release.yml

name: release
run-name: "${{ format('release {0}{1}', inputs.bump, inputs.version) }}"

# Builds are separated from signing and publishing.
# - build-* jobs run repository code (`bun run build`, `bun run pack`) with no environment, secrets or id-token.
# - sign-* and publish-* jobs run in the release environment, check out only .github/release/, and run those
#   scripts on verified artifacts, which they treat as data. They never execute repository code.
# - sign-* and publish-* jobs read their secrets from AWS Secrets Manager: they assume
#   arn:aws:iam::604439173067:role/github/opencode-release over GitHub OIDC in the release environment. The Azure
#   trusted signing ids are repository variables.
# - publish-cli and publish-desktop upload to R2 with a 30-minute token minted by the token issuer from that role
#   (.github/release/cloudflare-token.sh), not with a long-lived Cloudflare token from Secrets Manager.
# - plan decides version, channel and npm dist-tag from the event, inputs and ref; only a dispatch with a bump or
#   version on dev reaches latest.
# .github/release/ and this file are the security boundary for releases.

on:
  push:
    branches: [dev, beta]
  workflow_dispatch:
    inputs:
      bump:
        description: "Bump major, minor, or patch"
        required: false
        type: choice
        options: [major, minor, patch]
      version:
        description: "Override version (optional)"
        required: false
        type: string
      release_notes:
        description: "Reviewed V2 release notes for CHANGELOG.md and the GitHub release (required with bump or version)"
        required: false
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ (inputs.bump || inputs.version) && 'release' || 'build' }}
  # Beta ships only the newest commit to the team. A cancelled beta run can leave unreferenced files in R2, but only
  # publish-desktop records a release, in one request.
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.ref_name == 'beta' }}

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  plan:
    if: github.repository == 'anomalyco/opencode'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      version: ${{ steps.plan.outputs.version }}
      channel: ${{ steps.plan.outputs.channel }}
      npm_tag: ${{ steps.plan.outputs.npm_tag }}
      dry_run: ${{ steps.plan.outputs.dry_run }}
      cli: ${{ steps.plan.outputs.cli }}
      desktop: ${{ steps.plan.outputs.desktop }}
      node: ${{ steps.plan.outputs.node }}
      release: ${{ steps.plan.outputs.release }}
    steps:
      - &checkout-release
        name: Check out release scripts
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: ${{ github.sha }}
          sparse-checkout: /.github/release/
          sparse-checkout-cone-mode: false
          persist-credentials: false
      - id: plan
        name: Plan
        run: bash .github/release/plan-release.sh
        env:
          GH_TOKEN: ${{ github.token }} # reads the triggering actor's repository role for stable releases
          INPUT_BUMP: ${{ inputs.bump }}
          INPUT_VERSION: ${{ inputs.version }}
          INPUT_RELEASE_NOTES: ${{ inputs.release_notes }}

  # ---- Gate: the full check suite, before anything is published ------------------------------------------------

  # release.yml does not wait for the check-test push run on the same commit, so a stable release would publish
  # whatever that run later says. This gate runs the whole suite — unit tests on both OSes, the compiled builds and
  # the Linux browser suites — before any publish job below. Continuous dev and beta builds skip it: they publish
  # their own channel from a dev push, whose check-test run covers the same commit.
  verify:
    needs: plan
    if: needs.plan.outputs.channel == 'latest'
    permissions:
      contents: read
      checks: write
    uses: ./.github/workflows/check-test.yml
    with:
      release_gate: true

  # A versioned release builds from a commit with its versions and changelog on the dispatched dev commit,
  # tagged v<version>. Runs git only.
  tag:
    needs: plan
    runs-on: ubuntu-24.04
    # Stable tags are pushed with the release deploy key, the only non-releasers actor the v* tag ruleset admits.
    environment: ${{ needs.plan.outputs.channel == 'latest' && needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: &env
      OPENCODE_VERSION: ${{ needs.plan.outputs.version }}
      OPENCODE_CHANNEL: ${{ needs.plan.outputs.channel }}
      OPENCODE_NPM_TAG: ${{ needs.plan.outputs.npm_tag }}
      OPENCODE_DRY_RUN: ${{ needs.plan.outputs.dry_run }}
    outputs:
      sha: ${{ steps.tag.outputs.sha || github.sha }}
    steps:
      # Fetch the deploy key only for the tag command; checkout uses its read-only token.
      - id: aws
        name: Configure AWS credentials
        if: needs.plan.outputs.channel == 'latest' && needs.plan.outputs.dry_run != 'true'
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with: &release-role
          output-env-credentials: false
          output-credentials: true
          role-to-assume: arn:aws:iam::604439173067:role/github/opencode-release
          role-session-name: opencode-${{ github.run_id }}
          aws-region: us-east-1

      - name: Check out
        if: needs.plan.outputs.channel == 'latest'
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false
      - id: tag
        name: Tag
        if: needs.plan.outputs.channel == 'latest'
        run: bash .github/release/with-secrets.sh RELEASE_TAG_KEY=opencode/release/RELEASE_TAG_KEY -- bash .github/release/tag-release.sh
        env:
          AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
          AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
          OPENCODE_RELEASE_NOTES: ${{ inputs.release_notes }}

  # ---- Build: repository code; no environment, secrets or id-token --------------------------------------------

  # Fetches the models.dev catalog once per run, so every CLI bundles the same copy.
  models-catalog:
    needs: [plan, tag]
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 10
    env: *env
    steps:
      - &checkout
        name: Check out
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: ${{ needs.tag.outputs.sha }}
          persist-credentials: false
      - name: Set up Bun
        uses: ./.github/actions/setup-bun
      - name: Fetch
        run: bun packages/core/script/update-models-snapshot.ts .cache/models-catalog/api.json
      - name: Upload
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: models-catalog
          path: .cache/models-catalog/api.json
          if-no-files-found: error

  build-cli:
    needs: [plan, tag, models-catalog]
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    env: *env
    steps:
      - *checkout
      - name: Set up Bun
        uses: ./.github/actions/setup-bun
        with:
          bun-version: 1.4.4
      - &download-models-catalog
        name: Download models catalog
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: models-catalog
          path: .cache/models-catalog
      - name: Build
        working-directory: packages/cli
        run: bun run build && rm -rf dist/.bun
        env:
          BUN_COMPILE_RELEASE: bun-v1.4.4
          OPENCODE_MODELS_SNAPSHOT: ${{ github.workspace }}/.cache/models-catalog/api.json
          OPENCODE_RELEASE_NOTES: ${{ needs.plan.outputs.channel == 'latest' && inputs.release_notes || '' }}
          GH_TOKEN: ${{ github.token }} # read-only; raises the rate limit for Bun release downloads
      - name: Verify bundled models catalog
        run: bun packages/cli/script/catalog-smoke.ts packages/cli/dist/cli-linux-x64/bin/opencode
        env:
          OPENCODE_MODELS_SNAPSHOT: ${{ github.workspace }}/.cache/models-catalog/api.json
      - name: Upload
        uses: ./.github/release/upload
        with:
          name: build-cli
          path: packages/cli/dist

  build-node:
    needs: [plan, tag, models-catalog]
    if: needs.plan.outputs.node == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: linux-arm64, host: blacksmith-4vcpu-ubuntu-2404-arm }
          - { target: linux-x64, host: blacksmith-4vcpu-ubuntu-2404 }
          - { target: darwin-arm64, host: blacksmith-6vcpu-macos-26 }
          - { target: windows-arm64, host: blacksmith-4vcpu-windows-2025 }
          - { target: windows-x64, host: blacksmith-4vcpu-windows-2025 }
    runs-on: ${{ matrix.host }}
    env: *env
    steps:
      - *checkout
      - name: Set up Bun
        uses: ./.github/actions/setup-bun
      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "26.4.0"
      - *download-models-catalog
      - name: Build
        working-directory: packages/cli
        run: bun run build:node
        env:
          OPENCODE_TARGET: ${{ matrix.target }}
          OPENCODE_MODELS_SNAPSHOT: ${{ github.workspace }}/.cache/models-catalog/api.json
      - name: Test
        if: matrix.target != 'windows-arm64'
        working-directory: packages/cli
        run: bun run script/service-smoke.ts --node
      - name: Verify bundled models catalog
        if: matrix.target != 'windows-arm64'
        run: bun packages/cli/script/catalog-smoke.ts "packages/cli/dist/node/cli-node-$OPENCODE_TARGET/bin/opencode2-node$EXE"
        env:
          OPENCODE_TARGET: ${{ matrix.target }}
          EXE: ${{ startsWith(matrix.target, 'windows') && '.exe' || '' }}
          OPENCODE_MODELS_SNAPSHOT: ${{ github.workspace }}/.cache/models-catalog/api.json
      - name: Upload
        uses: ./.github/release/upload
        with:
          name: build-node-${{ matrix.target }}
          path: packages/cli/dist/node

  # `bun run pack` packs every npm package into dist/npm and the Linux and Node CLI archives into dist/archives.
  # The macOS and Windows CLI packages and archives are re-packed after signing.
  build-npm:
    needs: [plan, tag, build-cli, build-node]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.cli == 'true' }}
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    env: *env
    steps:
      - *checkout
      - name: Set up Bun
        uses: ./.github/actions/setup-bun
      - &download-cli
        name: Download
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: build-cli
          path: packages/cli/dist
      - name: Download Node CLI
        if: needs.plan.outputs.node == 'true'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          pattern: build-node-*
          path: packages/cli/dist/node
          merge-multiple: true
      - name: Pack
        run: rm packages/cli/dist/SHA256SUMS && bun run pack
      - name: Upload
        uses: ./.github/release/upload
        with:
          name: build-npm
          path: dist/npm
      - name: Upload archives
        uses: ./.github/release/upload
        with:
          name: build-archives
          path: dist/archives

  build-docker:
    needs: [plan, tag, build-cli]
    if: needs.plan.outputs.release == 'true'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    env: *env
    steps:
      - *checkout
      - *download-cli
      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      - name: Set up Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - name: Set up Bun
        uses: ./.github/actions/setup-bun
      - name: Pack
        working-directory: packages/cli
        run: bun run pack:docker
      - name: Upload
        uses: ./.github/release/upload
        with:
          name: build-docker
          path: dist/docker

  # macOS and Windows pack an unsigned app; Linux packs the final AppImage, deb and rpm.
  # Dev and beta package macOS x64 on Apple Silicon and Windows arm64 on Blacksmith for speed. electron-builder's
  # afterPack rejects a bundle whose CLI or node-pty does not match the target CPU.
  build-desktop:
    needs: [plan, tag, build-cli]
    if: needs.plan.outputs.desktop == 'true'
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: darwin-x64
            host: ${{ (needs.plan.outputs.channel == 'dev' || needs.plan.outputs.channel == 'beta') && 'blacksmith-6vcpu-macos-26' || 'macos-26-intel' }}
            install: ${{ (needs.plan.outputs.channel == 'dev' || needs.plan.outputs.channel == 'beta') && '--os=darwin --cpu=*' || '--os=darwin --cpu=x64' }}
          - { target: darwin-arm64, host: blacksmith-6vcpu-macos-26, install: --os=darwin --cpu=arm64 }
          # github-hosted: blacksmith lacks the ARM64 MSVC cross-compilation toolchain
          - target: windows-arm64
            host: ${{ (needs.plan.outputs.channel == 'dev' || needs.plan.outputs.channel == 'beta') && 'blacksmith-4vcpu-windows-2025' || 'windows-2025' }}
            install: --cpu=*
          - { target: windows-x64, host: blacksmith-4vcpu-windows-2025 }
          - { target: linux-x64, host: blacksmith-4vcpu-ubuntu-2404 }
          - { target: linux-arm64, host: blacksmith-4vcpu-ubuntu-2404-arm }
    runs-on: ${{ matrix.host }}
    env: *env
    steps:
      - *checkout
      - *download-cli
      - name: Set up Bun
        uses: ./.github/actions/setup-bun
        with:
          install-flags: ${{ matrix.install }}
      - name: Set up rpm
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends rpm
      # Dev and beta trade larger packages for faster packaging. fpm sets XZ_OPT for the deb and rpm level, but xz
      # still reads XZ_DEFAULTS, so it uses every CPU.
      - name: Preview packaging settings
        if: (needs.plan.outputs.channel == 'dev' || needs.plan.outputs.channel == 'beta') && runner.os == 'Linux'
        run: echo "XZ_DEFAULTS=-T0" >> "$GITHUB_ENV"
      - name: Build
        working-directory: packages/desktop
        run: bun run build
        env:
          OPENCODE_TARGET: ${{ matrix.target }}
          NODE_OPTIONS: --max-old-space-size=4096
          VITE_SENTRY_DSN: ${{ vars.WEB_SENTRY_DSN }}
          VITE_SENTRY_ENVIRONMENT: ${{ needs.plan.outputs.channel == 'latest' && 'production' || needs.plan.outputs.channel }}
          VITE_SENTRY_RELEASE: desktop@${{ needs.plan.outputs.version }}
      - name: Pack
        working-directory: packages/desktop
        timeout-minutes: 60
        run: bun run pack
        env:
          OPENCODE_TARGET: ${{ matrix.target }}
      - name: Upload
        uses: ./.github/release/upload
        with:
          name: build-desktop-${{ matrix.target }}
          path: dist/desktop

  # Packs the NSIS installer around the signed app. This runs repository config, so it is a build job; the
  # installer is signed next.
  build-desktop-windows-installer:
    needs: [plan, tag, sign-windows]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.desktop == 'true' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: windows-arm64
            host: ${{ (needs.plan.outputs.channel == 'dev' || needs.plan.outputs.channel == 'beta') && 'blacksmith-4vcpu-windows-2025' || 'windows-2025' }}
            install: --cpu=*
          - { target: windows-x64, host: blacksmith-4vcpu-windows-2025 }
    runs-on: ${{ matrix.host }}
    env: *env
    steps:
      - *checkout
      - name: Set up Bun
        uses: ./.github/actions/setup-bun
        with:
          install-flags: ${{ matrix.install }}
      - name: Download
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: sign-desktop-${{ matrix.target }}
          path: ${{ runner.temp }}/app
      - name: Pack
        working-directory: packages/desktop
        timeout-minutes: 30
        run: bun run pack
        env:
          OPENCODE_TARGET: ${{ matrix.target }}
          OPENCODE_DESKTOP_APP: ${{ runner.temp }}/app/app
      - name: Upload
        uses: ./.github/release/upload
        with:
          name: build-desktop-windows-installer-${{ matrix.target }}
          path: dist/desktop

  # ---- Sign: release environment; only .github/release/ is checked out ----------------------------------------
  # Pull requests run sign and publish jobs without an environment, so steps that need a secret skip or dry-run.

  # Signs the macOS CLI; signs the desktop apps inside-out, notarizes them in one submission, staples them, and
  # only then builds the zip, dmg and .app.tar.gz from the stapled apps.
  sign-macos:
    needs: [plan, build-npm, build-desktop]
    if: ${{ !cancelled() && !failure() && (needs.plan.outputs.cli == 'true' || needs.plan.outputs.desktop == 'true') }}
    runs-on: macos-26
    timeout-minutes: 90
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    outputs:
      digest: ${{ steps.upload.outputs.digest }}
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: "{build-npm,build-desktop-darwin-*}"
      - &configure-release-role
        id: aws
        name: Configure AWS credentials
        if: needs.plan.outputs.dry_run != 'true'
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with: *release-role
      # The certificate has no password, which apple-actions/import-codesign-certs rejects. The sign scripts look up
      # the identity in build.keychain, and codesign finds the key through the user search list.
      - name: Import certificate
        if: needs.plan.outputs.dry_run != 'true'
        env: &aws-step
          AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
          AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
        run: bash .github/release/with-secrets.sh APPLE_SIGNING_CERTIFICATE=shared/APPLE_SIGNING_CERTIFICATE -- bash .github/release/import-certificate.sh
      - name: Sign CLI
        if: needs.plan.outputs.cli == 'true'
        run: bash .github/release/sign-cli-macos.sh "$RUNNER_TEMP/in/build-npm" "$RUNNER_TEMP/out"
      - name: Sign desktop
        if: needs.plan.outputs.desktop == 'true'
        run: |
          bash .github/release/with-secrets.sh APPLE_NOTARY_KEY=shared/APPLE_NOTARY_KEY -- bash .github/release/sign-desktop-macos.sh "$RUNNER_TEMP/out" \
            "$RUNNER_TEMP"/in/build-desktop-darwin-*/opencode-desktop-mac-*.app.tar
        env:
          AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
          AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
          APPLE_NOTARY_KEY_ID: ${{ vars.APPLE_NOTARY_KEY_ID }}
          APPLE_NOTARY_ISSUER_ID: ${{ vars.APPLE_NOTARY_ISSUER_ID }}
      - id: upload
        name: Upload
        uses: ./.github/release/upload
        with:
          name: sign-macos
          path: ${{ runner.temp }}/out
      - name: Delete keychain
        if: always() && needs.plan.outputs.dry_run != 'true'
        run: |
          rm -f "$RUNNER_TEMP/cert.p12"
          security delete-keychain build.keychain || true

  # Signs the Windows CLI and every executable and native module of the unpacked desktop apps.
  sign-windows:
    needs: [plan, build-npm, build-desktop]
    if: ${{ !cancelled() && !failure() && (needs.plan.outputs.cli == 'true' || needs.plan.outputs.desktop == 'true') }}
    runs-on: windows-2025
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    outputs:
      digest: ${{ steps.upload.outputs.digest }}
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: "{build-npm,build-desktop-windows-*}"
      - name: Unpack
        run: bash .github/release/unpack-windows.sh "$RUNNER_TEMP/in" "$RUNNER_TEMP/work"
      - &azure-login
        name: Log in to Azure
        if: needs.plan.outputs.dry_run != 'true'
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      - &azure-sign
        name: Sign
        if: needs.plan.outputs.dry_run != 'true'
        uses: azure/artifact-signing-action@b443cf8ea4124818d2ea9f043cba29fc3ec47b16 # v1.2.0
        with:
          cache-dependencies: false
          endpoint: ${{ vars.AZURE_TRUSTED_SIGNING_ENDPOINT }}
          signing-account-name: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ vars.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}
          files-folder: ${{ runner.temp }}\work
          files-folder-filter: exe,node
          files-folder-recurse: true
          exclude-environment-credential: true
          exclude-workload-identity-credential: true
          exclude-managed-identity-credential: true
          exclude-shared-token-cache-credential: true
          exclude-visual-studio-credential: true
          exclude-visual-studio-code-credential: true
          exclude-azure-cli-credential: false
          exclude-azure-powershell-credential: true
          exclude-azure-developer-cli-credential: true
          exclude-interactive-browser-credential: true
      - name: Repack
        run: bash .github/release/repack-windows.sh "$RUNNER_TEMP/work" "$RUNNER_TEMP/out"
      - id: upload
        name: Upload
        if: needs.plan.outputs.cli == 'true'
        uses: ./.github/release/upload
        with:
          name: sign-windows
          path: ${{ runner.temp }}/out
      - name: Upload arm64 app
        if: needs.plan.outputs.desktop == 'true'
        uses: ./.github/release/upload
        with:
          name: sign-desktop-windows-arm64
          path: ${{ runner.temp }}/work/desktop-windows-arm64
      - name: Upload x64 app
        if: needs.plan.outputs.desktop == 'true'
        uses: ./.github/release/upload
        with:
          name: sign-desktop-windows-x64
          path: ${{ runner.temp }}/work/desktop-windows-x64

  sign-desktop-windows-installer:
    needs: [plan, build-desktop-windows-installer]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.desktop == 'true' }}
    runs-on: windows-2025
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    outputs:
      digest: ${{ steps.upload.outputs.digest }}
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: build-desktop-windows-installer-*
      - name: Unpack
        run: mkdir -p "$RUNNER_TEMP/work" && cp "$RUNNER_TEMP"/in/build-desktop-windows-installer-*/*.exe "$RUNNER_TEMP/work/"
      - *azure-login
      - *azure-sign
      - name: Repack
        run: bash .github/release/repack-windows.sh "$RUNNER_TEMP/work" "$RUNNER_TEMP/out"
      - id: upload
        name: Upload
        uses: ./.github/release/upload
        with:
          name: sign-desktop-windows-installer
          path: ${{ runner.temp }}/work

  # ---- Publish: release environment; only .github/release/ is checked out -------------------------------------
  # Destinations, names and channels come from plan and the scripts, never from artifacts.

  # Build provenance for the npm tarballs and Linux archives. No secrets; id-token only for Sigstore.
  publish-attestations:
    needs: [plan, build-npm, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.cli == 'true' && needs.plan.outputs.dry_run != 'true' }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: "{build-npm,build-archives}"
      - name: Sign
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            ${{ runner.temp }}/in/build-npm/*.tgz
            ${{ runner.temp }}/in/build-archives/opencode*

  publish-npm:
    needs: [plan, sign-macos, sign-windows, publish-attestations, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.cli == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
      attestations: read
    env: *env
    steps:
      - *checkout-release
      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "24.11.0"
      - &download-signed-cli
        name: Download
        uses: ./.github/release/download
        with:
          pattern: "{build-npm,build-archives,sign-macos,sign-windows}"
          digests: sign-macos=${{ needs.sign-macos.outputs.digest }} sign-windows=${{ needs.sign-windows.outputs.digest }}
      - name: Publish
        run: bash .github/release/publish-npm.sh "$RUNNER_TEMP/in/build-npm" "$RUNNER_TEMP/in/sign-macos" "$RUNNER_TEMP/in/sign-windows"
        env:
          GH_TOKEN: ${{ github.token }}

  publish-cli:
    needs: [plan, sign-macos, sign-windows, publish-npm, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.cli == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    steps:
      - *checkout-release
      - *download-signed-cli
      - *configure-release-role
      - &cloudflare-token
        name: Cloudflare token
        id: cloudflare-token
        if: needs.plan.outputs.dry_run != 'true'
        run: bash .github/release/cloudflare-token.sh
        env:
          AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
          AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
          CLOUDFLARE_TOKEN_URL: ${{ vars.CLOUDFLARE_TOKEN_URL }}
      - name: Publish
        run: bash .github/release/publish-cli.sh "$RUNNER_TEMP/in/build-archives" "$RUNNER_TEMP/in/sign-macos" "$RUNNER_TEMP/in/sign-windows"
        env: &cloudflare
          CLOUDFLARE_ACCOUNT_ID: 15d29c8639fd3733b1b5486a2acfd968
          CLOUDFLARE_API_TOKEN: ${{ steps.cloudflare-token.outputs.token }}

  publish-desktop:
    needs: [plan, sign-macos, sign-desktop-windows-installer, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.desktop == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: "{sign-macos,sign-desktop-windows-installer,build-desktop-linux-*}"
          digests: sign-macos=${{ needs.sign-macos.outputs.digest }} sign-desktop-windows-installer=${{ needs.sign-desktop-windows-installer.outputs.digest }}
      - *configure-release-role
      - *cloudflare-token
      - name: Publish
        run: |
          bash .github/release/publish-desktop.sh "$RUNNER_TEMP/in/sign-macos" "$RUNNER_TEMP/in/sign-desktop-windows-installer" \
            "$RUNNER_TEMP/in/build-desktop-linux-x64" "$RUNNER_TEMP/in/build-desktop-linux-arm64"
        env: *cloudflare

  publish-docker:
    needs: [plan, build-docker, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.release == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      packages: write
    env: *env
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: build-docker
      - name: Publish
        run: bash .github/release/publish-docker.sh "$RUNNER_TEMP/in/build-docker"
        env:
          GH_TOKEN: ${{ github.token }}

  publish-homebrew:
    needs: [plan, sign-macos, sign-windows, publish-cli, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.release == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    steps:
      - *checkout-release
      - *download-signed-cli
      - *configure-release-role
      - name: Publish
        env: *aws-step
        run: bash .github/release/with-secrets.sh HOMEBREW_TAP_DEPLOY_KEY=shared/HOMEBREW_TAP_DEPLOY_KEY -- bash .github/release/publish-homebrew.sh "$RUNNER_TEMP/in/sign-macos" "$RUNNER_TEMP/in/build-archives"

  # The AUR package installs the published npm tarballs, so it follows the npm publish.
  publish-aur:
    needs: [plan, sign-macos, sign-windows, publish-npm, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.release == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    steps:
      - *checkout-release
      - *download-signed-cli
      - *configure-release-role
      - name: Publish
        env: *aws-step
        run: bash .github/release/with-secrets.sh AUR_KEY=shared/AUR_SSH_KEY -- bash .github/release/publish-aur.sh "$RUNNER_TEMP/in/build-npm"

  # WinGet manifests as data. Submission to microsoft/winget-pkgs stays paused until the packages are accepted.
  publish-winget:
    needs: [plan, sign-windows, sign-desktop-windows-installer, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.release == 'true' }}
    runs-on: ubuntu-24.04
    env: *env
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: "{sign-windows,sign-desktop-windows-installer}"
          digests: sign-windows=${{ needs.sign-windows.outputs.digest }} sign-desktop-windows-installer=${{ needs.sign-desktop-windows-installer.outputs.digest }}
      - name: Render
        run: bash .github/release/render-winget.sh "$RUNNER_TEMP/in/sign-windows" "$RUNNER_TEMP/in/sign-desktop-windows-installer" "$RUNNER_TEMP/out"
      - name: Upload
        uses: ./.github/release/upload
        with:
          name: publish-winget
          path: ${{ runner.temp }}/out

  publish-github-release:
    needs: [plan, sign-macos, sign-windows, sign-desktop-windows-installer, publish-cli, publish-desktop, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.release == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: write
    env: *env
    steps:
      - *checkout-release
      - name: Download
        uses: ./.github/release/download
        with:
          pattern: "{build-archives,build-desktop-linux-*,sign-macos,sign-windows,sign-desktop-windows-installer}"
          digests: >-
            sign-macos=${{ needs.sign-macos.outputs.digest }} sign-windows=${{ needs.sign-windows.outputs.digest }}
            sign-desktop-windows-installer=${{ needs.sign-desktop-windows-installer.outputs.digest }}
      - name: Publish
        run: bash .github/release/publish-github-release.sh "$RUNNER_TEMP"/in/*
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          OPENCODE_RELEASE_NOTES: ${{ inputs.release_notes }}

  publish-discord:
    needs: [plan, publish-github-release, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.release == 'true' }}
    runs-on: ubuntu-24.04
    environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
    permissions:
      contents: read
      id-token: write
    env: *env
    steps:
      - *checkout-release
      - *configure-release-role
      - name: Publish
        run: bash .github/release/with-secrets.sh DISCORD_WEBHOOK=opencode/release/DISCORD_WEBHOOK -- bash .github/release/publish-discord.sh
        env:
          AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
          AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
          OPENCODE_RELEASE_NOTES: ${{ inputs.release_notes }}

  # Brings the release commit back to dev. Pushing to dev is blocked by rulesets, so it opens a PR.
  publish-version-pr:
    needs: [plan, tag, publish-npm, publish-cli, publish-desktop, publish-github-release, verify]
    if: ${{ !cancelled() && !failure() && needs.plan.outputs.channel == 'latest' }}
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
    env: *env
    steps:
      - *checkout-release
      - name: Publish
        run: bash .github/release/publish-version-pr.sh "$SHA"
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          SHA: ${{ needs.tag.outputs.sha }}