release.yml

name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write

jobs:
  windows-test-portability:
    name: Windows path contracts (Node ${{ matrix.node-version }})
    strategy:
      fail-fast: false
      matrix:
        node-version: [22, 24]
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
          node-version: ${{ matrix.node-version }}
      - name: Install test dependencies
        run: npm ci --ignore-scripts && npm --prefix archify ci --ignore-scripts
      - name: Provision controlled Windows path fixtures
        shell: pwsh
        run: scripts/windows-path-fixtures.ps1 -NodeVersion '${{ matrix.node-version }}'
      - name: Verify maintained Windows path contracts
        run: node scripts/run-windows-path-tests.mjs ${{ matrix.node-version == 24 && '--smoke' || '' }}
        env:
          ARCHIFY_REQUIRE_WINDOWS_8DOT3: '1'
          ARCHIFY_REQUIRE_WINDOWS_REAL_PATHS: '1'
      - name: Clean up controlled Windows path fixtures
        if: ${{ always() }}
        shell: pwsh
        run: scripts/windows-path-fixtures.ps1 -NodeVersion '${{ matrix.node-version }}' -Cleanup

  release:
    needs: windows-test-portability
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
      - name: Fetch exact tag object
        shell: bash
        run: git fetch --force --no-tags origin "+refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: |
            package-lock.json
            archify/package-lock.json
      - name: Install renderer dependencies
        run: npm ci && npm --prefix archify ci
      - name: Complete regression suite on canonical Node before releasing
        run: npm run test:full
      - name: Provision a known Chrome runtime
        id: setup-chrome
        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
        with:
          chrome-version: stable
          install-dependencies: true
      - name: Install the WebM decoder
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y ffmpeg
      - name: WebM export must contain distinct decoded frames
        run: npm run test:webm
        env:
          ARCHIFY_CHROME: ${{ steps.setup-chrome.outputs.chrome-path }}
      - name: Run shared browser regression gate
        run: npm run test:browser
        env:
          ARCHIFY_CHROME: ${{ steps.setup-chrome.outputs.chrome-path }}
          ARCHIFY_CHROME_NO_SANDBOX: '1'
      - name: Tag must match package.json version
        run: |
          pkg_version="$(node -p "require('./archify/package.json').version")"
          tag="${GITHUB_REF_NAME#v}"
          if [ "$pkg_version" != "$tag" ]; then
            echo "::error::tag v$tag does not match archify/package.json version $pkg_version"
            exit 1
          fi
      - name: Classify stable and prerelease tags
        id: release-kind
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          channel="$(node --input-type=module -e 'import fs from "node:fs"; import { validateLocalRelease } from "./archify/scripts/update-contract.mjs"; const release = validateLocalRelease(JSON.parse(fs.readFileSync("./archify/skill-release.json", "utf8"))); if (release.version !== process.argv[1]) process.exit(1); process.stdout.write(release.channel);' "$version")"
          if [[ "$channel" == "development" ]]; then
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
            echo "make_latest=false" >> "$GITHUB_OUTPUT"
          else
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
            echo "make_latest=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Stable release tag must be annotated
        if: steps.release-kind.outputs.prerelease == 'false'
        shell: bash
        run: |
          if [[ "$(git cat-file -t "refs/tags/${GITHUB_REF_NAME}" 2>/dev/null || true)" != "tag" ]]; then
            echo "::error::stable releases require an annotated tag: ${GITHUB_REF_NAME}"
            exit 1
          fi
      - name: Stable notifier manifest must remain on the previous release
        if: steps.release-kind.outputs.prerelease == 'false'
        run: |
          node --input-type=module -e '
            import fs from "node:fs";
            import { compareSemver, validateStableUpdateManifest } from "./archify/scripts/update-contract.mjs";
            const releasing = process.argv[1];
            const published = validateStableUpdateManifest(JSON.parse(fs.readFileSync("./docs/skill-updates/archify/stable.json", "utf8")));
            if (compareSemver(published.version, releasing) >= 0) {
              console.error(`::error::stable.json must remain below v${releasing} until its GitHub Release exists; publish the manifest in a follow-up commit`);
              process.exit(1);
            }
          ' "${GITHUB_REF_NAME#v}"
      - name: Build skill archive
        run: scripts/build-zip.sh /tmp/archify-built.zip
      - name: Validate the exact release archive without installing dependencies
        run: |
          set -euo pipefail
          package_root="$RUNNER_TEMP/archify-release-package"
          mkdir -p "$package_root"
          unzip -q /tmp/archify-built.zip -d "$package_root"
          node scripts/package-smoke.mjs "$package_root/archify"
      - name: Committed zip must match the build (same gate as CI)
        run: cmp -s /tmp/archify-built.zip archify.zip
      - name: Create GitHub Release with the zip attached
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          files: archify.zip
          generate_release_notes: true
          prerelease: ${{ steps.release-kind.outputs.prerelease }}
          make_latest: ${{ steps.release-kind.outputs.make_latest }}
      - name: Record stable notifier publication follow-up
        if: steps.release-kind.outputs.prerelease == 'false'
        run: |
          echo '[Complete the central release checklist](https://github.com/tt-a1i/archify/blob/main/CONTRIBUTING.md#release-checklist), including final-head evidence and public acceptance.' >> "$GITHUB_STEP_SUMMARY"
          echo 'After the repository Pages source is set to GitHub Actions, publish docs/skill-updates/archify/stable.json in a follow-up commit; the gated deploy job will verify this Release, its archify.zip digest, and the tagged Skill tree before exposure.' >> "$GITHUB_STEP_SUMMARY"
      - name: Record DSH synchronization follow-up
        run: |
          echo '[Central release checklist](https://github.com/tt-a1i/archify/blob/main/CONTRIBUTING.md#release-checklist), including [DSH synchronization](https://github.com/tt-a1i/archify/blob/main/CONTRIBUTING.md#release-checklist-dsh-synchronization): record the pinned DSH bundle update and verification, or an explicit deferral. Archify release publication does not publish the independently versioned DSH plugin; keep npm/tag/README/community status accurate until that separate release is verified.' >> "$GITHUB_STEP_SUMMARY"