-install-recommends \
            build-essential \
            cmake \
            pkg-config \
            ninja-build \
            ca-certificates \
            nlohmann-json3-dev \
            libssl-dev \
            zlib1g-dev \
            libsqlite3-dev \
            libbrotli-dev \
            libspdlog-dev \
            libfmt-dev \
            libgtk-3-dev

          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev || \
          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.0-dev

          pkg-config --modversion gtk+-3.0
          pkg-config --modversion webkit2gtk-4.1 || pkg-config --modversion webkit2gtk-4.0

      # -------------------------
      # Linux aarch64 toolchain + arm64 dev libs
      # -------------------------
      - name: Setup Linux aarch64 toolchain
        if: runner.os == 'Linux' && matrix.arch == 'aarch64'
        shell: bash
        run: |
          set -euxo pipefail

          sudo dpkg --add-architecture arm64 || true
          sudo apt-get update

          sudo apt-get install -y --no-install-recommends \
            build-essential \
            cmake \
            gcc-aarch64-linux-gnu \
            g++-aarch64-linux-gnu \
            pkg-config \
            ninja-build \
            ca-certificates \
            nlohmann-json3-dev:arm64 \
            libssl-dev:arm64 \
            zlib1g-dev:arm64 \
            libsqlite3-dev:arm64 \
            libbrotli-dev:arm64 \
            libspdlog-dev:arm64 \
            libfmt-dev:arm64 \
            libgtk-3-dev:arm64

          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev:arm64 || \
          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.0-dev:arm64

          cat > toolchain-aarch64.cmake <<'EOF'
          set(CMAKE_SYSTEM_NAME Linux)
          set(CMAKE_SYSTEM_PROCESSOR aarch64)

          set(CMAKE_C_COMPILER   aarch64-linux-gnu-gcc)
          set(CMAKE_CXX_COMPILER aarch64-linux-gnu-g++)

          set(CMAKE_FIND_ROOT_PATH
            /usr/aarch64-linux-gnu
            /usr/lib/aarch64-linux-gnu
            /usr/include/aarch64-linux-gnu
            /usr
          )

          set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
          set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
          set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
          set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE BOTH)

          list(APPEND CMAKE_PREFIX_PATH
            /usr/lib/aarch64-linux-gnu/cmake
            /usr/lib/x86_64-linux-gnu/cmake
            /usr/lib/cmake
            /lib/aarch64-linux-gnu/cmake
            /lib/x86_64-linux-gnu/cmake
          )

          set(PKG_CONFIG_EXECUTABLE /usr/bin/pkg-config)
          set(ENV{PKG_CONFIG_LIBDIR} "/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig")
          set(ENV{PKG_CONFIG_PATH} "")
          EOF

          PKG_CONFIG_LIBDIR="/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig" \
            pkg-config --modversion gtk+-3.0

          PKG_CONFIG_LIBDIR="/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig" \
            pkg-config --modversion webkit2gtk-4.1 || \
          PKG_CONFIG_LIBDIR="/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig" \
            pkg-config --modversion webkit2gtk-4.0

      # -------------------------
      # macOS deps
      # -------------------------
      - name: Install deps (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euxo pipefail

          export HOMEBREW_NO_AUTO_UPDATE=1
          export HOMEBREW_NO_INSTALL_UPGRADE=1
          export HOMEBREW_NO_INSTALL_CLEANUP=1

          brew install \
            cmake \
            ninja \
            pkg-config \
            openssl@3 \
            nlohmann-json \
            spdlog \
            fmt

      # -------------------------
      # Windows deps (OpenSSL via vcpkg)
      # -------------------------
      - name: Setup vcpkg (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          git clone https://github.com/microsoft/vcpkg $env:GITHUB_WORKSPACE\vcpkg
          "VCPKG_ROOT=$env:GITHUB_WORKSPACE\vcpkg" | Out-File -FilePath $env:GITHUB_ENV -Append
          cd $env:GITHUB_WORKSPACE\vcpkg
          .\bootstrap-vcpkg.bat

      # -------------------------
      # Configure (Unix)
      # -------------------------
      # NOTE: The normal CLI release intentionally uses the legacy (non-SDK)
      # profile. VIX_SDK_PROFILE is opt-in; "legacy" preserves the exact
      # historical module defaults for this lightweight multi-platform CLI
      # build. SDK profiles (default/web/data/...) are only used by
      # sdk-release.yml. Do NOT switch this to an SDK profile.
      - name: Configure (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euxo pipefail

          CMAKE_ARGS=(
            -S . -B build -G Ninja
            -DCMAKE_BUILD_TYPE=Release
            -DVIX_SDK_PROFILE=legacy
            -DVIX_ENABLE_INSTALL=OFF
            -DVIX_DB_USE_MYSQL=OFF
            -DVIX_CORE_WITH_MYSQL=OFF
            -DVIX_ENABLE_HTTP_COMPRESSION=OFF

            -DVIX_ENABLE_UI=ON
            -DVIX_ENABLE_NOTE=ON
            -DVIX_UI_BUILD_TESTS=OFF
            -DVIX_UI_BUILD_EXAMPLES=OFF
            -DVIX_UI_BUILD_BENCHMARKS=OFF
            -DUI_BUILD_TESTS=OFF
            -DUI_BUILD_EXAMPLES=OFF
            -DUI_BUILD_BENCHMARKS=OFF
            -DUI_INSTALL=OFF
            -DVIX_NOTE_BUILD_TESTS=OFF
            -DVIX_NOTE_BUILD_EXAMPLES=OFF
            -DVIX_NOTE_INSTALL=OFF
          )

          if [ "${{ runner.os }}" = "Linux" ]; then
            CMAKE_ARGS+=(
              -DVIX_UI_ENABLE_LINUX_WEBVIEW=ON
            )
          else
            CMAKE_ARGS+=(
              -DVIX_UI_ENABLE_LINUX_WEBVIEW=OFF
            )
          fi

          if [ "${{ runner.os }}" = "Linux" ] && [ "${{ matrix.arch }}" = "aarch64" ]; then
            CMAKE_ARGS+=(
              -DCMAKE_TOOLCHAIN_FILE="${GITHUB_WORKSPACE}/toolchain-aarch64.cmake"
            )
          fi

          if [ "${{ runner.os }}" = "macOS" ]; then
            BREW_PREFIX="$(brew --prefix)"
            BREW_SSL="$(brew --prefix openssl@3)"

            CMAKE_ARGS+=(-DOPENSSL_ROOT_DIR="$BREW_SSL")
            CMAKE_ARGS+=(-DCMAKE_PREFIX_PATH="$BREW_PREFIX")
            CMAKE_ARGS+=(-Dnlohmann_json_DIR="$BREW_PREFIX/share/cmake/nlohmann_json")
          fi

          : > cmake_output.log
          cmake "${CMAKE_ARGS[@]}" --log-level=VERBOSE --debug-output 2>&1 | tee -a cmake_output.log

      - name: Dump CMake logs (Unix)
        if: failure() && runner.os != 'Windows'
        shell: bash
        run: |
          set +e
          echo "=== build/ dir ==="
          ls -la build || true
          echo
          echo "=== CMakeError.log (tail) ==="
          test -f build/CMakeFiles/CMakeError.log && tail -n 250 build/CMakeFiles/CMakeError.log || echo "missing"
          echo
          echo "=== CMakeOutput.log (tail) ==="
          test -f build/CMakeFiles/CMakeOutput.log && tail -n 250 build/CMakeFiles/CMakeOutput.log || echo "missing"
          echo
          echo "=== CMakeConfigureLog.yaml (tail) ==="
          test -f build/CMakeFiles/CMakeConfigureLog.yaml && tail -n 250 build/CMakeFiles/CMakeConfigureLog.yaml || echo "missing"
          echo
          echo "=== cmake_output.log (tail) ==="
          test -f cmake_output.log && tail -n 200 cmake_output.log || echo "missing"

      - name: Build (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euxo pipefail
          : > build_output.log
          cmake --build build -j 2>&1 | tee -a build_output.log

      - name: Collect logs (Unix)
        if: always() && runner.os != 'Windows'
        shell: bash
        run: |
          set -euxo pipefail
          OUT="logs/${{ matrix.vixos }}-${{ matrix.arch }}"
          mkdir -p "$OUT"
          echo "logs collected" > "$OUT/_ok.txt"
          test -f cmake_output.log && cp -f cmake_output.log "$OUT/" || true
          test -f build_output.log && cp -f build_output.log "$OUT/" || true
          test -f build/CMakeCache.txt && cp -f build/CMakeCache.txt "$OUT/" || true
          test -f build/CMakeFiles/CMakeError.log && cp -f build/CMakeFiles/CMakeError.log "$OUT/" || true
          test -f build/CMakeFiles/CMakeOutput.log && cp -f build/CMakeFiles/CMakeOutput.log "$OUT/" || true
          test -f build/CMakeFiles/CMakeConfigureLog.yaml && cp -f build/CMakeFiles/CMakeConfigureLog.yaml "$OUT/" || true
          find logs -maxdepth 3 -type f -print || true

      - name: Upload logs (Unix)
        if: always() && runner.os != 'Windows'
        uses: actions/upload-artifact@v6
        with:
          name: logs-${{ matrix.vixos }}-${{ matrix.arch }}
          path: logs/${{ matrix.vixos }}-${{ matrix.arch }}/*
          if-no-files-found: warn

      - name: Vcpkg install (manifest, Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          Write-Host "VCPKG_ROOT=$env:VCPKG_ROOT"
          cd $env:GITHUB_WORKSPACE

          & "$env:VCPKG_ROOT\vcpkg.exe" install --triplet x64-windows --x-manifest-root "$env:GITHUB_WORKSPACE"
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      # -------------------------
      # Configure + Build (Windows)
      # -------------------------
      # NOTE: legacy (non-SDK) profile on purpose — see Unix configure note.
      - name: Configure (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          "" | Out-File -FilePath cmake_output.log -Encoding utf8

          Write-Host "VCPKG_ROOT=$env:VCPKG_ROOT"

          cmake -S . -B build -A x64 `
            -DVIX_SDK_PROFILE=legacy `
            -DVIX_ENABLE_INSTALL=OFF `
            -DVIX_BUILD_EXAMPLES=OFF `
            -DVIX_BUILD_TESTS=OFF `
            -DVIX_DB_USE_MYSQL=OFF `
            -DVIX_DB_USE_SQLITE=OFF `
            -DVIX_CORE_WITH_MYSQL=OFF `
            -DVIX_ENABLE_HTTP_COMPRESSION=OFF `
            -DVIX_ENABLE_UI=ON `
            -DVIX_ENABLE_NOTE=ON `
            -DVIX_UI_ENABLE_LINUX_WEBVIEW=OFF `
            -DVIX_UI_BUILD_TESTS=OFF `
            -DVIX_UI_BUILD_EXAMPLES=OFF `
            -DVIX_UI_BUILD_BENCHMARKS=OFF `
            -DUI_BUILD_TESTS=OFF `
            -DUI_BUILD_EXAMPLES=OFF `
            -DUI_BUILD_BENCHMARKS=OFF `
            -DUI_INSTALL=OFF `
            -DVIX_NOTE_BUILD_TESTS=OFF `
            -DVIX_NOTE_BUILD_EXAMPLES=OFF `
            -DVIX_NOTE_INSTALL=OFF `
            -DVCPKG_TARGET_TRIPLET=x64-windows `
            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT\scripts\buildsystems\vcpkg.cmake" 2>&1 | Tee-Object -FilePath cmake_output.log -Append

          if ($LASTEXITCODE -ne 0) {
            exit $LASTEXITCODE
          }

      - name: Dump vcpkg manifest log (Windows)
        if: failure() && runner.os == 'Windows'
        shell: pwsh
        run: |
          Write-Host "=== cmake_output.log ==="
          if (Test-Path "cmake_output.log") {
            Get-Content "cmake_output.log" -Raw
          } else {
            Write-Host "missing cmake_output.log"
          }

          Write-Host "=== vcpkg-manifest-install.log ==="
          if (Test-Path "build\vcpkg-manifest-install.log") {
            Get-Content "build\vcpkg-manifest-install.log" -Raw
          } else {
            Write-Host "missing build\vcpkg-manifest-install.log"
          }

          Write-Host "=== vcpkg logs (last 200 lines each) ==="
          $logRoot = "$env:VCPKG_ROOT\buildtrees"
          if (Test-Path $logRoot) {
            Get-ChildItem -Recurse $logRoot -Filter "*.log" -ErrorAction SilentlyContinue |
              Sort-Object LastWriteTime -Descending |
              Select-Object -First 8 |
              ForEach-Object {
                Write-Host "`n--- $($_.FullName) ---"
                Get-Content $_.FullName -Tail 200
              }
          } else {
            Write-Host "missing vcpkg buildtrees folder"
          }

      - name: Build (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          "" | Out-File -FilePath build_output.log -Encoding utf8

          cmake --build build --config Release 2>&1 | Tee-Object -FilePath build_output.log -Append

          if ($LASTEXITCODE -ne 0) {
            exit $LASTEXITCODE
          }

      - name: Collect logs (Windows)
        if: always() && runner.os == 'Windows'
        shell: pwsh
        run: |
          $out = "logs/${{ matrix.vixos }}-${{ matrix.arch }}"
          New-Item -ItemType Directory -Force -Path $out | Out-Null

          if (Test-Path "cmake_output.log") { Copy-Item "cmake_output.log" $out -Force }
          if (Test-Path "build_output.log") { Copy-Item "build_output.log" $out -Force }

          if (Test-Path "build\CMakeCache.txt") { Copy-Item "build\CMakeCache.txt" $out -Force }
          if (Test-Path "build\CMakeFiles\CMakeError.log") { Copy-Item "build\CMakeFiles\CMakeError.log" $out -Force }
          if (Test-Path "build\CMakeFiles\CMakeOutput.log") { Copy-Item "build\CMakeFiles\CMakeOutput.log" $out -Force }
          if (Test-Path "build\CMakeFiles\CMakeConfigureLog.yaml") { Copy-Item "build\CMakeFiles\CMakeConfigureLog.yaml" $out -Force }

          if (Test-Path "build") {
            Compress-Archive -Path "build\*" -DestinationPath "$out\build.zip" -Force
          }

      - name: Upload logs (Windows)
        if: always() && runner.os == 'Windows'
        uses: actions/upload-artifact@v6
        with:
          name: logs-${{ matrix.vixos }}-${{ matrix.arch }}
          path: logs/${{ matrix.vixos }}-${{ matrix.arch }}/*
          if-no-files-found: warn

      # -------------------------
      # Package artifact
      # -------------------------
      - name: Package (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euxo pipefail

          BIN=""
          for p in "build/vix" "build/bin/vix" "build/Release/vix"; do
            if [ -f "$p" ]; then
              BIN="$p"
              break
            fi
          done

          if [ -z "$BIN" ]; then
            echo "Expected vix binary not found. Listing build/ ..." >&2
            ls -la build || true
            find build -maxdepth 6 -type f -name vix -print || true
            exit 1
          fi

          PACKAGE_DIR="package-${{ matrix.vixos }}-${{ matrix.arch }}"
          ASSET="vix-${{ matrix.vixos }}-${{ matrix.arch }}.tar.gz"

          rm -rf "$PACKAGE_DIR"
          mkdir -p \
            "$PACKAGE_DIR/share/vix/note/assets" \
            dist

          cp "$BIN" "$PACKAGE_DIR/vix"
          chmod +x "$PACKAGE_DIR/vix"

          cp modules/note/assets/index.html \
            "$PACKAGE_DIR/share/vix/note/index.html"

          cp modules/note/assets/note.css \
            "$PACKAGE_DIR/share/vix/note/assets/note.css"

          cp modules/note/assets/note.js \
            "$PACKAGE_DIR/share/vix/note/assets/note.js"

          test -x "$PACKAGE_DIR/vix"
          test -f "$PACKAGE_DIR/share/vix/note/index.html"
          test -f "$PACKAGE_DIR/share/vix/note/assets/note.css"
          test -f "$PACKAGE_DIR/share/vix/note/assets/note.js"

          tar -C "$PACKAGE_DIR" -czf "dist/$ASSET" .

          echo "Archive content:"
          tar -tzf "dist/$ASSET"

          rm -rf "$PACKAGE_DIR"

      - name: Validate packaged runtime (Linux)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euxo pipefail

          rm -rf smoke
          mkdir -p smoke

          tar -xzf \
            "dist/vix-${{ matrix.vixos }}-${{ matrix.arch }}.tar.gz" \
            -C smoke

          test -x smoke/vix
          test -f smoke/share/vix/note/index.html
          test -f smoke/share/vix/note/assets/note.css
          test -f smoke/share/vix/note/assets/note.js

          file smoke/vix
          ldd smoke/vix || true
          smoke/vix --version
          smoke/vix note --help >/tmp/vix-note-help.txt
          head -n 80 /tmp/vix-note-help.txt

      - name: Validate packaged runtime (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euxo pipefail

          smoke_root="$(mktemp -d)"
          trap 'rm -rf "$smoke_root"' EXIT

          archive="dist/vix-${{ matrix.vixos }}-${{ matrix.arch }}.tar.gz"
          extract_dir="$smoke_root/extract"
          install_dir="$smoke_root/install"

          test -f "$archive"
          tar -tzf "$archive"
          mkdir -p "$extract_dir"
          tar -xzf "$archive" -C "$extract_dir"

          test -f "$extract_dir/vix"
          test -x "$extract_dir/vix"
          test -f "$extract_dir/share/vix/note/index.html"
          test -f "$extract_dir/share/vix/note/assets/note.css"
          test -f "$extract_dir/share/vix/note/assets/note.js"
          "$extract_dir/vix" --version

          mkdir -p "$install_dir/bin" "$install_dir/share/vix"
          cp "$extract_dir/vix" "$install_dir/bin/vix"
          cp -R "$extract_dir/share/vix/note" "$install_dir/share/vix/note"
          test -x "$install_dir/bin/vix"
          test -f "$install_dir/share/vix/note/index.html"
          test -f "$install_dir/share/vix/note/assets/note.css"
          test -f "$install_dir/share/vix/note/assets/note.js"
          "$install_dir/bin/vix" --version
          "$install_dir/bin/vix" note --help >/tmp/vix-note-help.txt
          head -n 80 /tmp/vix-note-help.txt

      - name: Package (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"

          $candidates = @(
            "build\vix.exe",
            "build\Release\vix.exe",
            "build\bin\vix.exe",
            "build\Release\bin\vix.exe"
          )

          $bin = $null

          foreach ($p in $candidates) {
            if (Test-Path -LiteralPath $p) {
              $bin = $p
              break
            }
          }

          if (-not $bin) {
            Write-Host "Expected vix.exe not found in build outputs"

            if (Test-Path -LiteralPath "build") {
              Get-ChildItem -LiteralPath "build" -Recurse |
                Select-Object FullName
            }

            exit 1
          }

          $packageDir = "package-windows-${{ matrix.arch }}"
          $noteDir = Join-Path $packageDir "share\vix\note"
          $noteAssetsDir = Join-Path $noteDir "assets"

          Remove-Item `
            -LiteralPath $packageDir `
            -Recurse `
            -Force `
            -ErrorAction SilentlyContinue

          New-Item `
            -ItemType Directory `
            -Force `
            -Path "dist" |
            Out-Null

          New-Item `
            -ItemType Directory `
            -Force `
            -Path $noteAssetsDir |
            Out-Null

          Copy-Item `
            -LiteralPath $bin `
            -Destination (Join-Path $packageDir "vix.exe") `
            -Force

          Copy-Item `
            -LiteralPath "modules\note\assets\index.html" `
            -Destination (Join-Path $noteDir "index.html") `
            -Force

          Copy-Item `
            -LiteralPath "modules\note\assets\note.css" `
            -Destination (Join-Path $noteAssetsDir "note.css") `
            -Force

          Copy-Item `
            -LiteralPath "modules\note\assets\note.js" `
            -Destination (Join-Path $noteAssetsDir "note.js") `
            -Force

          $packagedExe = Join-Path $packageDir "vix.exe"

          $requiredFiles = @(
            $packagedExe,
            (Join-Path $noteDir "index.html"),
            (Join-Path $noteAssetsDir "note.css"),
            (Join-Path $noteAssetsDir "note.js")
          )

          foreach ($requiredFile in $requiredFiles) {
            if (-not (Test-Path -LiteralPath $requiredFile -PathType Leaf)) {
              Write-Host "Missing package file: $requiredFile"
              exit 1
            }
          }

          & $packagedExe --version

          if ($LASTEXITCODE -ne 0) {
            exit $LASTEXITCODE
          }

          & $packagedExe note --help |
            Select-Object -First 80

          if ($LASTEXITCODE -ne 0) {
            exit $LASTEXITCODE
          }

          $asset = "vix-windows-${{ matrix.arch }}.zip"

          Compress-Archive `
            -Path "$packageDir\*" `
            -DestinationPath "dist\$asset" `
            -Force

          Write-Host "Packaged archive content:"

          Add-Type -AssemblyName System.IO.Compression.FileSystem

          [System.IO.Compression.ZipFile]::OpenRead(
            (Resolve-Path "dist\$asset")
          ).Entries |
            ForEach-Object {
              Write-Host $_.FullName
            }

          Remove-Item `
            -LiteralPath $packageDir `
            -Recurse `
            -Force

      - name: Validate packaged runtime (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"

          $smokeRoot = Join-Path `
            ([System.IO.Path]::GetTempPath()) `
            ("vix-release-smoke-" + [System.Guid]::NewGuid().ToString("N"))
          $archive = "dist\vix-windows-${{ matrix.arch }}.zip"
          $extractDir = Join-Path $smokeRoot "extract"
          $installDir = Join-Path $smokeRoot "install"

          try {
            if (-not (Test-Path -LiteralPath $archive -PathType Leaf)) {
              throw "missing release archive: $archive"
            }

            Expand-Archive -LiteralPath $archive -DestinationPath $extractDir -Force

            $sourceExe = Join-Path $extractDir "vix.exe"
            $sourceNote = Join-Path $extractDir "share\vix\note"

            foreach ($requiredFile in @(
              $sourceExe,
              (Join-Path $sourceNote "index.html"),
              (Join-Path $sourceNote "assets\note.css"),
              (Join-Path $sourceNote "assets\note.js")
            )) {
              if (-not (Test-Path -LiteralPath $requiredFile -PathType Leaf)) {
                throw "missing package file: $requiredFile"
              }
            }

            & $sourceExe --version
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

            $installBin = Join-Path $installDir "bin"
            $installNoteParent = Join-Path $installDir "share\vix"
            $installedExe = Join-Path $installBin "vix.exe"
            $installedNote = Join-Path $installNoteParent "note"

            New-Item -ItemType Directory -Force -Path $installBin, $installNoteParent | Out-Null
            Copy-Item -LiteralPath $sourceExe -Destination $installedExe -Force
            Copy-Item -LiteralPath $sourceNote -Destination $installedNote -Recurse -Force

            & $installedExe --version
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
            & $installedExe note --help | Select-Object -First 80
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          }
          finally {
            Remove-Item -LiteralPath $smokeRoot -Recurse -Force -ErrorAction SilentlyContinue
          }
      - name: Upload dist
        uses: actions/upload-artifact@v6
        with:
          name: dist-${{ matrix.vixos }}-${{ matrix.arch }}
          path: dist/*
          if-no-files-found: error

  publish:
    name: publish (github release)
    needs: build-release
    runs-on: ubuntu-24.04

    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist-all

      - name: Flatten dist only
        shell: bash
        run: |
          set -euxo pipefail
          mkdir -p dist

          find dist-all -type f -path "*/dist-*/vix-*" -print0 | while IFS= read -r -d '' f; do
            base="$(basename "$f")"
            if [ -f "dist/$base" ]; then
              echo "Collision while flattening: $base" >&2
              echo "file: $f" >&2
              exit 1
            fi
            cp -f "$f" "dist/$base"
          done

          ls -la dist

          test "$(ls -A dist | wc -l)" -gt 0

      - name: Generate sha256 files
        shell: bash
        run: |
          set -euxo pipefail
          cd dist
          for f in vix-*; do
            [ -f "$f" ] || continue
            sha256sum "$f" > "$f.sha256"
          done
          ls -la

      - name: Sign assets (minisign)
        shell: bash
        env:
          MINISIGN_PRIVATE_KEY_B64: ${{ secrets.MINISIGN_PRIVATE_KEY_B64 }}
        run: |
          set -euxo pipefail
          cd dist

          MS_VER="0.11"
          curl -fL --retry 10 --retry-delay 2 \
            -o minisign-linux.tar.gz \
            "https://github.com/jedisct1/minisign/releases/download/${MS_VER}/minisign-${MS_VER}-linux.tar.gz"

          tar -xzf minisign-linux.tar.gz
          chmod +x minisign-linux/x86_64/minisign
          MS="./minisign-linux/x86_64/minisign"

          keyfile="$(mktemp)"
          chmod 600 "$keyfile"
          printf "%s" "$MINISIGN_PRIVATE_KEY_B64" | base64 -d > "$keyfile"
          test -s "$keyfile"

          for f in vix-*.tar.gz vix-*.zip; do
            [ -f "$f" ] || continue
            "$MS" -S -s "$keyfile" -m "$f"
          done

          rm -f "$keyfile"
          ls -la

      - name: Determine tag
        id: tag
        shell: bash
        run: |
          set -euxo pipefail
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ github.event.inputs.tag }}" ]; then
            echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          fi

      - name: Create GitHub Release + upload
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.tag.outputs.tag }}
          name: ${{ steps.tag.outputs.tag }}
          draft: false
          prerelease: false
          files: dist/*