release.yaml

# Build, sign, notarize, and release ORGII for macOS (Apple Silicon), Windows (x64), and Linux (x64).
#
# Trigger: push a tag matching v* (e.g. v1.1.0, v1.1.1).
# Release tags must be valid three-part SemVer because Tauri app/updater
# versions are written directly from the tag.
#
# Update channels:
#   Stable — tag vX.Y.Z. Served via the GitHub "latest release" alias
#     (releases/latest/download/latest.json), which excludes prereleases.
#   Beta   — tag vX.Y.Z-beta.N for the NEXT unreleased X.Y.Z (never a version
#     that already shipped, or SemVer would sort it below stable and the
#     updater would never offer it). Marked as a GitHub prerelease.
#     Windows beta builds ship NSIS only: WiX/MSI rejects SemVer prerelease
#     versions, and the updater uses the NSIS artifact anyway.
#   Every release (stable and beta) overwrites beta.json on the rolling
#   `updater` release when it is the highest version so far, so the beta
#   channel always points at the newest build of either kind and beta users
#   converge back onto stable once it overtakes the last beta.
#
# Sidecar binaries (peekaboo, agent-browser, dugite/git) are NOT bundled in the
# .app. They are downloaded at first launch into ~/.orgii/bin/ by the app itself
# (post-notarized download strategy). This keeps the notarized bundle small and
# eliminates the historical notarization hang caused by thousands of dugite files.
#
# Required GitHub Secrets (macOS):
#   APPLE_CERTIFICATE               — base64-encoded .p12 Developer ID certificate
#   APPLE_CERTIFICATE_PASSWORD      — password for the .p12
#   APPLE_SIGNING_IDENTITY          — e.g. "Developer ID Application: HOUYi HE (S4UG24G7HJ)"
#   APPLE_ID                        — Apple account email for notarization
#   APPLE_PASSWORD                  — app-specific password for notarization
#   APPLE_TEAM_ID                   — 10-char Apple Team ID
#   TAURI_SIGNING_PRIVATE_KEY       — Tauri updater ed25519 private key
#   TAURI_SIGNING_PRIVATE_KEY_PASSWORD — password for the updater key
#   ORGII_DIAGNOSTICS_TOKEN         — Bearer token for Diagnostics Worker uploads
#
# Required GitHub Secrets (Windows — Azure Trusted Signing via OIDC):
#   AZURE_CLIENT_ID                 — App Registration client ID (Federated Credential)
#   AZURE_TENANT_ID                 — Entra ID tenant ID
#   AZURE_SUBSCRIPTION_ID           — Azure subscription ID
#
# Recommended GitHub/Azure OIDC setup for scalable tag releases:
#   GitHub Environment: code-signing
#   Azure Federated Credential subject:
#     repo:YORG-AI/ORGII:environment:code-signing
#
# Azure Trusted Signing config (already provisioned):
#   Account:  orgii-codesign  (East US — https://eus.codesigning.azure.net/)
#   Profile:  orgii-windows   (Public Trust, SHA256)

name: "Release ORGII"

on:
  push:
    tags: ["v*"]

permissions:
  contents: write # create releases and upload assets
  id-token: write # Azure OIDC for Trusted Signing (Windows job)

jobs:
  build-and-release:
    name: Build & Release (macOS aarch64)
    runs-on: macos-latest
    env:
      HAS_APPLE_CERT: ${{ secrets.APPLE_CERTIFICATE != '' }}
    steps:
      # ── Checkout ──────────────────────────────────────────────
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          path: .

      # ── Apple code-signing certificate (fail fast before slow steps) ─
      - name: Import Apple certificate
        if: env.HAS_APPLE_CERT == 'true'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          printf '%s' "$APPLE_CERTIFICATE" | base64 -d > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A \
            -t cert \
            -f pkcs12 \
            -k "$KEYCHAIN_PATH"

          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db

      # ── Stamp version from git tag ──────────────────────────
      # Tag format: v1.1.0 (valid three-part SemVer).
      - name: Set version from tag
        run: |
          FULL_VERSION="${GITHUB_REF_NAME#v}"
          if ! [[ "$FULL_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag must be valid three-part SemVer: $GITHUB_REF_NAME" >&2
            exit 1
          fi
          SEMVER="$FULL_VERSION"
          echo "VERSION=$FULL_VERSION" >> "$GITHUB_ENV"
          echo "SEMVER=$SEMVER" >> "$GITHUB_ENV"
          echo "=== Release version: $FULL_VERSION ==="
          sed -i '' "s/\"version\": \".*\"/\"version\": \"$SEMVER\"/" src-tauri/tauri.conf.json
          sed -i '' "s/\"version\": \".*\"/\"version\": \"$FULL_VERSION\"/" package.json
          grep '"version"' src-tauri/tauri.conf.json package.json

      # ── Node.js + pnpm ───────────────────────────────────────
      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Cache node_modules
        uses: actions/cache@v5
        with:
          path: node_modules
          key: node-modules-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

      # ── Rust ──────────────────────────────────────────────────
      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"
          shared-key: "release-macos-aarch64"

      # ── Download sidecar binaries (peekaboo, agent-browser) ──
      - name: Cache sidecar binaries
        uses: actions/cache@v4
        with:
          path: src-tauri/bin
          key: sidecars-peekaboo-v3.2.3-agent-browser-v0.27.2-aarch64

      - name: Download sidecar binaries
        run: python3 scripts/tools/download_sidecars.py

      # ── Build Tauri app (sign + notarize + updater artifacts) ─
      - name: Build ORGII
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          ORGII_DIAGNOSTICS_TOKEN: ${{ secrets.ORGII_DIAGNOSTICS_TOKEN }}
          ORGII_APP_VERSION: ${{ env.SEMVER }}
        run: pnpm tauri build --target aarch64-apple-darwin

      # ── Locate build artifacts ────────────────────────────────
      - name: Gather release artifacts
        id: artifacts
        run: |
          BUNDLE_DIR="src-tauri/target/aarch64-apple-darwin/release/bundle"

          DMG=$(find "$BUNDLE_DIR/dmg" -name "*.dmg" | head -1)
          LATEST_DMG="ORG2-latest-mac-apple-silicon.dmg"
          cp "$DMG" "$LATEST_DMG"
          echo "dmg=$DMG" >> "$GITHUB_OUTPUT"
          echo "latest_dmg=$LATEST_DMG" >> "$GITHUB_OUTPUT"

          UPDATER_TAR=$(find "$BUNDLE_DIR/macos" -name "*.app.tar.gz" ! -name "*.sig" | head -1)
          UPDATER_SIG=$(find "$BUNDLE_DIR/macos" -name "*.app.tar.gz.sig" | head -1)
          LATEST_UPDATER_TAR="ORG2-updater-mac-apple-silicon.app.tar.gz"
          cp "$UPDATER_TAR" "$LATEST_UPDATER_TAR"
          echo "updater_tar=$LATEST_UPDATER_TAR" >> "$GITHUB_OUTPUT"
          echo "updater_sig=$UPDATER_SIG" >> "$GITHUB_OUTPUT"
          echo "updater_tar_name=$LATEST_UPDATER_TAR" >> "$GITHUB_OUTPUT"

          echo "=== Release artifacts ==="
          echo "DMG:         $DMG"
          echo "Updater tar: $LATEST_UPDATER_TAR"
          echo "Updater sig: $UPDATER_SIG"

      # ── Generate updater manifest (latest.json) ───────────────
      - name: Generate latest.json for updater
        env:
          TAG: ${{ github.ref_name }}
        run: |
          SIGNATURE=$(cat "${{ steps.artifacts.outputs.updater_sig }}")
          TAR_NAME="${{ steps.artifacts.outputs.updater_tar_name }}"
          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${TAR_NAME}"

          if ! [[ "$SEMVER" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid updater SemVer: $SEMVER" >&2
            exit 1
          fi

          jq -n \
            --arg version "$SEMVER" \
            --arg notes "Release ${TAG}" \
            --arg pub_date "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            --arg signature "$SIGNATURE" \
            --arg url "$DOWNLOAD_URL" \
            '{ version: $version, notes: $notes, pub_date: $pub_date, platforms: { "darwin-aarch64": { signature: $signature, url: $url } } }' \
            > latest.json

          echo "=== latest.json ==="
          cat latest.json

      # ── Create GitHub Release ─────────────────────────────────
      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          draft: false
          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') || contains(github.ref_name, '-nightly') }}
          generate_release_notes: true
          files: |
            ${{ steps.artifacts.outputs.latest_dmg }}
            ${{ steps.artifacts.outputs.updater_tar }}
            latest.json

      # ── Cleanup keychain ────────────────────────────────────────
      - name: Cleanup keychain
        if: always() && env.HAS_APPLE_CERT == 'true'
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          if [ -f "$KEYCHAIN_PATH" ]; then
            security delete-keychain "$KEYCHAIN_PATH"
          fi

  # ── Windows x64 build ─────────────────────────────────────────────────
  build-windows:
    name: Build & Release (Windows x64)
    runs-on: windows-latest
    needs: build-and-release
    # This makes GitHub's OIDC subject stable across all release tags:
    # repo:YORG-AI/ORGII:environment:code-signing
    environment: code-signing
    env:
      HAS_AZURE_SIGNING: ${{ secrets.AZURE_CLIENT_ID != '' }}
    steps:
      # ── Checkout ────────────────────────────────────────────────
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # ── Stamp version from git tag ───────────────────────────────
      - name: Set version from tag
        shell: bash
        run: |
          FULL_VERSION="${GITHUB_REF_NAME#v}"
          if ! [[ "$FULL_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag must be valid three-part SemVer: $GITHUB_REF_NAME" >&2
            exit 1
          fi
          SEMVER="$FULL_VERSION"
          echo "VERSION=$FULL_VERSION" >> "$GITHUB_ENV"
          echo "SEMVER=$SEMVER" >> "$GITHUB_ENV"
          # WiX/MSI rejects SemVer prerelease versions, so beta builds ship NSIS only.
          # The updater's windows-x86_64 entry uses NSIS either way.
          if [[ "$FULL_VERSION" == *-* ]]; then
            echo "IS_PRERELEASE=true" >> "$GITHUB_ENV"
            echo "WIN_BUNDLES=nsis" >> "$GITHUB_ENV"
          else
            echo "IS_PRERELEASE=false" >> "$GITHUB_ENV"
            echo "WIN_BUNDLES=msi,nsis" >> "$GITHUB_ENV"
          fi
          sed -i "s/\"version\": \".*\"/\"version\": \"$SEMVER\"/" src-tauri/tauri.conf.json
          sed -i "s/\"version\": \".*\"/\"version\": \"$FULL_VERSION\"/" package.json

      # ── Node.js + pnpm ──────────────────────────────────────────
      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

      # ── Rust ────────────────────────────────────────────────────
      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"
          shared-key: "release-windows-x64"

      # ── Build Tauri app ──────────────────────────────────────────
      - name: Build ORGII
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          ORGII_DIAGNOSTICS_TOKEN: ${{ secrets.ORGII_DIAGNOSTICS_TOKEN }}
          ORGII_APP_VERSION: ${{ env.SEMVER }}
        run: pnpm tauri build --target x86_64-pc-windows-msvc --bundles ${{ env.WIN_BUNDLES }}

      # ── Sign with Azure Trusted Signing ─────────────────────────
      - name: Azure login (OIDC)
        if: env.HAS_AZURE_SIGNING == 'true'
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Sign Windows artifacts
        if: env.HAS_AZURE_SIGNING == 'true'
        uses: azure/artifact-signing-action@v2
        with:
          endpoint: https://eus.codesigning.azure.net/
          signing-account-name: orgii-codesign
          certificate-profile-name: orgii-windows
          files-folder: src-tauri\target\x86_64-pc-windows-msvc\release\bundle
          files-folder-filter: exe,msi
          files-folder-recurse: true
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      # ── Regenerate updater signatures after code signing ─────────
      - name: Regenerate updater signatures
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          BUNDLE_DIR="src-tauri/target/x86_64-pc-windows-msvc/release/bundle"
          # The msi directory does not exist on prerelease builds (nsis-only).
          # This step runs under bash -eo pipefail, so a bare find would kill
          # the whole script the moment it exits non-zero.
          MSI=$(find "$BUNDLE_DIR/msi" -name "*.msi" ! -name "*.zip" 2>/dev/null | head -1 || true)
          NSIS=$(find "$BUNDLE_DIR/nsis" -name "*.exe" ! -name "*.zip" | head -1)

          if [ ! -f "$NSIS" ]; then
            echo "Missing Windows updater artifact: $NSIS" >&2
            exit 1
          fi
          if [ "$IS_PRERELEASE" != "true" ] && [ ! -f "$MSI" ]; then
            echo "Missing Windows updater artifact: $MSI" >&2
            exit 1
          fi

          rm -f "$NSIS.sig"
          pnpm tauri signer sign "$NSIS"
          if [ -f "$MSI" ]; then
            rm -f "$MSI.sig"
            pnpm tauri signer sign "$MSI"
          fi

      # ── Gather artifacts ─────────────────────────────────────────
      - name: Gather release artifacts
        id: artifacts
        shell: bash
        run: |
          BUNDLE_DIR="src-tauri/target/x86_64-pc-windows-msvc/release/bundle"

          # msi directory is absent on prerelease builds; see note in the
          # signature-regeneration step about bash -eo pipefail.
          MSI=$(find "$BUNDLE_DIR/msi" -name "*.msi" ! -name "*.zip" 2>/dev/null | head -1 || true)
          MSI_SIG=$(find "$BUNDLE_DIR/msi" -name "*.msi.sig" 2>/dev/null | head -1 || true)
          NSIS=$(find "$BUNDLE_DIR/nsis" -name "*.exe" ! -name "*.zip" | head -1)
          NSIS_SIG=$(find "$BUNDLE_DIR/nsis" -name "*.exe.sig" | head -1)

          for artifact in "$NSIS" "$NSIS_SIG"; do
            if [ ! -f "$artifact" ]; then
              echo "Missing Windows release artifact: $artifact" >&2
              exit 1
            fi
          done

          if [ "$IS_PRERELEASE" != "true" ]; then
            for artifact in "$MSI" "$MSI_SIG"; do
              if [ ! -f "$artifact" ]; then
                echo "Missing Windows release artifact: $artifact" >&2
                exit 1
              fi
            done
          fi

          LATEST_NSIS="ORG2-latest-windows-x64-setup.exe"
          cp "$NSIS" "$LATEST_NSIS"

          if [ -f "$MSI" ]; then
            LATEST_MSI="ORG2-latest-windows-x64.msi"
            cp "$MSI" "$LATEST_MSI"
            echo "msi=$MSI"               >> "$GITHUB_OUTPUT"
            echo "msi_sig=$MSI_SIG"       >> "$GITHUB_OUTPUT"
            echo "latest_msi=$LATEST_MSI" >> "$GITHUB_OUTPUT"
          fi

          echo "nsis=$NSIS"               >> "$GITHUB_OUTPUT"
          echo "nsis_sig=$NSIS_SIG"       >> "$GITHUB_OUTPUT"
          echo "latest_nsis=$LATEST_NSIS" >> "$GITHUB_OUTPUT"

          echo "=== Windows artifacts ==="
          echo "MSI:      ${MSI:-<skipped for prerelease>}"
          echo "MSI sig:  ${MSI_SIG:-<skipped for prerelease>}"
          echo "NSIS:     $NSIS"
          echo "NSIS sig: $NSIS_SIG"

      # ── Merge Windows updater entry into latest.json ─────────────
      - name: Generate latest.json for Windows updater
        env:
          TAG: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          gh release download "$TAG" --pattern latest.json --output latest.json

          SIGNATURE=$(cat "${{ steps.artifacts.outputs.nsis_sig }}")
          NSIS_NAME="${{ steps.artifacts.outputs.latest_nsis }}"
          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${NSIS_NAME}"

          jq \
            --arg signature "$SIGNATURE" \
            --arg url "$DOWNLOAD_URL" \
            '.platforms["windows-x86_64"] = { signature: $signature, url: $url }' \
            latest.json > latest-with-windows.json

          mv latest-with-windows.json latest.json

          echo "=== latest.json with Windows updater ==="
          cat latest.json

      # ── Upload to existing GitHub Release ───────────────────────
      - name: Upload Windows artifacts to release
        uses: softprops/action-gh-release@v3
        with:
          draft: false
          overwrite_files: true
          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') || contains(github.ref_name, '-nightly') }}
          files: |
            ${{ steps.artifacts.outputs.latest_msi }}
            ${{ steps.artifacts.outputs.latest_nsis }}
            latest.json

  # ── Linux x64 build ───────────────────────────────────────────────────
  build-linux:
    name: Build & Release (Linux x64)
    runs-on: ubuntu-22.04
    needs: build-windows
    steps:
      # ── Checkout ────────────────────────────────────────────────
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # ── Stamp version from git tag ───────────────────────────────
      - name: Set version from tag
        run: |
          FULL_VERSION="${GITHUB_REF_NAME#v}"
          if ! [[ "$FULL_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag must be valid three-part SemVer: $GITHUB_REF_NAME" >&2
            exit 1
          fi
          SEMVER="$FULL_VERSION"
          echo "VERSION=$FULL_VERSION" >> "$GITHUB_ENV"
          echo "SEMVER=$SEMVER" >> "$GITHUB_ENV"
          sed -i "s/\"version\": \".*\"/\"version\": \"$SEMVER\"/" src-tauri/tauri.conf.json
          sed -i "s/\"version\": \".*\"/\"version\": \"$FULL_VERSION\"/" package.json

      # ── System dependencies ──────────────────────────────────────
      - name: Install Linux build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf

      # ── Node.js + pnpm ──────────────────────────────────────────
      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

      # ── Rust ────────────────────────────────────────────────────
      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"
          shared-key: "release-linux-x64"

      # ── Build Tauri app ──────────────────────────────────────────
      - name: Build ORGII
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          ORGII_DIAGNOSTICS_TOKEN: ${{ secrets.ORGII_DIAGNOSTICS_TOKEN }}
          ORGII_APP_VERSION: ${{ env.SEMVER }}
        run: pnpm tauri build --target x86_64-unknown-linux-gnu --bundles deb,appimage

      # ── Gather artifacts ─────────────────────────────────────────
      - name: Gather release artifacts
        id: artifacts
        run: |
          BUNDLE_DIR="src-tauri/target/x86_64-unknown-linux-gnu/release/bundle"

          DEB=$(find "$BUNDLE_DIR/deb" -name "*.deb" | head -1)
          APPIMAGE=$(find "$BUNDLE_DIR/appimage" -name "*.AppImage" | head -1)
          APPIMAGE_SIG=$(find "$BUNDLE_DIR/appimage" -name "*.AppImage.sig" | head -1)

          for artifact in "$DEB" "$APPIMAGE" "$APPIMAGE_SIG"; do
            if [ ! -f "$artifact" ]; then
              echo "Missing Linux release artifact: $artifact" >&2
              find "$BUNDLE_DIR" -maxdepth 3 -type f -print >&2
              exit 1
            fi
          done

          LATEST_DEB="ORG2-latest-linux-x64.deb"
          LATEST_APPIMAGE="ORG2-latest-linux-x64.AppImage"
          cp "$DEB" "$LATEST_DEB"
          cp "$APPIMAGE" "$LATEST_APPIMAGE"

          echo "appimage_sig=$APPIMAGE_SIG" >> "$GITHUB_OUTPUT"
          echo "latest_deb=$LATEST_DEB" >> "$GITHUB_OUTPUT"
          echo "latest_appimage=$LATEST_APPIMAGE" >> "$GITHUB_OUTPUT"
          echo "latest_appimage_name=$LATEST_APPIMAGE" >> "$GITHUB_OUTPUT"

          echo "=== Linux artifacts ==="
          echo "DEB:          $DEB"
          echo "AppImage:     $APPIMAGE"
          echo "AppImage sig: $APPIMAGE_SIG"

      # ── Merge Linux updater entry into latest.json ───────────────
      - name: Generate latest.json for Linux updater
        env:
          TAG: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download "$TAG" --pattern latest.json --output latest.json

          SIGNATURE=$(cat "${{ steps.artifacts.outputs.appimage_sig }}")
          APPIMAGE_NAME="${{ steps.artifacts.outputs.latest_appimage_name }}"
          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${APPIMAGE_NAME}"

          jq \
            --arg signature "$SIGNATURE" \
            --arg url "$DOWNLOAD_URL" \
            '.platforms["linux-x86_64"] = { signature: $signature, url: $url }' \
            latest.json > latest-with-linux.json

          mv latest-with-linux.json latest.json

          echo "=== latest.json with Linux updater ==="
          cat latest.json

      # ── Upload to existing GitHub Release ───────────────────────
      - name: Upload Linux artifacts to release
        uses: softprops/action-gh-release@v3
        with:
          draft: false
          overwrite_files: true
          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') || contains(github.ref_name, '-nightly') }}
          files: |
            ${{ steps.artifacts.outputs.latest_deb }}
            ${{ steps.artifacts.outputs.latest_appimage }}
            latest.json

      # ── Publish beta channel manifest ─────────────────────────────
      # The `updater` release is a rolling prerelease that hosts channel
      # manifests at a stable URL. Every release (stable and beta) overwrites
      # beta.json when it is the highest version so far, so the beta channel
      # always tracks the newest build of either kind. The stable channel
      # keeps using the releases/latest alias and needs no extra publishing.
      - name: Publish beta channel manifest
        env:
          TAG: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        run: |
          if ! gh release view updater >/dev/null 2>&1; then
            gh release create updater \
              --title "Updater channel manifests" \
              --notes "Rolling release hosting update-channel manifests (beta.json). Do not delete: installed apps on the beta channel poll its assets." \
              --prerelease \
              --target "$GITHUB_SHA"
          fi

          NEW_VERSION=$(jq -r '.version' latest.json)
          EXISTING_VERSION=$(gh release download updater --pattern beta.json --output - 2>/dev/null | jq -r '.version // empty' || true)
          EXISTING_VERSION="${EXISTING_VERSION:-0.0.0}"

          # Guard against regressing beta.json when an older tag is (re)built
          # after a newer one already published (e.g. a stable hotfix behind
          # the current beta). semver handles prerelease ordering correctly.
          HIGHEST=$(pnpm dlx semver@7 "$NEW_VERSION" "$EXISTING_VERSION" | tail -1)
          if [ -z "$HIGHEST" ]; then
            echo "semver comparison produced no output; refusing to guess" >&2
            exit 1
          fi
          if [ "$HIGHEST" != "$NEW_VERSION" ]; then
            echo "Skipping beta.json: existing $EXISTING_VERSION > new $NEW_VERSION"
            exit 0
          fi

          cp latest.json beta.json
          gh release upload updater beta.json --clobber
          echo "Published beta.json for $NEW_VERSION (was $EXISTING_VERSION)"