name: Release
run-name: ${{ inputs.channel == 'preview' && format('Stack deploy {0} build', inputs.request_id) || inputs.channel == 'cloud-migrator' && format('Cloud migrator {0}', inputs.source_ref) || 'Release' }}

on:
  push:
    branches:
      - master
  schedule:
    # Nightly cut at 09:00 UTC, after the workday's merges have settled.
    - cron: "0 9 * * *"
  workflow_dispatch:
    inputs:
      channel:
        description: Release channel to publish
        required: true
        type: choice
        options:
          - stable
          - beta
          - nightly
          - preview
          - cloud-migrator
        default: stable
      source_ref:
        description: Stable source ref, or full immutable SHA for a preview or cloud migrator build
        required: true
        type: string
        default: master
      request_id:
        description: (preview/cloud-migrator) Correlation UUID
        type: string
        default: ""
      preview_migrator:
        description: (preview) Publish isolated shared and database packages if missing
        type: boolean
        default: false
      stable_date:
        description: Enter a UTC date in YYYY-MM-DD format, for example 2026-03-18. Do not enter a version string. The workflow will resolve that date to a stable version such as 2026.318.0, then 2026.318.1 for the next same-day stable.
        required: false
        type: string
      source_version:
        description: For nightly, the explicit canary version to promote (empty selects the newest canary on master). For beta, the explicit nightly version to promote (empty selects the newest nightly on master).
        required: false
        type: string
      candidate_branch:
        description: (beta) candidate/beta-* branch to build a cherry-picked beta from. Leave empty to promote a nightly. Mutually exclusive with source_version.
        required: false
        type: string
      skip_soak_justification:
        description: (stable) Written justification for publishing a stable whose source has not soaked as a beta for 3 days. Leave empty for normal releases.
        required: false
        type: string
      dry_run:
        description: Preview the release without publishing
        required: true
        type: boolean
        default: false

concurrency:
  group: ${{ (inputs.channel == 'preview' || inputs.channel == 'cloud-migrator') && format('{0}-{1}', inputs.channel, inputs.source_ref) || format('release-{0}-{1}', github.event_name, github.ref) }}
  cancel-in-progress: false

env:
  # npm accepts a publish immediately, but the registry's CDN can lag packument
  # propagation by several minutes (observed 2.5-4+ minutes on 2026-08-21,
  # which failed four consecutive canary runs mid-loop). Give release.sh's
  # post-publish visibility poll a 10-minute budget per package instead of its
  # 60-second default; a healthy publish still exits the poll on the first
  # visible check. (A 5-minute budget missed by seconds on 2026-08-21:
  # adapter-opencode-local was accepted at 07:02:27 and became visible at
  # 07:07:40.) The publish jobs' timeout-minutes are sized for several
  # laggard packages; if most of a batch lags the full budget, npm is having
  # a real incident and the job failing is correct.
  NPM_PUBLISH_VERIFY_ATTEMPTS: "60"
  NPM_PUBLISH_VERIFY_DELAY_SECONDS: "10"

jobs:
  plan_preview:
    # Only the current master commit can use AWS. A preview or older source
    # falls back to GitHub-hosted runners, including raced merge dispatches.
    name: Check preview artifacts
    if: github.ref == 'refs/heads/master' && github.event_name == 'workflow_dispatch' && (inputs.channel == 'preview' || inputs.channel == 'cloud-migrator') && !inputs.dry_run
    runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
    permissions:
      contents: read
    # Preserve the previous hosted default; only AWS needs the Fleet limit.
    timeout-minutes: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 10 || 360 }}
    outputs:
      image: ${{ steps.plan.outputs.image }}
      packages: ${{ steps.plan.outputs.packages }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - name: Validate immutable source and inspect existing artifacts
        id: plan
        env:
          SOURCE_SHA: ${{ inputs.source_ref }}
          REQUEST_ID: ${{ inputs.request_id }}
          PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }}
          PLAN_COMMAND: ${{ inputs.channel == 'cloud-migrator' && 'plan-migrator' || 'plan' }}
        run: node scripts/preview-artifacts.mjs "$PLAN_COMMAND" "$SOURCE_SHA" "$REQUEST_ID" "$PREVIEW_MIGRATOR"

  package_preview:
    name: Build preview migrator
    needs: plan_preview
    if: needs.plan_preview.outputs.packages == 'true'
    runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          path: trusted
          persist-credentials: false
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.source_ref }}
          path: source
          persist-credentials: false
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
        with:
          version: 9.15.4
          run_install: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - name: Install build dependencies without lifecycle scripts
        working-directory: source
        run: pnpm install --ignore-scripts --no-frozen-lockfile
      - name: Build and pack exact-source preview packages
        env:
          SOURCE_SHA: ${{ inputs.source_ref }}
        run: node trusted/scripts/preview-artifacts.mjs pack source packages "$SOURCE_SHA"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: preview-packages
          overwrite: true
          path: packages/*.tgz
          if-no-files-found: error
          retention-days: 7

  publish_preview:
    # npm trusted publishing supports GitHub-hosted runners only.
    name: Publish preview migrator
    needs: [plan_preview, package_preview]
    if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.packages == 'true' && needs.package_preview.result == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # A manual preview and a merge-triggered migrator may compile in parallel.
    # Serialize only publication so they cannot race an immutable npm version,
    # without making the migrator wait for a preview's separate image build.
    concurrency:
      group: preview-package-publish-${{ inputs.source_ref }}
      cancel-in-progress: false
    # Reuse release.yml's established npm trusted-publisher identity. This job
    # publishes only isolated preview versions; it cannot advance lane tags.
    environment: npm-canary
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - name: Install npm with trusted publishing support
        run: npm install --global npm@11.18.0 --ignore-scripts
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: preview-packages
          path: preview-packages
      - name: Publish immutable preview packages without running package code
        env:
          SOURCE_SHA: ${{ inputs.source_ref }}
        run: node scripts/preview-artifacts.mjs publish preview-packages "$SOURCE_SHA"

  image_preview:
    name: Build preview cloud image
    needs: plan_preview
    if: needs.plan_preview.outputs.image == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.source_ref }}
          persist-credentials: false
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
        with:
          version: 9.15.4
          run_install: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - name: Prepare locked image context
        env:
          SOURCE_SHA: ${{ inputs.source_ref }}
        run: |
          set -euo pipefail
          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
          pnpm install --resolution-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile
          echo "TOOLS_EPOCH=$(date -u +%G-W%V)" >> "$GITHUB_ENV"
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
      - name: Build the immutable cloud image without registry credentials
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          target: cloud
          platforms: linux/amd64
          push: false
          provenance: false # Docker archives cannot carry registry attestations.
          outputs: type=docker,dest=${{ runner.temp }}/preview-image.tar
          tags: ghcr.io/paperclipai/paperclip:sha-${{ inputs.source_ref }}-cloud
          build-args: |
            CLOUD_BUNDLED_PLUGINS=daytona
            CLOUD_BUNDLED_SERVER_DEPS=@sentry/node
            PAPERCLIP_BUILD_COMMIT=${{ inputs.source_ref }}
            PAPERCLIP_BUILD_VERSION=0.0.0-preview.g${{ inputs.source_ref }}
            CLI_TOOLS_CACHE_EPOCH=${{ env.TOOLS_EPOCH }}
          labels: |
            org.opencontainers.image.revision=${{ inputs.source_ref }}
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: preview-image
          overwrite: true
          path: ${{ runner.temp }}/preview-image.tar
          compression-level: 0
          if-no-files-found: error
          retention-days: 1

  publish_image_preview:
    name: Publish preview cloud image
    needs: [plan_preview, image_preview]
    if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.image == 'true' && needs.image_preview.result == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # This existing environment has an external master-only branch policy.
    environment: npm-canary
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: preview-image
          path: preview-image
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Verify image identity and publish without executing image code
        env:
          SOURCE_SHA: ${{ inputs.source_ref }}
        run: node scripts/preview-artifacts.mjs publish-image preview-image/preview-image.tar "$SOURCE_SHA"

  result_preview:
    name: Verify preview artifacts
    needs: [plan_preview, image_preview, publish_image_preview, package_preview, publish_preview]
    if: >-
      always() && inputs.channel == 'preview' && needs.plan_preview.result == 'success' &&
      (needs.publish_image_preview.result == 'success' || needs.plan_preview.outputs.image == 'false') &&
      (needs.publish_preview.result == 'success' || needs.plan_preview.outputs.packages == 'false')
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - name: Confirm exact artifacts are visible
        env:
          SOURCE_SHA: ${{ inputs.source_ref }}
          REQUEST_ID: ${{ inputs.request_id }}
          PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }}
        run: node scripts/preview-artifacts.mjs result "$SOURCE_SHA" "$REQUEST_ID"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: stack-deploy-result
          overwrite: true
          path: stack-deploy-result/result.json
          if-no-files-found: error
          retention-days: 30

  verify_canary:
    name: Reuse exact-source verification
    if: github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master'
    runs-on: ubuntu-latest
    timeout-minutes: 50
    permissions:
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
      - name: Require successful source checks for this exact master push
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SOURCE_SHA: ${{ github.sha }}
        run: node scripts/cloud-source-verification.mjs "$SOURCE_SHA"

  publish_canary:
    if: github.event_name == 'push'
    needs: verify_canary
    runs-on: ubuntu-latest
    timeout-minutes: 90
    environment: npm-canary
    outputs:
      canary_version: ${{ steps.canary_tag.outputs.version }}
    permissions:
      contents: write
      id-token: write
      # For the explicit docker.yml dispatch below.
      actions: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 9.15.4

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      - name: Validate release package manifest
        run: node ./scripts/release-package-map.mjs check

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Restore tracked install-time changes
        run: git checkout -- pnpm-lock.yaml

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Publish canary
        env:
          GITHUB_ACTIONS: "true"
        run: ./scripts/release.sh canary --skip-verify

      - name: Dump npm debug logs
        if: failure()
        run: |
          shopt -s nullglob
          for f in "$HOME"/.npm/_logs/*.log; do
            echo "===== $f ====="
            tail -n 300 "$f" | sed -E \
              -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
          done

      - name: Push canary tag
        id: canary_tag
        run: |
          tag="$(git tag --points-at HEAD | grep '^canary/v' | head -1)"
          if [ -z "$tag" ]; then
            echo "Error: no canary tag points at HEAD after release." >&2
            exit 1
          fi
          git push origin "refs/tags/${tag}"
          echo "version=${tag#canary/v}" >> "$GITHUB_OUTPUT"

      # Canary images previously relied on the master-push docker.yml run,
      # whose single pending concurrency slot gets superseded by every
      # newer push — on a busy day no canary image publishes at all (five
      # consecutive canaries shipped npm packages with no cloud image on
      # 2026-09-06, starving downstream managed deploys for ~18 hours).
      # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's
      # triggers, so dispatch the image build at the canary tag
      # explicitly, exactly like the nightly and beta lanes: the run keys
      # its concurrency off the tag ref, so no master push can supersede
      # it, and docker.yml's `type=sha` mapping publishes the
      # sha-<short> and sha-<short>-cloud images either way.
      - name: Build Docker images for the canary tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          {
            echo "## Canary published"
            echo ""
            echo "- Published canary: \`${{ steps.canary_tag.outputs.version }}\`"
            echo "- Docker build dispatched at \`canary/v${{ steps.canary_tag.outputs.version }}\`"
          } >> "$GITHUB_STEP_SUMMARY"
          gh workflow run docker.yml --ref "refs/tags/canary/v${{ steps.canary_tag.outputs.version }}" --repo "$GITHUB_REPOSITORY"

  # The package is already public when this gate runs. A red result leaves the
  # immutable canary in npm, but makes the release workflow visibly fail before
  # anyone mistakes an installable package for an onboardable one.
  smoke_canary_onboarding:
    needs: publish_canary
    if: needs.publish_canary.result == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    env:
      PAPERCLIPAI_VERSION: ${{ needs.publish_canary.outputs.canary_version }}
      PAPERCLIP_PLAYWRIGHT_CHANNEL: chrome

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
        with:
          version: 9.15.4

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24

      - name: Install test dependencies
        run: pnpm install --frozen-lockfile

      - name: Show browser version
        run: google-chrome --version

      - name: Smoke exact published canary through onboarding
        env:
          PAPERCLIP_CANARY_SMOKE_SERVER_LOG: ${{ runner.temp }}/canary-onboarding-server.log
        run: pnpm run test:canary-onboarding-smoke

      - name: Upload failed canary onboarding diagnostics
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: canary-onboarding-smoke-${{ needs.publish_canary.outputs.canary_version }}
          if-no-files-found: warn
          retention-days: 14
          path: |
            ${{ runner.temp }}/canary-onboarding-server.log
            tests/canary-onboarding/playwright-report/
            tests/canary-onboarding/test-results/

  # ----- Nightly lane -----------------------------------------------------
  # Once a night (or on a forced nightly dispatch), promote the newest master
  # commit that already shipped a green canary: smoke-test that exact
  # published canary first, then republish the same commit under the nightly
  # identity. The candidate commit already passed release-verify during its
  # canary publish, so the nightly publish skips re-verification.

  select_nightly:
    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.channel == 'nightly')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      proceed: ${{ steps.select.outputs.proceed }}
      sha: ${{ steps.select.outputs.sha }}
      canary_version: ${{ steps.select.outputs.canary_version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: master
          fetch-depth: 0

      - name: Select nightly candidate
        id: select
        env:
          EXPLICIT_CANARY_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.source_version || '' }}
        run: |
          set -euo pipefail

          git fetch origin --tags --prune --quiet

          skip() {
            echo "proceed=false" >> "$GITHUB_OUTPUT"
            {
              echo "## Nightly skipped"
              echo ""
              echo "$1"
            } >> "$GITHUB_STEP_SUMMARY"
            echo "Nightly skipped: $1"
          }

          if [ -n "${EXPLICIT_CANARY_VERSION:-}" ]; then
            tag="canary/v${EXPLICIT_CANARY_VERSION}"
            sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)"
            if [ -z "$sha" ]; then
              echo "Error: tag $tag does not exist." >&2
              exit 1
            fi
          else
            # Newest canary-tagged commit on master. Canary tags are pushed
            # only after a successful canary publish, so tag presence is the
            # green-publish signal. Walk master newest-first and stop at the
            # first commit that carries a canary tag.
            sha="$(grep -m1 -F \
              -f <(git for-each-ref 'refs/tags/canary/v*' --format='%(objectname)') \
              <(git rev-list origin/master -n 500) || true)"

            if [ -z "$sha" ]; then
              skip "No canary/v* tag found on the last 500 commits of master."
              exit 0
            fi

            tag="$(git tag --points-at "$sha" | grep '^canary/v' | sort -V | tail -1)"
          fi

          canary_version="${tag#canary/v}"

          existing_nightly="$(git tag --points-at "$sha" | grep '^nightly/v' | head -1 || true)"
          if [ -n "$existing_nightly" ]; then
            skip "Candidate \`$sha\` (canary \`$canary_version\`) already shipped as \`$existing_nightly\`."
            exit 0
          fi

          # Promotions run the release tooling of the source commit, so the
          # source must already understand the nightly channel. (Literal match
          # of release.sh's channel case arm; if that line is reformatted this
          # fails closed and should be updated alongside it.)
          if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly'; then
            echo "Error: source commit $sha predates nightly release tooling; promote a newer canary." >&2
            exit 1
          fi

          echo "proceed=true" >> "$GITHUB_OUTPUT"
          echo "sha=$sha" >> "$GITHUB_OUTPUT"
          echo "canary_version=$canary_version" >> "$GITHUB_OUTPUT"
          {
            echo "## Nightly candidate"
            echo ""
            echo "- Source SHA: \`$sha\`"
            echo "- Source canary: \`$canary_version\`"
          } >> "$GITHUB_STEP_SUMMARY"

  # Gate the promotion on the release smoke suite, run against the exact
  # published canary artifact that would become tonight's nightly. Red smoke
  # means no nightly tonight. Skipped for dry-run dispatches.
  smoke_nightly:
    needs: select_nightly
    if: needs.select_nightly.outputs.proceed == 'true' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run)
    uses: ./.github/workflows/release-smoke.yml
    with:
      paperclip_version: ${{ needs.select_nightly.outputs.canary_version }}
      artifact_name: nightly-release-smoke

  publish_nightly:
    needs: [select_nightly, smoke_nightly]
    # Publish when smoke passed, or when smoke was deliberately skipped by a
    # dry-run dispatch (the publish itself is a dry-run in that case).
    if: >-
      !cancelled() &&
      needs.select_nightly.outputs.proceed == 'true' &&
      (needs.smoke_nightly.result == 'success' ||
       (needs.smoke_nightly.result == 'skipped' && github.event_name == 'workflow_dispatch' && inputs.dry_run))
    runs-on: ubuntu-latest
    timeout-minutes: 90
    environment: npm-canary
    # The workflow-level concurrency group is per event, so a forced dispatch
    # nightly could otherwise overlap the scheduled one and race it to the
    # same next -nightly.N version. Serialize actual nightly publishes across
    # events here; release.sh additionally refuses to double-publish a commit
    # that already carries a nightly tag.
    concurrency:
      group: release-publish-nightly
      cancel-in-progress: false
    permissions:
      contents: write
      id-token: write
      actions: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.select_nightly.outputs.sha }}
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 9.15.4

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      - name: Validate release package manifest
        run: node ./scripts/release-package-map.mjs check

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Restore tracked install-time changes
        run: git checkout -- pnpm-lock.yaml

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Publish nightly
        env:
          GITHUB_ACTIONS: "true"
        run: |
          args=(nightly --skip-verify)
          if [ "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}" = "true" ]; then
            args+=(--dry-run)
          fi
          ./scripts/release.sh "${args[@]}"

      - name: Dump npm debug logs
        if: failure()
        run: |
          shopt -s nullglob
          for f in "$HOME"/.npm/_logs/*.log; do
            echo "===== $f ====="
            tail -n 300 "$f" | sed -E \
              -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
          done

      - name: Push nightly tag
        if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
        run: |
          tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)"
          if [ -z "$tag" ]; then
            echo "Error: no nightly tag points at HEAD after release." >&2
            exit 1
          fi
          if ! git push origin "refs/tags/${tag}"; then
            sha="$(git rev-parse HEAD)"
            {
              echo "## Tag push rejected"
              echo ""
              echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
              echo "This usually means the tagged commit modifies workflow files,"
              echo "which GITHUB_TOKEN may not reference when creating refs from"
              echo "dispatch or scheduled runs. Recover with maintainer credentials:"
              echo ""
              echo '```'
              echo "git tag ${tag} ${sha}"
              echo "git push origin refs/tags/${tag}"
              echo "gh workflow run docker.yml --ref refs/tags/${tag}"
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
            echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
            exit 1
          fi

      # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
      # trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
      # pushes), so dispatch the image build at the new tag explicitly.
      - name: Build Docker images for the nightly tag
        if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)"
          {
            echo "## Nightly published"
            echo ""
            echo "- Source SHA: \`${{ needs.select_nightly.outputs.sha }}\`"
            echo "- Source canary: \`${{ needs.select_nightly.outputs.canary_version }}\`"
            echo "- Published nightly: \`${tag#nightly/v}\`"
            echo "- Docker build dispatched at \`${tag}\`"
          } >> "$GITHUB_STEP_SUMMARY"
          gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"

  # ----- Beta lane --------------------------------------------------------
  # Beta is a manual, human-approved promotion of a nightly. Unlike the
  # scheduled nightly lane, a beta dispatch is explicit operator intent, so
  # selection problems fail the run loudly instead of skipping quietly. The
  # publish runs behind the npm-beta environment, whose required reviewers
  # are the approval gate.

  select_beta:
    if: github.event_name == 'workflow_dispatch' && inputs.channel == 'beta'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      sha: ${{ steps.select.outputs.sha }}
      nightly_version: ${{ steps.select.outputs.nightly_version }}
      mode: ${{ steps.select.outputs.mode }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: master
          fetch-depth: 0

      - name: Select beta candidate
        id: select
        env:
          EXPLICIT_NIGHTLY_VERSION: ${{ inputs.source_version }}
          CANDIDATE_BRANCH: ${{ inputs.candidate_branch }}
        run: |
          set -euo pipefail

          git fetch origin --tags --prune --quiet

          # Candidate mode: build a cherry-picked beta from a short-lived
          # candidate branch instead of promoting a nightly.
          if [ -n "${CANDIDATE_BRANCH:-}" ]; then
            if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then
              echo "Error: candidate_branch and source_version are mutually exclusive." >&2
              exit 1
            fi
            case "$CANDIDATE_BRANCH" in
              candidate/beta-*) ;;
              *)
                echo "Error: candidate branches must be named candidate/beta-<target> (got: $CANDIDATE_BRANCH)." >&2
                exit 1
                ;;
            esac
            git fetch origin "$CANDIDATE_BRANCH" --quiet
            sha="$(git rev-parse --verify "origin/${CANDIDATE_BRANCH}^{commit}" 2>/dev/null || true)"
            if [ -z "$sha" ]; then
              echo "Error: candidate branch $CANDIDATE_BRANCH does not exist on origin." >&2
              exit 1
            fi

            existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)"
            if [ -n "$existing_beta" ]; then
              echo "Error: candidate head $sha already shipped as $existing_beta." >&2
              exit 1
            fi

            if ! git show "${sha}:scripts/release.sh" | grep -qF -- '--from-candidate'; then
              echo "Error: candidate head $sha predates candidate-build release tooling; rebase the candidate onto a newer base." >&2
              exit 1
            fi

            merge_base="$(git merge-base origin/master "$sha")"
            echo "mode=candidate" >> "$GITHUB_OUTPUT"
            echo "sha=$sha" >> "$GITHUB_OUTPUT"
            echo "nightly_version=" >> "$GITHUB_OUTPUT"
            {
              echo "## Beta candidate branch"
              echo ""
              echo "- Branch: \`$CANDIDATE_BRANCH\`"
              echo "- Head: \`$sha\`"
              echo "- Base (merge-base with master): \`$merge_base\`"
              echo "- Cherry-picked commits:"
              echo ""
              echo '\`\`\`'
              git log --oneline "${merge_base}..${sha}"
              echo '\`\`\`'
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          echo "mode=promote" >> "$GITHUB_OUTPUT"

          if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then
            tag="nightly/v${EXPLICIT_NIGHTLY_VERSION}"
            sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)"
            if [ -z "$sha" ]; then
              echo "Error: tag $tag does not exist." >&2
              exit 1
            fi
          else
            # Newest nightly-tagged commit on master.
            sha="$(grep -m1 -F \
              -f <(git for-each-ref 'refs/tags/nightly/v*' --format='%(objectname)') \
              <(git rev-list origin/master -n 2000) || true)"

            if [ -z "$sha" ]; then
              echo "Error: no nightly/v* tag found on the last 2000 commits of master. Publish a nightly first, or pass source_version." >&2
              exit 1
            fi

            tag="$(git tag --points-at "$sha" | grep '^nightly/v' | sort -V | tail -1)"
          fi

          nightly_version="${tag#nightly/v}"

          existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)"
          if [ -n "$existing_beta" ]; then
            echo "Error: candidate $sha (nightly $nightly_version) already shipped as $existing_beta." >&2
            exit 1
          fi

          # Promotions run the release tooling of the source commit, so the
          # source must already understand the beta channel. (Literal match of
          # release.sh's channel case arm; if that line is reformatted this
          # fails closed and should be updated alongside it.)
          if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly|beta|stable)'; then
            echo "Error: source commit $sha predates beta release tooling; promote a newer nightly whose source contains the beta channel." >&2
            exit 1
          fi

          echo "sha=$sha" >> "$GITHUB_OUTPUT"
          echo "nightly_version=$nightly_version" >> "$GITHUB_OUTPUT"
          {
            echo "## Beta candidate"
            echo ""
            echo "- Source SHA: \`$sha\`"
            echo "- Source nightly: \`$nightly_version\`"
          } >> "$GITHUB_STEP_SUMMARY"

  # Candidate-branch heads are new commits that never went through a canary
  # or nightly, so they must pass full verification before publishing.
  # Promoted nightlies were already verified by their canary run and skip it.
  verify_beta_candidate:
    needs: select_beta
    if: needs.select_beta.outputs.mode == 'candidate'
    uses: ./.github/workflows/release-verify.yml
    with:
      ref: ${{ needs.select_beta.outputs.sha }}

  publish_beta:
    needs: [select_beta, verify_beta_candidate]
    if: >-
      !cancelled() &&
      needs.select_beta.result == 'success' &&
      (needs.verify_beta_candidate.result == 'success' ||
       (needs.verify_beta_candidate.result == 'skipped' && needs.select_beta.outputs.mode == 'promote'))
    runs-on: ubuntu-latest
    timeout-minutes: 90
    environment: npm-beta
    # Serialize beta publishes so two dispatches cannot race to the same next
    # -beta.N version; release.sh additionally refuses to double-publish a
    # commit that already carries a beta tag.
    concurrency:
      group: release-publish-beta
      cancel-in-progress: false
    permissions:
      contents: write
      id-token: write
      actions: write
    outputs:
      beta_version: ${{ steps.result.outputs.beta_version }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.select_beta.outputs.sha }}
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 9.15.4

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      - name: Validate release package manifest
        run: node ./scripts/release-package-map.mjs check

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Restore tracked install-time changes
        run: git checkout -- pnpm-lock.yaml

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Publish beta
        env:
          GITHUB_ACTIONS: "true"
        run: |
          args=(beta --skip-verify)
          if [ "${{ needs.select_beta.outputs.mode }}" = "candidate" ]; then
            args+=(--from-candidate)
          fi
          if [ "${{ inputs.dry_run }}" = "true" ]; then
            args+=(--dry-run)
          fi
          ./scripts/release.sh "${args[@]}"

      - name: Dump npm debug logs
        if: failure()
        run: |
          shopt -s nullglob
          for f in "$HOME"/.npm/_logs/*.log; do
            echo "===== $f ====="
            tail -n 300 "$f" | sed -E \
              -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
          done

      - name: Push beta tag
        if: ${{ !inputs.dry_run }}
        run: |
          tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)"
          if [ -z "$tag" ]; then
            echo "Error: no beta tag points at HEAD after release." >&2
            exit 1
          fi
          if ! git push origin "refs/tags/${tag}"; then
            sha="$(git rev-parse HEAD)"
            {
              echo "## Tag push rejected"
              echo ""
              echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
              echo "This usually means the tagged commit modifies workflow files,"
              echo "which GITHUB_TOKEN may not reference when creating refs from"
              echo "dispatch or scheduled runs. Recover with maintainer credentials:"
              echo ""
              echo '```'
              echo "git tag ${tag} ${sha}"
              echo "git push origin refs/tags/${tag}"
              echo "gh workflow run docker.yml --ref refs/tags/${tag}"
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
            echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
            exit 1
          fi

      # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
      # trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
      # pushes), so dispatch the image build at the new tag explicitly.
      - name: Build Docker images for the beta tag
        id: result
        if: ${{ !inputs.dry_run }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)"
          echo "beta_version=${tag#beta/v}" >> "$GITHUB_OUTPUT"
          {
            echo "## Beta published"
            echo ""
            echo "- Source SHA: \`${{ needs.select_beta.outputs.sha }}\`"
            echo "- Source nightly: \`${{ needs.select_beta.outputs.nightly_version }}\`"
            echo "- Published beta: \`${tag#beta/v}\`"
            echo "- Docker build dispatched at \`${tag}\`"
          } >> "$GITHUB_STEP_SUMMARY"
          gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"

  # Draft the eventual stable's release notes the moment the beta exists:
  # the promoted bits are frozen now, and the 3-day soak is the natural
  # review window. The draft lands on a machine-owned branch; a human opens
  # and merges the PR, because a PR created with GITHUB_TOKEN would not
  # trigger the pr.yml checks a merge requires.
  draft_stable_notes:
    needs: [select_beta, publish_beta]
    if: ${{ !cancelled() && !inputs.dry_run && needs.publish_beta.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      # gh pr view needs PR read for the skeleton's nested summaries;
      # without it the enrichment silently degrades to bare subjects.
      pull-requests: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: master
          fetch-depth: 0

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Draft stable notes from the published beta
        env:
          # gh needs a token so the generator can nest each PR's summary
          # under its subject line (best-effort thoroughness).
          GH_TOKEN: ${{ github.token }}
          BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
          SOURCE_SHA: ${{ needs.select_beta.outputs.sha }}
        run: |
          set -euo pipefail
          git fetch origin --tags --quiet
          # A rejected beta tag push (the workflows-permission case) leaves
          # the tag absent from origin while npm already has the beta;
          # recreate it locally so drafting does not block on the manual
          # tag recovery.
          if ! git rev-parse --verify "refs/tags/beta/v${BETA_VERSION}" >/dev/null 2>&1; then
            git tag "beta/v${BETA_VERSION}" "${SOURCE_SHA}"
          fi
          ./scripts/draft-stable-notes.sh "${BETA_VERSION}"

      - name: Push the draft branch
        env:
          BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
        run: |
          set -euo pipefail
          branch="release-notes/v${BETA_VERSION}"
          git checkout -B "$branch"
          git add "releases/beta/v${BETA_VERSION}.md"
          git commit -m "docs(release): draft stable notes for beta ${BETA_VERSION}"
          # Machine-owned branch: force push so a re-run regenerates cleanly.
          git push -f origin "$branch"
          {
            echo "## Stable notes draft pushed"
            echo ""
            echo "- Branch: \`${branch}\`"
            echo "- Open the PR (a human opens it so CI runs):"
            echo "  https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
            echo "- Edit it during the soak. The stable promotion reads"
            echo "  \`releases/beta/v${BETA_VERSION}.md\` from master."
          } >> "$GITHUB_STEP_SUMMARY"

  # Post-publish verification: run the release smoke suite against the exact
  # beta version that was just published.
  #
  # The condition must carry an explicit status-check function: without one,
  # GitHub attaches an implicit success(), which evaluates the needs chain
  # transitively — and publish_beta's chain contains verify_beta_candidate,
  # which is skipped on every promote-mode beta. The implicit form silently
  # skipped this job on the first promote-mode beta after the candidate
  # lane landed.
  smoke_beta:
    needs: publish_beta
    if: ${{ !cancelled() && needs.publish_beta.result == 'success' && !inputs.dry_run }}
    uses: ./.github/workflows/release-smoke.yml
    with:
      paperclip_version: ${{ needs.publish_beta.outputs.beta_version }}
      artifact_name: beta-release-smoke

  # ----- Stable lane ------------------------------------------------------

  # Stable releases promote a soaked beta. The preflight enforces that the
  # source commit shipped as a beta at least 3 days ago (measured from the
  # npm publish time of that beta version), unless a written justification
  # is provided. Dry runs report soak state without blocking.
  # Resolves source_ref to an immutable commit exactly once; every downstream
  # stable job consumes that SHA. Otherwise a branch or movable tag that
  # advances mid-run could be soak-checked at one commit and verified or
  # published at another.
  preflight_stable:
    if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      sha: ${{ steps.soak.outputs.sha }}
      beta_version: ${{ steps.soak.outputs.beta_version }}
      stable_version: ${{ steps.notes.outputs.stable_version }}
      notes_mode: ${{ steps.notes.outputs.notes_mode }}
      notes_path: ${{ steps.notes.outputs.notes_path }}
      notes_ref: ${{ steps.notes.outputs.notes_ref }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: master
          fetch-depth: 0

      - name: Check beta soak
        id: soak
        env:
          SOURCE_REF: ${{ inputs.source_ref }}
          JUSTIFICATION: ${{ inputs.skip_soak_justification }}
          DRY_RUN: ${{ inputs.dry_run }}
        run: |
          set -euo pipefail

          git fetch origin --tags --prune --quiet

          sha="$(git rev-parse --verify "${SOURCE_REF}^{commit}" 2>/dev/null || true)"
          if [ -z "$sha" ]; then
            git fetch origin "$SOURCE_REF" --quiet || true
            sha="$(git rev-parse --verify "FETCH_HEAD^{commit}" 2>/dev/null || true)"
          fi
          if [ -z "$sha" ]; then
            echo "Error: could not resolve source_ref '$SOURCE_REF' to a commit." >&2
            exit 1
          fi

          echo "sha=$sha" >> "$GITHUB_OUTPUT"
          {
            echo "## Stable source pinned"
            echo ""
            echo "- source_ref: \`${SOURCE_REF}\` -> \`$sha\`"
          } >> "$GITHUB_STEP_SUMMARY"

          fail_or_justify() {
            if [ -n "${JUSTIFICATION:-}" ]; then
              {
                echo "## Stable soak gate bypassed"
                echo ""
                echo "$1"
                echo ""
                echo "Justification: ${JUSTIFICATION}"
              } >> "$GITHUB_STEP_SUMMARY"
              echo "::warning::Soak gate bypassed: $1"
              return 0
            fi
            if [ "${DRY_RUN}" = "true" ]; then
              echo "::warning::Soak gate would block a real release: $1"
              {
                echo "## Stable soak gate (dry run)"
                echo ""
                echo "A real release would be blocked: $1"
              } >> "$GITHUB_STEP_SUMMARY"
              return 0
            fi
            echo "Error: $1" >&2
            echo "Pass skip_soak_justification with a written reason to release anyway." >&2
            exit 1
          }

          beta_tag="$(git tag --points-at "$sha" | grep '^beta/v' | sort -V | tail -1 || true)"
          if [ -z "$beta_tag" ]; then
            fail_or_justify "source commit $sha never shipped as a beta (no beta/v* tag)."
            exit 0
          fi

          beta_version="${beta_tag#beta/v}"
          echo "beta_version=${beta_version}" >> "$GITHUB_OUTPUT"
          publish_time="$(npm view "paperclipai@${beta_version}" time --json 2>/dev/null \
            | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const t=JSON.parse(d);process.stdout.write(typeof t === "string" ? t : (t[process.argv[1]] ?? ""))})' "$beta_version" || true)"
          if [ -z "$publish_time" ]; then
            fail_or_justify "could not determine the npm publish time of beta ${beta_version}."
            exit 0
          fi

          age_seconds="$(node -e 'process.stdout.write(String(Math.floor((Date.now() - Date.parse(process.argv[1])) / 1000)))' "$publish_time")"
          min_seconds=$((3 * 24 * 60 * 60))
          age_days="$(node -e 'process.stdout.write((Number(process.argv[1]) / 86400).toFixed(1))' "$age_seconds")"

          if [ "$age_seconds" -lt "$min_seconds" ]; then
            fail_or_justify "beta ${beta_version} has only soaked ${age_days} days (minimum is 3)."
            exit 0
          fi

          {
            echo "## Stable soak gate passed"
            echo ""
            echo "- Source beta: \`${beta_version}\`"
            echo "- Soak time: ${age_days} days"
          } >> "$GITHUB_STEP_SUMMARY"

      # The stable notes need not exist inside the promoted source commit:
      # a promoted beta's notes are drafted on master (releases/beta/v*.md)
      # at beta-publish time and edited during the soak. Resolve which copy
      # publish_stable should read, and fail early — before the npm-stable
      # approval gate — when none exists. Notes inside the source tree
      # (the candidate fix path) take precedence.
      - name: Resolve stable release notes
        id: notes
        env:
          SHA: ${{ steps.soak.outputs.sha }}
          BETA_VERSION: ${{ steps.soak.outputs.beta_version }}
          STABLE_DATE: ${{ inputs.stable_date }}
          DRY_RUN: ${{ inputs.dry_run }}
        run: |
          set -euo pipefail

          # Pin the master revision the notes were resolved at, so the
          # publish and canonicalization steps read the same content even
          # when master advances during the approval delay.
          echo "notes_ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

          args=(stable --print-version)
          if [ -n "${STABLE_DATE}" ]; then
            args+=(--date "${STABLE_DATE}")
          fi
          version="$(./scripts/release.sh "${args[@]}")"
          echo "stable_version=${version}" >> "$GITHUB_OUTPUT"

          if git cat-file -e "${SHA}:releases/v${version}.md" 2>/dev/null; then
            echo "notes_mode=source_tree" >> "$GITHUB_OUTPUT"
            echo "notes_path=releases/v${version}.md" >> "$GITHUB_OUTPUT"
            echo "- Stable notes: \`releases/v${version}.md\` at the source commit" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          if [ -n "${BETA_VERSION}" ] && [ -f "releases/beta/v${BETA_VERSION}.md" ]; then
            echo "notes_mode=master_beta" >> "$GITHUB_OUTPUT"
            echo "notes_path=releases/beta/v${BETA_VERSION}.md" >> "$GITHUB_OUTPUT"
            echo "- Stable notes: \`releases/beta/v${BETA_VERSION}.md\` on master" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          msg="no release notes found for stable ${version}: neither releases/v${version}.md at the source commit nor releases/beta/v${BETA_VERSION:-<beta>}.md on master. Merge the notes PR from the beta's draft branch (release-notes/v<beta-version>), or add the file to the source ref."
          if [ "${DRY_RUN}" = "true" ]; then
            echo "::warning::${msg}"
            echo "- Stable notes: MISSING (a real release would be blocked)" >> "$GITHUB_STEP_SUMMARY"
            echo "notes_mode=missing" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "::error::${msg}"
          exit 1

  verify_stable:
    if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable'
    needs: preflight_stable
    uses: ./.github/workflows/release-verify.yml
    with:
      ref: ${{ needs.preflight_stable.outputs.sha }}

  preview_stable:
    if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && inputs.dry_run
    needs: [preflight_stable, verify_stable]
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ needs.preflight_stable.outputs.sha }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 9.15.4

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      - name: Validate release package manifest
        run: node ./scripts/release-package-map.mjs check

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Dry-run stable release
        env:
          GITHUB_ACTIONS: "true"
        run: |
          args=(stable --skip-verify --dry-run)
          if [ -n "${{ inputs.stable_date }}" ]; then
            args+=(--date "${{ inputs.stable_date }}")
          fi
          ./scripts/release.sh "${args[@]}"

  publish_stable:
    if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run
    needs: [preflight_stable, verify_stable]
    runs-on: ubuntu-latest
    timeout-minutes: 90
    environment: npm-stable
    permissions:
      contents: write
      id-token: write
      actions: write
    outputs:
      stable_version: ${{ steps.tag.outputs.version }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ needs.preflight_stable.outputs.sha }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 9.15.4

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Restore tracked install-time changes
        run: git checkout -- pnpm-lock.yaml

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      # A promoted beta's notes live on master (drafted at beta publish,
      # edited during the soak), not inside the promoted source commit — a
      # commit cannot carry a file named for a promotion date that was
      # unknown when it was created. Materialize them outside the worktree
      # so release.sh still runs against a clean source checkout.
      - name: Materialize stable release notes from master
        if: needs.preflight_stable.outputs.notes_mode == 'master_beta'
        env:
          NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
          NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
        run: |
          set -euo pipefail
          git fetch origin master --quiet
          git show "${NOTES_REF}:${NOTES_PATH}" > "$RUNNER_TEMP/stable-notes.md"
          echo "STABLE_NOTES_FILE=$RUNNER_TEMP/stable-notes.md" >> "$GITHUB_ENV"

      - name: Publish stable
        env:
          GITHUB_ACTIONS: "true"
        run: |
          args=(stable --skip-verify)
          if [ -n "${{ inputs.stable_date }}" ]; then
            args+=(--date "${{ inputs.stable_date }}")
          fi
          if [ -n "${STABLE_NOTES_FILE:-}" ]; then
            args+=(--notes-file "$STABLE_NOTES_FILE")
          fi
          ./scripts/release.sh "${args[@]}"

      - name: Dump npm debug logs
        if: failure()
        run: |
          shopt -s nullglob
          for f in "$HOME"/.npm/_logs/*.log; do
            echo "===== $f ====="
            tail -n 300 "$f" | sed -E \
              -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
          done

      - name: Push stable tag
        id: tag
        run: |
          tag="$(git tag --points-at HEAD | grep '^v' | head -1)"
          if [ -z "$tag" ]; then
            echo "Error: no stable tag points at HEAD after release." >&2
            exit 1
          fi
          echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
          if ! git push origin "refs/tags/${tag}"; then
            sha="$(git rev-parse HEAD)"
            {
              echo "## Tag push rejected"
              echo ""
              echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
              echo "This usually means the tagged commit modifies workflow files,"
              echo "which GITHUB_TOKEN may not reference when creating refs from"
              echo "dispatch or scheduled runs. Recover with maintainer credentials:"
              echo ""
              echo '```'
              echo "git tag ${tag} ${sha}"
              echo "git push origin refs/tags/${tag}"
              echo "gh workflow run docker.yml --ref refs/tags/${tag}"
            echo "./scripts/create-github-release.sh ${tag#v}"
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
            echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
            exit 1
          fi

      # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
      # trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
      # pushes), so dispatch the image build at the new tag explicitly. This
      # is what moves Docker `:latest` and publishes the versioned stable
      # image tags.
      - name: Build Docker images for the stable tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="$(git tag --points-at HEAD | grep '^v' | head -1)"
          if gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"; then
            echo "Dispatched docker.yml at ${tag}."
          else
            # Older source commits may predate docker.yml's workflow_dispatch
            # trigger; the dispatch then fails while the npm release is
            # already complete and correct.
            echo "::warning::Could not dispatch docker.yml at ${tag}. Run docker.yml manually at that tag to publish the stable images."
          fi

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          PUBLISH_REMOTE: origin
        run: |
          version="$(git tag --points-at HEAD | grep '^v' | head -1 | sed 's/^v//')"
          if [ -z "$version" ]; then
            echo "Error: no v* tag points at HEAD after stable release." >&2
            exit 1
          fi
          args=("$version")
          if [ -n "${STABLE_NOTES_FILE:-}" ]; then
            args+=(--notes-file "$STABLE_NOTES_FILE")
          fi
          ./scripts/create-github-release.sh "${args[@]}"

  # After a stable ships from master-side beta notes, move the file to its
  # canonical home (releases/vYYYY.MDD.P.md) so the stable-notes invariant
  # holds durably. Machine-owned branch + human-opened PR, as with the
  # draft job above.
  canonicalize_stable_notes:
    needs: [preflight_stable, publish_stable]
    if: ${{ needs.preflight_stable.outputs.notes_mode == 'master_beta' && needs.publish_stable.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: master
          fetch-depth: 0

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Push the canonicalization branch
        env:
          STABLE_VERSION: ${{ needs.publish_stable.outputs.stable_version }}
          NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
          NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
        run: |
          set -euo pipefail
          branch="release-notes/v${STABLE_VERSION}-canonicalize"
          git checkout -B "$branch"
          # Canonicalize exactly what shipped: take the notes at the pinned
          # revision the release read them from, so a master edit made
          # during the run surfaces as a reviewable diff in this PR instead
          # of silently diverging from the published GitHub Release.
          git show "${NOTES_REF}:${NOTES_PATH}" > "releases/v${STABLE_VERSION}.md"
          git add "releases/v${STABLE_VERSION}.md"
          if git ls-files --error-unmatch "${NOTES_PATH}" >/dev/null 2>&1; then
            git rm -q "${NOTES_PATH}"
          fi
          git commit -m "docs(release): canonicalize stable notes for v${STABLE_VERSION}"
          git push -f origin "$branch"
          {
            echo "## Stable notes canonicalization pushed"
            echo ""
            echo "- Branch: \`${branch}\`"
            echo "- Open and merge the PR (a human opens it so CI runs):"
            echo "  https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
          } >> "$GITHUB_STEP_SUMMARY"