release.yml

name: 🚀 Release

run-name: Release v${{ github.ref_name }}

on:
  push:
    tags:
      - "16.*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  compute-release-context:
    name: 🧮 Compute release context
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    outputs:
      git_tag: ${{ steps.ctx.outputs.git_tag }}
      major: ${{ steps.ctx.outputs.major }}
      is_stable: ${{ steps.ctx.outputs.is_stable }}
      is_active_major: ${{ steps.ctx.outputs.is_active_major }}
      is_highest_stable_major: ${{ steps.ctx.outputs.is_highest_stable_major }}
    steps:
      - name: 🧮 Compute
        id: ctx
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          GIT_TAG="${GITHUB_REF#refs/tags/}"
          MAJOR="${GIT_TAG%%.*}"

          if [[ "$GIT_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            IS_STABLE=true
          else
            IS_STABLE=false
          fi

          # Highest stable major already published as a non-prerelease, non-draft GitHub Release.
          HIGHEST=$(gh release list --repo "$GITHUB_REPOSITORY" \
            --exclude-drafts --exclude-pre-releases \
            --limit 100 \
            --json tagName \
            --jq '[.[] | .tagName | select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$")) | split(".")[0] | tonumber] | max // 0')

          if [[ "$MAJOR" -ge "$HIGHEST" ]]; then
            IS_ACTIVE_MAJOR=true
          else
            IS_ACTIVE_MAJOR=false
          fi

          if [[ "$IS_STABLE" == "true" && "$IS_ACTIVE_MAJOR" == "true" ]]; then
            IS_HIGHEST_STABLE_MAJOR=true
          else
            IS_HIGHEST_STABLE_MAJOR=false
          fi

          {
            echo "git_tag=$GIT_TAG"
            echo "major=$MAJOR"
            echo "is_stable=$IS_STABLE"
            echo "is_active_major=$IS_ACTIVE_MAJOR"
            echo "is_highest_stable_major=$IS_HIGHEST_STABLE_MAJOR"
          } | tee -a "$GITHUB_OUTPUT"

  create-draft:
    name: 📝 Create Draft Release
    runs-on: ubuntu-26.04
    needs: [compute-release-context]
    permissions:
      contents: write
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}
      IS_STABLE: ${{ needs.compute-release-context.outputs.is_stable }}
    steps:
      - name: 📝 Create draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Empty when no release exists for the tag yet.
          is_draft=$(gh release view "$GIT_TAG" \
            --repo "${{ github.repository }}" \
            --json isDraft \
            --jq .isDraft 2>/dev/null || true)

          if [[ "$is_draft" == "true" ]]; then
            echo "Draft release for $GIT_TAG already exists; leaving it untouched."
            exit 0
          fi

          if [[ "$is_draft" == "false" ]]; then
            echo "::error::Release $GIT_TAG is already published; create releases by pushing a tag."
            exit 1
          fi

          prerelease_flag=()
          if [[ "$IS_STABLE" != "true" ]]; then
            prerelease_flag=(--prerelease)
          fi

          gh release create "$GIT_TAG" \
            --repo "${{ github.repository }}" \
            --draft \
            "${prerelease_flag[@]}" \
            --title "$GIT_TAG" \
            --generate-notes \
            --target "$GITHUB_SHA"

  pack-nuget:
    name: 📦 Build NuGet Packages
    runs-on: ubuntu-26.04
    needs: [compute-release-context]
    permissions:
      contents: read
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          show-progress: false

      - name: 🛠 Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            8.x
            9.x
            10.x
          global-json-file: global.json

      - name: 🖍️ Stamp template PackageReference versions
        shell: bash
        run: |
          sed -i "s|0\.0\.0-placeholder|${GIT_TAG}|g" \
            templates/azure-function/HotChocolate.Template.AzureFunctions.csproj \
            templates/gateway/HotChocolate.Template.Gateway.csproj \
            templates/server/HotChocolate.Template.Server.csproj

      - name: 📦 Build NuGet Packages
        shell: bash
        run: |
          dotnet pack src/Build.Pack.slnx \
            -c Release \
            -o output/packages \
            -p:Version=${GIT_TAG} \
            -p:NitroApiClientId="${NitroApiClientId}" \
            -p:NitroIdentityClientId="${NitroIdentityClientId}" \
            -p:NitroIdentityScopes="${NitroIdentityScopes}"

          dotnet pack templates/HotChocolate.Templates.csproj \
            -c Release \
            -o output/packages \
            -p:Version=${GIT_TAG}
        env:
          NitroApiClientId: ${{ secrets.NITRO_API_CLIENT_ID }}
          NitroIdentityClientId: ${{ secrets.NITRO_IDENTITY_CLIENT_ID }}
          NitroIdentityScopes: ${{ secrets.NITRO_IDENTITY_SCOPES }}

      - name: 📤 Upload NuGet packages as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: nuget-packages
          path: |
            output/packages/*.nupkg
            output/packages/*.snupkg

  build-nitro-cli:
    name: 🧱 Build Nitro CLI
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    needs: [compute-release-context]
    permissions:
      contents: read
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}
    strategy:
      matrix:
        include:
          # Linux
          # linux-x64 and linux-arm64 build on the oldest Ubuntu LTS runner GitHub supports,
          # because the binary runs only on systems with the build host's glibc or newer.
          - os: ubuntu-22.04
            rid: linux-x64
          - os: ubuntu-26.04
            rid: linux-musl-x64
            container: alpine:3.24.2
          - os: ubuntu-22.04-arm
            rid: linux-arm64
          # macOS
          - os: macos-26
            rid: osx-x64
          - os: macos-26
            rid: osx-arm64
          # Windows
          - os: windows-2025
            rid: win-x64
          - os: windows-2025
            rid: win-x86
          # Commented, since azure/artifact-signing-action does not currently support ARM.
          # - os: windows-11-arm
          #   rid: win-arm64

    steps:
      - name: 🐧 Install musl build dependencies
        if: matrix.rid == 'linux-musl-x64'
        shell: sh
        run: |
          apk add --no-cache bash clang lld build-base zlib-dev musl-dev \
            git curl icu-libs libstdc++ libgcc github-cli

      # Enable Git long path support before checkout. Must be --system:
      # actions/checkout overrides HOME (and thus global config) for its run,
      # but honors system config.
      - name: 🪟 Enable Git long paths (Windows)
        if: runner.os == 'Windows'
        run: git config --system core.longpaths true

      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 🛠 Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0

      - name: 📦 Publish binary
        shell: bash
        run: |
          dotnet publish src/Nitro/CommandLine/src/CommandLine \
            -c Release \
            -r ${{ matrix.rid }} \
            -f net11.0 \
            -o publish \
            --self-contained \
            -p:PublishAot=true \
            -p:TargetFrameworks=net11.0 \
            -p:RuntimeIdentifiers=${{ matrix.rid }} \
            -p:Version=${GIT_TAG} \
            -p:NitroApiClientId="${NitroApiClientId}" \
            -p:NitroIdentityClientId="${NitroIdentityClientId}" \
            -p:NitroIdentityScopes="${NitroIdentityScopes}"
        env:
          NitroApiClientId: ${{ secrets.NITRO_API_CLIENT_ID }}
          NitroIdentityClientId: ${{ secrets.NITRO_IDENTITY_CLIENT_ID }}
          NitroIdentityScopes: ${{ secrets.NITRO_IDENTITY_SCOPES }}

      - name: 🖋️ Azure login (Windows)
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        if: runner.os == 'Windows'
        with:
          creds: ${{ secrets.SIGNING_CREDENTIALS }}

      - name: 🖋️ Sign binary (Windows)
        uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
        if: runner.os == 'Windows'
        with:
          endpoint: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
          certificate-profile-name: ${{ secrets.WINDOWS_APP_CERT_PROFILE_NAME }}
          files: ${{ github.workspace }}\publish\nitro.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256
          exclude-environment-credential: true
          exclude-workload-identity-credential: true
          exclude-managed-identity-credential: true
          exclude-shared-token-cache-credential: true
          exclude-visual-studio-credential: true
          exclude-visual-studio-code-credential: true
          exclude-azure-cli-credential: false
          exclude-azure-powershell-credential: true
          exclude-azure-developer-cli-credential: true
          exclude-interactive-browser-credential: true

      # https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications
      - name: 🖋️ Set up signing resources (macOS)
        if: runner.os == 'macOS'
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.TEMPORARY_KEYCHAIN_PASSWORD }}
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificate from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

      - name: 🖋️ Sign binary (macOS)
        if: runner.os == 'macOS'
        env:
          CODESIGN_IDENTITY: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_IDENTITY }}
        run: |
          echo "Code signing 'publish/nitro'..."

          codesign --sign "$CODESIGN_IDENTITY" \
            --verbose=3 \
            --identifier "com.chillicream.nitro" \
            --options runtime \
            --timestamp \
            --force \
            publish/nitro

          codesign --verify --deep --strict --verbose=2 publish/nitro

      - name: 📦 Zip binary (Windows)
        if: runner.os == 'Windows'
        run: |
          Compress-Archive -Path (Get-Item publish/nitro.exe) -DestinationPath nitro-${{ matrix.rid }}.zip
        shell: pwsh

      - name: 📦 Zip binary (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          zip -j nitro-${{ matrix.rid }}.zip publish/nitro

      - name: 📦 Tar binary (Linux)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          tar -czf nitro-${{ matrix.rid }}.tar.gz -C publish nitro

      - name: 🖋️ Notarize binary (macOS)
        if: runner.os == 'macOS'
        env:
          APPLE_DEVELOPER_ID_EMAIL: ${{ secrets.APPLE_DEVELOPER_ID_EMAIL }}
          APPLE_DEVELOPER_TEAM_ID: ${{ secrets.APPLE_DEVELOPER_TEAM_ID }}
          APPLE_DEVELOPER_NITRO_CLI_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_DEVELOPER_NITRO_CLI_APP_SPECIFIC_PASSWORD }}
        run: |
          echo "Notarizing 'nitro-${{ matrix.rid }}.zip'..."

          xcrun notarytool submit nitro-${{ matrix.rid }}.zip \
            --apple-id "$APPLE_DEVELOPER_ID_EMAIL" \
            --team-id "$APPLE_DEVELOPER_TEAM_ID" \
            --password "$APPLE_DEVELOPER_NITRO_CLI_APP_SPECIFIC_PASSWORD" \
            --wait

      - name: 🖋️ Clean up signing resources (macOS)
        if: always() && runner.os == 'macOS'
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db

      - name: 📤 Upload packaged binary as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: nitro-${{ matrix.rid }}
          path: nitro-${{ matrix.rid }}.${{ runner.os == 'Linux' && 'tar.gz' || 'zip' }}

  pack-npm:
    name: 🧱 Pack Nitro CLI npm tarballs
    runs-on: ubuntu-26.04
    needs: [compute-release-context, build-nitro-cli]
    permissions:
      contents: read
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 🧰 Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          registry-url: ${{ vars.NPM_REGISTRY_URL }}
          scope: "@chillicream"

      - name: 📥 Download all nitro binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: nitro-*
          path: dist

      - name: 🗂️ Stage binaries and pack platform tarballs
        shell: bash
        run: |
          set -euo pipefail
          runtime_ids=(linux-x64 linux-musl-x64 linux-arm64 osx-x64 osx-arm64 win-x64 win-x86)
          mkdir -p "$GITHUB_WORKSPACE/tarballs"
          for runtime_id in "${runtime_ids[@]}"; do
            package_dir="src/Nitro/CommandLine/src/npm/chillicream-nitro-${runtime_id}"
            archive="$GITHUB_WORKSPACE/dist/nitro-${runtime_id}/nitro-${runtime_id}.tar.gz"
            if [ ! -f "$archive" ]; then
              archive="$GITHUB_WORKSPACE/dist/nitro-${runtime_id}/nitro-${runtime_id}.zip"
            fi
            case "$archive" in
              *.tar.gz) tar -xzf "$archive" -C "$package_dir" ;;
              *.zip)    unzip -q "$archive" -d "$package_dir" ;;
            esac
            if [[ "$runtime_id" != win-* ]]; then
              chmod +x "$package_dir/nitro"
            fi
            ( cd "$package_dir" \
              && npm version "$GIT_TAG" --no-git-tag-version --allow-same-version \
              && npm pack --pack-destination "$GITHUB_WORKSPACE/tarballs" )
          done

      - name: 🏗️ Build and pack wrapper tarball
        working-directory: src/Nitro/CommandLine/src/npm/chillicream-nitro
        shell: bash
        run: |
          set -euo pipefail
          npm ci
          npm run build
          npm version "$GIT_TAG" --no-git-tag-version --allow-same-version
          jq --arg v "$GIT_TAG" '
            .optionalDependencies = {
              "@chillicream/nitro-linux-arm64": $v,
              "@chillicream/nitro-linux-musl-x64": $v,
              "@chillicream/nitro-linux-x64": $v,
              "@chillicream/nitro-osx-arm64": $v,
              "@chillicream/nitro-osx-x64": $v,
              "@chillicream/nitro-win-x64": $v,
              "@chillicream/nitro-win-x86": $v
            }
          ' package.json > package.json.tmp
          mv package.json.tmp package.json
          npm pack --pack-destination "$GITHUB_WORKSPACE/tarballs"

      - name: 📤 Upload npm tarballs as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-tarballs
          path: tarballs/*.tgz

  publish-nuget:
    name: 🚀 Publish NuGet packages
    runs-on: ubuntu-26.04
    needs: [compute-release-context, create-draft, pack-nuget, pack-npm, publish-nitro-ops, publish-aspire-nitro-ops]
    permissions:
      contents: read
      id-token: write

    steps:
      - name: 🛠 Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 10.x

      - name: 📥 Download NuGet packages
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: nuget-packages
          path: output/packages

      - name: NuGet login
        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
        id: login
        with:
          user: ${{ secrets.NUGET_USERNAME }}

      - name: 🚀 Push Packages to NuGet
        shell: bash
        run: |
          for nupkg in output/packages/*.nupkg; do
            dotnet nuget push "$nupkg" \
              --source https://api.nuget.org/v3/index.json \
              --api-key "${NUGET_API_KEY}" \
              --skip-duplicate
          done
        env:
          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}

  publish-npm:
    name: 🚀 Publish Nitro CLI to npm
    runs-on: ubuntu-26.04
    needs: [compute-release-context, create-draft, pack-nuget, pack-npm, publish-nitro-ops]
    permissions:
      contents: read
      id-token: write
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}
      MAJOR: ${{ needs.compute-release-context.outputs.major }}
      IS_STABLE: ${{ needs.compute-release-context.outputs.is_stable }}
      IS_HIGHEST_STABLE_MAJOR: ${{ needs.compute-release-context.outputs.is_highest_stable_major }}

    steps:
      - name: 🧰 Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          registry-url: ${{ vars.NPM_REGISTRY_URL }}
          scope: "@chillicream"

      - name: 📥 Download npm tarballs
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-tarballs
          path: tarballs

      - name: 🚀 Publish tarballs to npm
        shell: bash
        env:
          REGISTRY: ${{ vars.NPM_REGISTRY_URL }}
        run: |
          set -euo pipefail

          # Pick the band this release publishes under, based on release context.
          if [[ "$IS_HIGHEST_STABLE_MAJOR" == "true" ]]; then
            PRIMARY_BAND="latest"
          elif [[ "$IS_STABLE" == "true" ]]; then
            PRIMARY_BAND="latest-${MAJOR}"
          elif [[ "$GIT_TAG" =~ -rc\. ]]; then
            PRIMARY_BAND="rc"
          else
            PRIMARY_BAND="preview"
          fi

          publish_tarball() {
            local tarball="$1"
            local metadata name version
            metadata=$(tar -xzO -f "$tarball" package/package.json)
            name=$(printf '%s' "$metadata" | jq -r .name)
            version=$(printf '%s' "$metadata" | jq -r .version)
            if npm view "${name}@${version}" version --registry="$REGISTRY" >/dev/null 2>&1; then
              echo "Skipping ${name}@${version} (already published)"
              return 0
            fi
            npm publish "./$tarball" \
              --access public \
              --registry="$REGISTRY" \
              --tag "$PRIMARY_BAND"
          }

          # Split tarballs into platform packages and the wrapper by their real package name.
          platform_tarballs=()
          wrapper_tarball=""
          for tarball in tarballs/*.tgz; do
            package_name=$(tar -xzO -f "$tarball" package/package.json | jq -r .name)
            if [[ "$package_name" == "@chillicream/nitro" ]]; then
              wrapper_tarball="$tarball"
            else
              platform_tarballs+=("$tarball")
            fi
          done

          # Platforms first, then the wrapper (its optionalDependencies reference them).
          for tarball in "${platform_tarballs[@]}"; do
            publish_tarball "$tarball"
          done
          if [[ -n "$wrapper_tarball" ]]; then
            publish_tarball "$wrapper_tarball"
          else
            echo "::error::wrapper tarball (@chillicream/nitro) not found in artifact"
            exit 1
          fi

  publish-nitro-ops:
    name: 🚀 Publish Nitro CLI operations
    runs-on: ubuntu-26.04
    needs: [compute-release-context, create-draft, pack-nuget, pack-npm]
    permissions:
      contents: read
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          show-progress: false

      - name: 📤 Upload Nitro CLI client operations
        uses: ChilliCream/nitro-client-upload@af40d52e9bfdec54a68f283f67be8422a2b80c27 # v16.6.7
        with:
          tag: ${{ env.GIT_TAG }}
          operations-file: src/Nitro/Common/src/ChilliCream.Nitro.Client/persisted/operations.json
          client-id: ${{ secrets.NITRO_API_CLIENT_ID }}
          api-key: ${{ secrets.NITRO_API_KEY }}

      - name: 🚀 Publish Nitro CLI client (Dev)
        uses: ChilliCream/nitro-client-publish@f2edb50455c732649bcce2e1376d9a31a83e276d # v16.6.7
        with:
          tag: ${{ env.GIT_TAG }}
          stage: Dev
          client-id: ${{ secrets.NITRO_API_CLIENT_ID }}
          api-key: ${{ secrets.NITRO_API_KEY }}

      - name: 🚀 Publish Nitro CLI client (Prod)
        uses: ChilliCream/nitro-client-publish@f2edb50455c732649bcce2e1376d9a31a83e276d # v16.6.7
        with:
          tag: ${{ env.GIT_TAG }}
          stage: Prod
          client-id: ${{ secrets.NITRO_API_CLIENT_ID }}
          api-key: ${{ secrets.NITRO_API_KEY }}

  publish-aspire-nitro-ops:
    name: 🚀 Publish Fusion Aspire Nitro operations
    runs-on: ubuntu-26.04
    needs: [compute-release-context, create-draft, pack-nuget]
    permissions:
      contents: read
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          show-progress: false

      - name: 🛠 Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: |
            10.x
          global-json-file: global.json

      - name: 🔍 Verify hashes and create operations manifest
        run: >
          .github/scripts/nitro-aspire-operations.sh verify
          --output "${{ runner.temp }}/nitro-aspire-operations.json"

      - name: 📤 Upload Fusion Aspire client operations
        uses: ChilliCream/nitro-client-upload@af40d52e9bfdec54a68f283f67be8422a2b80c27 # v16.6.7
        with:
          tag: ${{ env.GIT_TAG }}
          operations-file: ${{ runner.temp }}/nitro-aspire-operations.json
          client-id: ${{ secrets.NITRO_ASPIRE_CLIENT_ID }}
          api-key: ${{ secrets.NITRO_API_KEY }}

      - name: 🚀 Publish Fusion Aspire client (Dev)
        uses: ChilliCream/nitro-client-publish@f2edb50455c732649bcce2e1376d9a31a83e276d # v16.6.7
        with:
          tag: ${{ env.GIT_TAG }}
          stage: Dev
          client-id: ${{ secrets.NITRO_ASPIRE_CLIENT_ID }}
          api-key: ${{ secrets.NITRO_API_KEY }}

      - name: 🚀 Publish Fusion Aspire client (Prod)
        uses: ChilliCream/nitro-client-publish@f2edb50455c732649bcce2e1376d9a31a83e276d # v16.6.7
        with:
          tag: ${{ env.GIT_TAG }}
          stage: Prod
          client-id: ${{ secrets.NITRO_ASPIRE_CLIENT_ID }}
          api-key: ${{ secrets.NITRO_API_KEY }}

  publish-release:
    name: 🚀 Publish Release
    runs-on: ubuntu-26.04
    needs:
      - compute-release-context
      - create-draft
      - publish-nuget
      - publish-npm
      - publish-nitro-ops
      - publish-aspire-nitro-ops
    permissions:
      contents: write
    env:
      GIT_TAG: ${{ needs.compute-release-context.outputs.git_tag }}
      IS_STABLE: ${{ needs.compute-release-context.outputs.is_stable }}

    steps:
      - name: 📥 Download all release artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: assets

      - name: 📤 Attach assets to draft release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          mapfile -t files < <(find assets -type f \
            \( -name '*.nupkg' -o -name '*.tgz' -o -name '*.tar.gz' -o -name '*.zip' \))
          if [[ "${#files[@]}" -eq 0 ]]; then
            echo "::error::no release assets found to attach"
            exit 1
          fi
          gh release upload "$GIT_TAG" "${files[@]}" \
            --clobber \
            --repo "${{ github.repository }}"

      - name: 🚀 Publish draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$IS_STABLE" == "true" ]]; then
            prerelease=false
          else
            prerelease=true
          fi
          gh release edit "$GIT_TAG" \
            --repo "${{ github.repository }}" \
            --draft=false \
            --prerelease=$prerelease

  update-homebrew:
    name: 🍺 Update Homebrew Tap
    runs-on: ubuntu-26.04
    needs: [compute-release-context, publish-release]
    # Serialize across release runs, so each run compares against the formulas of the previous release.
    concurrency:
      group: update-homebrew
      cancel-in-progress: false

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: .github/actions
          show-progress: false

      - name: 🔐 Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.ACTIONS_APP_CLIENT_ID }}
          private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
          owner: ChilliCream
          repositories: homebrew-tools

      - name: 🍺 Run homebrew tap update workflow
        uses: ./.github/actions/dispatch-and-watch-workflow
        with:
          repo: ChilliCream/homebrew-tools
          workflow: release.yaml
          version: ${{ needs.compute-release-context.outputs.git_tag }}
          token: ${{ steps.app-token.outputs.token }}

  update-github-actions:
    name: 🔄 Update GitHub Actions
    runs-on: ubuntu-26.04
    needs: [compute-release-context, publish-release]
    # Serialize per action repository across release runs, so each run computes the floating
    # tags (vX, vX.Y) against the tags of the previous release.
    concurrency:
      group: update-github-actions-${{ matrix.repo }}
      cancel-in-progress: false
    strategy:
      fail-fast: false
      matrix:
        repo:
          - nitro-client-publish
          - nitro-client-upload
          - nitro-client-validate
          - nitro-fusion-publish
          - nitro-fusion-upload
          - nitro-fusion-validate
          - nitro-mcp-publish
          - nitro-mcp-upload
          - nitro-mcp-validate
          - nitro-openapi-publish
          - nitro-openapi-upload
          - nitro-openapi-validate
          - nitro-schema-download
          - nitro-schema-publish
          - nitro-schema-upload
          - nitro-schema-validate

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: .github/actions
          show-progress: false

      - name: 🔐 Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.ACTIONS_APP_CLIENT_ID }}
          private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
          owner: ChilliCream
          repositories: ${{ matrix.repo }}

      - name: 🔄 Run action repository update workflow
        uses: ./.github/actions/dispatch-and-watch-workflow
        with:
          repo: ChilliCream/${{ matrix.repo }}
          workflow: release.yaml
          version: ${{ needs.compute-release-context.outputs.git_tag }}
          token: ${{ steps.app-token.outputs.token }}

  update-cloud-platform:
    name: 🔄 Update Cloud Platform Version
    runs-on: ubuntu-26.04
    needs: [compute-release-context, publish-release]

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: .github/actions
          show-progress: false

      - name: 🔐 Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.CLOUD_ACTIONS_APP_CLIENT_ID }}
          private-key: ${{ secrets.CLOUD_ACTIONS_APP_PRIVATE_KEY }}
          owner: ChilliCream
          repositories: cloud

      - name: 🔄 Run cloud platform update workflow
        uses: ./.github/actions/dispatch-and-watch-workflow
        with:
          repo: ChilliCream/cloud
          workflow: update-platform-version.yml
          version: ${{ needs.compute-release-context.outputs.git_tag }}
          is_stable: ${{ needs.compute-release-context.outputs.is_stable }}
          is_active_major: ${{ needs.compute-release-context.outputs.is_active_major }}
          triggered_by: ${{ github.actor }}
          token: ${{ steps.app-token.outputs.token }}

  update-azure-pipelines-extension:
    name: 🔄 Update Azure Pipelines Extension
    runs-on: ubuntu-26.04
    needs: [compute-release-context, publish-release]
    if: needs.compute-release-context.outputs.is_stable == 'true'
    # Serialize across release runs and branches, so each run gates against the tags of the previous
    # release. Every branch's release.yml must use this same group name.
    concurrency:
      group: update-azure-pipelines-extension
      cancel-in-progress: false

    steps:
      - name: 📦 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: .github/actions
          show-progress: false

      - name: 🔐 Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.ACTIONS_APP_CLIENT_ID }}
          private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
          owner: ChilliCream
          repositories: nitro-azure-pipelines-tasks

      - name: 🚀 Run extension release workflow
        uses: ./.github/actions/dispatch-and-watch-workflow
        with:
          repo: ChilliCream/nitro-azure-pipelines-tasks
          workflow: release.yaml
          version: ${{ needs.compute-release-context.outputs.git_tag }}
          token: ${{ steps.app-token.outputs.token }}