release-kit.yml

name: release-kit

on:
  push:
    tags:
      - kit/v*
  pull_request:
    paths:
      - .github/workflows/release-security.yml
      - scripts/lib/secret-scan-scope.mjs
      - scripts/lib/secret-scan-result.mjs
      - scripts/check-secrets.mjs
      - .secrets.baseline
      - .github/workflows/release-kit.yml
      - kit/**
      - package.json
      - pnpm-lock.yaml
      - scripts/check-sdk-kit-pack-audit.mjs
      - scripts/lib/command-runner.mjs
      - scripts/release/build-component-package.mjs
      - sdks/typescript/**
  workflow_dispatch:
    inputs:
      version:
        description: Exact stable Kit SemVer for a dry-run
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-kit-${{ github.ref }}
  cancel-in-progress: false

jobs:
  security:
    if: github.event_name != 'pull_request'
    uses: ./.github/workflows/release-security.yml
    with:
      component: kit

  validate:
    name: Kit validate and dry-run
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: none
    outputs:
      artifact_name: ${{ steps.release.outputs.artifact_name }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: Checkout exact source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.34.5
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org
      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile
      - name: Check package licensing
        run: pnpm check:license-file-map
      - name: Resolve Kit component identity
        id: release
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          package_version="$(node -p "JSON.parse(require('node:fs').readFileSync('kit/package.json','utf8')).version")"
          if [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then
            version="${GITHUB_REF_NAME#kit/v}"
            production=true
            test "${GITHUB_REF}" = "refs/tags/kit/v${version}"
            test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            version="${INPUT_VERSION#v}"
            production=false
          else
            version="${package_version}"
            production=false
          fi
          if ! [[ "${version}" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "Kit version must be a stable SemVer: ${version}" >&2
            exit 1
          fi
          test "${package_version}" = "${version}"
          {
            echo "artifact_name=kit-component-package-${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}"
            echo "production=${production}"
            echo "version=${version}"
          } >> "${GITHUB_OUTPUT}"
      - name: Install Linux dependencies for Rust bridge generation
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
      - name: Test Kit
        run: |
          pnpm --filter @nimiplatform/sdk build
          pnpm check:nimi-kit
          pnpm --filter @nimiplatform/kit typecheck
          pnpm --filter @nimiplatform/kit test
      - name: Build deterministic Kit package with platform native dependencies
        run: pnpm release:component:pack -- --component kit --output-dir dist/component-release/kit
      - name: Dry-run Kit publication
        run: |
          set -euo pipefail
          shopt -s nullglob
          tarballs=(dist/component-release/kit/*.tgz)
          test "${#tarballs[@]}" -eq 1
          npm publish "${tarballs[0]}" --access public --dry-run
      - name: Require public SDK dependency for tag publication
        if: steps.release.outputs.production == 'true'
        run: |
          set -euo pipefail
          shopt -s nullglob
          tarballs=(dist/component-release/kit/*.tgz)
          test "${#tarballs[@]}" -eq 1
          sdk_range="$(tar -xOf "${tarballs[0]}" package/package.json | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.stdout.write(JSON.parse(s).dependencies['@nimiplatform/sdk'] || ''))")"
          if ! [[ "${sdk_range}" =~ ^\^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "packed Kit SDK dependency must be an exact stable caret range: ${sdk_range}" >&2
            exit 1
          fi
          npm view "@nimiplatform/sdk@${sdk_range#^}" version >/dev/null
      - name: Upload exact Kit package for tag publication
        if: steps.release.outputs.production == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.release.outputs.artifact_name }}
          path: dist/component-release/kit/*.tgz
          if-no-files-found: error
          retention-days: 7

  validate-windows:
    name: Kit Windows native validate and dry-run
    runs-on: windows-latest
    permissions:
      contents: read
      id-token: none
    outputs:
      artifact_name: ${{ steps.release.outputs.artifact_name }}
    steps:
      - name: Checkout exact source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.34.5
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
        with:
          toolchain: stable
      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile
      - name: Resolve Windows Kit component identity
        id: release
        env:
          INPUT_VERSION: ${{ inputs.version }}
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $kit = Get-Content kit/package.json -Raw | ConvertFrom-Json
          $native = Get-Content kit/shell/protected-local-node/npm/win32-x64/package.json -Raw | ConvertFrom-Json
          if ($native.name -ne '@nimiplatform/kit-protected-local-win32-x64' -or $native.version -ne $kit.version) { throw 'Windows native identity must match Kit' }
          if ($kit.version -notmatch '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$') { throw 'Kit requires stable SemVer' }
          if ($env:GITHUB_EVENT_NAME -eq 'push' -and $env:GITHUB_REF -ne "refs/tags/kit/v$($kit.version)") { throw 'Kit tag/version mismatch' }
          if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch' -and $env:INPUT_VERSION.TrimStart('v') -ne $kit.version) { throw 'Kit dispatch/version mismatch' }
          "artifact_name=kit-windows-native-package-$env:GITHUB_SHA-$env:GITHUB_RUN_ATTEMPT" >> $env:GITHUB_OUTPUT
      - name: Test the Windows native crates for publication
        if: github.event_name != 'pull_request'
        run: pnpm test:kit:native
      - name: Build the production Windows native carrier
        run: node kit/shell/protected-local-node/scripts/build-windows-x64-package.mjs
      - name: Test the real release native binding
        shell: pwsh
        run: |
          $env:CARGO_TARGET_DIR = Join-Path $env:GITHUB_WORKSPACE 'kit/shell/protected-local-node/target/windows-production'
          node kit/shell/protected-local-node/test/native-input-contract.cjs release
          if ($LASTEXITCODE -ne 0) { throw 'Windows production native contract failed' }
      - name: Pack and dry-run the Windows native package
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $outputRoot = Join-Path $env:GITHUB_WORKSPACE 'dist/component-release/kit-windows'
          New-Item -ItemType Directory -Force -Path $outputRoot | Out-Null
          $pack = @(npm pack ./kit/shell/protected-local-node/npm/win32-x64 --pack-destination $outputRoot --ignore-scripts --json | ConvertFrom-Json)
          if ($LASTEXITCODE -ne 0 -or $pack.Count -ne 1) { throw 'Windows native pack failed' }
          npm publish (Join-Path $outputRoot $pack[0].filename) --access public --dry-run
          if ($LASTEXITCODE -ne 0) { throw 'Windows native publication dry-run failed' }
          git diff --exit-code
          if ($LASTEXITCODE -ne 0) { throw 'Windows native build changed tracked source' }
      - name: Upload exact Windows native package for tag publication
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/kit/v')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.release.outputs.artifact_name }}
          path: dist/component-release/kit-windows/*.tgz
          if-no-files-found: error
          retention-days: 7

  validate-macos:
    name: Kit macOS native validate and dry-run
    runs-on: macos-15
    permissions:
      contents: read
      id-token: none
    env:
      NIMI_MACOS_TEAM_ID: RMZJPQQR3X
      CARGO_BUILD_JOBS: '2'
    outputs:
      artifact_name: ${{ steps.release.outputs.artifact_name }}
    steps:
      - name: Checkout exact source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          version: 10.34.5
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
        with:
          toolchain: stable
      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile
      - name: Resolve macOS Kit component identity
        id: release
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          test "$(uname -m)" = arm64
          node --input-type=module - <<'JS'
          import assert from 'node:assert/strict';
          import { readFileSync } from 'node:fs';
          const kit = JSON.parse(readFileSync('kit/package.json', 'utf8'));
          const native = JSON.parse(readFileSync('kit/shell/protected-local-node/npm/darwin-arm64/package.json', 'utf8'));
          assert.equal(native.name, '@nimiplatform/kit-protected-local-darwin-arm64');
          assert.equal(native.version, kit.version);
          assert.match(kit.version, /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u);
          if (process.env.GITHUB_EVENT_NAME === 'push') assert.equal(process.env.GITHUB_REF, `refs/tags/kit/v${kit.version}`);
          if (process.env.GITHUB_EVENT_NAME === 'workflow_dispatch') assert.equal(process.env.INPUT_VERSION.replace(/^v/u, ''), kit.version);
          JS
          echo "artifact_name=kit-macos-native-package-${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
      - name: Test native crates for publication
        run: |
          cargo test --locked --manifest-path kit/shell/protected-local/Cargo.toml
          cargo test --locked --manifest-path kit/shell/protected-local-node/Cargo.toml
      - name: Build the production macOS native carrier
        run: node kit/shell/protected-local-node/scripts/build-darwin-arm64-package.mjs
      - name: Test the real release native binding
        run: node kit/shell/protected-local-node/test/native-input-contract.cjs release
      - name: Pack and dry-run the macOS native package
        run: |
          set -euo pipefail
          mkdir -p dist/component-release/kit-macos
          npm pack ./kit/shell/protected-local-node/npm/darwin-arm64 --pack-destination dist/component-release/kit-macos --ignore-scripts
          tarballs=(dist/component-release/kit-macos/*.tgz)
          test "${#tarballs[@]}" -eq 1
          npm publish "${tarballs[0]}" --access public --dry-run
          git diff --exit-code
      - name: Upload exact macOS native package for tag publication
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/kit/v')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.release.outputs.artifact_name }}
          path: dist/component-release/kit-macos/*.tgz
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Kit publish
    needs: [validate, validate-windows, validate-macos, security]
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/kit/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout exact tag source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Require immutable tag identity on main
        env:
          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          test "${GITHUB_REF}" = "refs/tags/kit/v${RELEASE_VERSION}"
          test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
          git fetch --no-tags origin main:refs/remotes/origin/main
          git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main
      - name: Setup Node.js for npm OIDC
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org
      - name: Download exact validated Kit package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.validate.outputs.artifact_name }}
          path: dist/component-release/kit
      - name: Download exact validated Windows native package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.validate-windows.outputs.artifact_name }}
          path: dist/component-release/kit-windows
      - name: Publish or verify exact Windows native package through npm OIDC
        env:
          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          tarballs=(dist/component-release/kit-windows/*.tgz)
          test "${#tarballs[@]}" -eq 1
          package_identity="$(tar -xOf "${tarballs[0]}" package/package.json | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const p=JSON.parse(s);process.stdout.write(p.name+'@'+p.version)})")"
          test "${package_identity}" = "@nimiplatform/kit-protected-local-win32-x64@${RELEASE_VERSION}"
          local_sha1="$(shasum -a 1 "${tarballs[0]}" | awk '{print $1}')"
          if remote_sha1="$(npm view "${package_identity}" dist.shasum --json 2>/dev/null)"; then
            remote_sha1="$(printf '%s' "${remote_sha1}" | tr -d '"[:space:]')"
            test "${remote_sha1}" = "${local_sha1}"
          else
            npm publish "${tarballs[0]}" --access public --provenance
          fi
      - name: Download exact validated macOS native package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.validate-macos.outputs.artifact_name }}
          path: dist/component-release/kit-macos
      - name: Publish or verify exact macOS native package through npm OIDC
        env:
          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          tarballs=(dist/component-release/kit-macos/*.tgz)
          test "${#tarballs[@]}" -eq 1
          package_identity="$(tar -xOf "${tarballs[0]}" package/package.json | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const p=JSON.parse(s);process.stdout.write(p.name+'@'+p.version)})")"
          test "${package_identity}" = "@nimiplatform/kit-protected-local-darwin-arm64@${RELEASE_VERSION}"
          local_sha1="$(shasum -a 1 "${tarballs[0]}" | awk '{print $1}')"
          if remote_sha1="$(npm view "${package_identity}" dist.shasum --json 2>/dev/null)"; then
            remote_sha1="$(printf '%s' "${remote_sha1}" | tr -d '\"[:space:]')"
            test "${remote_sha1}" = "${local_sha1}"
          else
            npm publish "${tarballs[0]}" --access public --provenance
          fi
      - name: Publish or verify exact Kit package through npm OIDC
        env:
          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          tarballs=(dist/component-release/kit/*.tgz)
          test "${#tarballs[@]}" -eq 1
          package_identity="$(tar -xOf "${tarballs[0]}" package/package.json | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const p=JSON.parse(s);process.stdout.write(p.name+'@'+p.version)})")"
          test "${package_identity}" = "@nimiplatform/kit@${RELEASE_VERSION}"
          local_sha1="$(shasum -a 1 "${tarballs[0]}" | awk '{print $1}')"
          if remote_sha1="$(npm view "${package_identity}" dist.shasum --json 2>/dev/null)"; then
            remote_sha1="$(printf '%s' "${remote_sha1}" | tr -d '"[:space:]')"
            test "${remote_sha1}" = "${local_sha1}"
          else
            npm publish "${tarballs[0]}" --access public --provenance
          fi