release.yml

name: Release

# The Actions list shows one row per run and nothing else, so the row has to say which version it
# is. A ship carries it in ref_name, because it is a tag push; a rebuild is told by release.sh.
run-name: ObjectExplorer ${{ inputs.version && format('v{0}', inputs.version) || github.ref_name }}

# The whole product ships from this one run: the @knockdata/objectexplorer npm package and the
# desktop binaries that embed it, under one version number that comes from the package itself.
#
# Pushing the tag v<version> is what ships it. rock2/objectexplorer/publish.sh uploads a candidate
# to objectexplorer.com and pushes that tag; the run picks the candidate up, so nothing ever waits
# for a publish — the package is tested on six platforms, the binaries are built and smoke-tested,
# and only then does npm publish and the GitHub release happen, together, from the same bytes.
#
# The tag is also what the Actions list shows against the run. A dispatch runs on a branch, so every
# ship used to be a row labelled "main"; shipping by tag is what makes the row say v0.4.3.
#
# A dispatch is the other door: it rebuilds and re-releases the binaries for a version that is
# already on npm, and publishes nothing.
#
# Every build job runs the same four steps — addon, bundle, sea, pack — because the native addon is
# compiled per platform and the SEA is built on that platform's node binary. Only the signing
# differs.
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version on npm to rebuild the binaries for. Empty means whatever npm calls latest."
        type: string
        default: ""
      promote:
        description: "Cut the GitHub release when every leg passes. Nothing is ever published to npm from here — push the tag for that."
        type: boolean
        default: true

jobs:
  # What is being shipped, decided once — nothing else looks at github.ref_name. Reading it
  # directly is what published a release called "ObjectExplorer main", tagged main, on top of the
  # real versions.
  #
  # The version is never invented here: it is read out of the package.json inside the tarball, so
  # the binaries, the npm publish and the release name cannot disagree about what this run is.
  source:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.pick.outputs.version }}
      tag: ${{ steps.pick.outputs.tag }}
      publish: ${{ steps.pick.outputs.publish }}
      release: ${{ steps.pick.outputs.release }}
    steps:
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      - id: pick
        # through env, not ${{ }} inside the script: an expression is pasted in as text before
        # bash sees it, so a value typed with a quote in it would run as a command
        env:
          REF_NAME: ${{ github.ref_name }}
          EVENT: ${{ github.event_name }}
          PROMOTE: ${{ inputs.promote }}
          CLAIMED: ${{ inputs.version }}
        run: |
          if [ "$EVENT" = "push" ]; then
            # Shipping. The tag names the version and publish.sh has already uploaded the bytes, so
            # they come from the candidate — nothing here waits for a publish that has not happened.
            tagged="${REF_NAME#v}"
            curl -fsSL -o objectexplorer.tgz https://objectexplorer.com/releases/objectexplorer.tgz
            publish=true
            release=true
          else
            # Rebuilding the binaries for a version that is already on npm, which is where its bytes
            # are. Nothing is published: the package on npm is exactly the one being rebuilt around.
            tagged=""
            wanted="$CLAIMED"
            if [ -z "$wanted" ]; then
              wanted=$(npm view @knockdata/objectexplorer version)
            fi
            npm pack "@knockdata/objectexplorer@$wanted"
            mv knockdata-objectexplorer-*.tgz objectexplorer.tgz
            publish=false
            if [ "$PROMOTE" = "false" ]; then
              release=false
            else
              release=true
            fi
          fi
          # the test suite never ships inside the package, so it travels beside it
          curl -fsSL -o objectexplorer-test.tgz https://objectexplorer.com/releases/objectexplorer-test.tgz

          tar xzf objectexplorer.tgz package/package.json
          version=$(node -p 'require("./package/package.json").version')

          # win-resources.mjs splits this into exactly three numbers and msix.mjs appends a fourth,
          # so a prerelease version would reach the PE version block as NaN
          if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "shipping $version (publish=$publish release=$release)" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "::error::expected a version like 1.2.3, got '$version'"
            exit 1
          fi

          # This is the whole reason the tag is trusted with nothing but naming the run: it can name a
          # version the candidate is not, and that is a publish of the wrong bytes under the right
          # name. It happens whenever the tag is pushed before the upload it belongs to.
          if [ -n "$tagged" ] && [ "$tagged" != "$version" ]; then
            echo "::error::tag v$tagged does not match the candidate's version $version — the upload and the tag disagree"
            exit 1
          fi

          # the run is already named after the version that was asked for, so a run named one thing
          # and rebuilding another is worse than no run at all
          if [ -n "$CLAIMED" ] && [ "$CLAIMED" != "$version" ]; then
            echo "::error::this run is named v$CLAIMED but the package is $version"
            exit 1
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=v$version" >> "$GITHUB_OUTPUT"
          echo "publish=$publish" >> "$GITHUB_OUTPUT"
          echo "release=$release" >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@v6
        with:
          name: candidate
          path: |
            objectexplorer.tgz
            objectexplorer-test.tgz

  # The package itself, driven through its own UI in a real headless browser on every platform it
  # claims to run on: local folder, all three clouds, navigating and viewing files.
  test:
    needs: source
    timeout-minutes: 30
    # bash on the windows runners too, so one set of steps covers all six legs. Kept to this job:
    # a workflow-wide default also moves the build jobs off powershell, and Git Bash's GNU tar
    # reads "C:\..." as a host to connect to, which is how the webview2 SDK unzip started failing.
    defaults:
      run:
        shell: bash
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            arch: x64
          - runner: ubuntu-24.04-arm
            arch: arm64
          - runner: macos-latest
            arch: arm64
          - runner: macos-latest
            arch: x64
          - runner: windows-latest
            arch: x64
          - runner: windows-11-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      # x64 node on the Apple Silicon runner, so the x64 duckdb and sqlite addons are the ones
      # loaded. macos-13 is the last native x64 runner and it queues for hours without ever
      # starting, so this is how x64 mac gets covered at all. Rosetta is not promised on an arm
      # runner: without it the leg says so and stops rather than testing arm64 twice.
      - name: rosetta
        if: matrix.arch == 'x64' && runner.os == 'macOS'
        run: |
          if arch -x86_64 /usr/bin/true 2> /dev/null; then
            echo "rosetta is available, running x64"
          else
            echo "no rosetta on this runner, skipping the x64 mac leg" | tee -a "$GITHUB_STEP_SUMMARY"
            echo "SKIP=1" >> "$GITHUB_ENV"
          fi

      - if: env.SKIP != '1'
        uses: actions/checkout@v6
      - if: env.SKIP != '1'
        uses: actions/download-artifact@v6
        with:
          name: candidate
      - if: env.SKIP != '1'
        uses: actions/setup-node@v6
        with:
          node-version: 24
          architecture: ${{ matrix.arch }}

      # Google ships no arm64 Chrome for linux, so that leg needs chromium from the distro. Every
      # other runner already has Chrome (macOS, ubuntu x64) or Edge (windows), and browser.js
      # finds whichever is there.
      - name: browser
        if: env.SKIP != '1'
        run: bash .github/browser.sh

      - name: install the candidate
        if: env.SKIP != '1'
        run: |
          mkdir work
          cd work
          npm init -y > /dev/null
          npm install ../objectexplorer.tgz
          tar xzf ../objectexplorer-test.tgz
          node -e "console.log('OBJECTEXPLORER_CLI=' + require('path').resolve('node_modules/@knockdata/objectexplorer/cli.js'))" >> "$GITHUB_ENV"

      # A native absolute path, written by node: a bash path like /d/a/... is not something node on
      # windows can open.
      - name: cloud credentials
        if: env.SKIP != '1'
        env:
          GCP_SERVICE_ACCOUNT_JSON: ${{ secrets.GCP_SERVICE_ACCOUNT_JSON }}
        run: |
          cd work
          node -e "const fs=require('fs'),path=require('path');const file=path.resolve('gcp-service-account.json');fs.writeFileSync(file,process.env.GCP_SERVICE_ACCOUNT_JSON||'');console.log('GOOGLE_APPLICATION_CREDENTIALS='+file)" >> "$GITHUB_ENV"

      - name: end to end
        if: env.SKIP != '1'
        env:
          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
          AZURE_STORAGE_CONNECTION_STRING: ${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}
          OBJECTEXPLORER_TEST_PORT: 9421
        run: |
          cd work
          node test/e2e.js

      - if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: failure-${{ matrix.runner }}-${{ matrix.arch }}
          path: work/test/*.png
          if-no-files-found: ignore

  # Both arches build on the Apple Silicon runner. macos-13 is the last x64 runner and it now
  # sits in the queue for hours, and it is not needed: one Xcode targets both arm64 and x86_64,
  # and codesign, hdiutil and notarytool do not care which arch they are handed.
  mac:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-latest
            arch: arm64
          - runner: macos-latest
            arch: x64
    needs: [source, test]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    env:
      TARGET_ARCH: ${{ matrix.arch }}
      BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
      P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
      KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
      APPLE_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
      APPLE_API_ISSUER: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
    steps:
      - uses: actions/checkout@v6
      # 0.3.5 died 15 minutes in because build/ is gitignored and the icons never left the
      # dev machine. One ls says so in seconds, and the same applies to the native sources —
      # native/build is gitignored, native/napi must not be.
      - name: Check the build inputs are in the repo
        shell: bash
        run: |
          ls -l assets/entitlements.plist assets/icon.icns assets/icon.ico assets/icon.png
          ls -l native/webview.h native/webview_napi.c native/Makefile
          ls -l native/webview-mac.m native/webview-linux.c native/webview-windows.c
          ls -l native/napi/node_api.h native/napi/node_api.def
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      - run: bash .github/set-version.sh "${{ needs.source.outputs.version }}"
      - uses: actions/download-artifact@v5
        with:
          name: candidate
          path: candidate
      - run: npm install --no-audit --no-fund

      # Without a certificate the build still produces a runnable ad-hoc signed app, which is
      # what a fork or a dry run gets.
      - name: Import signing certificate
        if: env.BUILD_CERTIFICATE_BASE64 != ''
        run: |
          CERT_PATH=$RUNNER_TEMP/cert.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 -D -o "$CERT_PATH"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH" login.keychain
          echo "CODESIGN_IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | head -1 | awk '{print $2}')" >> "$GITHUB_ENV"

      - name: Write App Store Connect API key
        if: env.BUILD_CERTIFICATE_BASE64 != ''
        run: |
          echo "$PRIVATE_KEY" > "$RUNNER_TEMP/AuthKey.p8"
          echo "APPLE_API_KEY=$RUNNER_TEMP/AuthKey.p8" >> "$GITHUB_ENV"
        env:
          PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}

      # 0.3.2 failed at hdiutil with ENOSPC; this tells us whether the runner disk was actually
      # the problem or whether hdiutil under-sized the image again
      - run: df -h /
      - run: npm run build
        env:
          OBJECTEXPLORER_TARBALL: ${{ github.workspace }}/candidate/objectexplorer.tgz

      - name: Check the signature
        run: |
          codesign -dv --verbose=4 dist/ObjectExplorer.app
          spctl -a -vv dist/ObjectExplorer.app || true

      - name: Fetch the test driver
        run: bash .github/test-driver.sh candidate/objectexplorer-test.tgz

      # the x64 build runs here only through Rosetta, which is not promised on an arm64 runner
      - name: Smoke test
        run: |
          if arch -x86_64 /usr/bin/true 2> /dev/null || [ "${{ matrix.arch }}" = "arm64" ]; then
            bash .github/smoke.sh dist/ObjectExplorer.app/Contents/MacOS/ObjectExplorer smoke/test
          else
            echo "no rosetta on this runner, skipping the x64 smoke test"
          fi

      - uses: actions/upload-artifact@v6
        with:
          name: mac-${{ matrix.arch }}
          path: dist/*.dmg

      - name: Delete keychain
        if: always()
        run: security delete-keychain "$RUNNER_TEMP/build.keychain" || true

  windows:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: windows-latest
            arch: x64
          - runner: windows-11-arm
            arch: arm64
    needs: [source, test]
    runs-on: ${{ matrix.runner }}
    # 0.3.2 sat here for hours. The build takes about a minute, so anything past 20 is a hang
    # and should fail while the log is still worth reading.
    timeout-minutes: 20
    # a step's own env is not visible to that step's if, so the signing secrets live here
    env:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
    steps:
      - uses: actions/checkout@v6
      - name: Check the build inputs are in the repo
        shell: bash
        run: |
          ls -l assets/entitlements.plist assets/icon.icns assets/icon.ico assets/icon.png
          ls -l assets/icon-44x44.png assets/icon-150x150.png
          ls -l native/webview.h native/webview_napi.c native/Makefile
          ls -l native/webview-mac.m native/webview-linux.c native/webview-windows.c
          ls -l native/napi/node_api.h native/napi/node_api.def
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      - shell: bash
        run: bash .github/set-version.sh "${{ needs.source.outputs.version }}"
      - uses: actions/download-artifact@v5
        with:
          name: candidate
          path: candidate

      # the binary is 134 MB and every step rewrites it; without this Defender re-scans the
      # whole file each time
      - name: Exclude the workspace from Defender
        shell: powershell
        run: Add-MpPreference -ExclusionPath "${{ github.workspace }}" -ErrorAction SilentlyContinue

      - run: npm install --no-audit --no-fund

      # This is what CMake used to do for us. scripts/addon-windows.mjs finds MSVC through
      # vswhere and calls vcvarsall.bat itself, so a runner image without the C++ workload has
      # to say so here rather than inside a .bat five minutes later.
      - name: Check the C toolchain
        shell: bash
        run: |
          vswhere="/c/Program Files (x86)/Microsoft Visual Studio/Installer/vswhere.exe"
          installed=$("$vswhere" -latest -products '*' -property installationPath)
          echo "MSVC: $installed"
          ls -l "$installed/VC/Auxiliary/Build/vcvarsall.bat"

      - run: npm run build
        env:
          OBJECTEXPLORER_TARBALL: ${{ github.workspace }}/candidate/objectexplorer.tgz
      - shell: bash
        run: ls -la dist

      - name: Fetch the test driver
        shell: bash
        run: bash .github/test-driver.sh candidate/objectexplorer-test.tgz

      - name: Smoke test
        shell: bash
        run: bash .github/smoke.sh "$(ls dist/*.exe)" smoke/test

      # The single unsigned .exe is exactly what Defender quarantines — 0.2.1 installed a
      # folder with no ObjectExplorer.exe in it. Signing is not optional here.
      - name: Sign
        if: env.AZURE_CLIENT_ID != ''
        uses: azure/trusted-signing-action@v0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: https://neu.codesigning.azure.net/
          trusted-signing-account-name: knockdata
          certificate-profile-name: KnockData
          files-folder: ${{ github.workspace }}\dist
          files-folder-filter: exe
          # false is the default, but here it is load-bearing: the store package sits in
          # dist\store and has to stay unsigned, because Partner Center signs that one
          files-folder-recurse: false

      # An unsigned build used to upload in silence. Defender holding a 107 MB unsigned exe is
      # what a user sees as a double-click that does nothing at all, so say so out loud.
      # ASCII only in here: Windows PowerShell 5.1 reads the generated .ps1 as ANSI, and an em
      # dash ends up as three cp1252 characters whose last one is a curly quote. That closed the
      # string early and failed the whole step with a parse error before anything ran.
      #
      # This is also where the direct msix gets its publisher. The certificate subject is what
      # signtool compares the manifest against, character for character, so it is read off the
      # exe that was just signed rather than written down anywhere.
      - name: Check the signature
        shell: powershell
        run: |
          $exe = (Get-ChildItem dist\*.exe)[0]
          $signature = Get-AuthenticodeSignature $exe.FullName
          Write-Output "$($exe.Name): $($signature.Status)"
          if ($signature.Status -eq "Valid") {
            Write-Output "signed: $($signature.SignerCertificate.Subject)" >> $env:GITHUB_STEP_SUMMARY
            Write-Output "MSIX_PUBLISHER=$($signature.SignerCertificate.Subject)" >> $env:GITHUB_ENV
          } else {
            Write-Output "::warning::$($exe.Name) is unsigned ($($signature.Status)); Defender and SmartScreen will block it on a user machine. Set AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET as repository secrets."
            Write-Output "**$($exe.Name) is unsigned** - Defender and SmartScreen will block it." >> $env:GITHUB_STEP_SUMMARY
          }

      # Both packs run after Sign, so the .exe inside each package carries its Authenticode
      # signature. Skipped without a certificate: a direct package whose publisher does not match
      # a real cert cannot be signed and cannot be installed, so there would be nothing to ship.
      - name: Pack the direct msix
        if: env.MSIX_PUBLISHER != ''
        run: npm run msix

      # Always: the store package is unsigned by design, so it builds on a fork too.
      - name: Pack the store msix
        run: npm run msix:store

      # Same certificate as the exe. This is what makes the msix on the releases page install
      # with a double click - App Installer refuses a package it cannot chain to a trusted root.
      - name: Sign the msix
        if: env.AZURE_CLIENT_ID != ''
        uses: azure/trusted-signing-action@v0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: https://neu.codesigning.azure.net/
          trusted-signing-account-name: knockdata
          certificate-profile-name: KnockData
          files-folder: ${{ github.workspace }}\dist
          files-folder-filter: msix
          files-folder-recurse: false

      # A publisher mismatch is the failure to expect here, and signtool reports it as a bare
      # 0x8007000B with no mention of which side is wrong - so print both.
      - name: Check the msix signature
        shell: powershell
        run: |
          $msix = Get-ChildItem dist\*.msix -ErrorAction SilentlyContinue
          if ($msix) {
            $signature = Get-AuthenticodeSignature $msix[0].FullName
            Write-Output "$($msix[0].Name): $($signature.Status)"
            if ($signature.Status -eq "Valid") {
              Write-Output "msix signed: $($signature.SignerCertificate.Subject)" >> $env:GITHUB_STEP_SUMMARY
            } else {
              Write-Output "::warning::$($msix[0].Name) is unsigned ($($signature.Status)); the manifest Publisher must equal the certificate subject exactly."
            }
          } else {
            Write-Output "no direct msix in dist, the build was unsigned"
          }

      # The exe and the direct msix both go on the releases page: one portable file, or a real
      # install with a Start menu entry and an uninstall.
      - uses: actions/upload-artifact@v6
        with:
          name: windows-${{ matrix.arch }}
          path: |
            dist/*.exe
            dist/*.msix

      # A separate artifact, and never a release asset: this one is unsigned until Partner Center
      # signs it. The release job filters it out by name.
      - uses: actions/upload-artifact@v6
        with:
          name: store-msix-${{ matrix.arch }}
          path: dist/store/*.msix

  # One bundle from both arches, so a single Store submission serves x64 and arm64 and an arm64
  # machine installs the native build instead of emulating. Not in the windows matrix because
  # makeappx bundle needs both packages in one place, which only exists after both legs finish.
  # This is the store variant only; the direct packages ship per arch on the releases page.
  msixbundle:
    needs: [source, windows]
    runs-on: windows-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      - shell: bash
        run: bash .github/set-version.sh "${{ needs.source.outputs.version }}"
      - uses: actions/download-artifact@v5
        with:
          pattern: store-msix-*
          merge-multiple: true
          path: dist/store
      - run: npm run msix:bundle
      - uses: actions/upload-artifact@v6
        with:
          name: msixbundle
          path: dist/*.msixbundle

  linux:
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            arch: x64
          - runner: ubuntu-24.04-arm
            arch: arm64
    needs: [source, test]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6
      - name: Check the build inputs are in the repo
        run: |
          ls -l assets/entitlements.plist assets/icon.icns assets/icon.ico assets/icon.png
          ls -l native/webview.h native/webview_napi.c native/Makefile
          ls -l native/webview-mac.m native/webview-linux.c native/webview-windows.c
          ls -l native/napi/node_api.h native/napi/node_api.def
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      - run: bash .github/set-version.sh "${{ needs.source.outputs.version }}"
      - uses: actions/download-artifact@v6
        with:
          name: candidate
          path: candidate
      # no webkitgtk -dev package here on purpose: native/webview-linux.c opens gtk and webkit
      # with dlopen, so the build has no dependency on them and the addon has no DT_NEEDED. A
      # machine without webkit falls back to a browser instead of failing to load the addon.
      - run: npm install --no-audit --no-fund
      - run: npm run build
        env:
          OBJECTEXPLORER_TARBALL: ${{ github.workspace }}/candidate/objectexplorer.tgz

      # the whole point of the dlopen backend: nothing links webkit, so nothing requires it.
      # Without this the dependency could come back and only a user without webkit would find out.
      - name: Check the addon has no webkit dependency
        run: |
          ldd out/webview_napi-linux-*.node
          ! ldd out/webview_napi-linux-*.node | grep -qi webkit

      # runs the artifact the way a user does, through the runtime and AppRun.
      # APPIMAGE_EXTRACT_AND_RUN because ubuntu-24.04 has no libfuse2 to mount an AppImage with.
      - name: Fetch the test driver
        run: bash .github/test-driver.sh candidate/objectexplorer-test.tgz

      - name: Smoke test
        run: APPIMAGE_EXTRACT_AND_RUN=1 bash .github/smoke.sh "$(ls dist/*.AppImage)" smoke/test

      - uses: actions/upload-artifact@v6
        with:
          name: linux-${{ matrix.arch }}
          path: dist/*.AppImage

  # The npm half of the release, and the last point of no return. Everything above has already
  # passed: the package on six platforms, the binaries built from this very tarball and smoke
  # tested. A dispatch skips this — that version is already on npm.
  promote:
    needs: [source, test, mac, windows, linux, msixbundle]
    if: needs.source.outputs.publish == 'true'
    runs-on: ubuntu-latest
    # npm trusted publishing: the registry trusts this repo and this workflow file by name, and
    # GitHub only mints the OIDC token the exchange needs when id-token: write is asked for. Without
    # it npm falls back to a token and a 2FA account answers "EOTP: requires a one-time password",
    # which no CI can answer. No NPM_TOKEN here on purpose — a token in the environment is used in
    # preference to OIDC and puts that error straight back.
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/download-artifact@v6
        with:
          name: candidate
      # deliberately no registry-url: it writes an .npmrc saying _authToken=${NODE_AUTH_TOKEN}, and
      # with no such variable npm sends an empty credential instead of reaching for OIDC — an
      # authenticated request with nothing in it, which the registry answers 404 on a publish
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      # trusted publishing needs npm 11.5.1 or newer; whatever node ships with is not a promise
      - run: npm install -g npm@latest
      - name: publish
        run: |
          echo "npm $(npm --version), OIDC token endpoint ${ACTIONS_ID_TOKEN_REQUEST_URL:+available}"
          npm publish objectexplorer.tgz --access public
      # the registry is the only thing that can confirm a publish landed
      - name: verify
        run: |
          version=${{ needs.source.outputs.version }}
          delay=6
          for attempt in $(seq 1 10); do
            published=$(npm view @knockdata/objectexplorer version 2>/dev/null || echo "")
            if [ "$published" = "$version" ]; then
              echo "published $version after $attempt checks" >> "$GITHUB_STEP_SUMMARY"
              exit 0
            fi
            echo "attempt $attempt: registry says ${published:-nothing}, waiting ${delay}s"
            sleep $delay
            # the registry needs minutes, not seconds, to settle: 6s grows by half each
            # time, so the last of the 10 checks lands about 7 minutes after the publish
            delay=$((delay * 3 / 2))
          done
          echo "::error::npm still reports $published, not $version"
          exit 1

  release:
    needs: [source, mac, windows, linux, promote]
    # promote is skipped on a dispatch, and a skipped need skips its dependents — without this the
    # release would silently never happen. !cancelled() keeps the skip from counting as a reason to
    # stop; the failure check keeps it from releasing binaries a failed job never produced.
    if: ${{ !cancelled() && !contains(needs.*.result, 'failure') && needs.source.outputs.release == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      # First, and only first: checkout cleans the workspace, so anything downloaded before it
      # would be deleted. It is here for CHANGELOG.md, which is what the version release says.
      - uses: actions/checkout@v6

      # pattern, not everything: the store-msix-* and msixbundle artifacts are unsigned until the
      # Store signs them, and `files: artifacts/**/*` below would publish them on the releases
      # page. They are downloaded by hand instead - see RELEASE.md. The signed direct msix does
      # ship, and arrives inside windows-<arch> next to the exe.
      - uses: actions/download-artifact@v6
        with:
          pattern: "{mac,windows,linux}-*"
          path: artifacts

      # The version is in every filename, so no download link can be written down once and
      # keep working. These copies drop it: ObjectExplorer-mac-arm64.dmg, always the newest
      # build, which is what the README links to. The artifact directory is already
      # <platform>-<arch>, so nothing has to be parsed out of the filename.
      - name: Name a copy of each build without the version
        run: |
          mkdir latest
          for file in artifacts/*/*; do
            dir=$(basename "$(dirname "$file")")
            cp "$file" "latest/ObjectExplorer-$dir.${file##*.}"
          done
          ls -l latest

      # One extra release, replaced every build, so the aliases cost one copy in total rather
      # than one per version, and it is the row a visitor should land on.
      - name: Drop the previous latest release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: gh release delete latest --yes --cleanup-tag || true

      # Published BEFORE the version release, which is what puts it on top of the releases
      # page. GitHub sorts by the target commit's date, and these two releases point at the
      # same commit — so the tie is broken by release id, lowest first. The run that shipped
      # 0.3.8 published the version release first and it sat above the latest one:
      #   362909923  v0.3.8   created=…T07:22:18Z
      #   362910013  latest   created=…T07:22:18Z   <- 90 ids later, one row lower
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: latest
          name: ObjectExplorer ${{ needs.source.outputs.tag }} (latest)
          body: |
            The newest build, under names that never change — this is what the README links to.
            Release notes live on [${{ needs.source.outputs.tag }}](https://github.com/${{ github.repository }}/releases/tag/${{ needs.source.outputs.tag }}).
          target_commitish: ${{ github.sha }}
          make_latest: true
          files: latest/*

      # What this version says about itself, taken out of CHANGELOG.md by its own heading —
      # `## v0.5.1` down to the next `## `, shortened to its opening line and one bullet per
      # headline: a releases page is where a download is picked up, not where the full notes are
      # read. A version with no section there leaves an empty file, and the release is then the
      # generated notes alone, exactly as it was before.
      - name: Short notes from this version's CHANGELOG.md section
        run: |
          node scripts/release-notes.mjs "${{ needs.source.outputs.tag }}" CHANGELOG.md > notes.md
          cat notes.md

      # make_latest: false, or this would take the Latest badge back off the rolling release —
      # and with it /releases/latest/download, which is the whole point of the aliases.
      # body_path first, then the generated commit list underneath it.
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.source.outputs.tag }}
          name: ObjectExplorer ${{ needs.source.outputs.tag }}
          target_commitish: ${{ github.sha }}
          body_path: notes.md
          generate_release_notes: true
          make_latest: false
          files: artifacts/**/*