release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      skip_release:
        description: 'Build artifacts only (no GitHub release)'
        type: boolean
        default: true

env:
  PNPM_VERSION: '10.34.5'
  GO_VERSION: '1.26.6'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

# SR-007: least-privilege default for every job. Build jobs only need to read
# the repo + exchange artifacts. Jobs that publish override this with their
# own per-job `permissions:` (create-release → contents: write; GHCR pushes →
# packages: write; Tauri/MSI signing → id-token: write).
permissions:
  contents: read

jobs:
  build-api:
    name: Build API
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .node-version
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build API
        run: pnpm build --filter=@breeze/api

      - name: Upload API artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: api-dist
          path: apps/api/dist
          retention-days: 30

  build-web:
    name: Build Web
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .node-version
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: web-version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build Web
        env:
          PUBLIC_APP_VERSION: ${{ steps.web-version.outputs.version }}
        run: pnpm build --filter=@breeze/web

      - name: Upload Web artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: web-dist
          path: apps/web/dist
          retention-days: 30

  build-agent:
    name: Build Agent
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
            suffix: ''
            cgo: '0'
            runner: ubuntu-latest
          - goos: linux
            goarch: arm64
            suffix: ''
            cgo: '0'
            runner: ubuntu-latest
          - goos: darwin
            goarch: amd64
            suffix: ''
            cgo: '1'
            runner: macos-latest
          - goos: darwin
            goarch: arm64
            suffix: ''
            cgo: '1'
            runner: macos-latest
          - goos: windows
            goarch: amd64
            suffix: '.exe'
            cgo: '0'
            runner: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: agent/go.sum

      - name: Download Go dependencies
        working-directory: agent
        run: go mod download

      - name: Get version from tag
        id: version
        env:
          REF_NAME: ${{ github.ref_name }}
        run: echo "version=${REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build Agent
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: ${{ matrix.cgo }}
          BUILD_VERSION: ${{ steps.version.outputs.version }}
          # Allow weak-linking ScreenCaptureKit so the binary runs on macOS 12+
          # where SCK doesn't exist (prevents dyld Symbol not found crash)
          CGO_LDFLAGS_ALLOW: '-weak_framework|ScreenCaptureKit'
        run: |
          agent/scripts/build-edition.sh --edition self-host --component agent \
            --goos "$GOOS" --goarch "$GOARCH" --version "$BUILD_VERSION" \
            --out "breeze-agent-${GOOS}-${GOARCH}${{ matrix.suffix }}"

      - name: Upload Agent artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-agent-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
          retention-days: 30

      - name: Build breeze-backup
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: ${{ matrix.cgo }}
          BUILD_VERSION: ${{ steps.version.outputs.version }}
          CGO_LDFLAGS_ALLOW: '-weak_framework|ScreenCaptureKit'
        run: |
          agent/scripts/build-edition.sh --edition self-host --component backup \
            --goos "$GOOS" --goarch "$GOARCH" --version "$BUILD_VERSION" \
            --out "breeze-backup-${GOOS}-${GOARCH}${{ matrix.suffix }}"

      - name: Upload breeze-backup artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-backup-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-backup-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
          retention-days: 30

      - name: Build breeze-watchdog
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          agent/scripts/build-edition.sh --edition self-host --component watchdog \
            --goos "$GOOS" --goarch "$GOARCH" --version "$BUILD_VERSION" \
            --out "breeze-watchdog-${GOOS}-${GOARCH}${{ matrix.suffix }}"

      - name: Upload breeze-watchdog artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-watchdog-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-watchdog-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
          retention-days: 30

      - name: Build breeze-desktop-helper
        if: matrix.goos == 'darwin'
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: ${{ matrix.cgo }}
          BUILD_VERSION: ${{ steps.version.outputs.version }}
          CGO_LDFLAGS_ALLOW: '-weak_framework|ScreenCaptureKit'
        run: |
          agent/scripts/build-edition.sh --edition self-host --component desktop-helper \
            --goos "$GOOS" --goarch "$GOARCH" --version "$BUILD_VERSION" \
            --out "breeze-desktop-helper-${GOOS}-${GOARCH}"

      - name: Upload breeze-desktop-helper artifact
        if: matrix.goos == 'darwin'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-desktop-helper-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-desktop-helper-${{ matrix.goos }}-${{ matrix.goarch }}
          retention-days: 30

      # Regression guard (#2797): no shipped agent binary may contain
      # plaintext threat-signature strings — AV engines flag them as malware
      # (VT-confirmed Elastic Multi.EICAR on shipped exes). Scans every
      # breeze-* binary this matrix leg produced (agent/backup/watchdog, plus
      # desktop-helper on darwin); fails if the glob matches nothing so a
      # renamed output cannot silently skip the scan.
      - name: Scan built binaries for plaintext threat signatures (#2797)
        run: |
          shopt -s nullglob
          bins=(agent/breeze-*-${{ matrix.goos }}-${{ matrix.goarch }}*)
          if [ "${#bins[@]}" -eq 0 ]; then
            echo "no built agent binaries matched agent/breeze-*-${{ matrix.goos }}-${{ matrix.goarch }}* — refusing to pass a vacuous scan" >&2
            exit 1
          fi
          bash scripts/security/check-agent-binary-signatures.sh "${bins[@]}"

  build-windows-unsigned:
    name: Build Windows Agent Binaries (unsigned)
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    runs-on: windows-latest
    needs: [build-agent]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: agent/go.sum

      - name: Download Go dependencies
        working-directory: agent
        shell: pwsh
        run: go mod download

      - name: Get version from tag
        id: version
        shell: pwsh
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          $version = $env:REF_NAME.Substring(1)
          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Build Windows resources and binary
        shell: pwsh
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Fail-fast: a non-terminating PowerShell error (e.g. a missing
          # toolchain) otherwise lets a later `go build` proceed against
          # stale or missing resources, and a non-zero `go build` exit code
          # is silently ignored unless we check $LASTEXITCODE — that
          # combination shipped a release once where the agent .exe was
          # absent from dist\ and the installer step packaged whatever was
          # left from a previous run.
          $ErrorActionPreference = "Stop"
          New-Item -Path dist -ItemType Directory -Force | Out-Null
          go install github.com/tc-hib/go-winres@v0.3.3
          $winres = "$env:USERPROFILE\go\bin\go-winres.exe"
          # Embed VERSIONINFO + manifest + icon resources into every Windows
          # binary we ship. Without an embedded FileVersion, MSI treats our
          # exes as "unversioned" and applies the "preserve user-modified
          # unversioned files" rule, which surfaces in install.log as
          # `File: ...\breeze-agent.exe; Won't Overwrite` whenever an existing
          # binary at the install path has been modified (#944).
          #
          # We use `go-winres simply` (CLI args) rather than `make` + JSON
          # because .ico files work via --icon in simply mode but not in
          # JSON-mode RT_GROUP_ICON entries (go-winres v0.3.x rejects them
          # with "image: unknown format"). Each invocation is checked for
          # $LASTEXITCODE so a tooling failure aborts the release.
          Push-Location agent\resources
          & $winres simply --arch amd64 --no-suffix --icon icon.ico --admin `
            --file-version $env:BUILD_VERSION --product-version $env:BUILD_VERSION `
            --product-name "Breeze RMM Agent" --file-description "Breeze RMM Agent" `
            --copyright "Copyright (c) Breeze RMM" --original-filename "breeze-agent.exe" `
            --out ..\cmd\breeze-agent\rsrc_windows_amd64.syso
          if ($LASTEXITCODE -ne 0) { throw "go-winres simply breeze-agent failed with exit code $LASTEXITCODE" }
          # breeze-user-helper: asInvoker (NOT --admin). It is spawned into the
          # logged-in user's session with that user's filtered token; an admin
          # manifest makes CreateProcessAsUser fail ERROR_ELEVATION_REQUIRED
          # (#949 regression). Keeps VERSIONINFO for the #944 MSI overwrite rule.
          & $winres simply --arch amd64 --no-suffix --icon icon.ico `
            --file-version $env:BUILD_VERSION --product-version $env:BUILD_VERSION `
            --product-name "Breeze RMM User Helper" --file-description "Breeze RMM User Helper" `
            --copyright "Copyright (c) Breeze RMM" --original-filename "breeze-user-helper.exe" `
            --out ..\cmd\breeze-user-helper\rsrc_windows_amd64.syso
          if ($LASTEXITCODE -ne 0) { throw "go-winres simply breeze-user-helper failed with exit code $LASTEXITCODE" }
          & $winres simply --arch amd64 --no-suffix --icon icon.ico `
            --file-version $env:BUILD_VERSION --product-version $env:BUILD_VERSION `
            --product-name "Breeze RMM Watchdog" --file-description "Breeze RMM Watchdog" `
            --copyright "Copyright (c) Breeze RMM" --original-filename "breeze-watchdog.exe" `
            --out ..\cmd\breeze-watchdog\rsrc_windows_amd64.syso
          if ($LASTEXITCODE -ne 0) { throw "go-winres simply breeze-watchdog failed with exit code $LASTEXITCODE" }
          & $winres simply --arch amd64 --no-suffix --icon icon.ico `
            --file-version $env:BUILD_VERSION --product-version $env:BUILD_VERSION `
            --product-name "Breeze RMM Backup Helper" --file-description "Breeze RMM Backup Helper" `
            --copyright "Copyright (c) Breeze RMM" --original-filename "breeze-backup.exe" `
            --out ..\cmd\breeze-backup\rsrc_windows_amd64.syso
          if ($LASTEXITCODE -ne 0) { throw "go-winres simply breeze-backup failed with exit code $LASTEXITCODE" }
          & $winres simply --arch amd64 --no-suffix --manifest gui --icon icon.ico `
            --file-version $env:BUILD_VERSION --product-version $env:BUILD_VERSION `
            --product-name "Breeze RMM Desktop Helper" --file-description "Breeze RMM Desktop Helper" `
            --copyright "Copyright (c) Breeze RMM" --original-filename "breeze-desktop-helper.exe" `
            --out ..\cmd\breeze-desktop-helper\rsrc_windows_amd64.syso
          if ($LASTEXITCODE -ne 0) { throw "go-winres simply breeze-desktop-helper failed with exit code $LASTEXITCODE" }
          Pop-Location
          # All four exes below route through agent/scripts/build-edition.sh
          # (invoked via git-bash, which windows-latest runners provide) so
          # the self-host/hosted edition rules are enforced in one place
          # rather than reimplemented per go-build call site. --edition
          # self-host here is what makes this the public, unrestricted build
          # (agent/internal/hostpolicy stays inert; see the script's header).
          bash agent/scripts/build-edition.sh --edition self-host --component agent --goos windows --goarch amd64 --version $env:BUILD_VERSION --out ../dist/breeze-agent-windows-amd64.exe
          if ($LASTEXITCODE -ne 0) { throw "build-edition.sh (agent) failed with exit code $LASTEXITCODE" }
          # Build breeze-backup
          bash agent/scripts/build-edition.sh --edition self-host --component backup --goos windows --goarch amd64 --version $env:BUILD_VERSION --out ../dist/breeze-backup-windows-amd64.exe
          if ($LASTEXITCODE -ne 0) { throw "build-edition.sh (backup) failed with exit code $LASTEXITCODE" }
          # Build breeze-watchdog
          bash agent/scripts/build-edition.sh --edition self-host --component watchdog --goos windows --goarch amd64 --version $env:BUILD_VERSION --out ../dist/breeze-watchdog-windows-amd64.exe
          if ($LASTEXITCODE -ne 0) { throw "build-edition.sh (watchdog) failed with exit code $LASTEXITCODE" }
          # Build breeze-user-helper (GUI-subsystem sibling of breeze-agent).
          # Thin cmd/breeze-user-helper wrapper over the same internal/agentapp
          # code as breeze-agent — only the -H windowsgui linker flag and the
          # embedded asInvoker manifest differ. The separate cmd package is what
          # lets it ship asInvoker instead of the agent's requireAdministrator.
          # Required by the AgentUserHelper scheduled task and the sessionbroker
          # user-session spawn path (which uses the user's non-elevated token).
          bash agent/scripts/build-edition.sh --edition self-host --component user-helper --goos windows --goarch amd64 --version $env:BUILD_VERSION --windowsgui --out ../dist/breeze-user-helper-windows-amd64.exe
          if ($LASTEXITCODE -ne 0) { throw "build-edition.sh (user-helper) failed with exit code $LASTEXITCODE" }
          # Regression guard (#949): assert the SHIPPED manifests are correct.
          # The user-helper MUST be asInvoker and the agent MUST be
          # requireAdministrator — and the inverse for each, since #949 is a
          # bidirectional regression (user-helper gaining admin OR agent losing
          # it both break). Read via .NET ReadAllBytes (Get-Content -Encoding
          # Byte was removed in pwsh 7) and scan the exe's ASCII projection. cwd
          # is the repo root here (the builds above Push-Location'd into agent
          # and wrote ..\dist), so dist\ resolves at the repo root. The regexes
          # are quote/spacing/attribute-order tolerant so a benign go-winres
          # formatting change can't silently flip the guard.
          $uhText = [System.Text.Encoding]::ASCII.GetString([System.IO.File]::ReadAllBytes((Resolve-Path "dist\breeze-user-helper-windows-amd64.exe").Path))
          if ($uhText -notmatch 'requestedExecutionLevel[^>]*level\s*=\s*["'']asInvoker') { throw "breeze-user-helper.exe is not asInvoker — would reintroduce #949 (740 on filtered-token sessions)" }
          if ($uhText -match 'level\s*=\s*["'']requireAdministrator') { throw "breeze-user-helper.exe is requireAdministrator — wrong manifest (#949)" }
          $agText = [System.Text.Encoding]::ASCII.GetString([System.IO.File]::ReadAllBytes((Resolve-Path "dist\breeze-agent-windows-amd64.exe").Path))
          if ($agText -notmatch 'requestedExecutionLevel[^>]*level\s*=\s*["'']requireAdministrator') { throw "breeze-agent.exe lost its requireAdministrator manifest" }
          if ($agText -match 'level\s*=\s*["'']asInvoker') { throw "breeze-agent.exe is asInvoker — lost its requireAdministrator manifest (#949)" }
          Write-Host "Manifest guard OK: user-helper=asInvoker, agent=requireAdministrator"

      # Regression guard (#2797): the exes packaged into the MSI must not
      # contain plaintext threat-signature strings — AV engines flag them as
      # malware (VT-confirmed Elastic Multi.EICAR on shipped exes). git-bash
      # on the windows runner provides bash + grep. Scans every dist/breeze-*.exe
      # via glob (like the build-agent scan) instead of a hardcoded path list,
      # so a renamed build output cannot silently dodge the scan; also fails if
      # fewer than the four expected exes (agent, backup, watchdog, user-helper)
      # are present.
      - name: Scan Windows binaries for plaintext threat signatures (#2797)
        shell: bash
        run: |
          shopt -s nullglob
          bins=(dist/breeze-*.exe)
          if [ "${#bins[@]}" -eq 0 ]; then
            echo "no built Windows exes matched dist/breeze-*.exe — refusing to pass a vacuous scan" >&2
            exit 1
          fi
          if [ "${#bins[@]}" -lt 4 ]; then
            echo "only ${#bins[@]} exe(s) matched dist/breeze-*.exe, expected at least 4 (agent, backup, watchdog, user-helper) — a build output was renamed or dropped" >&2
            exit 1
          fi
          bash scripts/security/check-agent-binary-signatures.sh "${bins[@]}"

      # Publish these go-winres-resourced exes (VERSIONINFO, icon, the #949
      # asInvoker/requireAdministrator manifests) under their canonical
      # (non "-unsigned") artifact names. This job's overwrite:true wins over
      # build-agent's earlier, unresourced windows/amd64 matrix-leg upload of
      # the same artifact names — the public pipeline no longer signs these,
      # but the canonical filenames must still carry the resourced build,
      # since the agent's own Windows auto-updater fetches
      # breeze-agent-windows-amd64.exe (and its siblings) by that exact name
      # from the GitHub release (agent/internal/updater/updater.go).
      - name: Upload agent EXE artifact (canonical name)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-windows-amd64
          path: dist/breeze-agent-windows-amd64.exe
          overwrite: true
          retention-days: 30

      - name: Upload backup EXE artifact (canonical name)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-backup-windows-amd64
          path: dist/breeze-backup-windows-amd64.exe
          overwrite: true
          retention-days: 30

      - name: Upload watchdog EXE artifact (canonical name)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-watchdog-windows-amd64
          path: dist/breeze-watchdog-windows-amd64.exe
          overwrite: true
          retention-days: 30

      # Issue #816: ship the user-helper as a discrete GitHub release asset so
      # the agent's in-place auto-upgrade can fetch it directly.
      - name: Upload user-helper EXE artifact (canonical name)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-user-helper-windows-amd64
          path: dist/breeze-user-helper-windows-amd64.exe
          overwrite: true
          retention-days: 30

      - name: Stage unsigned Windows exes (BYO signing inputs)
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          New-Item -Path dist-unsigned -ItemType Directory -Force | Out-Null
          foreach ($component in @("agent", "backup", "watchdog", "user-helper")) {
            $src = "dist\breeze-$component-windows-amd64.exe"
            if (-not (Test-Path $src)) { throw "missing expected build output: $src" }
            Copy-Item $src "dist-unsigned\breeze-$component-windows-amd64-unsigned.exe"
          }

      - name: Upload unsigned agent EXE artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-windows-amd64-unsigned
          path: dist-unsigned/breeze-agent-windows-amd64-unsigned.exe
          retention-days: 30

      - name: Upload unsigned backup EXE artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-backup-windows-amd64-unsigned
          path: dist-unsigned/breeze-backup-windows-amd64-unsigned.exe
          retention-days: 30

      - name: Upload unsigned watchdog EXE artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-watchdog-windows-amd64-unsigned
          path: dist-unsigned/breeze-watchdog-windows-amd64-unsigned.exe
          retention-days: 30

      - name: Upload unsigned user-helper EXE artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-user-helper-windows-amd64-unsigned
          path: dist-unsigned/breeze-user-helper-windows-amd64-unsigned.exe
          retention-days: 30

      # The public release no longer Authenticode-signs the agent MSI (see
      # the removed build-windows-msi job). This publishes the self-host
      # edition MSI unsigned, built from the exact exes staged above.
      - name: Setup .NET SDK
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          dotnet-version: '8.0.x'

      - name: Install WiX CLI
        shell: pwsh
        run: |
          dotnet tool update --global wix | Out-Null
          if ($LASTEXITCODE -ne 0) {
            dotnet tool install --global wix | Out-Null
          }
          "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          wix eula accept wix7

      - name: Build unsigned self-host MSI
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $root = $env:GITHUB_WORKSPACE
          $version = "${{ steps.version.outputs.version }}"
          $agentExe = Join-Path $root "dist\breeze-agent-windows-amd64.exe"
          $backupExe = Join-Path $root "dist\breeze-backup-windows-amd64.exe"
          $watchdogExe = Join-Path $root "dist\breeze-watchdog-windows-amd64.exe"
          $userHelperExe = Join-Path $root "dist\breeze-user-helper-windows-amd64.exe"
          $msiPath = Join-Path $root "dist\breeze-agent.msi"
          & (Join-Path $root "agent\installer\build-msi.ps1") -Edition SelfHost -Version $version -AgentExePath $agentExe -BackupExePath $backupExe -WatchdogExePath $watchdogExe -UserHelperExePath $userHelperExe -OutputPath $msiPath
          if ($LASTEXITCODE -ne 0) { throw "build-msi.ps1 (SelfHost) failed with exit code $LASTEXITCODE" }

      - name: Upload unsigned self-host Windows MSI artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-windows-msi
          path: dist/breeze-agent.msi
          retention-days: 30

  build-macos-agent:
    name: Sign macOS Agent Binary
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    runs-on: macos-latest
    needs: [build-agent]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Download darwin/amd64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-agent-darwin-amd64
          path: staging/

      - name: Download darwin/arm64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-agent-darwin-arm64
          path: staging/

      - name: Download backup darwin/amd64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-backup-darwin-amd64
          path: staging/

      - name: Download backup darwin/arm64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-backup-darwin-arm64
          path: staging/

      - name: Download desktop-helper darwin/amd64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-desktop-helper-darwin-amd64
          path: staging/

      - name: Download desktop-helper darwin/arm64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-desktop-helper-darwin-arm64
          path: staging/

      - name: Download watchdog darwin/amd64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-watchdog-darwin-amd64
          path: staging/

      - name: Download watchdog darwin/arm64 artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-watchdog-darwin-arm64
          path: staging/

      # BYO signing (Deliverable 1): capture the exact pre-sign inputs. The
      # sign step below mutates staging/ in place, so this MUST run before
      # any codesign invocation. Deliberately not gated on
      # vars.ENABLE_MACOS_SIGNING — unsigned publication is independent of
      # the signing toggle.
      - name: Stage unsigned darwin binaries (BYO signing inputs)
        run: |
          set -euo pipefail
          mkdir -p staging-unsigned
          count=0
          for bin in staging/breeze-agent-darwin-amd64 staging/breeze-agent-darwin-arm64 \
                     staging/breeze-backup-darwin-amd64 staging/breeze-backup-darwin-arm64 \
                     staging/breeze-desktop-helper-darwin-amd64 staging/breeze-desktop-helper-darwin-arm64 \
                     staging/breeze-watchdog-darwin-amd64 staging/breeze-watchdog-darwin-arm64; do
            if [ ! -f "$bin" ]; then
              echo "::error::missing expected darwin binary for unsigned capture: $bin"
              exit 1
            fi
            cp "$bin" "staging-unsigned/$(basename "$bin")-unsigned"
            count=$((count + 1))
          done
          if [ "$count" -ne 8 ]; then
            echo "::error::expected 8 unsigned darwin binaries, staged $count"
            exit 1
          fi

      - name: Upload unsigned agent darwin binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-darwin-unsigned
          path: staging-unsigned/breeze-agent-darwin-*-unsigned
          retention-days: 30

      - name: Upload unsigned backup darwin binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-backup-darwin-unsigned
          path: staging-unsigned/breeze-backup-darwin-*-unsigned
          retention-days: 30

      - name: Upload unsigned desktop-helper darwin binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-desktop-helper-darwin-unsigned
          path: staging-unsigned/breeze-desktop-helper-darwin-*-unsigned
          retention-days: 30

      - name: Upload unsigned watchdog darwin binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-watchdog-darwin-unsigned
          path: staging-unsigned/breeze-watchdog-darwin-*-unsigned
          retention-days: 30

      - name: Import certificate into keychain
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          CERT_PATH="$RUNNER_TEMP/cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"

          echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" \
            $(security list-keychains -d user | tr -d '"')

          rm -f "$CERT_PATH"

      - name: Sign binaries
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          for bin in staging/breeze-agent-darwin-* staging/breeze-backup-darwin-* staging/breeze-desktop-helper-darwin-* staging/breeze-watchdog-darwin-*; do
            [ -f "$bin" ] || continue
            codesign --force --options runtime \
              --entitlements agent/entitlements/agent-macos.entitlements.plist \
              --sign "$APPLE_SIGNING_IDENTITY" --timestamp "$bin"
            codesign --verify --verbose "$bin"
            echo "Signed: $bin"
          done

      - name: Notarize binaries
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          for bin in staging/breeze-agent-darwin-* staging/breeze-backup-darwin-* staging/breeze-desktop-helper-darwin-* staging/breeze-watchdog-darwin-*; do
            [ -f "$bin" ] || continue
            case "$bin" in *.pkg|*.zip) continue ;; esac
            ZIP_PATH="${bin}.zip"
            ditto -c -k --keepParent "$bin" "$ZIP_PATH"

            scripts/release/notarize-submit.sh "$ZIP_PATH"

            rm -f "$ZIP_PATH"
          done

      - name: Upload signed darwin/amd64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-darwin-amd64
          path: staging/breeze-agent-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed darwin/arm64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-darwin-arm64
          path: staging/breeze-agent-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Upload signed backup darwin/amd64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-backup-darwin-amd64
          path: staging/breeze-backup-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed backup darwin/arm64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-backup-darwin-arm64
          path: staging/breeze-backup-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Upload signed desktop-helper darwin/amd64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-desktop-helper-darwin-amd64
          path: staging/breeze-desktop-helper-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed desktop-helper darwin/arm64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-desktop-helper-darwin-arm64
          path: staging/breeze-desktop-helper-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Upload signed watchdog darwin/amd64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-watchdog-darwin-amd64
          path: staging/breeze-watchdog-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed watchdog darwin/arm64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-watchdog-darwin-arm64
          path: staging/breeze-watchdog-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Build macOS .pkg installers
        env:
          BUILD_VERSION: ${{ github.ref_name }}
        run: |
          VERSION="${BUILD_VERSION#v}"
          chmod +x agent/installer/macos/build-pkg.sh
          for arch in amd64 arm64; do
            agent/installer/macos/build-pkg.sh \
              "staging/breeze-agent-darwin-${arch}" \
              "staging/breeze-desktop-helper-darwin-${arch}" \
              "staging/breeze-backup-darwin-${arch}" \
              "staging/breeze-watchdog-darwin-${arch}" \
              "$VERSION" \
              "$arch" \
              "staging/breeze-agent-darwin-${arch}.pkg"
          done

      - name: Sign .pkg installers
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_INSTALLER_IDENTITY: ${{ secrets.APPLE_INSTALLER_IDENTITY }}
        run: |
          if [ -z "$APPLE_INSTALLER_IDENTITY" ]; then
            if [[ "$GITHUB_REF" == refs/tags/* ]]; then
              echo "::error::APPLE_INSTALLER_IDENTITY required for tag releases (productsign would silently skip, shipping unsigned .pkgs that fail downstream Installer.app notarization)"
              exit 1
            fi
            echo "APPLE_INSTALLER_IDENTITY not set, skipping .pkg signing (non-tag build)"
            exit 0
          fi
          for pkg in staging/*.pkg; do
            SIGNED="${pkg%.pkg}-signed.pkg"
            productsign --sign "$APPLE_INSTALLER_IDENTITY" "$pkg" "$SIGNED"
            mv "$SIGNED" "$pkg"
            echo "Signed: $(basename "$pkg")"
          done

      - name: Notarize and staple .pkg installers
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_INSTALLER_IDENTITY: ${{ secrets.APPLE_INSTALLER_IDENTITY }}
        run: |
          if [ -z "$APPLE_INSTALLER_IDENTITY" ]; then
            if [[ "$GITHUB_REF" == refs/tags/* ]]; then
              echo "::error::APPLE_INSTALLER_IDENTITY required for tag releases (.pkgs would skip notarization and fail downstream Installer.app notarization)"
              exit 1
            fi
            echo "APPLE_INSTALLER_IDENTITY not set, skipping .pkg notarization (non-tag build)"
            exit 0
          fi
          for pkg in staging/*.pkg; do
            scripts/release/notarize-submit.sh "$pkg"
            xcrun stapler staple "$pkg"
            xcrun stapler validate "$pkg"
            echo "Notarized and stapled: $(basename "$pkg")"
          done

      - name: Verify macOS signatures and notarization
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          if [ "${{ vars.ENABLE_MACOS_SIGNING }}" != "true" ]; then
            echo "::error::ENABLE_MACOS_SIGNING must be true for tag releases."
            exit 1
          fi

          # Raw Mach-O binaries: verify signature + hardened runtime + Developer ID.
          # Do NOT run `spctl -a -t exec` against raw command-line binaries — Gatekeeper's
          # exec assessment is bundle-aware and rejects raw Mach-O with "the code is valid
          # but does not seem to be an app", even when signing/notarization are correct.
          # The user-facing assessment happens at the .pkg layer below (binaries are
          # delivered to end users only inside notarized .pkgs).
          for bin in staging/breeze-agent-darwin-* staging/breeze-backup-darwin-* staging/breeze-desktop-helper-darwin-* staging/breeze-watchdog-darwin-*; do
            [ -f "$bin" ] || continue
            # The prefix glob also matches .pkg / .zip files in staging at this
            # point in the workflow — skip them (.pkg uses productsign, .zip is
            # the notarytool upload artifact). The .pkg loop below verifies them.
            case "$bin" in *.pkg|*.zip) continue ;; esac
            codesign --verify --strict --verbose=2 "$bin"
            DETAILS=$(codesign -dvvv "$bin" 2>&1)
            if ! grep -q 'flags=.*runtime' <<<"$DETAILS"; then
              echo "::error::$bin missing hardened runtime flag"
              echo "$DETAILS"
              exit 1
            fi
            if ! grep -q 'Authority=Developer ID Application' <<<"$DETAILS"; then
              echo "::error::$bin not signed by Developer ID Application"
              echo "$DETAILS"
              exit 1
            fi
          done

          for pkg in staging/*.pkg; do
            [ -f "$pkg" ] || continue
            pkgutil --check-signature "$pkg"
            xcrun stapler validate "$pkg"
            spctl -a -vv -t install "$pkg"
          done

      - name: Upload .pkg darwin/amd64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-darwin-amd64-pkg
          path: staging/breeze-agent-darwin-amd64.pkg
          retention-days: 30

      - name: Upload .pkg darwin/arm64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-agent-darwin-arm64-pkg
          path: staging/breeze-agent-darwin-arm64.pkg
          retention-days: 30

      - name: Cleanup keychain
        if: always() && vars.ENABLE_MACOS_SIGNING == 'true'
        run: security delete-keychain "$RUNNER_TEMP/signing.keychain-db" || true

  build-macos-installer-app:
    name: Build macOS Installer App
    needs: [build-macos-agent]
    runs-on: macos-latest
    if: >-
      vars.ENABLE_MACOS_SIGNING == 'true'
      && github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Download .pkg darwin/amd64
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-agent-darwin-amd64-pkg
          path: installer-pkgs/

      - name: Download .pkg darwin/arm64
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-agent-darwin-arm64-pkg
          path: installer-pkgs/

      - name: Import certificate into keychain
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          CERT_PATH="$RUNNER_TEMP/cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"

          echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" \
            $(security list-keychains -d user | tr -d '"')

          rm -f "$CERT_PATH"

      - name: Build .app bundle
        run: |
          chmod +x agent/installer/macos-app/build-app-bundle.sh
          agent/installer/macos-app/build-app-bundle.sh \
            --pkg-amd64 installer-pkgs/breeze-agent-darwin-amd64.pkg \
            --pkg-arm64 installer-pkgs/breeze-agent-darwin-arm64.pkg \
            --output "build/Breeze Installer.app"

      - name: Sign .app
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign --force --options runtime \
            --entitlements agent/installer/macos-app/entitlements.plist \
            --sign "$APPLE_SIGNING_IDENTITY" --timestamp \
            --deep "build/Breeze Installer.app"
          codesign --verify --verbose=2 "build/Breeze Installer.app"

      - name: Notarize + staple
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          ditto -c -k --keepParent "build/Breeze Installer.app" build/installer-notarize.zip
          scripts/release/notarize-submit.sh build/installer-notarize.zip
          xcrun stapler staple "build/Breeze Installer.app"
          xcrun stapler validate "build/Breeze Installer.app"
          spctl -a -t exec -vv "build/Breeze Installer.app"

      - name: Package for release
        run: |
          ditto -c -k --sequesterRsrc --keepParent \
            "build/Breeze Installer.app" \
            "build/Breeze Installer.app.zip"
          ls -lh build/

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-installer-app
          path: build/Breeze Installer.app.zip
          retention-days: 30

      - name: Cleanup keychain
        if: always()
        run: security delete-keychain "$RUNNER_TEMP/signing.keychain-db" || true

  build-viewer:
    name: Build Viewer
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
            asset_name: breeze-viewer-windows.msi
            asset_glob: 'src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi'
          - platform: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            asset_name: breeze-viewer-linux.AppImage
            asset_glob: 'src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage'
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install Linux dependencies
        if: contains(matrix.platform, 'ubuntu')
        run: |
          # Harden against a degraded Azure apt mirror (same flake as #1605):
          # rewrite to the canonical mirror and retry update+install with
          # backoff so a transient hiccup doesn't fail the release build.
          sudo sed -i 's|azure.archive.ubuntu.com|archive.ubuntu.com|g' \
            /etc/apt/sources.list \
            /etc/apt/sources.list.d/*.list \
            /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          install_deps() {
            sudo apt-get update && \
            sudo apt-get install -y --no-install-recommends \
              libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          }
          for attempt in 1 2 3; do
            if install_deps; then
              echo "Linux dependencies installed (attempt ${attempt})."
              exit 0
            fi
            echo "::warning::apt install failed (attempt ${attempt}/3); retrying in $((attempt * 15))s"
            sleep $((attempt * 15))
          done
          echo "::error::Failed to install Linux dependencies after 3 attempts."
          exit 1

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .node-version
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Rust cache
        uses: swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
        with:
          workspaces: apps/viewer/src-tauri -> target

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into viewer config
        shell: bash
        working-directory: apps/viewer
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          # Update tauri.conf.json — match any semver version string
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update window title to include version
          sed -i.bak 's/"title": "Breeze Remote Desktop"/"title": "Breeze Remote Desktop '"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update Cargo.toml
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          # Update package.json
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into viewer config files (from $BUILD_VERSION)"

      - name: Validate signing key
        shell: bash
        run: |
          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
            echo "::error::TAURI_SIGNING_PRIVATE_KEY secret is not set — update signing will fail"
            exit 1
          fi
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}

      - name: Build Tauri app
        working-directory: apps/viewer
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: pnpm tauri build --target ${{ matrix.target }}

      - name: Find and rename artifact
        id: find_asset
        shell: bash
        working-directory: apps/viewer
        run: |
          asset=$(ls ${{ matrix.asset_glob }} 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No asset found matching ${{ matrix.asset_glob }}"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" "${{ matrix.asset_name }}"
          echo "path=${{ matrix.asset_name }}" >> "$GITHUB_OUTPUT"

      - name: Package updater bundle (Linux)
        if: matrix.platform == 'ubuntu-22.04'
        shell: bash
        working-directory: apps/viewer
        run: |
          bundle_dir="src-tauri/target/${{ matrix.target }}/release/bundle/appimage"
          appimage=$(ls "$bundle_dir"/*.AppImage 2>/dev/null | grep -v '\.sig$' | grep -v '\.tar\.gz' | head -1)
          sig_file=$(ls "$bundle_dir"/*.AppImage.sig 2>/dev/null | head -1)
          if [ -z "$appimage" ] || [ -z "$sig_file" ]; then
            echo "ERROR: Updater bundle not found in $bundle_dir"
            ls -la "$bundle_dir" || true
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$appimage" breeze-viewer-linux.AppImage
          cp "$sig_file" breeze-viewer-linux.AppImage.sig

      - name: Upload Viewer artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ matrix.asset_name }}
          path: apps/viewer/${{ matrix.asset_name }}
          retention-days: 30

      - name: Upload Viewer Linux updater bundle
        if: matrix.platform == 'ubuntu-22.04'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-viewer-linux-updater
          path: |
            apps/viewer/breeze-viewer-linux.AppImage
            apps/viewer/breeze-viewer-linux.AppImage.sig
          retention-days: 30

  build-helper:
    name: Build Helper
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
            asset_name: breeze-helper-windows.msi
            asset_glob: 'src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi'
          - platform: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            asset_name: breeze-helper-linux.AppImage
            asset_glob: 'src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage'
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install Linux dependencies
        if: contains(matrix.platform, 'ubuntu')
        run: |
          # Harden against a degraded Azure apt mirror (same flake as #1605):
          # rewrite to the canonical mirror and retry update+install with
          # backoff so a transient hiccup doesn't fail the release build.
          sudo sed -i 's|azure.archive.ubuntu.com|archive.ubuntu.com|g' \
            /etc/apt/sources.list \
            /etc/apt/sources.list.d/*.list \
            /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          install_deps() {
            sudo apt-get update && \
            sudo apt-get install -y --no-install-recommends \
              libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          }
          for attempt in 1 2 3; do
            if install_deps; then
              echo "Linux dependencies installed (attempt ${attempt})."
              exit 0
            fi
            echo "::warning::apt install failed (attempt ${attempt}/3); retrying in $((attempt * 15))s"
            sleep $((attempt * 15))
          done
          echo "::error::Failed to install Linux dependencies after 3 attempts."
          exit 1

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .node-version
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Rust cache
        uses: swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
        with:
          workspaces: apps/helper/src-tauri -> target

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into helper config
        shell: bash
        working-directory: apps/helper
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          # Update tauri.conf.json — match any semver version string
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update window title to include version
          sed -i.bak 's/"title": "Breeze Remote Desktop"/"title": "Breeze Remote Desktop '"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update Cargo.toml
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          # Update package.json
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into helper config files (from $BUILD_VERSION)"

      - name: Build Tauri app
        working-directory: apps/helper
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ''
        run: pnpm tauri build --target ${{ matrix.target }}

      - name: Find and rename artifact
        id: find_asset
        shell: bash
        working-directory: apps/helper
        run: |
          asset=$(ls ${{ matrix.asset_glob }} 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No asset found matching ${{ matrix.asset_glob }}"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" "${{ matrix.asset_name }}"
          echo "path=${{ matrix.asset_name }}" >> "$GITHUB_OUTPUT"

      - name: Upload Helper artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ matrix.asset_name }}
          path: apps/helper/${{ matrix.asset_name }}
          retention-days: 30

  build-viewer-macos:
    name: Build Viewer (macOS)
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .node-version
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Rust cache
        uses: swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
        with:
          workspaces: apps/viewer/src-tauri -> target

      - name: Add macOS universal target
        run: |
          rustup target add aarch64-apple-darwin
          rustup target add x86_64-apple-darwin

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into viewer config
        shell: bash
        working-directory: apps/viewer
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into viewer config files (from $BUILD_VERSION)"

      - name: Validate signing key
        shell: bash
        run: |
          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
            echo "::error::TAURI_SIGNING_PRIVATE_KEY secret is not set — update signing will fail"
            exit 1
          fi
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}

      - name: Build Tauri app
        working-directory: apps/viewer
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: pnpm tauri build --target universal-apple-darwin

      - name: Find and rename artifact
        shell: bash
        working-directory: apps/viewer
        run: |
          asset=$(ls src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No DMG found"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" breeze-viewer-macos.dmg

      - name: Notarize and staple DMG
        shell: bash
        working-directory: apps/viewer
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          "$GITHUB_WORKSPACE/scripts/release/notarize-submit.sh" breeze-viewer-macos.dmg
          xcrun stapler staple breeze-viewer-macos.dmg
          xcrun stapler validate breeze-viewer-macos.dmg

      - name: Package updater bundle (macOS)
        shell: bash
        working-directory: apps/viewer
        run: |
          bundle_dir="src-tauri/target/universal-apple-darwin/release/bundle/macos"
          tar_gz=$(ls "$bundle_dir"/*.app.tar.gz 2>/dev/null | head -1)
          sig_file=$(ls "$bundle_dir"/*.app.tar.gz.sig 2>/dev/null | head -1)
          if [ -z "$tar_gz" ] || [ -z "$sig_file" ]; then
            echo "ERROR: Updater bundle not found in $bundle_dir"
            ls -la "$bundle_dir" || true
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$tar_gz" breeze-viewer-macos.app.tar.gz
          cp "$sig_file" breeze-viewer-macos.app.tar.gz.sig

      - name: Upload Viewer macOS artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-viewer-macos.dmg
          path: apps/viewer/breeze-viewer-macos.dmg
          retention-days: 30

      - name: Upload Viewer macOS updater bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-viewer-macos-updater
          path: |
            apps/viewer/breeze-viewer-macos.app.tar.gz
            apps/viewer/breeze-viewer-macos.app.tar.gz.sig
          retention-days: 30

  build-helper-macos:
    name: Build Helper (macOS)
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .node-version
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Rust cache
        uses: swatinem/rust-cache@a45951ff880207c249adf57334cf2e9bd81d6e1e # v2
        with:
          workspaces: apps/helper/src-tauri -> target

      - name: Add macOS universal target
        run: |
          rustup target add aarch64-apple-darwin
          rustup target add x86_64-apple-darwin

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into helper config
        shell: bash
        working-directory: apps/helper
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into helper config files (from $BUILD_VERSION)"

      - name: Build Tauri app
        working-directory: apps/helper
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ''
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: pnpm tauri build --target universal-apple-darwin

      - name: Find and rename artifact
        shell: bash
        working-directory: apps/helper
        run: |
          asset=$(ls src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No DMG found"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" breeze-helper-macos.dmg

      - name: Notarize and staple DMG
        shell: bash
        working-directory: apps/helper
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          "$GITHUB_WORKSPACE/scripts/release/notarize-submit.sh" breeze-helper-macos.dmg
          xcrun stapler staple breeze-helper-macos.dmg
          xcrun stapler validate breeze-helper-macos.dmg

      - name: Upload Helper macOS artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-helper-macos.dmg
          path: apps/helper/breeze-helper-macos.dmg
          retention-days: 30

  sign-windows-tauri:
    name: Sign Windows Tauri Artifacts
    if: >-
      vars.ENABLE_WINDOWS_SIGNING == 'true'
      && github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    runs-on: windows-latest
    needs: [build-viewer, build-helper]
    permissions:
      contents: read
      id-token: write
    environment:
      name: ${{ contains(github.ref_name, '-') && 'signing-prerelease' || 'signing-production' }}
    steps:
      - name: Download viewer Windows MSI
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-viewer-windows.msi
          path: staging/

      - name: Download helper Windows MSI
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-helper-windows.msi
          path: staging/

      - name: Validate signing configuration
        shell: pwsh
        env:
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          AZURE_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
        run: |
          $required = @("AZURE_CLIENT_ID", "AZURE_TENANT_ID", "AZURE_SIGNING_ENDPOINT", "AZURE_SIGNING_ACCOUNT_NAME")
          foreach ($name in $required) {
            if ([string]::IsNullOrWhiteSpace((Get-Item "env:$name").Value)) {
              throw "Missing required signing secret: $name"
            }
          }

      - name: Azure Login (OIDC)
        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          allow-no-subscriptions: true

      - name: Sign viewer MSI (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}/staging/breeze-viewer-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign viewer MSI (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}/staging/breeze-viewer-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign helper MSI (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}/staging/breeze-helper-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign helper MSI (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}/staging/breeze-helper-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify signatures
        shell: pwsh
        run: |
          $targets = @(
            (Join-Path $env:GITHUB_WORKSPACE "staging\breeze-viewer-windows.msi"),
            (Join-Path $env:GITHUB_WORKSPACE "staging\breeze-helper-windows.msi")
          )
          foreach ($target in $targets) {
            $sig = Get-AuthenticodeSignature -FilePath $target
            if ($sig.Status -ne "Valid" -and $sig.Status -ne "UnknownError") {
              throw "Signature validation failed for $target. Status: $($sig.Status)"
            }
            if ($sig.Status -eq "UnknownError") {
              Write-Host "::warning::$target signed but root cert not yet trusted locally (Status: UnknownError)."
            }
            Write-Host "Verified: $target - Status: $($sig.Status) - Signer: $($sig.SignerCertificate.Subject)"
          }

      - name: Upload signed viewer MSI
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-viewer-windows.msi
          path: staging/breeze-viewer-windows.msi
          overwrite: true
          retention-days: 30

      - name: Upload signed helper MSI
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-helper-windows.msi
          path: staging/breeze-helper-windows.msi
          overwrite: true
          retention-days: 30

  package-windows-updater:
    name: Package Windows Updater Bundle
    if: >-
      vars.ENABLE_WINDOWS_SIGNING == 'true'
      && github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs: [sign-windows-tauri]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .node-version
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Download signed viewer MSI
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: breeze-viewer-windows.msi
          path: staging/

      - name: Create updater zip
        run: |
          set -euo pipefail
          if [ ! -s staging/breeze-viewer-windows.msi ]; then
            echo "::error::Signed MSI missing or empty at staging/breeze-viewer-windows.msi"
            exit 1
          fi
          cd staging
          zip -j breeze-viewer-windows.msi.zip breeze-viewer-windows.msi

      - name: Minisign the zip with Tauri key
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          key_file=$(mktemp)
          trap 'rm -f "$key_file"' EXIT
          printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$key_file"
          unset TAURI_SIGNING_PRIVATE_KEY
          cd apps/viewer
          pnpm exec tauri signer sign -f "$key_file" "$GITHUB_WORKSPACE/staging/breeze-viewer-windows.msi.zip"
          if [ ! -s "$GITHUB_WORKSPACE/staging/breeze-viewer-windows.msi.zip.sig" ]; then
            echo "::error::Tauri signer did not produce .sig file"
            exit 1
          fi

      - name: Upload Windows updater bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: breeze-viewer-windows-updater
          path: |
            staging/breeze-viewer-windows.msi.zip
            staging/breeze-viewer-windows.msi.zip.sig
          retention-days: 30

  merge-viewer-update-manifest:
    name: Generate Viewer Update Manifest
    runs-on: ubuntu-latest
    needs: [build-viewer, build-viewer-macos, package-windows-updater]
    if: >-
      !cancelled()
      && (needs.build-viewer.result == 'success' || needs.build-viewer.result == 'skipped')
      && (needs.build-viewer-macos.result == 'success' || needs.build-viewer-macos.result == 'skipped')
      && (needs.package-windows-updater.result == 'success' || needs.package-windows-updater.result == 'skipped')
    steps:
      - name: Download viewer updater bundles
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: updater-bundles
          pattern: 'breeze-viewer-*-updater'
          merge-multiple: true

      - name: Generate latest.json
        shell: bash
        env:
          REF_NAME: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
          SERVER_URL: ${{ github.server_url }}
          WIN_UPDATER_RESULT: ${{ needs.package-windows-updater.result }}
        run: |
          # Strip leading "v" and any prerelease suffix so the version matches
          # the one injected into tauri.conf.json at build time.
          version="${REF_NAME#v}"
          version="${version%%-*}"
          pub_date=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          release_base="${SERVER_URL}/${REPO}/releases/download/${REF_NAME}"
          notes_url="${SERVER_URL}/${REPO}/releases/tag/${REF_NAME}"

          echo "Downloaded updater bundle contents:"
          ls -la updater-bundles/ || true

          platforms='{}'

          # macOS — Tauri builds a universal binary, so the same bundle
          # satisfies both x86_64 and aarch64 clients.
          mac_sig="updater-bundles/breeze-viewer-macos.app.tar.gz.sig"
          if [ -f "$mac_sig" ]; then
            sig_content=$(cat "$mac_sig")
            url="${release_base}/breeze-viewer-macos.app.tar.gz"
            platforms=$(jq -n \
              --arg sig "$sig_content" \
              --arg url "$url" \
              '{"darwin-x86_64": {signature: $sig, url: $url}, "darwin-aarch64": {signature: $sig, url: $url}}')
          else
            echo "::warning::macOS updater signature not found — macOS auto-update disabled for this release"
          fi

          # Linux AppImage
          linux_sig="updater-bundles/breeze-viewer-linux.AppImage.sig"
          if [ -f "$linux_sig" ]; then
            sig_content=$(cat "$linux_sig")
            url="${release_base}/breeze-viewer-linux.AppImage"
            platforms=$(echo "$platforms" | jq \
              --arg sig "$sig_content" \
              --arg url "$url" \
              '. + {"linux-x86_64": {signature: $sig, url: $url}}')
          else
            echo "::warning::Linux updater signature not found — Linux auto-update disabled for this release"
          fi

          # Windows MSI updater bundle
          win_sig="updater-bundles/breeze-viewer-windows.msi.zip.sig"
          if [ -f "$win_sig" ]; then
            sig_content=$(cat "$win_sig")
            url="${release_base}/breeze-viewer-windows.msi.zip"
            platforms=$(echo "$platforms" | jq \
              --arg sig "$sig_content" \
              --arg url "$url" \
              '. + {"windows-x86_64": {signature: $sig, url: $url}}')
          elif [ "$WIN_UPDATER_RESULT" = "success" ]; then
            echo "::error::package-windows-updater reported success but no sig found at $win_sig"
            exit 1
          else
            echo "::warning::Windows updater signature not found (upstream result: $WIN_UPDATER_RESULT) — Windows auto-update disabled for this release"
          fi

          if [ "$(echo "$platforms" | jq 'keys | length')" = "0" ]; then
            echo "::error::No updater platforms available — latest.json would be useless"
            exit 1
          fi

          jq -n \
            --arg version "$version" \
            --arg notes "See release notes at $notes_url" \
            --arg pub_date "$pub_date" \
            --argjson platforms "$platforms" \
            '{version: $version, notes: $notes, pub_date: $pub_date, platforms: $platforms}' > latest.json

          echo "Generated latest.json:"
          cat latest.json

      - name: Upload generated manifest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: viewer-latest-json
          path: latest.json
          retention-days: 30

  release-integrity-gate:
    name: Release Integrity Gate
    runs-on: ubuntu-latest
    needs: [build-windows-unsigned, build-macos-agent, build-macos-installer-app, sign-windows-tauri, build-viewer-macos, build-helper-macos, package-windows-updater, merge-viewer-update-manifest]
    if: ${{ always() && !cancelled() }}
    steps:
      - name: Fail closed when release signing was skipped
        env:
          REF_NAME: ${{ github.ref_name }}
          GITHUB_REF_VALUE: ${{ github.ref }}
          EVENT_NAME: ${{ github.event_name }}
          SKIP_RELEASE: ${{ inputs.skip_release || false }}
          BUILD_WINDOWS_UNSIGNED_RESULT: ${{ needs.build-windows-unsigned.result }}
          BUILD_MACOS_AGENT_RESULT: ${{ needs.build-macos-agent.result }}
          BUILD_MACOS_INSTALLER_APP_RESULT: ${{ needs.build-macos-installer-app.result }}
          SIGN_WINDOWS_TAURI_RESULT: ${{ needs.sign-windows-tauri.result }}
          BUILD_VIEWER_MACOS_RESULT: ${{ needs.build-viewer-macos.result }}
          BUILD_HELPER_MACOS_RESULT: ${{ needs.build-helper-macos.result }}
          PACKAGE_WINDOWS_UPDATER_RESULT: ${{ needs.package-windows-updater.result }}
          MERGE_VIEWER_UPDATE_MANIFEST_RESULT: ${{ needs.merge-viewer-update-manifest.result }}
        run: |
          if [[ "$EVENT_NAME" == "workflow_dispatch" && "$SKIP_RELEASE" == "true" ]]; then
            echo "Build-only workflow_dispatch run: release signing gate is advisory."
            exit 0
          fi

          failed=0
          require_success() {
            local name="$1"
            local result="$2"
            if [[ "$result" != "success" ]]; then
              echo "::error::$name must succeed for tag release $REF_NAME; got '$result'."
              failed=1
            fi
          }

          require_success "build-windows-unsigned" "$BUILD_WINDOWS_UNSIGNED_RESULT"
          require_success "build-macos-agent" "$BUILD_MACOS_AGENT_RESULT"
          require_success "build-macos-installer-app" "$BUILD_MACOS_INSTALLER_APP_RESULT"
          require_success "sign-windows-tauri" "$SIGN_WINDOWS_TAURI_RESULT"
          require_success "build-viewer-macos" "$BUILD_VIEWER_MACOS_RESULT"
          require_success "build-helper-macos" "$BUILD_HELPER_MACOS_RESULT"
          require_success "package-windows-updater" "$PACKAGE_WINDOWS_UPDATER_RESULT"
          require_success "merge-viewer-update-manifest" "$MERGE_VIEWER_UPDATE_MANIFEST_RESULT"

          if [[ "$failed" -ne 0 ]]; then
            exit 1
          fi
          echo "All required signing/notarization jobs succeeded for tag release $REF_NAME."

  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    needs: [build-api, build-web, build-agent, build-windows-unsigned, build-macos-agent, build-macos-installer-app, sign-windows-tauri, build-viewer, build-helper, build-viewer-macos, build-helper-macos, merge-viewer-update-manifest, package-windows-updater, release-integrity-gate]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.build-api.result == 'success'
      && needs.build-web.result == 'success'
      && needs.build-agent.result == 'success'
      && needs.release-integrity-gate.result == 'success'
      && needs.build-windows-unsigned.result == 'success'
      && (needs.build-macos-agent.result == 'success' || needs.build-macos-agent.result == 'skipped')
      && (needs.build-macos-installer-app.result == 'success' || needs.build-macos-installer-app.result == 'skipped')
      && (needs.sign-windows-tauri.result == 'success' || needs.sign-windows-tauri.result == 'skipped')
      && (needs.package-windows-updater.result == 'success' || needs.package-windows-updater.result == 'skipped')
      && (needs.build-viewer.result == 'success' || needs.build-viewer.result == 'skipped')
      && (needs.build-helper.result == 'success' || needs.build-helper.result == 'skipped')
      && (needs.build-viewer-macos.result == 'success' || needs.build-viewer-macos.result == 'skipped')
      && (needs.build-helper-macos.result == 'success' || needs.build-helper-macos.result == 'skipped')
      && (needs.merge-viewer-update-manifest.result == 'success' || needs.merge-viewer-update-manifest.result == 'skipped')
      && !(github.event_name == 'workflow_dispatch' && inputs.skip_release)
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: artifacts
          pattern: '{api-dist,web-dist,breeze-agent-*,breeze-backup-*,breeze-desktop-helper-*,breeze-user-helper-*,breeze-watchdog-*,breeze-viewer-*,breeze-helper-*,breeze-installer-app,viewer-latest-json}'
          merge-multiple: false

      - name: Prepare release assets
        run: |
          mkdir -p release-assets

          # Copy agent binaries
          for dir in artifacts/breeze-agent-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy backup binaries
          for dir in artifacts/breeze-backup-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy desktop-helper binaries
          for dir in artifacts/breeze-desktop-helper-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy user-helper binaries (Windows-only sibling of the agent that
          # runs in interactive user sessions). See #816.
          for dir in artifacts/breeze-user-helper-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy watchdog binaries
          for dir in artifacts/breeze-watchdog-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy viewer installers
          for dir in artifacts/breeze-viewer-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy viewer update manifest
          if [ -d "artifacts/viewer-latest-json" ] && [ -f "artifacts/viewer-latest-json/latest.json" ]; then
            cp artifacts/viewer-latest-json/latest.json release-assets/latest.json
          fi

          # Copy helper installers
          for dir in artifacts/breeze-helper-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy macOS installer app
          if [ -d "artifacts/breeze-installer-app" ] && ls "artifacts/breeze-installer-app/"* >/dev/null 2>&1; then
            cp "artifacts/breeze-installer-app/"* release-assets/
          fi

          # Create archives for API and Web
          if [ -d "artifacts/api-dist" ]; then
            tar -czvf release-assets/breeze-api.tar.gz -C artifacts/api-dist .
          fi

          if [ -d "artifacts/web-dist" ]; then
            tar -czvf release-assets/breeze-web.tar.gz -C artifacts/web-dist .
          fi

          SOURCE_COMMIT="$(git rev-parse 'HEAD^{commit}')"
          export SOURCE_COMMIT

          python3 <<'PY'
          import hashlib
          import json
          import os
          import re
          from pathlib import Path

          release_dir = Path("release-assets")
          excluded = {
              "checksums.txt",
              "release-artifact-manifest.json",
              "release-artifact-manifest.json.ed25519",
              "release-artifact-manifest.json.minisig",
          }

          # Raw Mach-O agent binaries get Developer ID + notarization but
          # ship to users only inside the .pkg. spctl --assess --type execute
          # is invalid against raw Mach-O, so the trust label is correct
          # even though the end-user verifier differs (.pkg gatekeeper check).
          DARWIN_BINARY_RE = re.compile(
              r"^breeze-(agent|backup|desktop-helper|watchdog)-darwin-(amd64|arm64)$"
          )

          # BYO signing (Deliverable 1): unsigned build outputs published as
          # inputs for self-hosters to sign with their own certificates. The
          # -unsigned rule MUST be evaluated before the extension branches —
          # breeze-agent-windows-amd64-unsigned.exe would otherwise classify
          # as windows-authenticode-required.
          UNSIGNED_INPUT_RE = re.compile(
              r"^breeze-(agent|backup|watchdog|user-helper)-windows-amd64-unsigned\.exe$"
              r"|^breeze-(agent|backup|desktop-helper|watchdog)-darwin-(amd64|arm64)-unsigned$"
          )

          def is_signing_input(name):
              return UNSIGNED_INPUT_RE.match(name) is not None

          # The public pipeline no longer Authenticode-signs any agent-family
          # Windows artifact (the exes or the MSI) — this is the self-host
          # edition, unsigned by construction. Evaluated before the generic
          # extension branches below, which would otherwise classify these as
          # windows-authenticode-required. Deliberately does NOT cover the
          # unrelated viewer/helper Tauri MSIs (breeze-viewer-windows.msi,
          # breeze-helper-windows.msi) — those are still Authenticode-signed
          # (sign-windows-tauri job, out of scope here) and keep that trust
          # level. breeze-agent-template.msi is not currently produced by
          # this workflow (removed by an earlier initiative); nothing to
          # classify.
          AGENT_FAMILY_WINDOWS_RE = re.compile(
              r"^breeze-agent\.msi$"
              r"|^breeze-(agent|backup|watchdog|user-helper)-windows-amd64\.exe$"
          )

          def is_agent_family_windows(name):
              return AGENT_FAMILY_WINDOWS_RE.match(name) is not None

          def platform_trust(name):
              if is_signing_input(name):
                  return "none"
              if is_agent_family_windows(name):
                  return "none"
              if name.endswith(".msi") or name.endswith(".exe"):
                  return "windows-authenticode-required"
              if (
                  name.endswith(".pkg")
                  or name.endswith(".app.zip")
                  or name.endswith(".dmg")
              ):
                  return "macos-developer-id-notarization-required"
              if DARWIN_BINARY_RE.match(name):
                  return "macos-developer-id-notarization-required"
              return "release-workflow-produced"

          assets = []
          for path in sorted(release_dir.iterdir(), key=lambda item: item.name):
              if not path.is_file() or path.name in excluded:
                  continue
              entry = {
                  "name": path.name,
                  "sha256": hashlib.sha256(path.read_bytes()).hexdigest(),
                  "size": path.stat().st_size,
                  "platformTrust": platform_trust(path.name),
                  # BYO signing (Deliverable 2): every asset this workflow
                  # produces is the self-host edition — hosted builds happen
                  # in a separate, private repository and never reach this
                  # manifest. See the guard step below for the corresponding
                  # non-regression check.
                  "edition": "self-host",
              }
              if is_signing_input(path.name):
                  entry["intendedUse"] = "signing-input"
              assets.append(entry)

          manifest = {
              "schemaVersion": 1,
              "repository": os.environ["GITHUB_REPOSITORY"],
              "release": os.environ["GITHUB_REF_NAME"],
              "sourceCommit": os.environ["SOURCE_COMMIT"],
              "assets": assets,
          }
          (release_dir / "release-artifact-manifest.json").write_text(
              json.dumps(manifest, indent=2, sort_keys=True) + "\n"
          )
          PY

      # BYO signing (Deliverable 1) non-regression: the manifest must gain
      # sourceCommit and exactly the expected signing-input entries, and the
      # signed set's platform-trust classification must be unchanged. Runs
      # before the manifest is signed so a violation blocks the release.
      - name: Verify signing-input manifest entries
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          set -euo pipefail
          SOURCE_COMMIT="$(git rev-parse 'HEAD^{commit}')"
          export SOURCE_COMMIT
          python3 <<'PY'
          import json
          import os
          import re

          with open("release-assets/release-artifact-manifest.json") as fh:
              manifest = json.load(fh)

          source_commit = manifest.get("sourceCommit")
          assert isinstance(source_commit, str) and re.fullmatch(r"[0-9a-f]{40}", source_commit), \
              f"sourceCommit missing or malformed: {source_commit!r}"
          assert source_commit == os.environ["SOURCE_COMMIT"], \
              f"sourceCommit {source_commit} != checked-out commit {os.environ['SOURCE_COMMIT']}"

          EXPECTED_UNSIGNED = {
              "breeze-agent-windows-amd64-unsigned.exe",
              "breeze-backup-windows-amd64-unsigned.exe",
              "breeze-watchdog-windows-amd64-unsigned.exe",
              "breeze-user-helper-windows-amd64-unsigned.exe",
              "breeze-agent-darwin-amd64-unsigned",
              "breeze-agent-darwin-arm64-unsigned",
              "breeze-backup-darwin-amd64-unsigned",
              "breeze-backup-darwin-arm64-unsigned",
              "breeze-desktop-helper-darwin-amd64-unsigned",
              "breeze-desktop-helper-darwin-arm64-unsigned",
              "breeze-watchdog-darwin-amd64-unsigned",
              "breeze-watchdog-darwin-arm64-unsigned",
          }
          # Canonical (non "-unsigned") agent-family Windows assets. Unlike
          # every other non-signing-input asset, these legitimately carry
          # platformTrust "none" — the public pipeline no longer
          # Authenticode-signs the agent family at all (Deliverable 2).
          AGENT_FAMILY_WINDOWS_UNSIGNED = {
              "breeze-agent.msi",
              "breeze-agent-windows-amd64.exe",
              "breeze-backup-windows-amd64.exe",
              "breeze-watchdog-windows-amd64.exe",
              "breeze-user-helper-windows-amd64.exe",
          }

          by_name = {a["name"]: a for a in manifest["assets"]}
          missing = EXPECTED_UNSIGNED - set(by_name)
          assert not missing, f"missing unsigned signing-input assets: {sorted(missing)}"
          for name in sorted(EXPECTED_UNSIGNED):
              entry = by_name[name]
              assert entry.get("platformTrust") == "none", \
                  f"{name}: platformTrust {entry.get('platformTrust')!r} != 'none'"
              assert entry.get("intendedUse") == "signing-input", \
                  f"{name}: intendedUse {entry.get('intendedUse')!r} != 'signing-input'"

          missing_agent_family = AGENT_FAMILY_WINDOWS_UNSIGNED - set(by_name)
          assert not missing_agent_family, \
              f"missing unsigned agent-family Windows assets: {sorted(missing_agent_family)}"
          for name in sorted(AGENT_FAMILY_WINDOWS_UNSIGNED):
              entry = by_name[name]
              assert entry.get("platformTrust") == "none", \
                  f"{name}: platformTrust {entry.get('platformTrust')!r} != 'none' (agent-family Windows assets must be unsigned in the public pipeline)"
              assert "intendedUse" not in entry, \
                  f"{name}: canonical agent-family asset must not carry intendedUse (that's reserved for the -unsigned signing-input copies)"

          for name, entry in by_name.items():
              if name in EXPECTED_UNSIGNED or name in AGENT_FAMILY_WINDOWS_UNSIGNED:
                  continue
              assert "-unsigned" not in name, \
                  f"unexpected -unsigned asset outside the expected set: {name}"
              assert "intendedUse" not in entry, \
                  f"{name}: signed-set asset must not carry intendedUse"
              assert entry.get("platformTrust") != "none", \
                  f"{name}: signed-set asset must not have platformTrust 'none'"

          # Every asset this workflow produces is the self-host edition —
          # hosted builds happen in a separate, private repository.
          for name, entry in by_name.items():
              assert entry.get("edition") == "self-host", \
                  f"{name}: edition {entry.get('edition')!r} != 'self-host'"

          # Gate against any hosted/signed agent artifact leaking into public
          # assets: no agent-family Windows asset may carry a signed/notarized
          # platformTrust. (Darwin agent binaries are intentionally out of
          # scope here — macOS Developer ID signing/notarization is a
          # separate, unchanged gate; see build-macos-agent.)
          FORBIDDEN_AGENT_TRUST = {
              "windows-authenticode-required",
              "macos-developer-id-notarization-required",
          }
          for name in AGENT_FAMILY_WINDOWS_UNSIGNED:
              entry = by_name[name]
              assert entry.get("platformTrust") not in FORBIDDEN_AGENT_TRUST, \
                  f"{name}: agent-family asset carries platformTrust {entry.get('platformTrust')!r} — a hosted/signed agent artifact may have leaked into the public release"

          # Signed-set spot checks, one per trust class (classification-order
          # non-regression for the extension branches).
          assert by_name["breeze-agent.msi"]["platformTrust"] == "none"
          assert by_name["breeze-agent-windows-amd64.exe"]["platformTrust"] == "none"
          assert by_name["breeze-agent-darwin-arm64"]["platformTrust"] == "macos-developer-id-notarization-required"
          assert by_name["breeze-agent-linux-amd64"]["platformTrust"] == "release-workflow-produced"
          assert by_name["breeze-viewer-windows.msi"]["platformTrust"] == "windows-authenticode-required"
          print(f"OK: {len(EXPECTED_UNSIGNED)} signing-input assets + {len(AGENT_FAMILY_WINDOWS_UNSIGNED)} unsigned agent-family Windows assets verified; sourceCommit={source_commit}")
          PY

      - name: Sign release artifact manifest
        if: startsWith(github.ref, 'refs/tags/')
        env:
          RELEASE_MANIFEST_MINISIGN_PRIVATE_KEY: ${{ secrets.RELEASE_MANIFEST_MINISIGN_PRIVATE_KEY }}
          RELEASE_MANIFEST_MINISIGN_PUBLIC_KEY: ${{ secrets.RELEASE_MANIFEST_MINISIGN_PUBLIC_KEY }}
          RELEASE_MANIFEST_ED25519_PRIVATE_KEY: ${{ secrets.RELEASE_MANIFEST_ED25519_PRIVATE_KEY }}
          RELEASE_MANIFEST_ED25519_PUBLIC_KEY: ${{ secrets.RELEASE_MANIFEST_ED25519_PUBLIC_KEY }}
        run: |
          set -euo pipefail
          if [ -z "$RELEASE_MANIFEST_MINISIGN_PRIVATE_KEY" ] || [ -z "$RELEASE_MANIFEST_MINISIGN_PUBLIC_KEY" ]; then
            echo "::error::RELEASE_MANIFEST_MINISIGN_PRIVATE_KEY and RELEASE_MANIFEST_MINISIGN_PUBLIC_KEY are required for tag releases."
            exit 1
          fi
          if [ -z "$RELEASE_MANIFEST_ED25519_PRIVATE_KEY" ] || [ -z "$RELEASE_MANIFEST_ED25519_PUBLIC_KEY" ]; then
            echo "::error::RELEASE_MANIFEST_ED25519_PRIVATE_KEY and RELEASE_MANIFEST_ED25519_PUBLIC_KEY are required for tag releases."
            exit 1
          fi

          # Harden against a degraded Azure apt mirror (same flake as #1605).
          sudo sed -i 's|azure.archive.ubuntu.com|archive.ubuntu.com|g' \
            /etc/apt/sources.list \
            /etc/apt/sources.list.d/*.list \
            /etc/apt/sources.list.d/*.sources 2>/dev/null || true
          for attempt in 1 2 3; do
            if sudo apt-get update && sudo apt-get install -y --no-install-recommends minisign; then
              break
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "::error::Failed to install minisign after 3 attempts."
              exit 1
            fi
            echo "::warning::apt install failed (attempt ${attempt}/3); retrying in $((attempt * 15))s"
            sleep $((attempt * 15))
          done

          key_file="$RUNNER_TEMP/release-manifest.minisign.key"
          printf '%s' "$RELEASE_MANIFEST_MINISIGN_PRIVATE_KEY" > "$key_file"
          unset RELEASE_MANIFEST_MINISIGN_PRIVATE_KEY
          chmod 600 "$key_file"

          minisign -S \
            -s "$key_file" \
            -m release-assets/release-artifact-manifest.json \
            -x release-assets/release-artifact-manifest.json.minisig \
            -t "Breeze release artifact manifest ${GITHUB_REF_NAME}"

          minisign -V \
            -P "$RELEASE_MANIFEST_MINISIGN_PUBLIC_KEY" \
            -m release-assets/release-artifact-manifest.json \
            -x release-assets/release-artifact-manifest.json.minisig

          node <<'NODE'
          const { createPrivateKey, createPublicKey, sign, verify } = require('node:crypto');
          const { readFileSync, writeFileSync } = require('node:fs');

          const spkiPrefix = Buffer.from('302a300506032b6570032100', 'hex');

          function parsePrivateKey(value) {
            const trimmed = value.trim();
            if (trimmed.includes('BEGIN PRIVATE KEY')) {
              return createPrivateKey(trimmed);
            }
            return createPrivateKey({
              key: Buffer.from(trimmed, 'base64'),
              format: 'der',
              type: 'pkcs8',
            });
          }

          function parsePublicKey(value) {
            const trimmed = value.trim();
            if (trimmed.includes('BEGIN PUBLIC KEY')) {
              return createPublicKey(trimmed);
            }
            const decoded = Buffer.from(trimmed, 'base64');
            if (decoded.length === 32) {
              return createPublicKey({
                key: Buffer.concat([spkiPrefix, decoded]),
                format: 'der',
                type: 'spki',
              });
            }
            return createPublicKey({ key: decoded, format: 'der', type: 'spki' });
          }

          const manifest = readFileSync('release-assets/release-artifact-manifest.json');
          const privateKey = parsePrivateKey(process.env.RELEASE_MANIFEST_ED25519_PRIVATE_KEY);
          const publicKey = parsePublicKey(process.env.RELEASE_MANIFEST_ED25519_PUBLIC_KEY);
          const signature = sign(null, manifest, privateKey);
          if (!verify(null, manifest, publicKey, signature)) {
            throw new Error('Ed25519 release manifest signature self-verification failed');
          }
          writeFileSync(
            'release-assets/release-artifact-manifest.json.ed25519',
            `${signature.toString('base64')}\n`,
            { mode: 0o644 }
          );
          NODE

      - name: Generate release checksums
        run: |
          cd release-assets
          sha256sum * > checksums.txt

      - name: Verify release asset integrity requirements
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          set -euo pipefail
          # checksums.txt is verified for existence/non-emptiness but cannot
          # contain a SHA entry for itself: `sha256sum * > checksums.txt`
          # expands the glob before creating the redirection target.
          if [ ! -s "release-assets/checksums.txt" ]; then
            echo "::error::Required asset missing or empty: checksums.txt"
            exit 1
          fi

          # Build the asset list dynamically from release-assets/ to catch
          # partial-upload failures (missing AppImage, DMG, signature, etc.)
          # that a hand-curated list silently allows.
          # ! -name '.*' mirrors `sha256sum *`'s glob (which excludes dotfiles)
          # so the two steps see the same file set. Materialize via a tempfile
          # so a `find` failure propagates under set -e (process substitution
          # exit codes don't reach the parent shell).
          assets_list=$(mktemp)
          trap 'rm -f "$assets_list"' EXIT
          find release-assets -mindepth 1 -maxdepth 1 -type f ! -name '.*' -print0 \
            > "$assets_list"

          asset_count=0
          while IFS= read -r -d '' path; do
            asset=$(basename "$path")
            [ "$asset" = "checksums.txt" ] && continue
            asset_count=$((asset_count + 1))
            if [ ! -s "$path" ]; then
              echo "::error::Required signed/notarized release asset missing or empty: $asset"
              exit 1
            fi
            if ! awk -v asset="$asset" '
              $1 ~ /^[a-f0-9]{64}$/ {
                name=$0
                sub(/^[a-f0-9]{64}[[:space:]]+[*]?/, "", name)
                if (name == asset) found=1
              }
              END { exit found ? 0 : 1 }
            ' release-assets/checksums.txt; then
              echo "::error::checksums.txt missing SHA-256 entry for $asset"
              exit 1
            fi
          done < "$assets_list"

          if [ "$asset_count" -eq 0 ]; then
            echo "::error::No signable artifacts found in release-assets/ (only checksums.txt or empty)"
            exit 1
          fi
          echo "Verified $asset_count release assets against checksums.txt"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: release-assets/*
          generate_release_notes: true
          # RELEASE_DRAFT_FIRST (repo variable, normally unset): when 'true',
          # the release is created as a DRAFT so downstream consumers (self-host
          # servers syncing published releases) see nothing until it is
          # explicitly published — used when a release must be verified and
          # coordinated with out-of-band deployment steps before going live.
          # Publish with: gh release edit <tag> --draft=false
          draft: ${{ vars.RELEASE_DRAFT_FIRST == 'true' }}
          prerelease: ${{ contains(github.ref_name, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-binaries-image:
    name: Build & Push Binaries Init Image
    runs-on: ubuntu-latest
    needs: [build-agent, build-macos-agent, sign-windows-tauri, build-viewer, build-helper, build-viewer-macos, build-helper-macos, create-release]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.build-agent.result == 'success'
      && (needs.build-macos-agent.result == 'success' || needs.build-macos-agent.result == 'skipped')
      && (needs.sign-windows-tauri.result == 'success' || needs.sign-windows-tauri.result == 'skipped')
      && needs.build-viewer.result == 'success'
      && needs.build-helper.result == 'success'
      && (needs.build-viewer-macos.result == 'success' || needs.build-viewer-macos.result == 'skipped')
      && (needs.build-helper-macos.result == 'success' || needs.build-helper-macos.result == 'skipped')
      && needs.create-release.result == 'success'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Create staging directory
        run: mkdir -p staging/agent staging/viewer staging/helper

      - name: Download agent artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: staging/agent
          pattern: 'breeze-agent-*'
          merge-multiple: true

      - name: Download viewer artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: staging/viewer
          pattern: 'breeze-viewer-*'
          merge-multiple: true

      - name: Download helper artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: staging/helper
          pattern: 'breeze-helper-*'
          merge-multiple: true

      # BYO signing (Deliverable 1): -unsigned signing inputs are published
      # release assets only. Keep them out of the binaries-init image — the
      # API's local scanner would ignore them (parseBinaryFilename anchors on
      # breeze-<component>-<os>-<arch>[.exe]) but they'd bloat the image and
      # the /target volume for nothing.
      - name: Drop unsigned signing-input files from image staging
        run: |
          set -euo pipefail
          find staging -type f -name '*-unsigned*' -print -delete

      - name: Write VERSION file
        env:
          REF_NAME: ${{ github.ref_name }}
        run: echo "${REF_NAME#v}" > staging/VERSION

      - name: List staging contents
        run: find staging -type f | sort

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/binaries
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
            type=sha

      - name: Build and push binaries image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: staging/
          file: docker/Dockerfile.binaries
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-docker-api:
    name: Build & Push API Docker Image
    runs-on: ubuntu-latest
    needs: [build-api, create-release]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.build-api.result == 'success'
      && needs.create-release.result == 'success'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Download API artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: api-dist
          path: apps/api/dist

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/api
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
            type=sha

      - name: Build and push API image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: apps/api/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APP_VERSION=${{ steps.version.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-docker-m365-graph-read-executor:
    name: Build & Push M365 Graph Read Executor Image
    runs-on: ubuntu-latest
    needs: [create-release]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.create-release.result == 'success'
    permissions:
      contents: read
      packages: write
    outputs:
      executor-image-digest: ${{ steps.push-executor-digest.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # IMAGE_NAME is ${{ github.repository }} (e.g. LanternOps/breeze), but a
      # container reference must be lowercase. The api/web jobs launder this
      # through docker/metadata-action (which lowercases); this job builds the
      # ref by hand, so lowercase it explicitly.
      - name: Compute lowercase image base
        env:
          REGISTRY: ${{ env.REGISTRY }}
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
        run: |
          BASE="${REGISTRY}/${IMAGE_NAME}"
          echo "IMAGE_BASE=${BASE,,}" >> "$GITHUB_ENV"

      # Push by digest only: no release-facing tag exists until this exact
      # manifest passes the blocking vulnerability scan below.
      - name: Build and push unadvertised executor digest
        id: push-executor-digest
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: apps/m365-graph-read-executor/Dockerfile
          outputs: type=image,name=${{ env.IMAGE_BASE }}/m365-graph-read-executor,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan exact executor digest
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ env.IMAGE_BASE }}/m365-graph-read-executor@${{ steps.push-executor-digest.outputs.digest }}
          severity: 'HIGH,CRITICAL'
          format: 'table'
          exit-code: '1'

      # Promote the already-scanned manifest. imagetools only creates tag
      # references; it never rebuilds or mutates the image layers.
      - name: Promote scanned executor digest
        env:
          EXECUTOR_REPOSITORY: ${{ env.IMAGE_BASE }}/m365-graph-read-executor
          EXECUTOR_IMAGE_DIGEST: ${{ steps.push-executor-digest.outputs.digest }}
          RELEASE_REF_NAME: ${{ github.ref_name }}
          RELEASE_SHA: ${{ github.sha }}
        run: |
          VERSION="${RELEASE_REF_NAME#v}"
          SHORT_SHA="${RELEASE_SHA::7}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Executor image promotion requires an exact semver release tag" >&2
            exit 1
          fi
          docker buildx imagetools create \
            --tag "${EXECUTOR_REPOSITORY}:${VERSION}" \
            --tag "${EXECUTOR_REPOSITORY}:sha-${SHORT_SHA}" \
            "${EXECUTOR_REPOSITORY}@${EXECUTOR_IMAGE_DIGEST}"

      - name: Record executor digest
        env:
          EXECUTOR_IMAGE_DIGEST: ${{ steps.push-executor-digest.outputs.digest }}
        run: |
          test -n "$EXECUTOR_IMAGE_DIGEST"
          printf '%s\n' "$EXECUTOR_IMAGE_DIGEST" > m365-graph-read-executor-image-digest.txt

      - name: Upload executor digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: m365-graph-read-executor-image-digest
          path: m365-graph-read-executor-image-digest.txt
          retention-days: 90

  build-docker-m365-graph-actions-executor:
    name: Build & Push M365 Graph Actions Executor Image
    runs-on: ubuntu-latest
    needs: [create-release]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.create-release.result == 'success'
    permissions:
      contents: read
      packages: write
    outputs:
      executor-image-digest: ${{ steps.push-executor-digest.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # IMAGE_NAME is ${{ github.repository }} (e.g. LanternOps/breeze), but a
      # container reference must be lowercase. The api/web jobs launder this
      # through docker/metadata-action (which lowercases); this job builds the
      # ref by hand, so lowercase it explicitly.
      - name: Compute lowercase image base
        env:
          REGISTRY: ${{ env.REGISTRY }}
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
        run: |
          BASE="${REGISTRY}/${IMAGE_NAME}"
          echo "IMAGE_BASE=${BASE,,}" >> "$GITHUB_ENV"

      # Push by digest only: no release-facing tag exists until this exact
      # manifest passes the blocking vulnerability scan below.
      - name: Build and push unadvertised executor digest
        id: push-executor-digest
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: apps/m365-graph-actions-executor/Dockerfile
          outputs: type=image,name=${{ env.IMAGE_BASE }}/m365-graph-actions-executor,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan exact executor digest
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ env.IMAGE_BASE }}/m365-graph-actions-executor@${{ steps.push-executor-digest.outputs.digest }}
          severity: 'HIGH,CRITICAL'
          format: 'table'
          exit-code: '1'

      # Promote the already-scanned manifest. imagetools only creates tag
      # references; it never rebuilds or mutates the image layers.
      - name: Promote scanned executor digest
        env:
          EXECUTOR_REPOSITORY: ${{ env.IMAGE_BASE }}/m365-graph-actions-executor
          EXECUTOR_IMAGE_DIGEST: ${{ steps.push-executor-digest.outputs.digest }}
          RELEASE_REF_NAME: ${{ github.ref_name }}
          RELEASE_SHA: ${{ github.sha }}
        run: |
          VERSION="${RELEASE_REF_NAME#v}"
          SHORT_SHA="${RELEASE_SHA::7}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Executor image promotion requires an exact semver release tag" >&2
            exit 1
          fi
          docker buildx imagetools create \
            --tag "${EXECUTOR_REPOSITORY}:${VERSION}" \
            --tag "${EXECUTOR_REPOSITORY}:sha-${SHORT_SHA}" \
            "${EXECUTOR_REPOSITORY}@${EXECUTOR_IMAGE_DIGEST}"

      - name: Record executor digest
        env:
          EXECUTOR_IMAGE_DIGEST: ${{ steps.push-executor-digest.outputs.digest }}
        run: |
          test -n "$EXECUTOR_IMAGE_DIGEST"
          printf '%s\n' "$EXECUTOR_IMAGE_DIGEST" > m365-graph-actions-executor-image-digest.txt

      - name: Upload executor digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: m365-graph-actions-executor-image-digest
          path: m365-graph-actions-executor-image-digest.txt
          retention-days: 90

  build-docker-m365-communications-executor:
    name: Build & Push M365 Communications Executor Image
    runs-on: ubuntu-latest
    needs: [create-release]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.create-release.result == 'success'
    permissions:
      contents: read
      packages: write
    outputs:
      executor-image-digest: ${{ steps.push-executor-digest.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # IMAGE_NAME is ${{ github.repository }} (e.g. LanternOps/breeze), but a
      # container reference must be lowercase. The api/web jobs launder this
      # through docker/metadata-action (which lowercases); this job builds the
      # ref by hand, so lowercase it explicitly.
      - name: Compute lowercase image base
        env:
          REGISTRY: ${{ env.REGISTRY }}
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
        run: |
          BASE="${REGISTRY}/${IMAGE_NAME}"
          echo "IMAGE_BASE=${BASE,,}" >> "$GITHUB_ENV"

      # Push by digest only: no release-facing tag exists until this exact
      # manifest passes the blocking vulnerability scan below.
      - name: Build and push unadvertised executor digest
        id: push-executor-digest
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: apps/m365-communications-executor/Dockerfile
          outputs: type=image,name=${{ env.IMAGE_BASE }}/m365-communications-executor,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan exact executor digest
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ env.IMAGE_BASE }}/m365-communications-executor@${{ steps.push-executor-digest.outputs.digest }}
          severity: 'HIGH,CRITICAL'
          format: 'table'
          exit-code: '1'

      # Promote the already-scanned manifest. imagetools only creates tag
      # references; it never rebuilds or mutates the image layers.
      - name: Promote scanned executor digest
        env:
          EXECUTOR_REPOSITORY: ${{ env.IMAGE_BASE }}/m365-communications-executor
          EXECUTOR_IMAGE_DIGEST: ${{ steps.push-executor-digest.outputs.digest }}
          RELEASE_REF_NAME: ${{ github.ref_name }}
          RELEASE_SHA: ${{ github.sha }}
        run: |
          VERSION="${RELEASE_REF_NAME#v}"
          SHORT_SHA="${RELEASE_SHA::7}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Executor image promotion requires an exact semver release tag" >&2
            exit 1
          fi
          docker buildx imagetools create \
            --tag "${EXECUTOR_REPOSITORY}:${VERSION}" \
            --tag "${EXECUTOR_REPOSITORY}:sha-${SHORT_SHA}" \
            "${EXECUTOR_REPOSITORY}@${EXECUTOR_IMAGE_DIGEST}"

      - name: Record executor digest
        env:
          EXECUTOR_IMAGE_DIGEST: ${{ steps.push-executor-digest.outputs.digest }}
        run: |
          test -n "$EXECUTOR_IMAGE_DIGEST"
          printf '%s\n' "$EXECUTOR_IMAGE_DIGEST" > m365-communications-executor-image-digest.txt

      - name: Upload executor digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: m365-communications-executor-image-digest
          path: m365-communications-executor-image-digest.txt
          retention-days: 90

  build-docker-web:
    name: Build & Push Web Docker Image
    runs-on: ubuntu-latest
    needs: [build-web, create-release]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.build-web.result == 'success'
      && needs.create-release.result == 'success'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Download Web artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: web-dist
          path: apps/web/dist

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/web
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
            type=sha

      - name: Build and push Web image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: apps/web/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            PUBLIC_APP_VERSION=${{ steps.version.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-docker-portal:
    name: Build & Push Portal Docker Image
    runs-on: ubuntu-latest
    needs: [create-release]
    if: >-
      github.ref_type == 'tag'
      && startsWith(github.ref, 'refs/tags/v')
      && !cancelled()
      && needs.create-release.result == 'success'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/portal
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
            type=sha

      - name: Build and push Portal image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: apps/portal/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            PORTAL_BASE_PATH=/portal
            PUBLIC_API_URL=
          cache-from: type=gha
          cache-to: type=gha,mode=max