alef 0.85.13

name: Publish

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Git tag to publish (e.g. v0.4.6)"
        required: true
        type: string
      dry_run:
        description: "Dry run — build everything but skip registry publishes"
        required: false
        default: false
        type: boolean
      force_republish:
        description: "Force publish even if version already exists"
        required: false
        default: false
        type: boolean
      targets:
        # ~keep Empty means `crates,cli`, NOT every available target -- `homebrew` and `scoop`
        # are opt-in only, because nothing in this org installs alef via brew or scoop by
        # default. Name either explicitly to get that release. See the fallback chain on
        # `prepare-release-metadata` below.
        description: "Comma-separated targets (empty = crates,cli). Values: crates,cli,homebrew,scoop"
        required: false
        default: ""
        type: string
  repository_dispatch:
    types: [publish-release]

concurrency:
  group: publish-${{ github.event.inputs.tag || github.ref_name || github.run_id }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  prepare:
    name: Prepare release
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.meta.outputs.tag }}
      version: ${{ steps.meta.outputs.version }}
      checkout_ref: ${{ steps.meta.outputs.checkout_ref }}
      dry_run: ${{ steps.meta.outputs.dry_run }}
      force_republish: ${{ steps.meta.outputs.force_republish }}
      release_crates: ${{ steps.meta.outputs.release_crates }}
      release_cli: ${{ steps.meta.outputs.release_cli }}
      release_homebrew: ${{ steps.meta.outputs.release_homebrew }}
      release_scoop: ${{ steps.scoop-gate.outputs.release_scoop }}
      cli_matrix: ${{ steps.cli-targets.outputs.matrix }}
      cli_assets: ${{ steps.cli-targets.outputs.assets }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # ~keep `.github/cli-targets.json` is the single source of truth for the CLI release
      # artifacts: `build-cli` takes its matrix from `matrix`, and `check-github-release`
      # takes the asset set it demands from `assets`. Both must come from here. A
      # hand-maintained second list is what let the v0.62.6 re-run skip Build CLI and
      # Upload release assets on a release that only had two homebrew bottles on it.
      #
      # ~keep An empty `targets` list must hard-fail this step, never fall through to
      # `matrix=[]`: `build-cli`'s `strategy.matrix.include` (below) runs zero legs for a
      # zero-entry matrix, and GitHub Actions reports that as a silent job success, not a
      # failure -- a release with no CLI binaries and no red X anywhere. That is the same
      # "SKIPPED reads as PASSED" shape that caused a false-premise bug report in
      # html-to-markdown.
      - name: Resolve CLI target matrix
        id: cli-targets
        shell: bash
        run: |
          set -euo pipefail
          python3 - <<'PY' >>"$GITHUB_OUTPUT"
          import json
          import pathlib
          import sys

          targets = json.loads(pathlib.Path(".github/cli-targets.json").read_text())
          if not targets:
              sys.exit(
                  "CLI release target list is empty -- expected at least one platform in "
                  ".github/cli-targets.json; refusing to build a vacuous release matrix"
              )
          print("matrix=" + json.dumps(targets, separators=(",", ":")))
          print("assets=" + ",".join(f"alef-{t['target']}.{t['archive_ext']}" for t in targets))
          PY

      # ~keep A whitespace-only `targets` input is a non-empty string, so it is truthy and
      # wins the `||` fallback chain below even though it names no real target. Alef's own
      # `--targets` parser then trims it to empty and treats empty as "release everything"
      # (see parse_targets in src/cli/commands/release_metadata.rs) -- a stray space in a
      # manual dispatch form would silently enable every opt-in target, including Homebrew and
      # Scoop. Normalizing here, before the fallback chain runs, closes that gap without
      # touching Alef's own empty-means-all contract. See
      # scripts/publish/normalize-release-targets.sh for the exact rules, tested in
      # tests/publish_normalize_targets_test.rs.
      - name: Normalize release targets input
        id: normalize-targets
        shell: bash
        env:
          RAW_TARGETS: ${{ inputs.targets || github.event.client_payload.targets || '' }}
        run: echo "targets=$(scripts/publish/normalize-release-targets.sh)" >> "$GITHUB_OUTPUT"

      # ~keep Homebrew and Scoop stay OFF by default: nothing in this org installs alef via
      # brew or scoop, so every release was paying for a formula/manifest update and, for
      # homebrew, a four-way bottle matrix and DSL merge that no consumer ever consumed. Both
      # are deliberately still listed in `available-targets` and their gated jobs below are
      # deliberately still here -- this is a default, not a removal. Re-enable either release
      # by dispatching with an explicit `targets` that names it (e.g. `cli,homebrew` or
      # `cli,scoop`), which the normalized value above still honours; only the
      # empty/whitespace-only/automatic case is narrowed to `crates,cli`. A `release`-triggered
      # run carries no targets at all, so the automatic path is exactly the case this narrows.
      - name: Prepare release metadata
        id: meta
        uses: xberg-io/actions/prepare-release-metadata@v1
        with:
          available-targets: crates,cli,homebrew,scoop
          targets: ${{ steps.normalize-targets.outputs.targets }}
          alef-version: main

      # ~keep `prepare-release-metadata@v1` declares `release_homebrew` as a named output but
      # not `release_scoop` -- scoop was added to Alef's own target list after that action's
      # output list was fixed, and an undeclared `steps.meta.outputs.release_scoop` reference
      # evaluates to an empty string forever, which reads as "false" everywhere it's checked.
      # That is a green run that silently publishes nothing, which is worse than a red one.
      # Rather than depend on an Actions-repo change this branch does not control, derive the
      # gate here from `release_targets`, which IS declared and already carries every enabled
      # target (or the literal "all"). See scripts/publish/compute-scoop-gate.sh and
      # tests/publish_scoop_gate_test.rs for the exact matching semantics, including the
      # `all` case.
      - name: Derive Scoop release gate
        id: scoop-gate
        shell: bash
        env:
          RELEASE_TARGETS: ${{ steps.meta.outputs.release_targets }}
        run: echo "release_scoop=$(scripts/publish/compute-scoop-gate.sh)" >> "$GITHUB_OUTPUT"

  check-cratesio:
    name: Check crates.io
    needs: prepare
    if: needs.prepare.outputs.release_crates == 'true'
    runs-on: ubuntu-latest
    outputs:
      exists: ${{ steps.check.outputs.exists }}
    steps:
      # ~keep continue-on-error: this check is advisory, not a release gate --
      # every job downstream of it already runs under `always()` and treats a
      # missing/non-'true' `exists` output as "not published yet, proceed."
      # A transient failure here (e.g. the registry API rate-limiting an
      # anonymous or momentarily-unauthenticated request) must not flip the
      # whole run red when every publish/build job still succeeds. See
      # v0.66.0 run 32602290549: this step failed on a GitHub API 403 while
      # every other job, including the actual crates.io publish, succeeded.
      - name: Check crates.io for alef
        id: check
        continue-on-error: true
        uses: xberg-io/actions/check-registry@v1
        with:
          registry: cratesio
          package: alef
          version: ${{ needs.prepare.outputs.version }}
          alef-version: main

  check-github-release:
    name: Check GitHub release
    needs: prepare
    if: needs.prepare.outputs.release_cli == 'true'
    runs-on: ubuntu-latest
    outputs:
      exists: ${{ steps.check.outputs.exists }}
    steps:
      # ~keep `assets` (every expected archive must be present), never `asset-prefix`:
      # the homebrew bottles are named `alef-<version>.<bottle_tag>.bottle.tar.gz`, so
      # `asset-prefix: alef-` reported "published" for a release carrying nothing but
      # two bottles and no CLI archive at all.
      #
      # ~keep continue-on-error: this check is advisory, not a release gate -- `build-cli`
      # and `upload-release-assets` below already run under `always()` and treat a
      # missing/non-'true' `exists` output as "not published yet, proceed to build/upload."
      # A transient failure here must not flip the whole run red when every publish/build
      # job still succeeds. v0.66.0 run 32602290549 hit exactly this: this step failed on
      # an unauthenticated GitHub API call that got rate-limited (HTTP 403) while every
      # other job, including the actual asset upload, succeeded.
      - name: Check GitHub release assets
        id: check
        continue-on-error: true
        uses: xberg-io/actions/check-registry@v1
        with:
          registry: github-release
          package: alef
          version: ${{ needs.prepare.outputs.version }}
          tag: ${{ needs.prepare.outputs.tag }}
          assets: ${{ needs.prepare.outputs.cli_assets }}
          repo: xberg-io/alef
          alef-version: main

  check-homebrew:
    name: Check Homebrew tap
    needs: prepare
    if: needs.prepare.outputs.release_homebrew == 'true'
    runs-on: ubuntu-latest
    outputs:
      exists: ${{ steps.check.outputs.exists }}
    steps:
      # ~keep continue-on-error: same rationale as `check-github-release` and
      # `check-cratesio` -- this check is advisory, and downstream jobs already
      # treat a missing/non-'true' `exists` output as "not published yet."
      - name: Check Homebrew formula
        id: check
        continue-on-error: true
        uses: xberg-io/actions/check-registry@v1
        with:
          registry: homebrew
          package: alef
          version: ${{ needs.prepare.outputs.version }}
          tap-repo: xberg-io/homebrew-tap
          alef-version: main

  check-scoop:
    name: Check Scoop bucket
    needs: prepare
    if: needs.prepare.outputs.release_scoop == 'true'
    runs-on: ubuntu-latest
    outputs:
      exists: ${{ steps.check.outputs.exists }}
    steps:
      # ~keep continue-on-error: same rationale as `check-homebrew` -- this check is
      # advisory, and `publish-scoop-manifest` already treats a missing/non-'true' `exists`
      # output as "not published yet."
      - name: Check Scoop manifest
        id: check
        continue-on-error: true
        uses: xberg-io/actions/check-registry@v1
        with:
          registry: scoop
          package: alef
          version: ${{ needs.prepare.outputs.version }}
          tap-repo: xberg-io/scoop-bucket
          alef-version: main

  build-cli:
    name: Build CLI (${{ matrix.label }})
    needs: [prepare, check-github-release]
    if: |
      always() &&
      needs.prepare.outputs.release_cli == 'true' &&
      (needs.check-github-release.outputs.exists != 'true' || needs.prepare.outputs.force_republish == 'true')
    # ~keep Windows must stay in `.github/cli-targets.json`: without a published Windows
    # binary, `xberg-io/actions/install-alef` finds no asset and falls back to
    # `cargo install --git --tag`, which builds alef from source on a Windows runner and
    # blows the consumer's 60-minute job timeout — html-to-markdown's Windows Node e2e job
    # was cancelled twice this way.
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.prepare.outputs.cli_matrix) }}
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Setup Rust
        uses: xberg-io/actions/setup-rust@v1
        with:
          target: ${{ matrix.target }}
          cache-key-prefix: publish-cli-${{ matrix.label }}
          install-llvm-cov: "false"
          macos-dynamic-lookup: "false"
          disable-cache: ${{ runner.os == 'Windows' && 'true' || 'false' }}

      - name: Build CLI
        id: build
        uses: xberg-io/actions/build-rust-cli@v1
        with:
          package-name: alef
          binary-name: alef
          target: ${{ matrix.target }}

      - name: Create release archive
        id: archive
        shell: bash
        run: |
          set -euo pipefail
          ARCHIVE_DIR="alef-${{ matrix.target }}"
          mkdir -p "${ARCHIVE_DIR}"
          cp "${{ steps.build.outputs.binary-path }}" "${ARCHIVE_DIR}/"
          ARCHIVE_NAME="alef-${{ matrix.target }}.${{ matrix.archive_ext }}"
          if [[ "${{ matrix.archive_ext }}" == "zip" ]]; then
            7z a "${ARCHIVE_NAME}" "${ARCHIVE_DIR}"
          else
            tar -czf "${ARCHIVE_NAME}" "${ARCHIVE_DIR}"
          fi
          echo "path=${ARCHIVE_NAME}" >> "$GITHUB_OUTPUT"
          echo "name=${ARCHIVE_NAME}" >> "$GITHUB_OUTPUT"

      - name: Upload CLI artifact
        uses: actions/upload-artifact@v7
        with:
          name: cli-${{ matrix.label }}
          path: ${{ steps.archive.outputs.path }}
          retention-days: 14

  publish-homebrew-formula:
    name: Update Homebrew formula
    needs: [prepare, check-homebrew, publish-crates]
    if: |
      always() &&
      needs.prepare.outputs.release_homebrew == 'true' &&
      needs.prepare.outputs.dry_run != 'true' &&
      (needs.check-homebrew.outputs.exists != 'true' || needs.prepare.outputs.force_republish == 'true') &&
      needs.publish-crates.result != 'failure'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v3
        id: tap-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          owner: xberg-io
          repositories: homebrew-tap

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - uses: actions/checkout@v7
        with:
          repository: xberg-io/homebrew-tap
          token: ${{ steps.tap-token.outputs.token }}
          path: homebrew-tap

      - name: Update formula
        env:
          TAG: ${{ needs.prepare.outputs.tag }}
          VERSION: ${{ needs.prepare.outputs.version }}
          TAP_DIR: ${{ github.workspace }}/homebrew-tap
        run: scripts/publish/update-homebrew-formula.sh

      - name: Commit and push formula
        working-directory: homebrew-tap
        env:
          GH_TOKEN: ${{ steps.tap-token.outputs.token }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git diff --quiet Formula/alef.rb; then
            echo "No formula changes; skipping commit."
            exit 0
          fi
          git add Formula/alef.rb
          git commit -m "alef ${{ needs.prepare.outputs.version }}"
          git push origin HEAD

  homebrew-bottles:
    name: Build Homebrew bottle (${{ matrix.bottle_tag }})
    needs: [prepare, publish-homebrew-formula]
    if: |
      always() &&
      needs.prepare.outputs.release_homebrew == 'true' &&
      needs.prepare.outputs.dry_run != 'true' &&
      needs.publish-homebrew-formula.result == 'success'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            bottle_tag: arm64_sequoia
            install_brew: false
          # ~keep The Intel macOS `sequoia` bottle is deliberately absent, not forgotten. From
          # 2026-09-01 Homebrew serves no `openssl@3` bottle for x86_64 macOS -- "We do not
          # provide support for this platform (as-of September 2026, announced August 2025)",
          # after Apple dropped Intel in macOS 27 -- so the bottle cannot build and no change
          # here can fix it. Leaving the entry in is not harmless: this job's failure propagates
          # into the aggregate release-status job, which reverts the GitHub release to a DRAFT
          # after every registry has already received its packages. That is what happened to
          # liter-llm 1.19.1 and to crawlberg 1.5.0 on 2026-09-01 -- both had shipped, and both
          # were invisible until the release was manually un-drafted. Re-adding this entry
          # re-arms that cascade.
          - os: ubuntu-latest
            bottle_tag: x86_64_linux
            install_brew: true
          - os: ubuntu-24.04-arm
            bottle_tag: arm64_linux
            install_brew: true
    steps:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          owner: xberg-io

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Install Homebrew (Linux)
        if: ${{ matrix.install_brew }}
        uses: xberg-io/actions/install-homebrew-linux@v1

      - name: Build bottles
        uses: xberg-io/actions/homebrew-build-bottles@v1
        with:
          tag: ${{ needs.prepare.outputs.tag }}
          version: ${{ needs.prepare.outputs.version }}
          tap: xberg-io/homebrew-tap
          formulas: alef
          out-dir: ${{ github.workspace }}/bottle-json
          github-repo: xberg-io/alef
          token: ${{ steps.app-token.outputs.token }}

      - name: Upload bottle JSON manifests
        uses: actions/upload-artifact@v7
        with:
          name: homebrew-bottle-json-${{ matrix.bottle_tag }}
          path: ${{ github.workspace }}/bottle-json/*.json
          if-no-files-found: error
          retention-days: 14

  publish-homebrew-bottles:
    name: Merge Homebrew bottle DSL
    needs: [prepare, publish-homebrew-formula, homebrew-bottles]
    if: |
      always() &&
      needs.prepare.outputs.release_homebrew == 'true' &&
      needs.prepare.outputs.dry_run != 'true' &&
      needs.publish-homebrew-formula.result == 'success' &&
      needs.homebrew-bottles.result == 'success'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v3
        id: tap-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          owner: xberg-io
          repositories: homebrew-tap

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - uses: actions/checkout@v7
        with:
          repository: xberg-io/homebrew-tap
          token: ${{ steps.tap-token.outputs.token }}
          path: homebrew-tap

      - uses: actions/download-artifact@v8
        with:
          pattern: homebrew-bottle-json-*
          path: ${{ github.workspace }}/bottle-json
          merge-multiple: true

      - name: Merge bottle DSL into formula
        uses: xberg-io/actions/homebrew-merge-bottles@v1
        with:
          tag: ${{ needs.prepare.outputs.tag }}
          version: ${{ needs.prepare.outputs.version }}
          tap-dir: ${{ github.workspace }}/homebrew-tap
          json-dir: ${{ github.workspace }}/bottle-json
          formulas: alef
          github-repo: xberg-io/alef

      - name: Commit and push bottle DSL
        working-directory: homebrew-tap
        env:
          GH_TOKEN: ${{ steps.tap-token.outputs.token }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git diff --quiet Formula/alef.rb; then
            echo "No bottle DSL changes; skipping commit."
            exit 0
          fi
          git add Formula/alef.rb
          git commit -m "alef ${{ needs.prepare.outputs.version }}: add bottle DSL"
          git push origin HEAD

  upload-release-assets:
    name: Upload release assets
    needs: [prepare, check-github-release, build-cli]
    if: |
      always() &&
      needs.prepare.outputs.release_cli == 'true' &&
      needs.build-cli.result == 'success' &&
      (needs.check-github-release.outputs.exists != 'true' || needs.prepare.outputs.force_republish == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          owner: xberg-io

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Download all CLI artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: cli-*
          path: dist/cli
          merge-multiple: true

      - name: Verify CLI release assets are present
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          matched=(dist/cli/*)
          if [[ ${#matched[@]} -eq 0 ]]; then
            echo "::error::release asset glob 'dist/cli/*' matched no files; refusing to publish a release with no CLI assets" >&2
            exit 1
          fi
          echo "matched ${#matched[@]} CLI release asset(s) for 'dist/cli/*'"

      - name: Upload CLI artifacts to release
        uses: xberg-io/actions/publish-github-release@v1
        with:
          tag: ${{ needs.prepare.outputs.tag }}
          title: ${{ needs.prepare.outputs.tag }}
          artifacts: "dist/cli/*"
          generate-notes: "false"
          draft: "false"
          dry-run: ${{ needs.prepare.outputs.dry_run }}
          token: ${{ steps.app-token.outputs.token }}

  publish-scoop-manifest:
    name: Update Scoop bucket manifest
    needs: [prepare, check-scoop, upload-release-assets]
    # ~keep `upload-release-assets.result != 'failure'` (not `== 'success'`) so a same-tag
    # retry still proceeds regardless of *why* that job didn't freshly succeed this run --
    # skipped because the release already carried the asset, skipped for an unrelated reason,
    # cancelled, whatever short of an active failure. This job no longer needs to reason about
    # `check-github-release`'s output to decide that; if the Windows asset genuinely isn't on
    # the release, "Render and publish Scoop manifest" below fails loudly (its `gh release
    # download` has nothing to fetch) instead of this `if:` silently skipping the job -- a
    # loud, visible failure beats a green run that published nothing.
    #
    # ~keep Runs in dry-run too: only "Commit and push manifest" is gated on
    # `dry_run != 'true'`. A dry run that skipped rendering would prove nothing -- it must
    # still download the real release asset, hash it, and render+validate the real manifest,
    # and stop short of only the actual write (the git commit/push to scoop-bucket).
    if: |
      always() &&
      needs.prepare.outputs.release_scoop == 'true' &&
      needs.upload-release-assets.result != 'failure' &&
      (needs.check-scoop.outputs.exists != 'true' || needs.prepare.outputs.force_republish == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v3
        id: bucket-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          owner: xberg-io
          repositories: scoop-bucket

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - uses: actions/checkout@v7
        with:
          repository: xberg-io/scoop-bucket
          token: ${{ steps.bucket-token.outputs.token }}
          path: scoop-bucket

      # ~keep `publish-scoop-manifests@v1` is the authoritative renderer for
      # xberg-io/scoop-bucket manifests -- it owns the `architecture.64bit` shape the bucket
      # actually validates against, so this job must not hand-roll a second, competing
      # manifest writer. It resolves the Windows asset from the published GitHub release
      # itself (github-repo + tag), not from a same-run build artifact, so a Scoop-only retry
      # (release already published, manifest still missing) needs no `force_republish` and no
      # local rebuild. The action downloads that asset and computes its SHA256 itself, so the
      # hash is still always derived from the actual archive bytes, never taken on trust from
      # a manifest or a release body -- see scripts/publish/alef.json.tmpl and
      # tests/publish_scoop_manifest_template_test.rs for the exact rendered shape this
      # produces and why it is not the previous flat url/hash/extract_dir bug.
      #
      # ~keep The following are verified against xberg-io/actions@publish-scoop-manifests's
      # actual source (action.yml + scripts/render.py), fetched via
      # `gh api repos/xberg-io/actions/contents/...`, not inferred from its README:
      # - `config-file` resolves via `Path(INPUT_CONFIG_FILE).resolve()` against the step's
      #   process cwd (render.py `main()`); the composite step that runs it carries no
      #   `working-directory:` override, so that cwd is this job's default
      #   `$GITHUB_WORKSPACE` -- the alef checkout above, with no `path:` override. A relative
      #   `config-file` here is therefore alef-repo-root-relative, matching
      #   `scripts/publish/scoop-manifests.json` below.
      # - `token` is read exclusively by `_download_asset()`'s `gh release download -R {repo}`
      #   -- render.py contains no git-write code at all, and action.yml states outright: "The
      #   calling workflow is responsible for committing/pushing the resulting bucket changes
      #   -- bot identity is repo-specific." `contents: read` on the same-repo `github.token`
      #   is sufficient for a public-repo release download, and is in fact this input's own
      #   documented default (`default: ${{ github.token }}`); the write side stays entirely
      #   on `bucket-token` below, which this step never touches.
      # - Templating is confirmed `string.Template(raw).substitute(mapping)` in
      #   `_render_template()`, with `mapping = {"tag": ..., "version": ..., <sha_key>: <hex>}`
      #   built from the config's own `assets` dict keys -- exactly `${tag}`, `${version}`,
      #   `${win_x64_sha}` in scripts/publish/alef.json.tmpl. `.substitute()` (not
      #   `safe_substitute()`) raises `KeyError` on an unescaped unknown placeholder, which is
      #   exactly the error `$schema` produced locally before being escaped to `$$schema` --
      #   confirming that fix was necessary against the real renderer, not just this branch's
      #   local verification harness.
      #
      # ~keep `token: github.token`, not the `bucket-token` app-token step above: this step
      # only reads the public `xberg-io/alef` release (`github-repo` below), it never writes
      # to `scoop-bucket`, so it gets the workflow's own same-repo, `contents: read`-scoped
      # token rather than a broader one. `bucket-token` stays reserved for the one step that
      # actually needs write access to a different repository -- the commit/push below.
      #
      # ~keep Deliberately does NOT forward `needs.prepare.outputs.dry_run` as this step's own
      # `dry-run` input: per action.yml, that input makes the action tolerate a *missing*
      # asset via a zero-SHA placeholder, and its own "Validate rendered manifests" step is
      # gated `if: inputs.dry-run != 'true'` -- i.e. dry-run mode explicitly SKIPS the
      # action's own schema/version/zero-SHA validation. That is the opposite of what a
      # release dry run should prove, so this step always renders (and validates) for real
      # against the already-available asset; only "Commit and push manifest" below is gated on
      # our workflow's `dry_run`.
      - name: Render and publish Scoop manifest
        id: render
        uses: xberg-io/actions/publish-scoop-manifests@v1
        with:
          bucket-dir: ${{ github.workspace }}/scoop-bucket
          config-file: scripts/publish/scoop-manifests.json
          tag: ${{ needs.prepare.outputs.tag }}
          version: ${{ needs.prepare.outputs.version }}
          github-repo: xberg-io/alef
          token: ${{ github.token }}

      # ~keep Extracted to a standalone, unit-testable script (rather than inline workflow
      # bash) specifically so the untracked-first-publish fix has a real regression test --
      # see scripts/publish/commit-scoop-manifest.sh and
      # tests/publish_scoop_manifest_commit_test.rs, which reproduces the bug against a real
      # git repo and proves the old `git diff --quiet` form misses it.
      - name: Commit and push manifest
        if: needs.prepare.outputs.dry_run != 'true'
        env:
          GH_TOKEN: ${{ steps.bucket-token.outputs.token }}
          BUCKET_DIR: ${{ github.workspace }}/scoop-bucket
          MANIFEST_PATH: bucket/alef.json
          VERSION: ${{ needs.prepare.outputs.version }}
        run: scripts/publish/commit-scoop-manifest.sh

  publish-crates:
    name: Publish crates.io
    needs: [prepare, check-cratesio]
    if: |
      always() &&
      needs.prepare.outputs.release_crates == 'true' &&
      (needs.check-cratesio.outputs.exists != 'true' || needs.prepare.outputs.force_republish == 'true')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Setup Rust
        uses: xberg-io/actions/setup-rust@v1
        with:
          install-llvm-cov: "false"

      - name: Publish to crates.io
        uses: xberg-io/actions/publish-crates@v1
        with:
          crates: alef
          version: ${{ needs.prepare.outputs.version }}
          dry-run: ${{ needs.prepare.outputs.dry_run }}

  finalize:
    name: Finalize release
    needs: [prepare, upload-release-assets, publish-crates, publish-homebrew-bottles, publish-scoop-manifest]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.checkout_ref }}

      - name: Publish summary
        if: always()
        run: |
          {
            echo "## Release ${{ needs.prepare.outputs.tag }}"
            echo ""
            echo "| Registry | Status |"
            echo "|----------|--------|"
          } >> "$GITHUB_STEP_SUMMARY"
          report() {
            local name="$1" result="$2"
            case "$result" in
              success)  echo "| $name | :white_check_mark: Published |" ;;
              skipped)  echo "| $name | :fast_forward: Skipped |" ;;
              *)        echo "| $name | :x: $result |" ;;
            esac
          }
          {
            report "crates.io"       "${{ needs.publish-crates.result }}"
            report "GitHub Release"  "${{ needs.upload-release-assets.result }}"
            report "Homebrew"        "${{ needs.publish-homebrew-bottles.result }}"
            report "Scoop"           "${{ needs.publish-scoop-manifest.result }}"
          } >> "$GITHUB_STEP_SUMMARY"