openlogi 0.6.5

name: Release

on:
  push:
    tags:
      - "v*"

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  MACOSX_DEPLOYMENT_TARGET: "13.0"
  DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer

jobs:
  macos:
    name: macOS DMG (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: arm64
            runner: macos-latest
          - arch: x86_64
            runner: macos-15-intel
    permissions:
      contents: read
    env:
      OPENLOGI_BUNDLE_ASSETS: ${{ vars.OPENLOGI_BUNDLE_ASSETS }}
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Verify runner architecture
        run: test "$(uname -m)" = "${{ matrix.arch }}"

      - name: Load release secrets from 1Password
        id: load_secrets
        uses: 1password/load-secrets-action@v4
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.OP_APPLE_SECRET_ITEM }}/APPLE_SIGNING_IDENTITY
          APPLE_CERTIFICATE: ${{ secrets.OP_APPLE_SECRET_ITEM }}/APPLE_CERTIFICATE
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.OP_APPLE_SECRET_ITEM }}/APPLE_CERTIFICATE_PASSWORD
          APPLE_ID: ${{ secrets.OP_APPLE_SECRET_ITEM }}/APPLE_ID
          APPLE_PASSWORD: ${{ secrets.OP_APPLE_SECRET_ITEM }}/APPLE_PASSWORD
          APPLE_TEAM_ID: ${{ secrets.OP_APPLE_SECRET_ITEM }}/APPLE_TEAM_ID
          GITHUB_APP_ID: ${{ secrets.OP_GITHUB_APP_ITEM }}/GITHUB_APP_ID
          GITHUB_APP_PRIVATE_KEY: ${{ secrets.OP_GITHUB_APP_ITEM }}/GITHUB_APP_PRIVATE_KEY
          OPENLOGI_UPDATE_BASE_URL: ${{ secrets.OP_R2_SECRET_ITEM }}/OPENLOGI_UPDATE_BASE_URL
          OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY: ${{ secrets.OP_R2_SECRET_ITEM }}/OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY

      - name: Install packaging tools
        run: |
          brew install librsvg
          brew install create-dmg

      - name: Validate release secrets
        env:
          APPLE_SIGNING_IDENTITY: ${{ steps.load_secrets.outputs.APPLE_SIGNING_IDENTITY }}
          APPLE_CERTIFICATE: ${{ steps.load_secrets.outputs.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ steps.load_secrets.outputs.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ steps.load_secrets.outputs.APPLE_ID }}
          APPLE_PASSWORD: ${{ steps.load_secrets.outputs.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ steps.load_secrets.outputs.APPLE_TEAM_ID }}
          GITHUB_APP_ID: ${{ steps.load_secrets.outputs.GITHUB_APP_ID }}
          GITHUB_APP_PRIVATE_KEY: ${{ steps.load_secrets.outputs.GITHUB_APP_PRIVATE_KEY }}
          OPENLOGI_UPDATE_BASE_URL: ${{ steps.load_secrets.outputs.OPENLOGI_UPDATE_BASE_URL }}
          OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY: ${{ steps.load_secrets.outputs.OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY }}
        run: |
          set -euo pipefail
          : "${APPLE_SIGNING_IDENTITY:?Configure APPLE_SIGNING_IDENTITY in 1Password}"
          : "${APPLE_CERTIFICATE:?Configure APPLE_CERTIFICATE in 1Password}"
          : "${APPLE_CERTIFICATE_PASSWORD:?Configure APPLE_CERTIFICATE_PASSWORD in 1Password}"
          : "${APPLE_ID:?Configure APPLE_ID in 1Password}"
          : "${APPLE_PASSWORD:?Configure APPLE_PASSWORD in 1Password}"
          : "${APPLE_TEAM_ID:?Configure APPLE_TEAM_ID in 1Password}"
          : "${GITHUB_APP_ID:?Configure GITHUB_APP_ID in 1Password}"
          : "${GITHUB_APP_PRIVATE_KEY:?Configure GITHUB_APP_PRIVATE_KEY in 1Password}"
          : "${OPENLOGI_UPDATE_BASE_URL:?Configure OPENLOGI_UPDATE_BASE_URL in 1Password}"
          : "${OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY:?Configure OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY in 1Password}"

      - name: Import Apple signing certificate
        uses: apple-actions/import-codesign-certs@v7
        with:
          p12-file-base64: ${{ steps.load_secrets.outputs.APPLE_CERTIFICATE }}
          p12-password: ${{ steps.load_secrets.outputs.APPLE_CERTIFICATE_PASSWORD }}

      - name: Build OpenLogi.app with cargo-bundle
        env:
          OPENLOGI_UPDATE_BASE_URL: ${{ steps.load_secrets.outputs.OPENLOGI_UPDATE_BASE_URL }}
          OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY: ${{ steps.load_secrets.outputs.OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY }}
        run: |
          set -euo pipefail
          export OPENLOGI_UPDATE_MANIFEST_URL="${OPENLOGI_UPDATE_BASE_URL%/}/channels/stable/latest.json"
          cargo run -p xtask -- bundle-macos

      - name: Sign app bundle
        env:
          APPLE_SIGNING_IDENTITY: ${{ steps.load_secrets.outputs.APPLE_SIGNING_IDENTITY }}
        run: |
          set -euo pipefail
          app="target/release/bundle/osx/OpenLogi.app"
          helper="$app/Contents/Library/LoginItems/OpenLogiAgent.app"
          # Inside-out signing: seal the nested agent helper with its own
          # signature first, then the outer app (which seals the signed helper).
          # --deep is deprecated and can't give the helper an independent
          # signature, which a stable per-helper TCC identity — so the agent's
          # Accessibility grant survives app updates — requires.
          if [ -d "$helper" ]; then
            codesign --force --options runtime --timestamp \
              --sign "$APPLE_SIGNING_IDENTITY" "$helper"
          fi
          codesign --force --options runtime --timestamp \
            --sign "$APPLE_SIGNING_IDENTITY" "$app"
          codesign --verify --strict --verbose=2 "$app"
          [ -d "$helper" ] && codesign --verify --strict --verbose=2 "$helper"

      - name: Create and sign DMG
        env:
          APPLE_SIGNING_IDENTITY: ${{ steps.load_secrets.outputs.APPLE_SIGNING_IDENTITY }}
        run: |
          set -euo pipefail
          cargo run -p xtask -- dmg-macos --sign-identity "$APPLE_SIGNING_IDENTITY"

      - name: Notarize DMG
        env:
          APPLE_ID: ${{ steps.load_secrets.outputs.APPLE_ID }}
          APPLE_PASSWORD: ${{ steps.load_secrets.outputs.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ steps.load_secrets.outputs.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail
          xcrun notarytool submit target/release/OpenLogi.dmg \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

      - name: Staple DMG
        run: |
          set -euo pipefail
          xcrun stapler staple target/release/OpenLogi.dmg
          xcrun stapler validate target/release/OpenLogi.dmg

      - name: Collect DMG artifact
        run: |
          mkdir -p dist
          ref_name="${GITHUB_REF_NAME:-dev}"
          ref_name="${ref_name//\//-}"
          cp target/release/OpenLogi.dmg "dist/OpenLogi-${ref_name}-macos-${{ matrix.arch }}.dmg"

      - uses: actions/upload-artifact@v7
        with:
          name: OpenLogi-macos-dmg-${{ matrix.arch }}
          path: dist/*.dmg

  windows:
    name: Windows CLI (x86_64)
    runs-on: windows-2025
    # A hung signing/login call must become a normal failure (which publish
    # tolerates), not a 6-hour stall: publish waits for this job to reach a
    # terminal state before its own gate is even evaluated. Healthy runs take
    # ~8 minutes (v0.6.4 measured ~4.6 min up to the signing step).
    timeout-minutes: 30
    permissions:
      # Mint an OIDC token so azure/login can exchange it for an Azure access token
      # via a federated credential — no client secret is stored in GitHub.
      id-token: write
      contents: read
    # The federated credential's subject is bound to this GitHub environment, so the
    # OIDC `sub` claim stays stable (repo:AprilNEA/OpenLogi:environment:release)
    # instead of changing with every tag ref.
    environment: release
    steps:
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable

      # No rust-cache here: this workflow runs only on tag refs, whose saved
      # caches no future tag can restore (and no default-branch job produces a
      # matching key), so the save was pure overhead churning the cache quota.

      # Azure signing config lives in 1Password, matching the macOS job's secret flow.
      # load-secrets-action is a node action, so it runs on Windows runners too. The
      # client/tenant/subscription IDs are not secrets under OIDC, but are centralised
      # here so all release config has a single source of truth.
      - name: Load Azure signing config from 1Password
        id: azure_config
        uses: 1password/load-secrets-action@v4
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          AZURE_CLIENT_ID: ${{ secrets.OP_AZURE_SECRET_ITEM }}/AZURE_CLIENT_ID
          AZURE_TENANT_ID: ${{ secrets.OP_AZURE_SECRET_ITEM }}/AZURE_TENANT_ID
          AZURE_SUBSCRIPTION_ID: ${{ secrets.OP_AZURE_SECRET_ITEM }}/AZURE_SUBSCRIPTION_ID
          AZURE_SIGNING_ENDPOINT: ${{ secrets.OP_AZURE_SECRET_ITEM }}/AZURE_SIGNING_ENDPOINT
          AZURE_SIGNING_ACCOUNT: ${{ secrets.OP_AZURE_SECRET_ITEM }}/AZURE_SIGNING_ACCOUNT
          AZURE_CERT_PROFILE: ${{ secrets.OP_AZURE_SECRET_ITEM }}/AZURE_CERT_PROFILE

      # load-secrets-action silently skips values that aren't op:// references
      # (e.g. when OP_AZURE_SECRET_ITEM is unset) and emits empty outputs for
      # empty fields — without this gate the job only fails minutes later, in
      # azure/login, with an error that never names the real cause.
      - name: Validate Azure signing config
        shell: bash
        env:
          AZURE_CLIENT_ID: ${{ steps.azure_config.outputs.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ steps.azure_config.outputs.AZURE_TENANT_ID }}
          AZURE_SUBSCRIPTION_ID: ${{ steps.azure_config.outputs.AZURE_SUBSCRIPTION_ID }}
          AZURE_SIGNING_ENDPOINT: ${{ steps.azure_config.outputs.AZURE_SIGNING_ENDPOINT }}
          AZURE_SIGNING_ACCOUNT: ${{ steps.azure_config.outputs.AZURE_SIGNING_ACCOUNT }}
          AZURE_CERT_PROFILE: ${{ steps.azure_config.outputs.AZURE_CERT_PROFILE }}
        run: |
          set -euo pipefail
          : "${AZURE_CLIENT_ID:?Configure AZURE_CLIENT_ID in the Azure 1Password item}"
          : "${AZURE_TENANT_ID:?Configure AZURE_TENANT_ID in the Azure 1Password item}"
          : "${AZURE_SUBSCRIPTION_ID:?Configure AZURE_SUBSCRIPTION_ID in the Azure 1Password item}"
          : "${AZURE_SIGNING_ENDPOINT:?Configure AZURE_SIGNING_ENDPOINT in the Azure 1Password item}"
          : "${AZURE_SIGNING_ACCOUNT:?Configure AZURE_SIGNING_ACCOUNT in the Azure 1Password item}"
          : "${AZURE_CERT_PROFILE:?Configure AZURE_CERT_PROFILE in the Azure 1Password item}"

      # Only the `openlogi` CLI compiles on Windows from master today — the agent and
      # GUI are excluded from the Windows build (see ci.yml's `clippy (windows)`), so
      # this signs and ships `openlogi.exe` alone until the Windows agent/GUI land.
      - name: Build OpenLogi CLI
        run: cargo build --release -p openlogi

      # Federated (passwordless) login. Requires an app registration whose federated
      # credential subject is `repo:AprilNEA/OpenLogi:environment:release`, granted the
      # "Artifact Signing Certificate Profile Signer" role on the signing account.
      - name: Azure login (OIDC)
        uses: azure/login@v3
        with:
          client-id: ${{ steps.azure_config.outputs.AZURE_CLIENT_ID }}
          tenant-id: ${{ steps.azure_config.outputs.AZURE_TENANT_ID }}
          subscription-id: ${{ steps.azure_config.outputs.AZURE_SUBSCRIPTION_ID }}

      # Authenticode-signs via Artifact Signing (ex-Trusted Signing). The action only
      # runs on Windows runners. azure/login leaves an az CLI session that the action's
      # default AzureCliCredential picks up, so no azure-* secret inputs are needed.
      - name: Sign openlogi.exe with Artifact Signing
        uses: azure/artifact-signing-action@v2
        with:
          endpoint: ${{ steps.azure_config.outputs.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ steps.azure_config.outputs.AZURE_SIGNING_ACCOUNT }}
          certificate-profile-name: ${{ steps.azure_config.outputs.AZURE_CERT_PROFILE }}
          files: ${{ github.workspace }}\target\release\openlogi.exe
          # Timestamping is mandatory: without it the signature expires after
          # 3 days. https beats the action's http default; the file/timestamp
          # digests stay on the action's SHA256 defaults.
          timestamp-rfc3161: https://timestamp.acs.microsoft.com
          # Tag-only workflow: the action's four dependency caches save to
          # per-tag refs no future run can restore, so skip them.
          cache-dependencies: false

      - name: Verify the binary is signed
        shell: pwsh
        run: |
          $sig = Get-AuthenticodeSignature target\release\openlogi.exe
          $sig | Format-List
          # The signing step above already fails on error; this guards against it
          # silently producing an unsigned or corrupted binary. NotSigned and
          # HashMismatch (bytes no longer match the signature) are trust-store
          # independent and always ship-blockers; NotTrusted/UnknownError depend
          # on the runner's trust store, so they stay log-only.
          if ($null -eq $sig.SignerCertificate -or
              "$($sig.Status)" -in 'NotSigned', 'HashMismatch') {
            Write-Error "openlogi.exe Authenticode signature is invalid: $($sig.Status)"
            exit 1
          }

      - name: Collect signed CLI artifact
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          $ref = $env:GITHUB_REF_NAME -replace '/', '-'
          Copy-Item target\release\openlogi.exe "dist\OpenLogi-$ref-windows-x86_64.exe"

      - uses: actions/upload-artifact@v7
        with:
          name: OpenLogi-windows-x86_64
          path: dist/*.exe
          # 'warn' (the default) would let a no-exe job stay green, and publish
          # would then die at the by-name download instead of shipping DMG-only.
          if-no-files-found: error

  release-notes:
    name: Generate release notes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4
        with:
          version: 10.11.0

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: scripts/release-notes/pnpm-lock.yaml

      - name: Load Codex release-notes credentials from 1Password
        id: release_notes_config
        continue-on-error: true
        uses: 1password/load-secrets-action@v4
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          CODEX_ACCESS_TOKEN: ${{ secrets.OP_CODEX_SECRET_ITEM }}/credential
          CHATGPT_USERNAME: ${{ secrets.OP_CODEX_SECRET_ITEM }}/username
          CODEX_ENDPOINT: ${{ secrets.OP_CODEX_SECRET_ITEM }}/ENDPOINT

      - name: Mint release-notes GitHub App token
        id: release_notes_app_token
        continue-on-error: true
        uses: ./.github/actions/github-app-token-from-1password
        with:
          op-service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          op-github-app-item: ${{ secrets.OP_GITHUB_APP_ITEM }}

      - name: Install release-notes dependencies
        run: pnpm --dir scripts/release-notes install --frozen-lockfile

      - name: Generate GitHub Release notes
        env:
          CODEX_ACCESS_TOKEN: ${{ steps.release_notes_config.outputs.CODEX_ACCESS_TOKEN }}
          CHATGPT_USERNAME: ${{ steps.release_notes_config.outputs.CHATGPT_USERNAME }}
          CODEX_ENDPOINT: ${{ steps.release_notes_config.outputs.CODEX_ENDPOINT }}
          GH_TOKEN: ${{ steps.release_notes_app_token.outputs.token }}
        run: |
          set -euo pipefail
          node scripts/release-notes/generate.ts \
            --tag "$GITHUB_REF_NAME" \
            --output .release/RELEASE_NOTES.md

      - uses: actions/upload-artifact@v7
        with:
          name: OpenLogi-release-notes
          path: .release/RELEASE_NOTES.md

  # Single owner of the GitHub Release. softprops/action-gh-release@v3 creates the
  # release as a draft, uploads every asset to that (mutable) draft, then publishes
  # it as its final step — so the release only becomes immutable once all DMGs and
  # checksums are attached. The static updater assets are pushed to R2 *before* that
  # softprops call, so the GitHub Release is the last thing published.
  publish:
    name: Publish release
    runs-on: ubuntu-latest
    needs: [macos, windows, release-notes]
    # Wait for the Windows job (so a successful .exe can be attached) but do NOT let
    # its failure block the macOS release. `!cancelled()` removes the implicit
    # "all needs succeeded" gate, so the required deps are checked explicitly here —
    # windows is deliberately absent from this condition.
    # NOTE: after such a partial publish, do NOT "re-run failed jobs" — publish
    # re-runs as windows' dependent and fails against the now-immutable release
    # (and would overwrite immutable-cached R2 objects). A missed .exe ships
    # with the next tag instead.
    if: ${{ !cancelled() && needs.macos.result == 'success' && needs.release-notes.result == 'success' }}
    permissions:
      contents: write
    steps:
      # Needed to build & run the xtask manifest generator below.
      - uses: actions/checkout@v6

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - uses: actions/download-artifact@v8
        with:
          pattern: OpenLogi-macos-dmg-*
          path: dist
          merge-multiple: true

      # Present only when the independent Windows job succeeded; skipped otherwise.
      - uses: actions/download-artifact@v8
        if: ${{ needs.windows.result == 'success' }}
        with:
          name: OpenLogi-windows-x86_64
          path: dist

      - uses: actions/download-artifact@v8
        with:
          name: OpenLogi-release-notes
          path: .release

      - name: Generate checksums
        run: |
          cd dist
          # The DMGs are the release gate — fail loudly if none arrived (with
          # nullglob alone, sha256sum with zero args would silently hash stdin).
          compgen -G '*.dmg' > /dev/null
          # nullglob: when the Windows job didn't ship an .exe, *.exe drops to
          # nothing instead of erroring on a literal pattern, so the DMGs are
          # hashed alone.
          shopt -s nullglob
          sha256sum *.dmg *.exe > SHA256SUMS

      - name: Load static updater publishing config from 1Password
        id: r2_config
        uses: 1password/load-secrets-action@v4
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          OPENLOGI_UPDATE_BASE_URL: ${{ secrets.OP_R2_SECRET_ITEM }}/OPENLOGI_UPDATE_BASE_URL
          OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY: ${{ secrets.OP_R2_SECRET_ITEM }}/OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY
          OPENLOGI_UPDATE_MINISIGN_SECRET_KEY: ${{ secrets.OP_R2_SECRET_ITEM }}/OPENLOGI_UPDATE_MINISIGN_SECRET_KEY
          R2_ACCOUNT_ID: ${{ secrets.OP_R2_SECRET_ITEM }}/CLOUDFLARE_R2_ACCOUNT_ID
          R2_BUCKET: ${{ secrets.OP_R2_SECRET_ITEM }}/CLOUDFLARE_R2_BUCKET
          R2_ACCESS_KEY_ID: ${{ secrets.OP_R2_SECRET_ITEM }}/CLOUDFLARE_R2_ACCESS_KEY_ID
          R2_SECRET_ACCESS_KEY: ${{ secrets.OP_R2_SECRET_ITEM }}/CLOUDFLARE_R2_SECRET_ACCESS_KEY

      - name: Validate R2 publishing configuration
        env:
          OPENLOGI_UPDATE_BASE_URL: ${{ steps.r2_config.outputs.OPENLOGI_UPDATE_BASE_URL }}
          OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY: ${{ steps.r2_config.outputs.OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY }}
          OPENLOGI_UPDATE_MINISIGN_SECRET_KEY: ${{ steps.r2_config.outputs.OPENLOGI_UPDATE_MINISIGN_SECRET_KEY }}
          R2_ACCOUNT_ID: ${{ steps.r2_config.outputs.R2_ACCOUNT_ID }}
          R2_BUCKET: ${{ steps.r2_config.outputs.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ steps.r2_config.outputs.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ steps.r2_config.outputs.R2_SECRET_ACCESS_KEY }}
        run: |
          set -euo pipefail
          : "${OPENLOGI_UPDATE_BASE_URL:?Configure OPENLOGI_UPDATE_BASE_URL in the R2 1Password item}"
          : "${OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY:?Configure OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY in the R2 1Password item}"
          : "${OPENLOGI_UPDATE_MINISIGN_SECRET_KEY:?Configure OPENLOGI_UPDATE_MINISIGN_SECRET_KEY in the R2 1Password item}"
          : "${R2_ACCOUNT_ID:?Configure CLOUDFLARE_R2_ACCOUNT_ID in the R2 1Password item}"
          : "${R2_BUCKET:?Configure CLOUDFLARE_R2_BUCKET in the R2 1Password item}"
          : "${R2_ACCESS_KEY_ID:?Configure CLOUDFLARE_R2_ACCESS_KEY_ID in the R2 1Password item}"
          : "${R2_SECRET_ACCESS_KEY:?Configure CLOUDFLARE_R2_SECRET_ACCESS_KEY in the R2 1Password item}"

      - name: Install minisign
        run: |
          sudo apt-get update
          sudo apt-get install -y minisign

      - name: Sign updater artifacts
        env:
          OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY: ${{ steps.r2_config.outputs.OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY }}
          OPENLOGI_UPDATE_MINISIGN_SECRET_KEY: ${{ steps.r2_config.outputs.OPENLOGI_UPDATE_MINISIGN_SECRET_KEY }}
        run: |
          set -euo pipefail
          key_file="${RUNNER_TEMP}/openlogi-minisign.key"
          umask 077
          trap 'rm -f "$key_file"' EXIT
          # The secret key file is stored base64-encoded in 1Password so its two
          # lines survive paste/round-trip (a raw multi-line value can have its
          # newline mangled to a space — see the GitHub App key note above).
          # `tr -d` drops any wrapping whitespace before decoding.
          printf '%s' "$OPENLOGI_UPDATE_MINISIGN_SECRET_KEY" | tr -d '[:space:]' | base64 -d > "$key_file"
          for artifact in dist/*.dmg; do
            minisign -S -m "$artifact" -s "$key_file" -x "$artifact.minisig" -W
            minisign -V -m "$artifact" -P "$OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY" -x "$artifact.minisig"
          done

      - name: Generate static updater manifest
        env:
          OPENLOGI_UPDATE_BASE_URL: ${{ steps.r2_config.outputs.OPENLOGI_UPDATE_BASE_URL }}
        run: |
          set -euo pipefail
          cargo run -p xtask -- generate-updater-manifest \
            --dist dist \
            --tag "$GITHUB_REF_NAME" \
            --base-url "$OPENLOGI_UPDATE_BASE_URL" \
            --output dist/latest.json

      - name: Upload static updater assets to R2
        env:
          AWS_ACCESS_KEY_ID: ${{ steps.r2_config.outputs.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.r2_config.outputs.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
          AWS_REGION: auto
          R2_ACCOUNT_ID: ${{ steps.r2_config.outputs.R2_ACCOUNT_ID }}
          R2_BUCKET: ${{ steps.r2_config.outputs.R2_BUCKET }}
        run: |
          set -euo pipefail
          endpoint="https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com"
          release_prefix="s3://${R2_BUCKET}/releases/${GITHUB_REF_NAME}"
          channel_manifest="s3://${R2_BUCKET}/channels/stable/latest.json"

          # The exe's distribution channel is the GitHub Release; nothing in
          # the updater bucket references it (latest.json and the minisign
          # loop are dmg-only), so keep it out of the immutable releases/
          # prefix. SHA256SUMS still lists it — it describes the GitHub
          # Release's asset set.
          aws s3 cp dist/ "$release_prefix/" \
            --recursive \
            --exclude latest.json \
            --exclude "*.exe" \
            --cache-control "public, max-age=31536000, immutable" \
            --endpoint-url "$endpoint"

          aws s3 cp dist/latest.json "$channel_manifest" \
            --content-type "application/json" \
            --cache-control "no-cache" \
            --endpoint-url "$endpoint"

      # Create the draft, upload assets to it, then publish — all in one step.
      # `draft` is omitted, so for a non-prerelease softprops creates the release as
      # a draft, uploads every file, and only then flips it to published. That keeps
      # the release mutable for the whole upload, which is what avoids the "immutable
      # release" rejection. latest.json is intentionally not attached — it lives in
      # R2 only; RELEASE_NOTES.md is kept outside dist for the same reason.
      - name: Publish GitHub Release with assets
        uses: softprops/action-gh-release@v3
        with:
          body_path: .release/RELEASE_NOTES.md
          files: |
            dist/*.dmg
            dist/*.minisig
            dist/SHA256SUMS
            ${{ needs.windows.result == 'success' && 'dist/*.exe' || '' }}
          fail_on_unmatched_files: true

  homebrew-tap:
    name: Dispatch homebrew-tap update
    runs-on: ubuntu-latest
    needs: publish
    permissions:
      contents: read
    steps:
      # The token-minting action below is a local action, so the repo must be
      # on disk before it can run.
      - uses: actions/checkout@v6

      - name: Mint homebrew-tap token (GitHub App)
        id: tap_token
        uses: ./.github/actions/github-app-token-from-1password
        with:
          op-service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          op-github-app-item: ${{ secrets.OP_GITHUB_APP_ITEM }}
          owner: AprilNEA
          repositories: homebrew-tap

      - name: Dispatch homebrew-tap update
        uses: peter-evans/repository-dispatch@v4
        with:
          token: ${{ steps.tap_token.outputs.token }}
          repository: AprilNEA/homebrew-tap
          event-type: update-openlogi
          client-payload: |
            {"version": "${{ github.ref_name }}"}