release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write # for GitHub Releases
  id-token: write # for npm provenance (if enabled)

jobs:
  # ----------------------------------------------------------------------
  # Validate — typecheck + tests + build all packages
  # ----------------------------------------------------------------------
  validate:
    name: Validate before release
    runs-on: ubuntu-latest
    timeout-minutes: 25
    outputs:
      version: ${{ steps.version.outputs.version }}
      channel: ${{ steps.version.outputs.channel }}
      is_mandatory: ${{ steps.version.outputs.is_mandatory }}
      has_apple: ${{ steps.credentials.outputs.has_apple }}
      has_npm: ${{ steps.credentials.outputs.has_npm }}
      has_updater: ${{ steps.credentials.outputs.has_updater }}
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile

      # The release gate must validate in the same environment as CI. Without
      # this, `pnpm test` here runs against a weaker box than ci.yml uses, so a
      # green CI stops predicting a green release — which is exactly how the
      # first v0.3.0 tag failed: the deny-all-net fallback test spawns `bwrap`,
      # and this runner had no bubblewrap installed.
      # Kept byte-for-byte in step with the "Install sandbox tools" step in
      # ci.yml; change both together.
      - name: Install sandbox tools
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap slirp4netns curl
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
          sudo sysctl -w net.ipv4.ip_unprivileged_port_start=53 || true

      - run: pnpm typecheck
      - run: pnpm lint
      - run: pnpm format:check
      - name: Test
        # Matches ci.yml: opts in the selective-allowlist integration test, which
        # self-skips when bwrap/slirp4netns are absent.
        env:
          DC_SANDBOX_NET_TEST: '1'
        run: pnpm test
      - run: pnpm docs:check
      - run: pnpm release:check

      # Which publication legs can even run. A job that cannot possibly succeed
      # should be skipped, not failed — a red release for a missing credential
      # teaches people to ignore red releases.
      - name: Detect available publishing credentials
        id: credentials
        run: |
          if [ -n "${{ secrets.APPLE_ID }}" ] && [ -n "${{ secrets.CSC_LINK }}" ]; then
            echo "has_apple=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_apple=false" >> "$GITHUB_OUTPUT"
            echo "::warning::Apple signing secrets absent — skipping the Mac client build. See docs/RELEASING.md."
          fi
          # The updater is a third, independent credential set. Without it the
          # DMG still builds and ships — users just download it by hand, which
          # is exactly what they do today.
          if [ -n "${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}" ]; then
            echo "has_updater=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_updater=false" >> "$GITHUB_OUTPUT"
            echo "::warning::TAURI_SIGNING_PRIVATE_KEY absent — no update feed; users must download the DMG. See docs/RELEASING.md."
          fi
          if [ -n "${{ secrets.NPM_TOKEN }}" ]; then
            echo "has_npm=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_npm=false" >> "$GITHUB_OUTPUT"
            echo "::warning::NPM_TOKEN absent — skipping the npm publish. See docs/RELEASING.md."
          fi

      - name: Install Chromium
        run: pnpm --filter @deepcode/desktop exec playwright install --with-deps chromium

      - name: Exercise desktop protocol fixture
        run: pnpm --filter @deepcode/desktop test:e2e

      - name: Upload validation diagnostics
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: release-validation-diagnostics
          path: |
            apps/vscode/dist/release-gate-report.json
            apps/desktop/playwright-report
            apps/desktop/test-results
          if-no-files-found: ignore
          retention-days: 14

      - id: version
        name: Parse version + channel from tag
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          VERSION="${TAG#v}"
          CHANNEL="stable"
          IS_MANDATORY="false"
          if [[ "$VERSION" == *-nightly.* ]]; then CHANNEL="nightly"; fi
          if [[ "$VERSION" == *-beta.* ]]; then CHANNEL="beta"; fi
          if [[ "$VERSION" == *+security.* ]]; then IS_MANDATORY="true"; fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "channel=$CHANNEL" >> $GITHUB_OUTPUT
          echo "is_mandatory=$IS_MANDATORY" >> $GITHUB_OUTPUT
          echo "Released as version=$VERSION channel=$CHANNEL mandatory=$IS_MANDATORY"

  # ----------------------------------------------------------------------
  # Publish CLI to npm
  # ----------------------------------------------------------------------
  publish-cli:
    name: Publish @oratis/deepcode to npm
    # Avoid a partial release: do not publish npm until both installable
    # desktop/editor artifacts have built successfully.
    needs: [validate, build-vscode, build-mac]
    # The anti-partial-release rule stands: npm still waits on both installable
    # artifacts. It additionally needs a token to exist at all.
    if: needs.validate.outputs.has_npm == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'pnpm'
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile

      # Before `pnpm build`: core's VERSION is compiled into dist, and it is what
      # `deepcode --version`, `--help`, `/upgrade` and `/bug` print.
      - name: Stamp core VERSION from tag
        run: |
          sed -i.bak -E "s/^export const VERSION = '.*';/export const VERSION = '${{ needs.validate.outputs.version }}';/" packages/core/src/index.ts
          rm -f packages/core/src/index.ts.bak
          grep -q "export const VERSION = '${{ needs.validate.outputs.version }}';" packages/core/src/index.ts

      # Same workspace-protocol problem as build-vscode. This job had never run
      # (it needs both build jobs), so the bug was latent rather than observed.
      - name: Set CLI version from tag
        run: |
          cd apps/cli
          node -e '
            const fs = require("fs");
            const p = "package.json";
            const pkg = JSON.parse(fs.readFileSync(p, "utf8"));
            pkg.version = process.argv[1];
            fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + "\n");
          ' "${{ needs.validate.outputs.version }}"
          node -e 'process.exit(require("./package.json").version === process.argv[1] ? 0 : 1)' "${{ needs.validate.outputs.version }}"

      - run: pnpm build

      - name: Publish
        run: |
          cd apps/cli
          if [ "${{ needs.validate.outputs.channel }}" = "stable" ]; then
            pnpm publish --no-git-checks --access public
          else
            pnpm publish --no-git-checks --access public --tag ${{ needs.validate.outputs.channel }}
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # ----------------------------------------------------------------------
  # Build installable VS Code extension
  # ----------------------------------------------------------------------
  build-vscode:
    name: Build VS Code extension
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile

      # The extension bundles its own app-server, which bundles core.
      - name: Stamp core VERSION from tag
        run: |
          sed -i.bak -E "s/^export const VERSION = '.*';/export const VERSION = '${{ needs.validate.outputs.version }}';/" packages/core/src/index.ts
          rm -f packages/core/src/index.ts.bak

      # Not `npm version`: this is a pnpm workspace, and npm rejects the
      # `workspace:*` dependency protocol with EUNSUPPORTEDPROTOCOL before it
      # ever writes the field. Editing the one key touches nothing else.
      - name: Set extension version from tag
        run: |
          node -e '
            const fs = require("fs");
            const p = "package.json";
            const pkg = JSON.parse(fs.readFileSync(p, "utf8"));
            pkg.version = process.argv[1];
            fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + "\n");
          ' "${{ needs.validate.outputs.version }}"
          node -e 'process.exit(require("./package.json").version === process.argv[1] ? 0 : 1)' "${{ needs.validate.outputs.version }}"
        working-directory: apps/vscode

      # The VSIX bundles the app-server, which bundles core — and core's package
      # exports point at dist/. Without a workspace build first, esbuild cannot
      # resolve @deepcode/core/{skills,tools,dist/providers/deepseek.js} and the
      # package step dies. `pnpm release:check` has always built first; this job
      # was the one path that did not, and publish-cli already gets it right.
      # Also required because the step above stamps core's VERSION into source,
      # which only reaches the bundle once compiled.
      - run: pnpm build

      - name: Package VSIX
        run: |
          mkdir -p release-artifacts
          pnpm --dir apps/vscode package \
            --out "../../release-artifacts/deepcode-${{ needs.validate.outputs.version }}.vsix"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: vscode-release
          path: release-artifacts/deepcode-*.vsix

  # ----------------------------------------------------------------------
  # Build + sign Mac client (.dmg) via Tauri
  # ----------------------------------------------------------------------
  build-mac:
    name: Build + sign + notarize Mac client (Tauri)
    needs: validate
    if: needs.validate.outputs.has_apple == 'true'
    runs-on: macos-14
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin

      - name: Cache Cargo registry
        uses: actions/cache@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            apps/desktop/src-tauri/target
          key: cargo-mac-${{ hashFiles('**/Cargo.lock') }}

      - name: pnpm install
        run: pnpm install --frozen-lockfile

      - name: Prepare pinned Node sidecar runtime
        env:
          NODE_SIDECAR_VERSION: 22.23.1
          # Verified against https://nodejs.org/dist/v22.23.1/SHASUMS256.txt and by
          # hashing the downloaded artifact. The previous value never matched any
          # published tarball, so this check had never once passed.
          # Re-derive when bumping:
          #   curl -sS https://nodejs.org/dist/v<VER>/SHASUMS256.txt \
          #     | grep node-v<VER>-darwin-arm64.tar.xz
          NODE_SIDECAR_SHA256: fb526811860f81dcac7dd8b2b55eca4accfc5d61c3b7c2508f2639faee8a738d
        run: |
          archive="node-v${NODE_SIDECAR_VERSION}-darwin-arm64.tar.xz"
          curl --fail --location --retry 3 \
            "https://nodejs.org/dist/v${NODE_SIDECAR_VERSION}/${archive}" \
            --output "$RUNNER_TEMP/$archive"
          echo "${NODE_SIDECAR_SHA256}  $RUNNER_TEMP/$archive" | shasum -a 256 --check
          tar -xJf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP"
          echo "DEEPCODE_NODE_RUNTIME=$RUNNER_TEMP/node-v${NODE_SIDECAR_VERSION}-darwin-arm64/bin/node" >> "$GITHUB_ENV"

      - name: Set version
        run: |
          # core VERSION first — the sidecar it builds into reports it.
          sed -i.bak -E "s/^export const VERSION = '.*';/export const VERSION = '${{ needs.validate.outputs.version }}';/" packages/core/src/index.ts
          rm -f packages/core/src/index.ts.bak
          cd apps/desktop
          npm version "${{ needs.validate.outputs.version }}" --no-git-tag-version
          # Sync the tauri.conf.json version too
          node -e "
            const fs=require('fs');
            const p='src-tauri/tauri.conf.json';
            const c=JSON.parse(fs.readFileSync(p,'utf8'));
            c.version='${{ needs.validate.outputs.version }}';
            fs.writeFileSync(p, JSON.stringify(c,null,2)+'\n');
          "
          # And Cargo.toml + the lockfile entry, which must agree or a --locked
          # cargo invocation refuses to build.
          sed -i.bak -E 's/^version = ".*"/version = "${{ needs.validate.outputs.version }}"/' src-tauri/Cargo.toml
          rm -f src-tauri/Cargo.toml.bak
          node -e "
            const fs=require('fs');
            const p='src-tauri/Cargo.lock';
            const s=fs.readFileSync(p,'utf8');
            fs.writeFileSync(p, s.replace(
              /name = \"deepcode_desktop\"\nversion = \"[^\"]+\"/,
              'name = \"deepcode_desktop\"\nversion = \"${{ needs.validate.outputs.version }}\"'
            ));
          "

      # `tauri build` FAILS outright if createUpdaterArtifacts is true and no
      # signing key is in the environment, which is why the committed config
      # leaves it off. Flipping it here — and only when the key exists — keeps a
      # credential-less release building while a credentialed one produces the
      # feed.
      - name: Enable updater artifacts
        if: needs.validate.outputs.has_updater == 'true'
        run: |
          node -e "
            const fs=require('fs');
            const p='apps/desktop/src-tauri/tauri.conf.json';
            const c=JSON.parse(fs.readFileSync(p,'utf8'));
            c.bundle.createUpdaterArtifacts = true;
            fs.writeFileSync(p, JSON.stringify(c,null,2)+'\n');
          "
          node -e "
            const c=require('./apps/desktop/src-tauri/tauri.conf.json');
            if (c.bundle.createUpdaterArtifacts !== true) process.exit(1);
          "

      - name: Import Developer ID certificate
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
        run: |
          # CSC_LINK is base64-encoded .p12 of the Developer ID Application cert
          echo "$CSC_LINK" | base64 --decode > /tmp/cert.p12
          security create-keychain -p actions ci.keychain
          security default-keychain -s ci.keychain
          security unlock-keychain -p actions ci.keychain
          security import /tmp/cert.p12 -k ci.keychain -P "$CSC_KEY_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k actions ci.keychain
          rm -f /tmp/cert.p12

      - name: Store notarization credentials
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          xcrun notarytool store-credentials "DEEPCODE_NOTARY" \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD"

      - name: Build + sign + notarize
        env:
          DEEPCODE_TARGET: aarch64-apple-darwin
          DEEPCODE_NOTARY_PROFILE: DEEPCODE_NOTARY
          # Read by `tauri build` itself. Empty when no key is configured, in
          # which case the step above left createUpdaterArtifacts off and these
          # are never consulted.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: bash scripts/sign-and-notarize.sh

      - name: Stage release artifacts
        run: |
          mkdir -p release-artifacts
          cp apps/desktop/src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/DeepCode_${{ needs.validate.outputs.version }}_aarch64.dmg \
             release-artifacts/DeepCode-${{ needs.validate.outputs.version }}-arm64.dmg

      # The updater downloads the .app.tar.gz, not the DMG, and verifies it
      # against the .sig with the public key committed in tauri.conf.json.
      # Located by glob rather than a hardcoded path: the exact bundle filename
      # is Tauri's to choose, and a wrong guess here would produce a manifest
      # pointing at a file that was never uploaded.
      - name: Stage updater bundle + manifest
        if: needs.validate.outputs.has_updater == 'true'
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          bundle_dir=apps/desktop/src-tauri/target/aarch64-apple-darwin/release/bundle/macos
          bundle=$(find "$bundle_dir" -name '*.app.tar.gz' -maxdepth 1 | head -n 1)
          if [ -z "$bundle" ]; then
            echo "::error::createUpdaterArtifacts was enabled but no .app.tar.gz was produced in $bundle_dir"
            ls -la "$bundle_dir" || true
            exit 1
          fi
          if [ ! -f "$bundle.sig" ]; then
            echo "::error::$bundle has no .sig — the signing key did not reach tauri build"
            exit 1
          fi
          cp "$bundle" "$bundle.sig" release-artifacts/
          npx tsx scripts/gen-update-manifest.ts \
            --version "$VERSION" \
            --bundle "release-artifacts/$(basename "$bundle")" \
            --repo "$GITHUB_REPOSITORY" \
            > release-artifacts/latest.json
          cat release-artifacts/latest.json

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: mac-release
          # latest.json and the .app.tar.gz(.sig) are only present on a release
          # that had a signing key; `if-no-files-found: ignore` keeps a
          # credential-less release from failing here.
          path: |
            release-artifacts/DeepCode-*.dmg
            release-artifacts/*.app.tar.gz
            release-artifacts/*.app.tar.gz.sig
            release-artifacts/latest.json
          if-no-files-found: ignore

  # ----------------------------------------------------------------------
  # GitHub Release — runs after Mac build so the DMG can be attached
  # ----------------------------------------------------------------------
  github-release:
    name: Publish GitHub Release
    needs: [validate, publish-cli, build-vscode, build-mac]
    # Ship what was actually built. `always()` is required because a skipped
    # dependency would otherwise skip this job too — but the guard still refuses
    # to publish when something tried and *failed*, so a broken build never
    # becomes a release.
    if: >-
      always()
      && needs.validate.result == 'success'
      && needs.build-vscode.result == 'success'
      && needs.build-mac.result != 'failure'
      && needs.publish-cli.result != 'failure'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      # Full history: gen-release-notes walks the commit range. A shallow
      # clone makes the root-commit lookup return HEAD itself, so the range
      # comes out empty and the release body reads '0 commits.' — which is
      # exactly what v0.3.0 shipped with.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile

      - name: Download Mac DMG
        if: needs.build-mac.result == 'success'
        uses: actions/download-artifact@v8
        with:
          name: mac-release
          path: release-artifacts/

      - name: Download VS Code extension
        uses: actions/download-artifact@v8
        with:
          name: vscode-release
          path: release-artifacts/

      - name: Generate release notes
        id: notes
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          if [ -n "$PREV_TAG" ]; then
            FROM="$PREV_TAG"
          else
            FROM=$(git rev-list --max-parents=0 HEAD)
          fi
          # --version makes CHANGELOG.md's entry the release body; the commit
          # range is only the fallback when that entry does not exist.
          npx tsx scripts/gen-release-notes.ts "$FROM" HEAD \
            --version "${{ needs.validate.outputs.version }}" > release-notes.md
          # A release page missing an artifact reads as "there is no Mac build"
          # rather than "it was not produced this time". Say which.
          if [ "${{ needs.build-mac.result }}" != "success" ]; then
            printf '\n---\n\n> **No macOS build in this release.** Apple signing credentials were not configured when it was cut; see `docs/RELEASING.md`.\n' >> release-notes.md
          fi
          if [ "${{ needs.publish-cli.result }}" != "success" ]; then
            printf '\n> **Not published to npm.** `NPM_TOKEN` was not configured when this release was cut; install from source or the VSIX.\n' >> release-notes.md
          fi
          # Without this the in-app updater silently keeps polling a 404, so say
          # it on the page rather than leaving users to wonder why the banner
          # never appears.
          if [ "${{ needs.validate.outputs.has_updater }}" != "true" ] && [ "${{ needs.build-mac.result }}" = "success" ]; then
            printf '\n> **No in-app update feed in this release.** The Tauri signing key was not configured when it was cut, so `latest.json` was not produced — download the DMG manually. See `docs/RELEASING.md`.\n' >> release-notes.md
          fi
          cat release-notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          name: v${{ needs.validate.outputs.version }}
          body_path: release-notes.md
          prerelease: ${{ needs.validate.outputs.channel != 'stable' }}
          generate_release_notes: false
          files: |
            release-artifacts/*.dmg
            release-artifacts/*.vsix
            release-artifacts/*.app.tar.gz
            release-artifacts/*.app.tar.gz.sig
            release-artifacts/latest.json