release.yml

name: Release Intent

on:
  push:
    branches: [ main ]
    # Ignore common non-release paths. For other main pushes, the workflow
    # determines whether the committed VERSION represents release intent. Runs
    # with no new VERSION are successful no-ops.
    paths-ignore:
      - '.github/workflows/issue-triage.yml'
      - '.github/workflows/preview-build.yml'
      - '.github/workflows/upstream-merge.yml'
      - 'examples/**'
      - '**/*.test.ts'
      - 'test/**'
      - '*.md'
  workflow_dispatch:
    inputs:
      release_build_dry_run:
        description: Build release binaries without publishing a release.
        required: false
        type: boolean
        default: false
      release_build_scope:
        description: Targets to build during a release build dry run.
        required: false
        type: choice
        options: [macos, all]
        default: macos

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  actions: read
  contents: write
  id-token: write
  issues: write
  pull-requests: write
  statuses: write

jobs:
  preflight-tests:
    name: Preflight Tests (Linux fast E2E)
    needs: [determine-version, validate-release-metadata]
    if: needs.determine-version.outputs.release_intent == 'true'
    runs-on: ubuntu-24.04
    env:
      CARGO_HOME: ${{ github.workspace }}/.cargo-home
      RUSTUP_HOME: ${{ github.workspace }}/.rustup-home
    steps:
      - name: Prepare cargo target dir on data disk
        shell: bash
        run: |
          set -euo pipefail
          cargo_target_dir="${{ github.workspace }}/.cargo-target"
          if [ -d /mnt ] && [ -w /mnt ]; then
            cargo_target_dir="/mnt/code-release-preflight-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          fi
          echo "CARGO_TARGET_DIR=$cargo_target_dir" >> "$GITHUB_ENV"
          echo "CI_CLI_BIN=$cargo_target_dir/dev-fast/code" >> "$GITHUB_ENV"
          mkdir -p "$cargo_target_dir"
          df -h "$cargo_target_dir"

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read Rust toolchain channel
        id: rust_toolchain
        shell: bash
        run: |
          set -euo pipefail
          TOOLCHAIN=$(python3 -c "import sys, pathlib; p=pathlib.Path('code-rs/rust-toolchain.toml').read_text();
          try:
              import tomllib as tl
          except ModuleNotFoundError:
              import tomli as tl
          print(tl.loads(p)['toolchain']['channel'])")
          echo "channel=$TOOLCHAIN" >> "$GITHUB_OUTPUT"
          echo "RUST_TOOLCHAIN=$TOOLCHAIN" >> "$GITHUB_ENV"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ steps.rust_toolchain.outputs.channel }}

      - name: Setup Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v5-rust
          shared-key: code-preflight-${{ steps.rust_toolchain.outputs.channel }}
          workspaces: |
            code-rs -> target
          cache-targets: false
          cache-workspace-crates: true
          cache-on-failure: false

      - name: Build CLI (dev-fast)
        shell: bash
        run: |
          set -euo pipefail
          cd code-rs
          cargo build --locked --profile dev-fast --bin code

      - name: CLI smokes (skip duplicated cargo tests)
        shell: bash
        env:
          SKIP_CARGO_TESTS: "1"
        run: bash scripts/ci-tests.sh

      - name: Drop dev-fast artifacts before workspace tests
        shell: bash
        run: |
          set -euo pipefail
          rm -rf "$CARGO_TARGET_DIR"/dev-fast || true
          df -h

      - name: Install cargo-nextest
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-nextest

      - name: Workspace tests (nextest)
        shell: bash
        run: |
          cd code-rs
          cargo nextest run --no-fail-fast --locked

      - name: Free disk after tests
        if: always()
        shell: bash
        run: |
          echo "Disk usage before cleanup" && df -h
          rm -rf ~/.cache/sccache || true
          rm -rf "$CARGO_TARGET_DIR" || true
          echo "Disk usage after cleanup" && df -h

  determine-version:
    name: Determine Version
    runs-on: [self-hosted, Linux, X64, chris-testing]
    outputs:
      version: ${{ steps.version.outputs.version }}
      release_intent: ${{ steps.version.outputs.release_intent }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Determine GitHub Release intent
        id: version
        shell: bash
        run: scripts/release/determine-release-intent.sh

  validate-release-metadata:
    name: Validate Release Metadata
    needs: [determine-version]
    if: needs.determine-version.outputs.release_intent == 'true'
    runs-on: [self-hosted, Linux, X64, chris-testing]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: Validate committed release metadata
        shell: bash
        run: scripts/check-release-notes-version.sh --version "${{ needs.determine-version.outputs.version }}"

  detect-macos-release-runner:
    name: Detect self-hosted macOS release runner
    needs: [determine-version, validate-release-metadata]
    if: |
      always() && !cancelled() &&
      (
        (needs.determine-version.outputs.release_intent == 'true' && needs.validate-release-metadata.result == 'success') ||
        (github.event_name == 'workflow_dispatch' && inputs.release_build_dry_run == true)
      )
    runs-on: [self-hosted, Linux, X64, chris-testing]
    outputs:
      use_self_hosted: ${{ steps.select.outputs.use_self_hosted }}
      runs_on: ${{ steps.select.outputs.runs_on }}
      reason: ${{ steps.select.outputs.reason }}
    steps:
      - name: Select macOS runner
        id: select
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
          TRUSTED_ACTORS: cbusillo github-actions[bot] launchplane[bot]
          HOSTED_RUNS_ON: '["macos-14"]'
          SELF_HOSTED_RUNS_ON: '["self-hosted","macOS","ARM64","chris-mac","code-release"]'
          RELEASE_BUILD_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.release_build_dry_run == true }}
        run: |
          set -euo pipefail

          select_runner() {
            local use_self_hosted="$1"
            local runs_on="$2"
            local reason="$3"
            {
              printf 'use_self_hosted=%s\n' "$use_self_hosted"
              printf 'runs_on=%s\n' "$runs_on"
              printf 'reason=%s\n' "$reason"
            } >> "$GITHUB_OUTPUT"
            printf 'macOS release runner: %s\n' "$reason"
          }

          # Actor alone is not a safe self-hosted-runner signal: comments or
          # labels from a trusted actor can still target untrusted PR code. This
          # runner is eligible only for trusted main-branch code: real release
          # pushes, or maintainer-dispatched dry runs on main.
          trusted_main_code=false
          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF}" == "refs/heads/main" && "${GITHUB_REPOSITORY}" == "cbusillo/code" ]]; then
            trusted_main_code=true
          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${RELEASE_BUILD_DRY_RUN}" == "true" && "${GITHUB_REF}" == "refs/heads/main" && "${GITHUB_REPOSITORY}" == "cbusillo/code" ]]; then
            trusted_main_code=true
          fi

          if [[ "$trusted_main_code" != true ]]; then
            select_runner false "$HOSTED_RUNS_ON" "hosted fallback: not trusted main code"
            exit 0
          fi

          actor_trusted=false
          for trusted_actor in $TRUSTED_ACTORS; do
            if [[ "$GITHUB_ACTOR" == "$trusted_actor" ]]; then
              actor_trusted=true
              break
            fi
          done
          if [[ "$actor_trusted" != true ]]; then
            select_runner false "$HOSTED_RUNS_ON" "hosted fallback: untrusted workflow actor"
            exit 0
          fi

          if ! runners_json="$(gh api --method GET "/repos/${GITHUB_REPOSITORY}/actions/runners" -f per_page=100)"; then
            select_runner false "$HOSTED_RUNS_ON" "hosted fallback: runner query failed"
            exit 0
          fi

          runner_name="$(jq -r '
            .runners[]
            | select(.status == "online" and (.busy | not))
            | select([.labels[].name] | index("self-hosted") and index("macOS") and index("ARM64") and index("chris-mac") and index("code-release"))
            | .name
          ' <<< "$runners_json" | head -n 1)"

          if [[ -n "$runner_name" ]]; then
            select_runner true "$SELF_HOSTED_RUNS_ON" "self-hosted macOS runner online: ${runner_name}"
          else
            select_runner false "$HOSTED_RUNS_ON" "hosted fallback: no idle chris-mac code-release runner online"
          fi

  plan-release-build-matrix:
    name: Plan release build matrix
    needs: [determine-version, validate-release-metadata, detect-macos-release-runner]
    if: |
      always() && !cancelled() &&
      needs.detect-macos-release-runner.result == 'success' &&
      (
        (needs.determine-version.outputs.release_intent == 'true' && needs.validate-release-metadata.result == 'success') ||
        (github.event_name == 'workflow_dispatch' && inputs.release_build_dry_run == true)
      )
    runs-on: [self-hosted, Linux, X64, chris-testing]
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
      - name: Select release build targets
        id: matrix
        shell: bash
        env:
          MACOS_RUNS_ON: ${{ needs.detect-macos-release-runner.outputs.runs_on }}
          RELEASE_BUILD_SCOPE: ${{ inputs.release_build_scope || 'all' }}
          RELEASE_BUILD_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.release_build_dry_run == true }}
        run: |
          set -euo pipefail

          macos_matrix="$(jq -cn --argjson runs_on "$MACOS_RUNS_ON" '{include: [
            {os: "macos-release", runs_on: $runs_on, target: "x86_64-apple-darwin", artifact: "code-x86_64-apple-darwin"},
            {os: "macos-release", runs_on: $runs_on, target: "aarch64-apple-darwin", artifact: "code-aarch64-apple-darwin"}
          ]}')"

          if [[ "$RELEASE_BUILD_DRY_RUN" == "true" && "$RELEASE_BUILD_SCOPE" == "macos" ]]; then
            matrix="$macos_matrix"
          else
            matrix="$(jq -cn --argjson macos_runs_on "$MACOS_RUNS_ON" '{include: [
              {os: "ubuntu-24.04", runs_on: ["ubuntu-24.04"], target: "x86_64-unknown-linux-musl", artifact: "code-x86_64-unknown-linux-musl"},
              {os: "ubuntu-24.04-arm", runs_on: ["ubuntu-24.04-arm"], target: "aarch64-unknown-linux-musl", artifact: "code-aarch64-unknown-linux-musl"},
              {os: "macos-release", runs_on: $macos_runs_on, target: "x86_64-apple-darwin", artifact: "code-x86_64-apple-darwin"},
              {os: "macos-release", runs_on: $macos_runs_on, target: "aarch64-apple-darwin", artifact: "code-aarch64-apple-darwin"},
              {os: "windows-latest", runs_on: ["windows-latest"], target: "x86_64-pc-windows-msvc", artifact: "code-x86_64-pc-windows-msvc.exe"}
            ]}')"
          fi

          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
          echo "Release build matrix: $matrix"

          if [[ "$RELEASE_BUILD_DRY_RUN" == "true" ]]; then
            {
              echo "### Release build dry run"
              echo
              echo "Scope: ${RELEASE_BUILD_SCOPE}"
              echo
              echo "This run builds release binaries and uploads workflow artifacts only. It does not tag or publish a GitHub Release."
            } >> "$GITHUB_STEP_SUMMARY"
          fi

  build-binaries:
    name: Build ${{ matrix.target }}
    needs: [determine-version, validate-release-metadata, detect-macos-release-runner, plan-release-build-matrix]
    if: |
      always() && !cancelled() &&
      needs.plan-release-build-matrix.result == 'success' &&
      needs.detect-macos-release-runner.result == 'success' &&
      (
        (needs.determine-version.outputs.release_intent == 'true' && needs.validate-release-metadata.result == 'success') ||
        (github.event_name == 'workflow_dispatch' && inputs.release_build_dry_run == true)
      )
    runs-on: ${{ matrix.runs_on }}
    env:
      CARGO_HOME: ${{ github.workspace }}/.cargo-home
      RUSTUP_HOME: ${{ github.workspace }}/.rustup-home
    strategy:
      matrix: ${{ fromJson(needs.plan-release-build-matrix.outputs.matrix) }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read Rust toolchain channel
        id: rust_toolchain
        shell: bash
        run: |
          set -euo pipefail
          TOOLCHAIN=$(python3 -c "import sys, pathlib; p=pathlib.Path('code-rs/rust-toolchain.toml').read_text();
          try:
              import tomllib as tl
          except ModuleNotFoundError:
              import tomli as tl
          print(tl.loads(p)['toolchain']['channel'])")
          echo "channel=$TOOLCHAIN" >> "$GITHUB_OUTPUT"
          echo "RUST_TOOLCHAIN=$TOOLCHAIN" >> "$GITHUB_ENV"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ steps.rust_toolchain.outputs.channel }}
          targets: ${{ matrix.target }}

      - name: Use persistent self-hosted macOS target cache
        if: startsWith(matrix.os, 'macos-') && needs.detect-macos-release-runner.outputs.use_self_hosted == 'true'
        shell: bash
        run: |
          set -euo pipefail
          cache_root="$HOME/.cache/every-code/release-targets/${{ matrix.target }}"
          mkdir -p "$cache_root"
          echo "CARGO_TARGET_DIR=$cache_root" >> "$GITHUB_ENV"
          echo "Using persistent macOS release target cache: $cache_root"

      # Keep target/ across runs so Cargo can no-op when code hasn't changed
      - id: rust_cache
        name: Setup Rust Cache (target + registries)
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: v5-rust
          shared-key: code-${{ matrix.target }}-toolchain-${{ steps.rust_toolchain.outputs.channel }}
          workspaces: |
            code-rs -> target
          cache-targets: true
          cache-workspace-crates: true
          cache-on-failure: true

      # sccache: skip compiles when possible (doesn't skip linking)
      - name: Setup sccache (GHA backend)
        uses: mozilla-actions/sccache-action@v0.0.9
        with:
          version: v0.10.0
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Enable sccache
        shell: bash
        run: |
          {
            echo "SCCACHE_GHA_ENABLED=true"
            echo "RUSTC_WRAPPER=sccache"
            echo "SCCACHE_IDLE_TIMEOUT=1800"
            echo "SCCACHE_CACHE_SIZE=10G"
          } >> "$GITHUB_ENV"

      # -------- Platform tuning (minimal, proven) --------

      # Linux GNU: use mold if available; prefer system OpenSSL
      - name: Linux (gnu) tuning
        if: runner.os == 'Linux' && contains(matrix.target, 'gnu')
        shell: bash
        run: |
          set -euo pipefail
          if command -v apt-get >/dev/null 2>&1; then
            if command -v sudo >/dev/null 2>&1; then
              SUDO=(sudo)
            elif [[ ${EUID:-$(id -u)} -eq 0 ]]; then
              SUDO=()
            else
              echo "apt-get is available but neither sudo nor root is available; using preinstalled GNU build packages." >&2
              SUDO=(false)
            fi
            if [[ ${SUDO[0]:-} != false ]]; then
              "${SUDO[@]}" apt-get update || true
              "${SUDO[@]}" apt-get install -y libssl-dev pkg-config mold || true
            fi
          fi
          if command -v clang >/dev/null 2>&1; then
            echo 'CC=sccache clang'    >> "$GITHUB_ENV"
            echo 'CXX=sccache clang++' >> "$GITHUB_ENV"
          else
            echo 'CC=sccache gcc'      >> "$GITHUB_ENV"
            echo 'CXX=sccache g++'     >> "$GITHUB_ENV"
          fi
          echo 'OPENSSL_NO_VENDOR=1' >> "$GITHUB_ENV"
          echo 'RUSTFLAGS=-Awarnings -C link-arg=-fuse-ld=mold -C debuginfo=0 -C strip=symbols -C panic=abort' >> "$GITHUB_ENV"

      # Linux MUSL: reliable static build via musl-gcc (no glibc symbol leaks)
      - name: Linux (musl) tuning
        if: runner.os == 'Linux' && contains(matrix.target, 'musl')
        shell: bash
        run: |
          set -euo pipefail
          if command -v apt-get >/dev/null 2>&1 && ! command -v musl-gcc >/dev/null 2>&1; then
            if command -v sudo >/dev/null 2>&1; then
              SUDO=(sudo)
            elif [[ ${EUID:-$(id -u)} -eq 0 ]]; then
              SUDO=()
            else
              echo "musl-gcc is required but this runner cannot install packages without sudo/root." >&2
              exit 1
            fi
            "${SUDO[@]}" apt-get update
            "${SUDO[@]}" apt-get install -y musl-tools pkg-config
          fi
          {
            echo 'CC=musl-gcc'
            case "${{ matrix.target }}" in
              x86_64-unknown-linux-musl) echo 'CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=musl-gcc' ;;
              aarch64-unknown-linux-musl) echo 'CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=musl-gcc' ;;
            esac
            echo 'PKG_CONFIG_ALLOW_CROSS=1'
            echo 'OPENSSL_STATIC=1'
            echo 'RUSTFLAGS=-Awarnings -C debuginfo=0 -C strip=symbols -C panic=abort'
          } >> "$GITHUB_ENV"

      # macOS: stick with Apple toolchain to avoid brew overhead; still cache C via sccache
      - name: macOS tuning
        if: startsWith(matrix.os, 'macos-')
        shell: bash
        run: |
          {
            echo 'CC=sccache clang'
            echo 'CXX=sccache clang++'
            echo 'RUSTFLAGS=-Awarnings -C debuginfo=0 -C strip=symbols -C panic=abort'
          } >> "$GITHUB_ENV"

      # Windows: vcpkg not needed (rustls + pure Rust deps)

      # Windows: use SChannel (no OpenSSL) + fast linker flags
      - name: Windows TLS backend (SChannel) + linker flags
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          # Force libgit2 to use the native Windows TLS stack
          "LIBGIT2_SYS_USE_SCHANNEL=1" >> $env:GITHUB_ENV
          # If anything in your graph uses curl-sys, prefer SChannel there too
          "CURL_SSL_BACKEND=schannel"  >> $env:GITHUB_ENV
          # Prefer lld-link if present; otherwise MSVC link with good opts
          if (Get-Command lld-link -ErrorAction SilentlyContinue) {
            "RUSTFLAGS=-Awarnings -Clinker=lld-link -C codegen-units=16 -C debuginfo=0 -C strip=symbols -C panic=abort -C link-arg=/OPT:REF -C link-arg=/OPT:ICF -C link-arg=/DEBUG:NONE" >> $env:GITHUB_ENV
          } else {
            "RUSTFLAGS=-Awarnings -C codegen-units=16 -C debuginfo=0 -C strip=symbols -C panic=abort -C link-arg=/OPT:REF -C link-arg=/OPT:ICF -C link-arg=/DEBUG:NONE" >> $env:GITHUB_ENV
          }

      # Prefetch deps so --frozen works even with git deps
      - name: Prefetch dependencies (git + registry)
        working-directory: code-rs
        env:
          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
        run: cargo fetch --locked

      # Inject the display version without touching Cargo manifests
      - name: Export CODE_VERSION for Rust build
        shell: bash
        run: echo "CODE_VERSION=${{ needs.determine-version.outputs.version }}" >> "$GITHUB_ENV"

      - name: Build binaries (with timings)
        shell: bash
        env:
          CARGO_INCREMENTAL: "0"   # keep off in CI; release builds + sccache
          RUST_BACKTRACE: "1"
        run: |
          cd code-rs
          cargo build --release --frozen --locked --timings --target ${{ matrix.target }} --bin code

      - name: Post-build smoke (run binary) [Unix]
        if: |
          (runner.os == 'Linux'  && matrix.target == 'x86_64-unknown-linux-musl') ||
          (matrix.os == 'ubuntu-24.04-arm' && matrix.target == 'aarch64-unknown-linux-musl') ||
          (startsWith(matrix.os, 'macos-') && matrix.target == 'aarch64-apple-darwin')
        shell: bash
        run: |
          set -euo pipefail
          target_root="${CARGO_TARGET_DIR:-code-rs/target}"
          exe="$target_root/${{ matrix.target }}/release/code"
          "$exe" --version
          "$exe" completion bash > /dev/null

      - name: Post-build smoke (run binary) [Windows]
        if: matrix.os == 'windows-latest' && matrix.target == 'x86_64-pc-windows-msvc'
        shell: pwsh
        run: |
          $exe = "code-rs/target/${{ matrix.target }}/release/code.exe"
          & $exe --version | Out-Null
          & $exe completion bash | Out-Null

      - name: sccache stats
        shell: bash
        run: sccache --show-stats || true

      - name: Prepare artifacts
        shell: bash
        run: |
          target_root="${CARGO_TARGET_DIR:-code-rs/target}"
          mkdir -p artifacts
          if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
            cp code-rs/target/${{ matrix.target }}/release/code.exe artifacts/${{ matrix.artifact }}
          else
            cp "$target_root/${{ matrix.target }}/release/code" artifacts/${{ matrix.artifact }}
          fi

      - name: Compress artifacts (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          Get-ChildItem artifacts -File | ForEach-Object {
            $src = $_.FullName
            $dst = "$src.zip"
            Compress-Archive -Path $src -DestinationPath $dst -Force
            Remove-Item $src -Force
          }

      - name: Install zstd (Linux)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euo pipefail
          if command -v zstd >/dev/null 2>&1; then
            exit 0
          fi
          if command -v sudo >/dev/null 2>&1; then
            SUDO=(sudo)
          elif [[ ${EUID:-$(id -u)} -eq 0 ]]; then
            SUDO=()
          else
            echo "zstd is required but this runner cannot install packages without sudo/root." >&2
            exit 1
          fi
          "${SUDO[@]}" apt-get update -qq
          "${SUDO[@]}" apt-get install -y zstd

      - name: Install zstd (macOS)
        if: startsWith(matrix.os, 'macos-')
        shell: bash
        run: |
          set -euo pipefail
          if command -v zstd >/dev/null 2>&1; then
            exit 0
          fi
          if command -v brew >/dev/null 2>&1; then
            brew install zstd
            exit 0
          fi
          echo "zstd is required for macOS release artifacts, but Homebrew is unavailable." >&2
          exit 1

      - name: Compress artifacts (Linux dual-format)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          shopt -s nullglob
          for f in artifacts/*; do
            # Only process regular files; skip any directories
            [ -f "$f" ] || continue
            base=$(basename "$f")
            # .zst (size-optimized)
            zstd -T0 -19 --force -o "artifacts/${base}.zst" "$f"
            # .tar.gz fallback for users without zstd
            tar -C artifacts -czf "artifacts/${base}.tar.gz" "$base"
            rm -f "$f"
          done

      - name: Compress artifacts (macOS dual-format)
        if: startsWith(matrix.os, 'macos-')
        shell: bash
        run: |
          shopt -s nullglob
          for f in artifacts/*; do
            # Only process regular files; skip any directories
            [ -f "$f" ] || continue
            base=$(basename "$f")
            # .zst (size-optimized)
            zstd -T0 -19 --force -o "artifacts/${base}.zst" "$f"
            # .tar.gz fallback for users without zstd
            tar -C artifacts -czf "artifacts/${base}.tar.gz" "$base"
            rm -f "$f"
          done

      - name: Upload binaries (compressed)
        uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ matrix.target }}
          path: artifacts/
          compression-level: 0

      - name: Upload cargo timings
        uses: actions/upload-artifact@v4
        with:
          name: cargo-timings-${{ matrix.target }}
          path: ${{ env.CARGO_TARGET_DIR || 'code-rs/target' }}/cargo-timings/*.html
          if-no-files-found: ignore
          compression-level: 0

  release:
    name: Publish GitHub Release
    needs: [determine-version, validate-release-metadata, build-binaries, preflight-tests]
    runs-on: [self-hosted, Linux, X64, chris-testing]
    if: |
      always() && !cancelled() &&
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main' &&
      needs.determine-version.outputs.release_intent == 'true' &&
      needs.validate-release-metadata.result == 'success' &&
      needs.build-binaries.result == 'success' &&
      needs.preflight-tests.result == 'success' &&
      !contains(github.event.head_commit.message, '[skip ci]')
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}

      - name: Prepare release tag
        id: version
        shell: bash
        run: |
          NEW_VERSION="${{ needs.determine-version.outputs.version }}"
          if [[ "$(tr -d '[:space:]' < VERSION)" != "$NEW_VERSION" ]]; then
            echo "VERSION does not match release intent ${NEW_VERSION}" >&2
            exit 1
          fi
          echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
          if ! git rev-parse "v${NEW_VERSION}" >/dev/null 2>&1; then
            git tag "v${NEW_VERSION}"
          fi
          echo "tag=v${NEW_VERSION}" >> "$GITHUB_OUTPUT"

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts/

      - name: Prepare release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p release-assets
          shopt -s nullglob
          # Gather all built "code-*" files (zst/tar.gz/zip or raw) recursively under artifacts/
          while IFS= read -r -d '' f; do
            cp "$f" release-assets/
          done < <(find artifacts -type f -name 'code-*' -print0)
          # Show what we collected
          ls -la release-assets/ || true

      - name: Verify local release notes metadata
        shell: bash
        run: |
          set -euo pipefail
          scripts/check-release-notes-version.sh --version "${{ steps.version.outputs.version }}"

      - name: Push tag
        shell: bash
        run: git push origin "v${{ steps.version.outputs.version }}" || true

      - name: Verify release notes header matches version
        shell: bash
        run: |
          set -euo pipefail
          scripts/check-release-notes-version.sh

      - name: Generate update manifest
        shell: bash
        env:
          NEW_VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          scripts/release/generate-update-manifest.sh \
            --version "$NEW_VERSION" \
            --commit "$GITHUB_SHA" \
            --repository "$GITHUB_REPOSITORY" \
            --assets-dir release-assets \
            --output release-assets/update-manifest.json

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ steps.version.outputs.version }}
          name: Release v${{ steps.version.outputs.version }}
          body_path: docs/release-notes/RELEASE_NOTES.md
          files: |
            release-assets/*
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}