beta-release.yml

name: Beta Release

on:
  push:
    tags:
      - "v*.*.*-beta*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag name (e.g., v0.1.0-beta.1)"
        required: false
        type: string
      prerelease:
        description: "Mark release as pre-release"
        required: false
        default: true
        type: boolean

jobs:
  # Cargo.toml is what the binary self-reports (clap reads CARGO_PKG_VERSION),
  # so a tag pushed without bumping it ships a release that lies about its
  # version (betas 38-40 all reported 37). Fail fast instead.
  version-check:
    name: Tag matches Cargo.toml
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
      - name: Verify versions agree
        shell: bash
        run: |
          REF="${{ inputs.tag || github.ref_name }}"
          # Non-version refs (branch dispatch) skip the check, matching the
          # tolerant version-derivation steps later in this workflow.
          if [[ ! "$REF" =~ ^v[0-9] ]]; then
            echo "ref '$REF' is not a version tag; skipping"
            exit 0
          fi
          TAG_VERSION="${REF#v}"
          CARGO_VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
          echo "tag=$TAG_VERSION cargo=$CARGO_VERSION"
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "::error::Tag $REF does not match Cargo.toml version $CARGO_VERSION — bump Cargo.toml before tagging."
            exit 1
          fi

  build:
    name: Build (${{ matrix.os }})
    needs: version-check
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Linux and Windows here; macOS handled in dedicated jobs below
        os: [ubuntu-latest, windows-latest]

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Install Linux build deps
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y pkg-config libasound2-dev libspeechd-dev libclang-dev libudev-dev

      - name: Build release
        run: cargo build --release

      - name: Determine names (Unix)
        if: runner.os != 'Windows'
        id: names_unix
        shell: bash
        run: |
          APP_NAME="vellum-fe"
          case "$RUNNER_ARCH" in
            X64) ARCH="x86_64" ;;
            ARM64) ARCH="aarch64" ;;
            *) ARCH="$RUNNER_ARCH" ;;
          esac
          case "${{ runner.os }}" in
            Linux) OS="linux" ;;
            *) OS="unknown" ;;
          esac
          BIN_PATH="target/release/${APP_NAME}"
          PKG_NAME="${APP_NAME}-${OS}-${ARCH}.zip"
          echo "bin=${BIN_PATH}" >> $GITHUB_OUTPUT
          echo "pkg=${PKG_NAME}" >> $GITHUB_OUTPUT

      - name: Determine names (Windows)
        if: runner.os == 'Windows'
        id: names_win
        shell: pwsh
        run: |
          $APP_NAME = "vellum-fe"
          $OS = "windows"
          switch ($env:RUNNER_ARCH) {
            "X64" { $ARCH = "x86_64" }
            "ARM64" { $ARCH = "arm64" }
            default { $ARCH = $env:RUNNER_ARCH }
          }
          $BIN_PATH = "target/release/${APP_NAME}.exe"
          $PKG_NAME = "${APP_NAME}-${OS}-${ARCH}.zip"
          echo "bin=$BIN_PATH" >> $env:GITHUB_OUTPUT
          echo "pkg=$PKG_NAME" >> $env:GITHUB_OUTPUT

      - name: Package artifact (Unix)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          mkdir -p dist
          BIN_BASENAME="$(basename "${{ steps.names_unix.outputs.bin }}")"
          cp "${{ steps.names_unix.outputs.bin }}" ./dist/
          pushd dist >/dev/null
          chmod +x "$BIN_BASENAME"
          # Strip to reduce size
          strip -s "$BIN_BASENAME" || true
          # Add minimal Linux README
          cat > README-Linux.txt <<'EOF'
          VellumFE (Linux x86_64)
          
          Usage:
            ./vellum-fe --help
          
          Requirements:
            - GLIBC-based distro (Ubuntu 22.04+, Fedora 36+, etc.)
            - ALSA runtime for audio (e.g., libasound2)
            - X11/Wayland clipboard libraries (desktop environments usually include these)
          
          Notes:
            - If you encounter GLIBC version errors on older distros, please open an issue; we can add a more portable build.
            - Ensure your user has access to audio devices (e.g., is in the 'audio' group on some distros).
          EOF
          PKG_TGZ="vellum-fe-linux-x86_64.tar.gz"
          tar -czf "$PKG_TGZ" "$BIN_BASENAME" README-Linux.txt
          rm -f "$BIN_BASENAME" README-Linux.txt
          popd >/dev/null

      # --- Windows code signing (Azure Artifact / Trusted Signing) ---------
      # Signs the raw .exe BEFORE it is zipped, so the signature travels
      # inside the archive. Secret-gated exactly like the macOS job: if the
      # Azure signing secrets are absent (forks, or before setup is done),
      # the build ships UNSIGNED with a warning rather than failing.
      # Removes the Defender "Trojan:Win32/Cloxer" heuristic false positive
      # that unsigned, low-prevalence Rust binaries trigger. The action
      # authenticates directly via the azure-* inputs (no azure/login step).
      - name: Decide whether Windows signing secrets exist
        if: runner.os == 'Windows'
        id: winsign
        shell: pwsh
        run: |
          if ($env:AZURE_CLIENT_ID) {
            "enabled=true" >> $env:GITHUB_OUTPUT
          } else {
            "enabled=false" >> $env:GITHUB_OUTPUT
            Write-Output "::warning::AZURE_CLIENT_ID not set - shipping UNSIGNED Windows exe"
          }
        env:
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}

      # New windows-latest images ship pwsh without PSGallery registered;
      # the signing action's Install-Module dies with "Unable to find
      # repository 'PSGallery'" (beta.38's Windows job). Re-register it.
      - name: Register PSGallery (runner image regression workaround)
        if: runner.os == 'Windows' && steps.winsign.outputs.enabled == 'true'
        shell: pwsh
        run: |
          if (-not (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
            Register-PSRepository -Default
          }
          Set-PSRepository -Name PSGallery -InstallationPolicy Trusted

      - name: Sign Windows exe (Azure Artifact Signing)
        if: runner.os == 'Windows' && steps.winsign.outputs.enabled == 'true'
        uses: azure/trusted-signing-action@v0.5.1
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
          files-folder: target/release
          files-folder-filter: exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Package artifact (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Copy-Item "${{ steps.names_win.outputs.bin }}" dist/
          Push-Location dist
          Compress-Archive -Path "$(Split-Path -Leaf ${{ steps.names_win.outputs.bin }})" -DestinationPath "${{ steps.names_win.outputs.pkg }}" -Force
          Remove-Item "$(Split-Path -Leaf ${{ steps.names_win.outputs.bin }})"
          Pop-Location

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ runner.os }}-archive
          path: |
            dist/*.zip
            dist/*.tar.gz
          if-no-files-found: error

  android:
    name: Build (Android arm64)
    needs: version-check
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Rust with Android target
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-ndk
        run: cargo install cargo-ndk

      - name: Build core (arm64)
        run: |
          export ANDROID_NDK_HOME="$ANDROID_NDK_LATEST_HOME"
          cargo ndk -t arm64-v8a -o android/app/src/main/jniLibs \
            build --release -p vellum-android

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Assemble signed release APK
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          VELLUM_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          VELLUM_ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          VELLUM_ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.p12"
          export VELLUM_ANDROID_KEYSTORE="$RUNNER_TEMP/release.p12"
          gradle -p android :app:assembleRelease

      - name: Package artifact
        run: |
          mkdir -p dist
          cp android/app/build/outputs/apk/release/app-release.apk \
            dist/vellum-fe-android-arm64.apk

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-apk
          path: dist/*.apk
          if-no-files-found: error

  ios:
    name: Build (iOS, TestFlight upload)
    needs: version-check
    # Pinned: App Store Connect requires the iOS 26 SDK (Xcode 26+), but
    # macos-latest is mid-migration and can still hand out macOS 15
    # machines whose default Xcode is 16.4 (iOS 18.5 SDK).
    runs-on: macos-26
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Rust with iOS device target
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-ios

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build iOS core (device slice)
        run: cargo build --release -p vellum-ios --target aarch64-apple-ios

      - name: Generate Xcode project
        run: |
          brew install xcodegen
          cd ios && xcodegen generate

      - name: Import distribution certificate into a temp keychain
        env:
          P12_BASE64: ${{ secrets.APPLE_DISTRIBUTION_P12_BASE64 }}
          P12_PASSWORD: ${{ secrets.APPLE_DISTRIBUTION_P12_PASSWORD }}
        run: |
          KEYCHAIN="$RUNNER_TEMP/signing.keychain-db"
          KEYCHAIN_PASSWORD="$(uuidgen)"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
          security set-keychain-settings -lut 21600 "$KEYCHAIN"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
          echo "$P12_BASE64" | base64 -d > "$RUNNER_TEMP/distribution.p12"
          security import "$RUNNER_TEMP/distribution.p12" -k "$KEYCHAIN" \
            -P "$P12_PASSWORD" -T /usr/bin/codesign
          rm -f "$RUNNER_TEMP/distribution.p12"
          # Without this, codesign hangs forever on a keychain UI prompt
          # that a headless runner can never answer.
          security set-key-partition-list -S apple-tool:,apple: \
            -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" > /dev/null
          security list-keychains -d user -s "$KEYCHAIN" login.keychain-db

      - name: Write App Store Connect API key
        env:
          ASC_PRIVATE_KEY: ${{ secrets.APPSTORE_API_PRIVATE_KEY }}
        run: |
          mkdir -p "$RUNNER_TEMP/asc"
          printf '%s\n' "$ASC_PRIVATE_KEY" > "$RUNNER_TEMP/asc/AuthKey.p8"

      - name: Derive TestFlight version from tag
        run: |
          # CFBundleShortVersionString must be plain x.y.z — strip the
          # leading v and any -beta.N suffix. On a non-version ref
          # (manual dispatch from a branch) skip the override and let
          # project.yml's MARKETING_VERSION stand.
          REF="${{ inputs.tag || github.ref_name }}"
          VER="${REF#v}"
          VER="${VER%%-*}"
          if [[ "$VER" =~ ^[0-9]+(\.[0-9]+){2}$ ]]; then
            echo "MARKETING_VERSION_OVERRIDE=MARKETING_VERSION=$VER" >> "$GITHUB_ENV"
          fi

      - name: Install provisioning profile
        run: |
          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
          cp ios/ci/VellumFE_AppStore.mobileprovision \
            "$HOME/Library/MobileDevice/Provisioning Profiles/"

      - name: Archive (manual distribution signing)
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Manual signing with the committed App Store profile: automatic
          # signing archives with a *development* profile, which needs a
          # registered device (a fresh team has none), and refuses a
          # distribution-identity override as "conflicting".
          # $MARKETING_VERSION_OVERRIDE stays unquoted on purpose: empty
          # on non-version refs, a single VAR=value arg otherwise.
          xcodebuild archive \
            -project ios/VellumFE.xcodeproj \
            -scheme VellumFE \
            -configuration Release \
            -destination 'generic/platform=iOS' \
            -archivePath "$RUNNER_TEMP/VellumFE.xcarchive" \
            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="Apple Distribution" \
            PROVISIONING_PROFILE_SPECIFIER="VellumFE AppStore" \
            CURRENT_PROJECT_VERSION="${{ github.run_number }}" \
            $MARKETING_VERSION_OVERRIDE

      - name: Upload to TestFlight
        env:
          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
          APPSTORE_ISSUER_ID: ${{ secrets.APPSTORE_ISSUER_ID }}
        run: |
          xcodebuild -exportArchive \
            -archivePath "$RUNNER_TEMP/VellumFE.xcarchive" \
            -exportOptionsPlist ios/ExportOptions.plist \
            -exportPath "$RUNNER_TEMP/export" \
            -allowProvisioningUpdates \
            -authenticationKeyPath "$RUNNER_TEMP/asc/AuthKey.p8" \
            -authenticationKeyID "$APPSTORE_API_KEY_ID" \
            -authenticationKeyIssuerID "$APPSTORE_ISSUER_ID"

      - name: Delete temp keychain
        if: always()
        run: security delete-keychain "$RUNNER_TEMP/signing.keychain-db" || true

  macos-arm:
    name: Build (macOS arm64)
    needs: version-check
    runs-on: macos-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build release (aarch64)
        run: cargo build --release

      # Bare binary, not a zip: final zips are produced (and signed) by the
      # packaging job, and the release step's dist/*.zip glob must only ever
      # see those.
      - name: Stage binary
        shell: bash
        run: |
          mkdir -p dist
          cp target/release/vellum-fe dist/vellum-fe-arm64

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: macos-arm64-bin
          path: dist/vellum-fe-arm64
          if-no-files-found: error

  macos-intel:
    name: Build (macOS x86_64)
    needs: version-check
    runs-on: macos-15-intel
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Build release (x86_64)
        run: cargo build --release

      - name: Stage binary
        shell: bash
        run: |
          mkdir -p dist
          cp target/release/vellum-fe dist/vellum-fe-x64

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: macos-x64-bin
          path: dist/vellum-fe-x64
          if-no-files-found: error

  macos-universal:
    # Produces every macOS release asset: the three binary zips, the
    # VellumFE.app bundle, and a dmg. When the Developer ID secrets exist,
    # everything is codesigned (hardened runtime), notarized through the
    # same App Store Connect API key TestFlight uses, and the dmg is
    # stapled for offline Gatekeeper approval. Without the secrets it
    # ships the same assets unsigned, with a workflow warning.
    #
    # Signing needs two secrets beyond the iOS set (the account holder
    # issues a *Developer ID Application* certificate - a different type
    # from the App Store's "Apple Distribution" - and exports it as p12):
    #   DEVELOPER_ID_P12_BASE64, DEVELOPER_ID_P12_PASSWORD
    name: Package macOS (universal, sign + notarize)
    runs-on: macos-latest
    needs: [macos-arm, macos-intel]
    steps:
      - name: Create workspace
        run: mkdir -p dist work

      - name: Download arm64 binary
        uses: actions/download-artifact@v4
        with:
          name: macos-arm64-bin
          path: work

      - name: Download x64 binary
        uses: actions/download-artifact@v4
        with:
          name: macos-x64-bin
          path: work

      - name: Build universal binary
        shell: bash
        run: |
          set -euxo pipefail
          chmod +x work/vellum-fe-arm64 work/vellum-fe-x64
          lipo -create -output work/vellum-fe-universal \
            work/vellum-fe-arm64 work/vellum-fe-x64

      - name: Decide whether signing secrets exist
        id: signing
        env:
          P12: ${{ secrets.DEVELOPER_ID_P12_BASE64 }}
        run: |
          if [ -n "$P12" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            echo "::warning::DEVELOPER_ID_P12_BASE64 not set - shipping UNSIGNED macOS assets"
          fi

      - name: Import Developer ID certificate into a temp keychain
        if: steps.signing.outputs.enabled == 'true'
        env:
          P12_BASE64: ${{ secrets.DEVELOPER_ID_P12_BASE64 }}
          P12_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
        run: |
          KEYCHAIN="$RUNNER_TEMP/signing.keychain-db"
          KEYCHAIN_PASSWORD="$(uuidgen)"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
          security set-keychain-settings -lut 21600 "$KEYCHAIN"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
          echo "$P12_BASE64" | base64 -d > "$RUNNER_TEMP/developerid.p12"
          security import "$RUNNER_TEMP/developerid.p12" -k "$KEYCHAIN" \
            -P "$P12_PASSWORD" -T /usr/bin/codesign
          rm -f "$RUNNER_TEMP/developerid.p12"
          # Without this, codesign hangs forever on a keychain UI prompt
          # that a headless runner can never answer.
          security set-key-partition-list -S apple-tool:,apple: \
            -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" > /dev/null
          security list-keychains -d user -s "$KEYCHAIN" login.keychain-db
          IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN" \
            | awk -F'"' '/Developer ID Application/ {print $2; exit}')
          if [ -z "$IDENTITY" ]; then
            echo "No 'Developer ID Application' identity in the imported p12" >&2
            exit 1
          fi
          echo "SIGN_IDENTITY=$IDENTITY" >> "$GITHUB_ENV"

      - name: Sign binaries (hardened runtime)
        if: steps.signing.outputs.enabled == 'true'
        run: |
          for bin in work/vellum-fe-arm64 work/vellum-fe-x64 work/vellum-fe-universal; do
            codesign --force --timestamp --options runtime \
              --sign "$SIGN_IDENTITY" "$bin"
          done

      - name: Package binary zips
        shell: bash
        run: |
          set -euxo pipefail
          # Same asset names and inner filenames the release has always
          # shipped; the binaries are already signed when secrets exist
          # (the signature lives in the Mach-O, so cp preserves it).
          cp work/vellum-fe-arm64 work/vellum-fe
          (cd work && zip -9 ../dist/vellum-fe-macos-arm64.zip vellum-fe && rm -f vellum-fe)
          cp work/vellum-fe-x64 work/vellum-fe
          (cd work && zip -9 ../dist/vellum-fe-macos-x64.zip vellum-fe && rm -f vellum-fe)
          (cd work && zip -9 ../dist/vellum-fe-macos-universal.zip vellum-fe-universal)

      - name: Derive bundle version from tag
        run: |
          # CFBundleShortVersionString must be plain x.y.z - strip the
          # leading v and any -beta.N suffix (mirrors the iOS job).
          REF="${{ inputs.tag || github.ref_name }}"
          VER="${REF#v}"
          VER="${VER%%-*}"
          [[ "$VER" =~ ^[0-9]+(\.[0-9]+){2}$ ]] || VER="0.0.0"
          echo "BUNDLE_VERSION=$VER" >> "$GITHUB_ENV"

      - name: Build VellumFE.app
        shell: bash
        run: |
          set -euxo pipefail
          # A bare double-click launches with no args, which main.rs routes
          # to the GUI launcher - no wrapper script needed.
          APP=work/VellumFE.app
          mkdir -p "$APP/Contents/MacOS"
          cp work/vellum-fe-universal "$APP/Contents/MacOS/vellum-fe"
          cat > "$APP/Contents/Info.plist" <<PLIST
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>CFBundleDevelopmentRegion</key><string>en</string>
            <key>CFBundleExecutable</key><string>vellum-fe</string>
            <key>CFBundleIdentifier</key><string>dev.vellumfe.desktop</string>
            <key>CFBundleInfoDictionaryVersion</key><string>6.0</string>
            <key>CFBundleName</key><string>VellumFE</string>
            <key>CFBundleDisplayName</key><string>VellumFE</string>
            <key>CFBundlePackageType</key><string>APPL</string>
            <key>CFBundleShortVersionString</key><string>${BUNDLE_VERSION}</string>
            <key>CFBundleVersion</key><string>${{ github.run_number }}</string>
            <key>LSMinimumSystemVersion</key><string>11.0</string>
            <key>NSHighResolutionCapable</key><true/>
          </dict>
          </plist>
          PLIST

      - name: Sign VellumFE.app
        if: steps.signing.outputs.enabled == 'true'
        run: |
          codesign --force --timestamp --options runtime \
            --sign "$SIGN_IDENTITY" work/VellumFE.app

      - name: Create dmg
        shell: bash
        run: |
          set -euxo pipefail
          mkdir -p work/dmgroot
          cp -R work/VellumFE.app work/dmgroot/
          ln -s /Applications work/dmgroot/Applications
          # hdiutil on hosted runners intermittently reports "No space left
          # on device" with gigabytes free (actions/runner-images#4288, hit
          # twice on v0.3.0-beta.19): stage its temp on RUNNER_TEMP and
          # retry before giving up. df runs per attempt so a genuinely full
          # disk is visible in the log.
          export TMPDIR="$RUNNER_TEMP"
          for attempt in 1 2 3; do
            df -h
            if hdiutil create -volname "VellumFE" -srcfolder work/dmgroot \
              -ov -format UDZO dist/vellum-fe-macos.dmg; then
              break
            fi
            echo "hdiutil attempt ${attempt} failed"
            if [ "$attempt" = 3 ]; then exit 1; fi
            sleep 15
          done

      - name: Notarize and staple
        if: steps.signing.outputs.enabled == 'true'
        env:
          ASC_PRIVATE_KEY: ${{ secrets.APPSTORE_API_PRIVATE_KEY }}
          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
          APPSTORE_ISSUER_ID: ${{ secrets.APPSTORE_ISSUER_ID }}
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/asc"
          printf '%s\n' "$ASC_PRIVATE_KEY" > "$RUNNER_TEMP/asc/AuthKey.p8"
          notarize() {
            xcrun notarytool submit "$1" \
              --key "$RUNNER_TEMP/asc/AuthKey.p8" \
              --key-id "$APPSTORE_API_KEY_ID" \
              --issuer "$APPSTORE_ISSUER_ID" \
              --wait
          }
          notarize dist/vellum-fe-macos.dmg
          # Stapling only works on the dmg/.app; the zipped bare binaries
          # get an online Gatekeeper check from the notarization record.
          xcrun stapler staple dist/vellum-fe-macos.dmg
          for z in dist/vellum-fe-macos-*.zip; do
            notarize "$z"
          done

      - name: Delete temp keychain
        if: always()
        run: security delete-keychain "$RUNNER_TEMP/signing.keychain-db" || true

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: macos-dist
          path: |
            dist/*.zip
            dist/*.dmg
          if-no-files-found: error

  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [build, android, ios, macos-arm, macos-intel, macos-universal]
    # Publish whatever built rather than discarding every artifact because
    # one platform failed (a flaky dmg step shouldn't sink the Windows
    # build). Runs as long as at least one build job succeeded; the notes
    # call out what's missing.
    if: ${{ !cancelled() && contains(needs.*.result, 'success') }}
    steps:
      # Full history + tags: the changelog step needs the previous release
      # tag. (GitHub's generate_release_notes builds from PULL REQUESTS,
      # which this repo doesn't use - it produced empty notes. We derive
      # notes from commits instead.)
      - name: Check out repository (full history)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Show downloaded files
        run: ls -lah dist

      - name: Generate SHA256 checksums
        shell: bash
        run: |
          pushd dist >/dev/null
          shopt -s nullglob
          # Partial releases can have few (or no) assets; a bare sha256sum
          # with zero args would hang reading stdin.
          files=(*.zip *.tar.gz *.apk *.dmg)
          if [ ${#files[@]} -gt 0 ]; then
            sha256sum "${files[@]}" | tee SHA256SUMS.txt
          else
            : > SHA256SUMS.txt
          fi
          popd >/dev/null

      - name: Build release notes from commits
        shell: bash
        run: |
          TAG="${{ inputs.tag || github.ref_name }}"
          PREV=$(git describe --tags --abbrev=0 "$TAG^" 2>/dev/null || true)
          RANGE="${PREV:+$PREV..}$TAG"
          section() {
            local title="$1" pattern="$2" invert="${3:-}"
            local lines
            if [ -n "$invert" ]; then
              lines=$(git log "$RANGE" --no-merges --format='%s' | grep -Ev "$pattern" || true)
            else
              lines=$(git log "$RANGE" --no-merges --format='%s' | grep -E "$pattern" || true)
            fi
            if [ -n "$lines" ]; then
              echo "### $title"
              echo "$lines" | sed 's/^/- /'
              echo
            fi
          }
          {
            echo "iOS ships via TestFlight (uploaded by this run), not as a"
            echo "downloadable asset here."
            echo
            # Partial release: name the platforms whose builds failed so
            # missing assets are explicit, not mysterious. A later re-run of
            # the failed jobs adds their assets to this same release.
            missing=()
            [ "${{ needs.build.result }}" = "success" ] || missing+=("Windows / Linux")
            [ "${{ needs.android.result }}" = "success" ] || missing+=("Android")
            [ "${{ needs.ios.result }}" = "success" ] || missing+=("iOS (TestFlight upload)")
            [ "${{ needs.macos-universal.result }}" = "success" ] || missing+=("macOS")
            if [ ${#missing[@]} -gt 0 ]; then
              echo "> [!WARNING]"
              echo "> Incomplete release — these platform builds failed and their"
              echo "> assets are absent (a re-run of the failed jobs will add them):"
              for m in "${missing[@]}"; do
                echo "> - $m"
              done
              echo
            fi
            section "Features"      '^feat'
            section "Fixes"         '^fix'
            section "Other changes" '^(feat|fix|chore\(release\))' invert
            if [ -n "$PREV" ]; then
              echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/$PREV...$TAG"
            fi
          } > release_notes.md
          cat release_notes.md

      - name: Create GitHub prerelease and upload assets
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || github.ref_name }}
          name: VellumFE ${{ inputs.tag || github.ref_name }}
          # Commit-derived notes from the step above. Hand-written
          # highlights can replace them post-release with
          # `gh release edit --notes-file`.
          body_path: release_notes.md
          files: |
            dist/*.zip
            dist/*.tar.gz
            dist/*.apk
            dist/*.dmg
            dist/SHA256SUMS.txt
          prerelease: ${{ inputs.prerelease || contains(github.ref_name, '-beta') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}