release.yml

name: Release macOS app

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write
  attestations: write
  id-token: write

env:
  CREATE_DMG_VERSION: 8.0.0

jobs:
  build-ghostty-cli-helper:
    runs-on: ${{ vars.MACOS_RUNNER_15 || 'warp-macos-15-arm64-6x' }}
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive

      - name: Install zig
        run: ./scripts/install-zig-ci.sh

      - name: Cache Zig packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.cache/zig
          key: zig-packages-${{ hashFiles('ghostty/build.zig.zon', 'ghostty/build.zig.zon.json') }}
          restore-keys: zig-packages-

      - name: Build universal Ghostty CLI helper
        run: |
          set -euo pipefail
          mkdir -p ghostty-cli-helper
          ./scripts/build-ghostty-cli-helper.sh --universal --output ghostty-cli-helper/ghostty
          lipo ghostty-cli-helper/ghostty -verify_arch arm64 x86_64

      - name: Upload universal Ghostty CLI helper
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cmux-ghostty-cli-helper
          path: ghostty-cli-helper/ghostty
          if-no-files-found: error

  build-sign-notarize:
    needs: build-ghostty-cli-helper
    # Build the app on macOS 26 so SDK-gated SwiftUI Liquid Glass code compiles
    # into stable releases. The real universal Ghostty CLI helper is built on
    # macOS 15 above because Zig 0.15.2 cannot link it on macOS 26.
    runs-on: ${{ vars.MACOS_RUNNER_26 || 'warp-macos-26-arm64-6x' }}
    # Notarization wait times vary on Apple's side; v0.64.14 finished at 19m16s
    # and v0.64.15 attempt 1 was killed by a 20-minute budget mid-notarization.
    timeout-minutes: 40
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive

      - name: Validate Sparkle build number is monotonic
        run: ./tests/test_ci_sparkle_build_monotonic.sh

      - name: Guard immutable release assets
        id: guard_release_assets
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const { evaluateReleaseAssetGuard } = require('./scripts/release_asset_guard');
            const tag = context.ref.startsWith('refs/tags/')
              ? context.ref.replace('refs/tags/', '')
              : null;
            core.setOutput('skip_all', 'false');
            core.setOutput('skip_upload', 'false');
            core.setOutput('release_state', 'clear');
            if (!tag) {
              core.notice('workflow_dispatch is not running from a tag; release guard is in dry-run mode.');
              return;
            }
            try {
              const release = await github.rest.repos.getReleaseByTag({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag,
              });
              const existingAssetNames = (release.data.assets || []).map((asset) => asset.name);
              const {
                conflicts,
                missingImmutableAssets,
                guardState,
                hasPartialConflict,
                shouldSkipBuildAndUpload,
              } = evaluateReleaseAssetGuard({ existingAssetNames });

              core.setOutput('release_state', guardState);

              if (hasPartialConflict) {
                core.setFailed(
                  `Release ${tag} has a partial immutable asset state. Existing immutable assets: ` +
                  `${conflicts.join(', ')}. Missing immutable assets: ${missingImmutableAssets.join(', ')}. ` +
                  'Resolve release assets manually before rerunning.'
                );
                return;
              }

              if (shouldSkipBuildAndUpload) {
                core.notice(
                  `Release ${tag} already contains immutable assets (${conflicts.join(', ')}). ` +
                  'Skipping build, notarization, and upload to preserve existing signed artifacts.'
                );
                core.setOutput('skip_all', 'true');
                core.setOutput('skip_upload', 'true');
                return;
              }

              core.notice(`Release ${tag} exists but has no immutable release assets yet; continuing.`);
            } catch (error) {
              if (error.status === 404) {
                core.notice(`Release ${tag} does not exist yet; safe to build and publish assets.`);
                return;
              }
              throw error;
            }

      - name: Select Xcode
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          set -euo pipefail
          if [ -d "/Applications/Xcode.app/Contents/Developer" ]; then
            XCODE_DIR="/Applications/Xcode.app/Contents/Developer"
          else
            XCODE_APP="$(
              find /Applications -maxdepth 1 -name 'Xcode*.app' -print 2>/dev/null \
                | sort \
                | tail -n 1 \
                || true
            )"
            if [ -n "$XCODE_APP" ]; then
              XCODE_DIR="$XCODE_APP/Contents/Developer"
            else
              echo "No Xcode.app found under /Applications" >&2
              exit 1
            fi
          fi
          echo "DEVELOPER_DIR=$XCODE_DIR" >> "$GITHUB_ENV"
          export DEVELOPER_DIR="$XCODE_DIR"
          xcodebuild -version
          xcrun --sdk macosx --show-sdk-path

      # Same self-sufficiency as nightly: a self-hosted macOS runner may lack npm
      # on PATH, which breaks the pinned create-dmg install below. setup-node
      # guarantees node/npm regardless of which runner picks up the job.
      - name: Set up Node
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "20"

      - name: Install build deps
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          if ! command -v rustup >/dev/null 2>&1; then
            export HOMEBREW_NO_AUTO_UPDATE=1
            export HOMEBREW_NO_INSTALL_CLEANUP=1
            export HOMEBREW_NO_ENV_HINTS=1
            brew install rustup-init
            rustup-init -y --profile minimal --default-toolchain stable
          fi
          if ! rustup show active-toolchain >/dev/null 2>&1; then
            rustup default stable
          fi
          rustup target add aarch64-apple-darwin x86_64-apple-darwin
          npm install --global "create-dmg@${CREATE_DMG_VERSION}"

      - name: Download pre-built GhosttyKit.xcframework
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          ./scripts/download-prebuilt-ghosttykit.sh

      - name: Cache Swift packages
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: .spm-cache
          key: spm-${{ hashFiles('cmux.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}
          restore-keys: spm-

      - name: Setup Go
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: daemon/remote/go.mod
          cache-dependency-path: daemon/remote/go.sum

      - name: Derive Sparkle public key from private key
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        env:
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          if [ -z "$SPARKLE_PRIVATE_KEY" ]; then
            echo "Missing SPARKLE_PRIVATE_KEY secret" >&2
            exit 1
          fi
          DERIVED_PUBLIC_KEY=$(swift scripts/derive_sparkle_public_key.swift "$SPARKLE_PRIVATE_KEY")
          echo "Derived Sparkle public key: $DERIVED_PUBLIC_KEY"
          echo "SPARKLE_PUBLIC_KEY=$DERIVED_PUBLIC_KEY" >> "$GITHUB_ENV"

      - name: Build universal app (Release)
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          CMUX_SKIP_ZIG_BUILD=1 xcodebuild -scheme cmux -configuration Release -derivedDataPath build-universal \
            -destination 'generic/platform=macOS' \
            -clonedSourcePackagesDirPath .spm-cache \
            ARCHS="arm64 x86_64" \
            ONLY_ACTIVE_ARCH=NO \
            CODE_SIGNING_ALLOWED=NO build

      - name: Download universal Ghostty CLI helper
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: cmux-ghostty-cli-helper
          path: ghostty-cli-helper

      - name: Install universal Ghostty CLI helper
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          set -euo pipefail
          ./scripts/install-prebuilt-ghostty-cli-helper.sh \
            ghostty-cli-helper/ghostty \
            build-universal/Build/Products/Release/cmux.app

      - name: Verify binary architectures
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          set -euo pipefail
          APP_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/MacOS/cmux"
          CLI_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/Resources/bin/cmux"
          HELPER_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/Resources/bin/ghostty"
          APP_ARCHS="$(lipo -archs "$APP_BINARY")"
          CLI_ARCHS="$(lipo -archs "$CLI_BINARY")"
          HELPER_ARCHS="$(lipo -archs "$HELPER_BINARY")"
          SDK_VERSION="$(otool -l "$APP_BINARY" | awk '/LC_BUILD_VERSION/ { in_version=1; next } in_version && /sdk / { print $2; exit }')"
          echo "App binary architectures: $APP_ARCHS"
          echo "CLI binary architectures: $CLI_ARCHS"
          echo "Ghostty helper architectures: $HELPER_ARCHS"
          echo "App SDK version: $SDK_VERSION"
          [[ "$APP_ARCHS" == *arm64* && "$APP_ARCHS" == *x86_64* ]]
          [[ "$CLI_ARCHS" == *arm64* && "$CLI_ARCHS" == *x86_64* ]]
          [[ "$HELPER_ARCHS" == *arm64* && "$HELPER_ARCHS" == *x86_64* ]]
          [[ "$SDK_VERSION" == 26.* ]]

      - name: Build remote daemon release assets and inject manifest
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          set -euo pipefail
          APP_PLIST="build-universal/Build/Products/Release/cmux.app/Contents/Info.plist"
          APP_VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$APP_PLIST")
          ./scripts/build_remote_daemon_release_assets.sh \
            --version "$APP_VERSION" \
            --release-tag "$GITHUB_REF_NAME" \
            --repo "manaflow-ai/cmux" \
            --output-dir "remote-daemon-assets"
          MANIFEST_JSON="$(python3 -c 'import json,sys; print(json.dumps(json.load(open(sys.argv[1], encoding="utf-8")), separators=(",",":")))' remote-daemon-assets/cmuxd-remote-manifest.json)"
          plutil -remove CMUXRemoteDaemonManifestJSON "$APP_PLIST" >/dev/null 2>&1 || true
          plutil -insert CMUXRemoteDaemonManifestJSON -string "$MANIFEST_JSON" "$APP_PLIST"

      - name: Run CLI version memory guard regression
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          set -euo pipefail
          CLI_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/Resources/bin/cmux"
          [ -x "$CLI_BINARY" ] || { echo "cmux CLI binary not found at $CLI_BINARY" >&2; exit 1; }
          CMUX_CLI_BIN="$CLI_BINARY" python3 tests/test_cli_version_memory_guard.py

      - name: Verify bundled Ghostty theme picker helper
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          set -euo pipefail
          HELPER_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/Resources/bin/ghostty"
          [ -x "$HELPER_BINARY" ] || { echo "Ghostty theme picker helper not found at $HELPER_BINARY" >&2; exit 1; }

      - name: Inject Sparkle keys into Info.plist
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        run: |
          APP_PLIST="build-universal/Build/Products/Release/cmux.app/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Delete :SUPublicEDKey" "$APP_PLIST" >/dev/null 2>&1 || true
          /usr/libexec/PlistBuddy -c "Delete :SUFeedURL" "$APP_PLIST" >/dev/null 2>&1 || true
          echo "Adding SUPublicEDKey to Info.plist..."
          /usr/libexec/PlistBuddy -c "Add :SUPublicEDKey string ${SPARKLE_PUBLIC_KEY}" "$APP_PLIST"
          echo "Adding SUFeedURL to Info.plist..."
          /usr/libexec/PlistBuddy -c "Add :SUFeedURL string https://github.com/manaflow-ai/cmux/releases/latest/download/appcast.xml" "$APP_PLIST"
          echo "Verifying:"
          /usr/libexec/PlistBuddy -c "Print :SUPublicEDKey" "$APP_PLIST"
          /usr/libexec/PlistBuddy -c "Print :SUFeedURL" "$APP_PLIST"

      - name: Import signing cert
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        env:
          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          if [ -z "$APPLE_CERTIFICATE_BASE64" ]; then
            echo "Missing APPLE_CERTIFICATE_BASE64 secret" >&2
            exit 1
          fi
          if [ -z "$APPLE_CERTIFICATE_PASSWORD" ]; then
            echo "Missing APPLE_CERTIFICATE_PASSWORD secret" >&2
            exit 1
          fi
          KEYCHAIN_PASSWORD="$(uuidgen)"
          echo "$APPLE_CERTIFICATE_BASE64" | base64 --decode > /tmp/cert.p12
          security delete-keychain build.keychain >/dev/null 2>&1 || true
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -lut 21600 build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security import /tmp/cert.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          security list-keychains -d user -s build.keychain

      - name: Embed release provisioning profile
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        env:
          APPLE_RELEASE_PROVISIONING_PROFILE_BASE64: ${{ secrets.APPLE_RELEASE_PROVISIONING_PROFILE_BASE64 }}
        run: |
          if [ -z "$APPLE_RELEASE_PROVISIONING_PROFILE_BASE64" ]; then
            echo "Missing APPLE_RELEASE_PROVISIONING_PROFILE_BASE64 secret" >&2
            exit 1
          fi
          APP_PATH="build-universal/Build/Products/Release/cmux.app"
          PROFILE_PATH="$APP_PATH/Contents/embedded.provisionprofile"
          TMP_PROFILE="$(mktemp /tmp/cmux-release-profile.XXXXXX)"
          TMP_PLIST="$(mktemp /tmp/cmux-release-profile.XXXXXX.plist)"
          trap 'rm -f "$TMP_PROFILE" "$TMP_PLIST"' EXIT
          echo "$APPLE_RELEASE_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$TMP_PROFILE"
          security cms -D -i "$TMP_PROFILE" > "$TMP_PLIST"
          APP_ID="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:com.apple.application-identifier" "$TMP_PLIST")"
          if [ "$APP_ID" != "7WLXT3NR37.com.cmuxterm.app" ]; then
            echo "Release provisioning profile targets unexpected app ID: $APP_ID" >&2
            exit 1
          fi
          WEBAUTHN_ENTITLEMENT="$(/usr/libexec/PlistBuddy -c "Print :Entitlements:com.apple.developer.web-browser.public-key-credential" "$TMP_PLIST")"
          if [ "$WEBAUTHN_ENTITLEMENT" != "true" ]; then
            echo "Release provisioning profile missing WebAuthn browser entitlement" >&2
            exit 1
          fi
          PROVISIONS_ALL_DEVICES="$(/usr/libexec/PlistBuddy -c "Print :ProvisionsAllDevices" "$TMP_PLIST")"
          if [ "$PROVISIONS_ALL_DEVICES" != "true" ]; then
            echo "Release provisioning profile is not a Developer ID all-devices profile" >&2
            exit 1
          fi
          cp "$TMP_PROFILE" "$PROFILE_PATH"

      - name: Codesign app
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          if [ -z "$APPLE_SIGNING_IDENTITY" ]; then
            echo "Missing APPLE_SIGNING_IDENTITY secret" >&2
            exit 1
          fi
          APP_PATH="build-universal/Build/Products/Release/cmux.app"
          ./scripts/sign-cmux-bundle.sh \
            "$APP_PATH" \
            cmux.release.entitlements \
            "$APPLE_SIGNING_IDENTITY"

      - name: Notarize app
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          if [ -z "$APPLE_ID" ] || [ -z "$APPLE_APP_SPECIFIC_PASSWORD" ] || [ -z "$APPLE_TEAM_ID" ]; then
            echo "Missing notarization secrets (APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID)" >&2
            exit 1
          fi
          APP_PATH="build-universal/Build/Products/Release/cmux.app"
          ZIP_SUBMIT="cmux-notary.zip"
          DMG_RELEASE="cmux-macos.dmg"
          ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ZIP_SUBMIT"
          APP_SUBMIT_JSON="$(xcrun notarytool submit "$ZIP_SUBMIT" --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_SPECIFIC_PASSWORD" --wait --output-format json)"
          APP_SUBMIT_ID="$(python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])' <<<"$APP_SUBMIT_JSON")"
          APP_STATUS="$(python3 -c 'import json,sys; print(json.load(sys.stdin)["status"])' <<<"$APP_SUBMIT_JSON")"
          if [ "$APP_STATUS" != "Accepted" ]; then
            echo "App notarization failed with status: $APP_STATUS" >&2
            xcrun notarytool log "$APP_SUBMIT_ID" --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_SPECIFIC_PASSWORD" || true
            exit 1
          fi
          xcrun stapler staple "$APP_PATH"
          xcrun stapler validate "$APP_PATH"
          spctl -a -vv --type execute "$APP_PATH"
          ./scripts/smoke-launch-macos-app.sh "$APP_PATH"
          ./scripts/verify-app-bundle-channel-metadata.sh "$APP_PATH" stable
          rm -f "$ZIP_SUBMIT"
          # create-dmg generates a styled drag-to-install DMG
          create-dmg \
            --identity="$APPLE_SIGNING_IDENTITY" \
            "$APP_PATH" \
            ./
          mv ./cmux*.dmg "$DMG_RELEASE"
          DMG_SUBMIT_JSON="$(xcrun notarytool submit "$DMG_RELEASE" --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_SPECIFIC_PASSWORD" --wait --output-format json)"
          DMG_SUBMIT_ID="$(python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])' <<<"$DMG_SUBMIT_JSON")"
          DMG_STATUS="$(python3 -c 'import json,sys; print(json.load(sys.stdin)["status"])' <<<"$DMG_SUBMIT_JSON")"
          if [ "$DMG_STATUS" != "Accepted" ]; then
            echo "DMG notarization failed with status: $DMG_STATUS" >&2
            xcrun notarytool log "$DMG_SUBMIT_ID" --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_SPECIFIC_PASSWORD" || true
            exit 1
          fi
          xcrun stapler staple "$DMG_RELEASE"
          xcrun stapler validate "$DMG_RELEASE"

      - name: Upload dSYMs to Sentry
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: manaflow
          SENTRY_PROJECT: cmuxterm-macos
        run: |
          if [ -z "$SENTRY_AUTH_TOKEN" ]; then
            echo "SENTRY_AUTH_TOKEN not set, skipping dSYM upload"
            exit 0
          fi
          brew install getsentry/tools/sentry-cli || true
          sentry-cli debug-files upload --include-sources build-universal/Build/Products/Release/

      - name: Generate Sparkle appcast
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        env:
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          if [ -z "$SPARKLE_PRIVATE_KEY" ]; then
            echo "Missing SPARKLE_PRIVATE_KEY secret" >&2
            exit 1
          fi
          ./scripts/sparkle_generate_appcast.sh cmux-macos.dmg "$GITHUB_REF_NAME" appcast.xml

      - name: Attest remote daemon release assets
        id: attest-remote-daemon-release-assets
        if: steps.guard_release_assets.outputs.skip_all != 'true'
        continue-on-error: true
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: |
            remote-daemon-assets/cmuxd-remote-darwin-arm64
            remote-daemon-assets/cmuxd-remote-darwin-amd64
            remote-daemon-assets/cmuxd-remote-linux-arm64
            remote-daemon-assets/cmuxd-remote-linux-amd64
            remote-daemon-assets/cmuxd-remote-checksums.txt
            remote-daemon-assets/cmuxd-remote-manifest.json

      - name: Retry remote daemon release asset attestation
        if: steps.guard_release_assets.outputs.skip_all != 'true' && steps.attest-remote-daemon-release-assets.outcome == 'failure'
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: |
            remote-daemon-assets/cmuxd-remote-darwin-arm64
            remote-daemon-assets/cmuxd-remote-darwin-amd64
            remote-daemon-assets/cmuxd-remote-linux-arm64
            remote-daemon-assets/cmuxd-remote-linux-amd64
            remote-daemon-assets/cmuxd-remote-checksums.txt
            remote-daemon-assets/cmuxd-remote-manifest.json

      - name: Upload build artifacts (dry-run)
        if: steps.guard_release_assets.outputs.skip_upload != 'true' && github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cmux-release-dry-run
          path: |
            cmux-macos.dmg
            appcast.xml
            remote-daemon-assets/cmuxd-remote-*
          if-no-files-found: error

      - name: Upload release asset
        if: steps.guard_release_assets.outputs.skip_upload != 'true' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          files: |
            cmux-macos.dmg
            appcast.xml
            remote-daemon-assets/cmuxd-remote-darwin-arm64
            remote-daemon-assets/cmuxd-remote-darwin-amd64
            remote-daemon-assets/cmuxd-remote-linux-arm64
            remote-daemon-assets/cmuxd-remote-linux-amd64
            remote-daemon-assets/cmuxd-remote-checksums.txt
            remote-daemon-assets/cmuxd-remote-manifest.json
          generate_release_notes: true
          overwrite_files: false

      - name: Upload release appcast to R2
        if: steps.guard_release_assets.outputs.skip_upload != 'true' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ github.token }}
          AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
          R2_ENDPOINT: "https://${{ secrets.CF_R2_ACCOUNT_ID }}.r2.cloudflarestorage.com"
        run: |
          set -euo pipefail
          command -v aws >/dev/null 2>&1 || { echo "Installing AWS CLI..."; brew install awscli; }

          # Guard: only upload if this tag is the highest semver release.
          # Prevents a backport tag (e.g. v0.62.1 after v0.63.1) from
          # overwriting the stable appcast with an older version.
          LATEST=$(gh release list --exclude-drafts --exclude-pre-releases \
            --json tagName -q '.[].tagName' | sort -V | tail -1)
          if [ -n "$LATEST" ] && [ "$LATEST" != "$GITHUB_REF_NAME" ]; then
            echo "Skipping R2 stable upload: $GITHUB_REF_NAME is not the latest release ($LATEST)"
            exit 0
          fi

          # Upload after GitHub Release publish so the appcast never references
          # a DMG that doesn't exist yet. R2 PutObject is atomic, so the appcast
          # is either the old version or the new one, never missing.
          aws s3 cp appcast.xml \
            "s3://cmux-binaries/stable/appcast.xml" \
            --endpoint-url "$R2_ENDPOINT" \
            --cache-control "no-cache, no-store, must-revalidate"

          echo "R2 appcast upload complete: https://files.cmux.com/stable/appcast.xml"

      - name: Cleanup keychain
        if: always()
        run: |
          security delete-keychain build.keychain >/dev/null 2>&1 || true
          rm -f /tmp/cert.p12