release.yml

name: code-intel-release

on:
  push:
    tags:
      - "v*"

# Build jobs only need to read the repository. The write-capable scopes
# (contents for release creation, id-token/attestations for provenance)
# are granted only to the publish job below, so no build or validation
# step ever holds a token that could publish or mutate a release.
permissions:
  contents: read

jobs:
  release-windows:
    # Authoritative full release gate. Tag/version validation, Skill and
    # Rust test suites, the authoritative self-scan, packaging, and
    # packaged-payload validation all run here; publishing happens only in
    # the publish job after every platform's package has passed its gates.
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0

      - name: Validate release tag and package version
        shell: pwsh
        run: |
          $tag = "${{ github.ref_name }}"
          if ($tag -notmatch '^v(?<version>[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?)$') {
            throw "Unsupported release tag: $tag"
          }
          $tagVersion = $Matches.version
          $manifest = Get-Content -Raw -LiteralPath crates\code-intel-cli\Cargo.toml
          $manifestMatch = [regex]::Match($manifest, '(?m)^version\s*=\s*"([^"]+)"')
          if (-not $manifestMatch.Success) {
            throw "Could not read the code-intel package version."
          }
          $packageVersion = $manifestMatch.Groups[1].Value
          if ($packageVersion -ne $tagVersion) {
            throw "Release tag $tag does not match Cargo package version $packageVersion."
          }

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.11"

      - name: Validate Skill package and bootstrap security
        shell: pwsh
        run: |
          python tests/test_repository_layout.py -v
          python tests/test_skill_package.py -v

      - name: Setup Rust
        shell: pwsh
        run: |
          rustup toolchain install
          rustup show active-toolchain

      - name: Install ripgrep
        shell: pwsh
        run: choco install ripgrep --version 14.1.0 -y --no-progress

      - name: Rust format
        shell: pwsh
        run: cargo fmt -p code-intel -- --check

      - name: Rust check
        shell: pwsh
        run: cargo check --locked

      - name: Rust tests
        shell: pwsh
        run: cargo test -p code-intel --locked

      - name: Build Rust CLI
        shell: pwsh
        run: cargo build -p code-intel --release --locked

      - name: Authoritative self-scan (release blocking)
        shell: pwsh
        run: |
          $staging = Join-Path $env:RUNNER_TEMP "code-intel-release-self-scan"
          $authority = Join-Path $env:RUNNER_TEMP "code-intel-release-self-authority"
          New-Item -ItemType Directory -Force $authority | Out-Null
          ./target/release/code-intel.exe run execute --repo . --out $staging --authority-root $authority --final-name release-self-scan --manifest orchestration/integrations.json --doctor-require-repowise false
          if ($LASTEXITCODE -ne 0) {
            throw "release candidate failed its own scan (exit ${LASTEXITCODE}: 10 = architecture/domain gate failure, 70 = process failure). A failing self-scan must never publish."
          }

      - name: Validate any produced audit report (ai-safety-003)
        shell: pwsh
        run: |
          # The audit kernel's fail-closed validator (`audit --operation
          # validate`) previously ran on no automated path -- see issue #34
          # ai-safety-003. Departments are agent-run, not part of `run
          # execute`, so no audit-report.json is expected from this job
          # today; this step is the structural guarantee that if one ever
          # shows up here (repo root, orchestration/, or the self-scan
          # artifact directory), a release can never publish it unvalidated.
          $staging = Join-Path $env:RUNNER_TEMP "code-intel-release-self-scan"
          $searchRoots = @("orchestration", $staging) | Where-Object { Test-Path $_ }
          $reports = @()
          if (Test-Path "audit-report.json") { $reports += (Resolve-Path "audit-report.json").Path }
          foreach ($root in $searchRoots) {
            $reports += Get-ChildItem -LiteralPath $root -Recurse -Filter "audit-report.json" -File -ErrorAction SilentlyContinue |
              Select-Object -ExpandProperty FullName
          }
          $reports = $reports | Select-Object -Unique
          if (-not $reports) {
            Write-Host "No audit-report.json produced by this run; nothing to validate."
          }
          foreach ($report in $reports) {
            Write-Host "Validating audit report: $report"
            ./target/release/code-intel.exe audit --operation validate --repo . --report $report
            if ($LASTEXITCODE -ne 0) {
              throw "audit report failed --operation validate (exit ${LASTEXITCODE}): $report -- a release candidate must never publish an unvalidated audit report"
            }
          }

      - name: Install portable pipeline
        shell: pwsh
        run: .\archive\install-code-intel-pipeline.ps1 -RepoPath . -RepairSkillLinks -Json

      - name: Add pipeline tools PATH
        shell: pwsh
        run: Add-Content -Path $env:GITHUB_PATH -Value "$env:LOCALAPPDATA\code-intel\bin"

      - name: Doctor
        shell: pwsh
        # Runners don't install repowise; smoke runs on the lite fallback
        # (same as ci.yml). The probe requires repowise by default, hence the
        # explicit opt-out. Native since T3 (#48).
        run: code-intel doctor bootstrap --repo-path . --no-require-repowise

      - name: GitHub research contract tests
        shell: pwsh
        run: .\archive/scripts/tests/test-github-solution-research.ps1 -RepoPath .

      - name: Project discovery contract tests
        shell: pwsh
        run: .\archive/scripts/tests/test-project-discovery.ps1 -RepoPath .

      - name: Project management support contract tests
        shell: pwsh
        run: .\archive/scripts/tests/test-project-management-support.ps1 -RepoPath .

      - name: Skill development benchmark contract tests
        shell: pwsh
        run: .\archive/scripts/tests/test-skill-development-benchmark.ps1 -RepoPath .

      - name: Pipeline smoke
        shell: pwsh
        run: .\archive/scripts/tests/test-code-intel-pipeline.ps1 -RepoPath . -SkipRepowise -AllowGraphMissing -SkipSentruxGate -SkipGitHubResearch -Mode normal

      - name: Package
        shell: pwsh
        run: |
          $version = "${{ github.ref_name }}"
          # Package from `git archive HEAD`, not the working tree: earlier
          # steps (install, smoke) must never be able to mutate what ships.
          New-Item -ItemType Directory -Force dist\code-intel-pipeline\bin | Out-Null
          git archive --format=zip -o dist\payload.zip HEAD
          if ($LASTEXITCODE -ne 0) { throw "git archive failed" }
          Expand-Archive -LiteralPath dist\payload.zip -DestinationPath dist\code-intel-pipeline -Force
          Remove-Item dist\payload.zip
          Copy-Item -LiteralPath target\release\code-intel.exe -Destination dist\code-intel-pipeline\bin\code-intel.exe -Force
          $zip = "dist\code-intel-pipeline-$version-windows.zip"
          Compress-Archive -Path dist\code-intel-pipeline -DestinationPath $zip -Force
          $hash = (Get-FileHash -Algorithm SHA256 $zip).Hash.ToLowerInvariant()
          "$hash *$(Split-Path -Leaf $zip)" | Set-Content -Encoding ascii "$zip.sha256"
          $manifest = [ordered]@{
            schema = "code-intel-release-manifest.v1"
            tag = $version
            commit = (git rev-parse HEAD).Trim()
            zipSha256 = $hash
            toolchain = (rustc --version).Trim()
            builtAt = (Get-Date).ToUniversalTime().ToString("o")
          }
          $manifest | ConvertTo-Json | Set-Content -Encoding ascii "$zip.release-manifest.json"

      - name: Validate packaged Skill bootstrap
        shell: pwsh
        run: |
          $tag = "${{ github.ref_name }}"
          $asset = "dist\code-intel-pipeline-$tag-windows.zip"
          $expanded = Join-Path $env:RUNNER_TEMP "code-intel-release-layout"
          Expand-Archive -LiteralPath $asset -DestinationPath $expanded
          $payload = Join-Path $expanded "code-intel-pipeline"
          $required = @(
            (Join-Path $payload "archive/install-code-intel-pipeline.ps1"),
            (Join-Path $payload "archive/code-intel.ps1"),
            (Join-Path $payload "skills\code-intel-pipeline\SKILL.md"),
            (Join-Path $payload "skills\code-intel-pipeline\agents\openai.yaml"),
            (Join-Path $payload "skills\code-intel-pipeline\scripts\bootstrap.py"),
            (Join-Path $payload "bin\code-intel.exe")
          )
          foreach ($path in $required) {
            if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
              throw "Release package is missing required file: $path"
            }
          }
          python (Join-Path $payload "skills\code-intel-pipeline\scripts\bootstrap.py") --help
          # The packaged binary must pass its own structural gates against the
          # packaged payload: release green, self-scan green, and published
          # artifact green must refer to the same snapshot content.
          $packagedBinary = Join-Path $payload "bin\code-intel.exe"
          & $packagedBinary sentrux --operation check --repo $payload
          if ($LASTEXITCODE -ne 0) { throw "packaged binary failed its own structural check" }
          & $packagedBinary sentrux --operation gate --repo $payload
          if ($LASTEXITCODE -ne 0) { throw "packaged binary failed its own no-degradation gate" }

          # ai-safety-003 (issue #34): if the packaged snapshot carries an
          # audit report, it must pass the same fail-closed validate
          # pipeline against the packaged payload, using the packaged
          # binary -- release green, self-scan green, and published
          # artifact green must all refer to the same snapshot, and an
          # unvalidated audit report must never ride along as if it were
          # authoritative.
          $packagedReports = Get-ChildItem -LiteralPath $payload -Recurse -Filter "audit-report.json" -File -ErrorAction SilentlyContinue |
            Select-Object -ExpandProperty FullName
          foreach ($report in $packagedReports) {
            Write-Host "Validating packaged audit report: $report"
            & $packagedBinary audit --operation validate --repo $payload --report $report
            if ($LASTEXITCODE -ne 0) { throw "packaged audit report failed --operation validate: $report" }
          }

      - name: Upload release dist artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: release-dist-windows
          path: |
            dist/code-intel-pipeline-*-windows.zip
            dist/code-intel-pipeline-*-windows.zip.sha256
            dist/code-intel-pipeline-*-windows.zip.release-manifest.json
          if-no-files-found: error

  package-unix:
    # Platform build + package lane. The windows job above stays the
    # authoritative full gate; this lane still refuses to hand a package to
    # publish unless the candidate passes its own self-scan and the packaged
    # payload passes the same structural gates as the windows package.
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: macos
          - os: ubuntu-latest
            platform: linux

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.11"

      - name: Setup Rust
        shell: pwsh
        run: |
          rustup toolchain install
          rustup show active-toolchain

      - name: Install ripgrep
        shell: pwsh
        # Same recipe as ci.yml cross-platform-smoke. Homebrew has no
        # supported way to pin a formula version, so the macOS install is
        # unpinned; apt installs the distribution-pinned ripgrep.
        run: |
          if ($IsMacOS) {
            brew install ripgrep
          }
          else {
            sudo apt-get update
            sudo apt-get install -y ripgrep
          }

      - name: Build Rust CLI
        shell: pwsh
        run: cargo build -p code-intel --release --locked

      - name: Authoritative self-scan (release blocking)
        shell: pwsh
        run: |
          $staging = Join-Path $env:RUNNER_TEMP "code-intel-release-self-scan"
          $authority = Join-Path $env:RUNNER_TEMP "code-intel-release-self-authority"
          New-Item -ItemType Directory -Force $authority | Out-Null
          ./target/release/code-intel run execute --repo . --out $staging --authority-root $authority --final-name release-self-scan --manifest orchestration/integrations.json --doctor-require-repowise false
          if ($LASTEXITCODE -ne 0) {
            throw "release candidate failed its own scan (exit ${LASTEXITCODE}: 10 = architecture/domain gate failure, 70 = process failure). A failing self-scan must never publish."
          }

      - name: Package
        shell: pwsh
        run: |
          $version = "${{ github.ref_name }}"
          $platform = "${{ matrix.platform }}"
          # Package from `git archive HEAD`, not the working tree: earlier
          # steps must never be able to mutate what ships.
          New-Item -ItemType Directory -Force dist/code-intel-pipeline/bin | Out-Null
          git archive --format=zip -o dist/payload.zip HEAD
          if ($LASTEXITCODE -ne 0) { throw "git archive failed" }
          Expand-Archive -LiteralPath dist/payload.zip -DestinationPath dist/code-intel-pipeline -Force
          Remove-Item dist/payload.zip
          Copy-Item -LiteralPath target/release/code-intel -Destination dist/code-intel-pipeline/bin/code-intel -Force
          chmod 755 dist/code-intel-pipeline/bin/code-intel
          if ($LASTEXITCODE -ne 0) { throw "chmod failed with exit code ${LASTEXITCODE}" }
          # Compress-Archive does not store POSIX file modes; the system zip
          # binary records the executable bit in each entry's external
          # attributes so the packaged binary stays runnable after unzip.
          $zipLeaf = "code-intel-pipeline-$version-$platform.zip"
          Push-Location dist
          try {
            zip -r $zipLeaf code-intel-pipeline
            if ($LASTEXITCODE -ne 0) { throw "zip failed with exit code ${LASTEXITCODE}" }
          }
          finally {
            Pop-Location
          }
          $zip = "dist/$zipLeaf"
          $hash = (Get-FileHash -Algorithm SHA256 $zip).Hash.ToLowerInvariant()
          "$hash *$(Split-Path -Leaf $zip)" | Set-Content -Encoding ascii "$zip.sha256"
          $manifest = [ordered]@{
            schema = "code-intel-release-manifest.v1"
            tag = $version
            commit = (git rev-parse HEAD).Trim()
            zipSha256 = $hash
            toolchain = (rustc --version).Trim()
            builtAt = (Get-Date).ToUniversalTime().ToString("o")
          }
          $manifest | ConvertTo-Json | Set-Content -Encoding ascii "$zip.release-manifest.json"

      - name: Validate packaged Skill bootstrap
        shell: pwsh
        run: |
          $tag = "${{ github.ref_name }}"
          $platform = "${{ matrix.platform }}"
          $asset = "dist/code-intel-pipeline-$tag-$platform.zip"
          $expanded = Join-Path $env:RUNNER_TEMP "code-intel-release-layout"
          # Extract with the system unzip so POSIX modes are restored from
          # the archive; running the packaged binary below then proves the
          # executable bit survived the zip round trip.
          unzip -q $asset -d $expanded
          if ($LASTEXITCODE -ne 0) { throw "unzip failed with exit code ${LASTEXITCODE}" }
          $payload = Join-Path $expanded "code-intel-pipeline"
          $required = @(
            (Join-Path $payload "archive/install-code-intel-pipeline.ps1"),
            (Join-Path $payload "archive/code-intel.ps1"),
            (Join-Path $payload "skills/code-intel-pipeline/SKILL.md"),
            (Join-Path $payload "skills/code-intel-pipeline/agents/openai.yaml"),
            (Join-Path $payload "skills/code-intel-pipeline/scripts/bootstrap.py"),
            (Join-Path $payload "bin/code-intel")
          )
          foreach ($path in $required) {
            if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
              throw "Release package is missing required file: $path"
            }
          }
          python (Join-Path $payload "skills/code-intel-pipeline/scripts/bootstrap.py") --help
          $packagedBinary = Join-Path $payload "bin/code-intel"
          bash -c "test -x '$packagedBinary'"
          if ($LASTEXITCODE -ne 0) { throw "packaged binary lost its executable bit in the zip round trip: $packagedBinary" }
          # The packaged binary must pass its own structural gates against the
          # packaged payload: release green, self-scan green, and published
          # artifact green must refer to the same snapshot content.
          & $packagedBinary sentrux --operation check --repo $payload
          if ($LASTEXITCODE -ne 0) { throw "packaged binary failed its own structural check" }
          & $packagedBinary sentrux --operation gate --repo $payload
          if ($LASTEXITCODE -ne 0) { throw "packaged binary failed its own no-degradation gate" }

          # ai-safety-003 (issue #34): if the packaged snapshot carries an
          # audit report, it must pass the same fail-closed validate
          # pipeline against the packaged payload, using the packaged
          # binary -- same guarantee as the windows package validation.
          $packagedReports = Get-ChildItem -LiteralPath $payload -Recurse -Filter "audit-report.json" -File -ErrorAction SilentlyContinue |
            Select-Object -ExpandProperty FullName
          foreach ($report in $packagedReports) {
            Write-Host "Validating packaged audit report: $report"
            & $packagedBinary audit --operation validate --repo $payload --report $report
            if ($LASTEXITCODE -ne 0) { throw "packaged audit report failed --operation validate: $report" }
          }

      - name: Upload release dist artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: release-dist-${{ matrix.platform }}
          path: |
            dist/code-intel-pipeline-*-${{ matrix.platform }}.zip
            dist/code-intel-pipeline-*-${{ matrix.platform }}.zip.sha256
            dist/code-intel-pipeline-*-${{ matrix.platform }}.zip.release-manifest.json
          if-no-files-found: error

  publish:
    # Single release creator: every platform package must already have
    # passed its build, self-scan, and packaged-payload gates before this
    # job runs, and only this job holds a write-capable token.
    runs-on: ubuntu-latest
    needs:
      - release-windows
      - package-unix

    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Download release dist artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          pattern: "release-dist-*"
          path: dist
          merge-multiple: true

      - name: Verify release inventory
        shell: pwsh
        run: |
          $tag = "${{ github.ref_name }}"
          foreach ($platform in @("windows", "macos", "linux")) {
            $zip = "dist/code-intel-pipeline-$tag-$platform.zip"
            foreach ($path in @($zip, "$zip.sha256", "$zip.release-manifest.json")) {
              if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
                throw "Release asset is missing: $path -- a partial release must never publish."
              }
            }
            $hash = (Get-FileHash -Algorithm SHA256 $zip).Hash.ToLowerInvariant()
            $sidecar = (Get-Content -Raw -LiteralPath "$zip.sha256").Trim()
            $expected = "$hash *$(Split-Path -Leaf $zip)"
            if ($sidecar -cne $expected) {
              throw "Checksum sidecar mismatch for ${zip}: expected '$expected', found '$sidecar'."
            }
          }

      - name: Attest build provenance
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-path: "dist/code-intel-pipeline-*.zip"

      - name: Create GitHub Release
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
          # No checkout in this job; gh must be told the target repository.
          GH_REPO: ${{ github.repository }}
        run: |
          $tag = "${{ github.ref_name }}"
          $assets = @()
          foreach ($platform in @("windows", "macos", "linux")) {
            $asset = "dist/code-intel-pipeline-$tag-$platform.zip"
            $assets += @($asset, "$asset.sha256", "$asset.release-manifest.json")
          }
          gh release view $tag *> $null
          if ($LASTEXITCODE -eq 0) {
            # No --clobber: a leaked contents:write token must not be able to
            # silently replace already-published release assets with no CI
            # trail. If a re-run genuinely needs to replace assets for this
            # tag, delete them deliberately (gh release delete-asset) first.
            gh release upload $tag @assets
          }
          else {
            $notes = "Code Intel Pipeline $tag."
            if ($tag.Contains("-")) {
              $notes += " Pre-release build for integration testing before stable promotion."
            }
            else {
              $notes += " Stable release."
            }
            $releaseArgs = @(
              "--title", $tag,
              "--notes", $notes
            )
            if ($tag.Contains("-")) {
              $releaseArgs += "--prerelease"
            }
            gh release create $tag @assets @releaseArgs
          }