linux-app-release.yml

name: Linux App Release

run-name: Linux App Release request=${{ github.event.workflow_run.id }} attempt=${{ github.event.workflow_run.run_attempt }}

on:
  workflow_run: # zizmor: ignore[dangerous-triggers] main-only release builder; exact successful request/main identity is validated before selected-tag execution, while signing and publication stay in fresh jobs
    workflows: ["Linux App Release Request"]
    branches: [main]
    types: [completed]

permissions: {}

# Serial admission lets later requests reuse the first completed publication.
concurrency:
  group: linux-app-release-build
  cancel-in-progress: false
  queue: max

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  # TEMPORARY: Windows Tauri companion publication is off. Release tags have
  # shipped unplanned Windows installers (and a windows-stable channel) from
  # sources without Windows local Gateway support. While "false", releases
  # build, sign, and publish only the Linux bundles: no
  # OpenClaw-<version>-windows-x86_64.exe, latest-windows.json, or
  # windows-stable channel. Opt-in desktop-test bundles still include their
  # Windows test installer. Re-enable by setting this to "true".
  WINDOWS_COMPANION_RELEASE: "false"
  MINISIGN_ARCHIVE_SHA256: 9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73
  MINISIGN_BINARY_SHA256: 2c74dffcc1c9a5ee55957c60971998ace2b89f22585631594ec2152c588af8db
  MINISIGN_URL: https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz
  TAURI_CLI_ARCHIVE_SHA256: 6864602a34292aa6f2ad40ae019eebe5c1064d6c623fe20696a8a8974067e60b
  TAURI_CLI_BINARY_SHA256: 23a27f61c50417fe87c92fa958fb56ecc8de7c791f78df3cac046c8579b45897
  TAURI_CLI_URL: https://github.com/tauri-apps/tauri/releases/download/tauri-cli-v2.11.4/cargo-tauri-x86_64-unknown-linux-gnu.tgz

jobs:
  validate_release:
    name: Validate release tag
    if: >-
      github.event_name == 'workflow_run' &&
      github.repository == 'openclaw/openclaw' &&
      github.event.workflow_run.repository.full_name == 'openclaw/openclaw' &&
      github.event.workflow_run.event == 'workflow_dispatch' &&
      github.event.workflow_run.path == '.github/workflows/linux-app-release-request.yml' &&
      github.event.workflow_run.head_branch == 'main' &&
      github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions:
      contents: read
    # Build jobs check out this exact SHA so a tag force-moved mid-run cannot
    # swap in code the ancestry guard never validated.
    outputs:
      desktop_test_bundles: ${{ steps.request.outputs.desktop_test_bundles }}
      release_tag: ${{ steps.request.outputs.release_tag }}
      tag_sha: ${{ steps.ancestry.outputs.tag_sha }}
      updater_pubkey: ${{ steps.updater_trust.outputs.updater_pubkey }}
      already_published: ${{ steps.completion.outputs.already_published }}
      # Opt-in desktop-test bundles include the Windows installer, so they build it
      # even while Windows companion publication is off.
      windows_build: ${{ (env.WINDOWS_COMPANION_RELEASE == 'true' || steps.request.outputs.desktop_test_bundles == 'true') && 'true' || 'false' }}
    steps:
      - name: Validate trusted release request
        id: request
        env:
          REQUEST_TITLE: ${{ github.event.workflow_run.display_title }}
          REQUEST_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
        run: |
          set -euo pipefail
          # Reject stale requests visibly before selected code runs; a job-level
          # SHA gate would silently skip the whole release when main advances.
          if [[ "$REQUEST_HEAD_SHA" != "$WORKFLOW_SHA" ]]; then
            echo "::error::Main advanced after this Linux release request. Dispatch a new Linux App Release Request from main with the same inputs." >&2
            exit 1
          fi
          pattern='^Linux App Release Request \[(v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-[1-9][0-9]*)?)\] desktop=(true|false)$'
          if [[ ! "${REQUEST_TITLE}" =~ ${pattern} ]]; then
            echo "Release request title does not match the trusted request contract"
            exit 1
          fi
          echo "release_tag=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
          echo "desktop_test_bundles=${BASH_REMATCH[3]}" >> "$GITHUB_OUTPUT"

      - name: Prepare Git owner
        uses: openclaw/openclaw/.github/actions/git-owner@88095dc00eef288c3829909d4dc64a9e249fa7ef

      - name: Checkout selected tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: refs/tags/${{ steps.request.outputs.release_tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Checkout trusted release tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          path: .release-tooling
          fetch-depth: 1
          persist-credentials: false
          sparse-checkout: |
            apps/linux/src-tauri/tauri.conf.json
            scripts/lib/record-shared.mjs
            scripts/release-tooling-identity.mjs
            scripts/linux-updater-manifest.mjs
            scripts/lib/release-version.mjs
          sparse-checkout-cone-mode: false

      - name: Setup supported Node runtime
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24.22.1"
          package-manager-cache: false

      - name: Verify trusted release tooling identity
        env:
          GH_TOKEN: ${{ github.token }}
          WORKFLOW_FULL_REF: ${{ github.ref }}
          WORKFLOW_REF: ${{ github.ref_name }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
        run: |
          set -euo pipefail
          node .release-tooling/scripts/release-tooling-identity.mjs verify \
            --repository "$GITHUB_REPOSITORY" \
            --workflow-ref "$WORKFLOW_REF" \
            --workflow-full-ref "$WORKFLOW_FULL_REF" \
            --workflow-sha "$WORKFLOW_SHA"

      - name: Validate updater trust root
        id: updater_trust
        run: |
          set -euo pipefail
          selected_config=apps/linux/src-tauri/tauri.conf.json
          trusted_config=.release-tooling/apps/linux/src-tauri/tauri.conf.json
          if [[ ! -f "$selected_config" || -L "$selected_config" ||
                ! -f "$trusted_config" || -L "$trusted_config" ]]; then
            echo "Updater trust metadata must be regular files"
            exit 1
          fi
          selected_pubkey=$(jq -er '.plugins.updater.pubkey' "$selected_config")
          trusted_pubkey=$(jq -er '.plugins.updater.pubkey' "$trusted_config")
          if [[ ! "$trusted_pubkey" =~ ^[A-Za-z0-9+/]+={0,2}$ ||
                "$selected_pubkey" != "$trusted_pubkey" ]]; then
            echo "Selected tag updater trust root must match trusted release tooling"
            exit 1
          fi
          echo "updater_pubkey=$trusted_pubkey" >> "$GITHUB_OUTPUT"

      - name: Ensure tag commit is reachable from its release branch
        id: ancestry
        env:
          RELEASE_TAG: ${{ steps.request.outputs.release_tag }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
        run: |
          set -euo pipefail
          exec python3 -I -S "$CI_GIT_OWNER" --policy - <<'PYTHON'
          import os
          import sys

          from ci_git_owner import GitFailure, git_output, run_git

          workspace = os.environ["GITHUB_WORKSPACE"]
          release_tag = os.environ["RELEASE_TAG"]

          def is_ancestor(sha, ref):
              try:
                  run_git(workspace, "merge-base", "--is-ancestor", sha, ref)
                  return True
              except GitFailure as error:
                  if error.code == 1:
                      return False
                  raise

          run_git(
              workspace,
              "fetch",
              "--no-tags",
              "origin",
              "+refs/heads/main:refs/remotes/origin/main",
              timeout=120,
              reclaim_locks=True,
          )
          if not is_ancestor(os.environ["WORKFLOW_SHA"], "origin/main"):
              print("Linux release tooling must be reachable from current main.", file=sys.stderr)
              raise SystemExit(1)
          tag_sha = git_output(
              workspace,
              "rev-parse",
              f"refs/tags/{release_tag}^{{commit}}",
          ).rstrip("\n")
          if not is_ancestor(tag_sha, "origin/main"):
              # The validated stable tag chooses its sole eligible release branch;
              # numeric correction tags share the base version's release branch.
              release_branch = f"release/{release_tag[1:].split('-', 1)[0]}"
              release_ref = f"refs/remotes/origin/{release_branch}"
              run_git(
                  workspace,
                  "fetch",
                  "--no-tags",
                  "origin",
                  f"+refs/heads/{release_branch}:{release_ref}",
                  timeout=120,
                  reclaim_locks=True,
              )
              if not is_ancestor(tag_sha, release_ref):
                  print(
                      f"Tag {release_tag} ({tag_sha}) is not reachable from main "
                      f"or {release_branch}.",
                      file=sys.stderr,
                  )
                  raise SystemExit(1)
          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
              output.write(f"tag_sha={tag_sha}\n")
          PYTHON

      - name: Ensure matching GitHub release exists
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ steps.request.outputs.release_tag }}
        run: gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --json tagName --jq .tagName

      - name: Reuse previously published Linux bundles
        id: completion
        if: ${{ steps.request.outputs.desktop_test_bundles != 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ steps.request.outputs.release_tag }}
        run: |
          set -euo pipefail
          publication_state="$(node .release-tooling/scripts/linux-updater-manifest.mjs status \
            --tag "$RELEASE_TAG" --repository "$GITHUB_REPOSITORY" \
            --output "$RUNNER_TEMP/linux-release-completion")"
          already_published="$(jq -r '.assetsComplete == true' <<< "$publication_state")"
          echo "already_published=$already_published" >> "$GITHUB_OUTPUT"
          if [[ "$already_published" == true ]]; then
            echo "- Linux: existing same-tag bundles and signed updater metadata verified; no rebuild needed. Current updater publication follows." >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Record Linux builder admission
        if: ${{ always() }}
        env:
          REQUEST_RUN_ID: ${{ github.event.workflow_run.id }}
          REQUEST_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
          REQUEST_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
          RELEASE_TAG: ${{ steps.request.outputs.release_tag }}
          TAG_SHA: ${{ steps.ancestry.outputs.tag_sha }}
          ADMISSION_STATUS: ${{ job.status }}
        run: |
          set -euo pipefail
          jq -n --arg repository "$GITHUB_REPOSITORY" \
            --arg requestRunId "$REQUEST_RUN_ID" --arg requestRunAttempt "$REQUEST_RUN_ATTEMPT" \
            --arg requestSha "$REQUEST_HEAD_SHA" --arg builderRunId "$GITHUB_RUN_ID" \
            --arg builderRunAttempt "$GITHUB_RUN_ATTEMPT" --arg toolingSha "$WORKFLOW_SHA" \
            --arg tag "$RELEASE_TAG" --arg sourceSha "$TAG_SHA" --arg status "$ADMISSION_STATUS" \
            '{schemaVersion: 1, repository: $repository,
              request: {runId: $requestRunId, runAttempt: $requestRunAttempt, headSha: $requestSha},
              builder: {runId: $builderRunId, runAttempt: $builderRunAttempt, toolingSha: $toolingSha},
              tag: (if $tag == "" then null else $tag end),
              sourceSha: (if $sourceSha == "" then null else $sourceSha end),
              admission: (if $status == "success" then "admitted" else "rejected" end)}' \
            > "$RUNNER_TEMP/linux-release-admission.json"
          echo "- Linux builder: $ADMISSION_STATUS; request https://github.com/$GITHUB_REPOSITORY/actions/runs/$REQUEST_RUN_ID; builder https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID." >> "$GITHUB_STEP_SUMMARY"

      - name: Retain Linux builder admission
        if: ${{ always() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-release-admission-${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/linux-release-admission.json
          if-no-files-found: error

      - name: Retain Linux completion evidence
        if: ${{ always() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-release-completion-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/linux-release-completion
          if-no-files-found: ignore

  build_linux:
    name: Build Linux companion bundles
    needs: validate_release
    if: ${{ needs.validate_release.outputs.already_published != 'true' }}
    # Oldest supported build base: bundles link against this glibc, so newer
    # runners would silently drop Ubuntu 22.04/Debian 12 users.
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    permissions:
      contents: read
    outputs:
      deb_artifact_id: ${{ steps.upload_deb.outputs.artifact-id }}
      unsigned_appimage_artifact_id: ${{ steps.upload_appimage.outputs.artifact-id }}
    steps:
      - name: Install Tauri system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            at-spi2-core \
            build-essential \
            curl \
            dbus-x11 \
            ffmpeg \
            file \
            gir1.2-atspi-2.0 \
            gstreamer1.0-libav \
            gstreamer1.0-plugins-bad \
            gstreamer1.0-plugins-good \
            gstreamer1.0-tools \
            libatk-adaptor \
            libayatana-appindicator3-dev \
            libegl1 \
            libgles2 \
            librsvg2-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libxdo-dev \
            mesa-utils \
            patchelf \
            unzip \
            pciutils \
            procps \
            psmisc \
            python3-gi \
            wget \
            wmctrl \
            xauth \
            xdg-utils \
            xvfb

      - name: Install Rust
        run: rustup toolchain install stable --profile minimal

      - name: Setup trusted Node runtime
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24.22.1

      - name: Checkout selected tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.validate_release.outputs.tag_sha }}
          persist-credentials: false

      - name: Install selected-tag dependencies
        run: |
          corepack enable
          pnpm install --frozen-lockfile --prefer-offline \
            --config.ignore-scripts=false --config.engine-strict=false \
            --config.enable-pre-post-scripts=true --config.side-effects-cache=true

      - name: Checkout trusted Linux packaging tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          path: .release-tooling
          fetch-depth: 1
          persist-credentials: false
          sparse-checkout: |
            apps/linux/scripts/stage-appimage-gstreamer.sh
            apps/linux/scripts/tauri-appimage-tools.sh
            apps/linux/scripts/tauri-appimage-tools-x86_64.tsv
            apps/linux/scripts/finalize-appimage.sh
            apps/linux/tests/packaged_runtime_smoke.py
            apps/linux/tests/first_run.py
          sparse-checkout-cone-mode: false

      - name: Stage AppImage GStreamer plugins
        run: | # zizmor: ignore[github-env] static runner-temporary path consumed by the Tauri build in this secretless job
          plugins="${RUNNER_TEMP}/openclaw-gstreamer-plugins"
          .release-tooling/apps/linux/scripts/stage-appimage-gstreamer.sh "$plugins" \
            | tee "${RUNNER_TEMP}/openclaw-gstreamer-elements.tsv"
          echo "GSTREAMER_PLUGINS_DIR=$plugins" >> "$GITHUB_ENV"

      - name: Prepare pinned AppImage tools
        env:
          XDG_CACHE_HOME: ${{ runner.temp }}/openclaw-tauri-cache
        run: |
          set -euo pipefail
          .release-tooling/apps/linux/scripts/tauri-appimage-tools.sh prepare
          .release-tooling/apps/linux/scripts/tauri-appimage-tools.sh verify pre-build

      - name: Build Linux companion bundles
        id: bundle-build
        working-directory: apps/linux/src-tauri
        env:
          # appimagetool strips fail on CI runners; Tauri documents NO_STRIP for Actions.
          NO_STRIP: "true"
          LDAI_RUNTIME_FILE: ${{ runner.temp }}/openclaw-tauri-cache/tauri/.appimage-runtime-x86_64
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          RELEASE_SHA: ${{ needs.validate_release.outputs.tag_sha }}
          XDG_CACHE_HOME: ${{ runner.temp }}/openclaw-tauri-cache
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          # Stamp the release version into the bundles; the committed manifests
          # keep a placeholder 0.1.0 so releases stay tag-driven.
          pnpm dlx @tauri-apps/cli@2.11.4 build --bundles deb,appimage \
            --config "{\"version\":\"${version}\",\"bundle\":{\"createUpdaterArtifacts\":false,\"useLocalToolsDir\":false}}"

      - name: Finalize AppImage
        id: finalize-appimage
        env:
          XDG_CACHE_HOME: ${{ runner.temp }}/openclaw-tauri-cache
        run: |
          set -euo pipefail
          bundle_dir=apps/linux/src-tauri/target/release/bundle/appimage
          .release-tooling/apps/linux/scripts/finalize-appimage.sh "$bundle_dir"

      - name: Verify and stage unsigned Linux bundles
        id: stage-bundles
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          version="${RELEASE_TAG#v}"
          debs=(apps/linux/src-tauri/target/release/bundle/deb/*.deb)
          appimages=(apps/linux/src-tauri/target/release/bundle/appimage/*.AppImage)
          signatures=(apps/linux/src-tauri/target/release/bundle/appimage/*.sig)
          if [[ ${#debs[@]} -ne 1 || ${#appimages[@]} -ne 1 || ${#signatures[@]} -ne 0 ]]; then
            echo "Expected one deb, one unsigned finalized AppImage, and no stale signature"
            exit 1
          fi
          deb_version=$(dpkg-deb -f "${debs[0]}" Version)
          if [[ "${deb_version}" != "${version}"* ]]; then
            echo "Debian package version '${deb_version}' does not match release version '${version}'"
            exit 1
          fi
          mkdir -p dist/linux-app/release dist/linux-app/unsigned
          cp "${debs[0]}" "dist/linux-app/release/OpenClaw-${version}-amd64.deb"
          cp "${appimages[0]}" "dist/linux-app/unsigned/OpenClaw-${version}-amd64.AppImage"

      - name: Test packaged AppImage runtime
        id: packaged-runtime
        shell: bash
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
        run: |
          version="${RELEASE_TAG#v}"
          # Historical tags install the CLI separately; the selected resource
          # contract determines whether the current checker must require Bun.
          runtime_mode="$(python3 - <<'PYTHON'
          import json
          from pathlib import Path
          resources = json.loads(Path("apps/linux/src-tauri/tauri.conf.json").read_text())["bundle"]["resources"]
          destinations = [destination.rstrip("/") for destination in resources.values()]
          print("bundled" if any(destination == "desktop-runtime" or destination.startswith("desktop-runtime/") for destination in destinations) else "legacy")
          PYTHON
          )"
          runtime_args=()
          if [[ "$runtime_mode" == legacy ]]; then
            runtime_args+=(--allow-legacy-runtime)
          fi
          xvfb-run -a -s '-screen 0 1280x1024x24' dbus-run-session -- \
            /usr/bin/python3 .release-tooling/apps/linux/tests/packaged_runtime_smoke.py \
            "dist/linux-app/unsigned/OpenClaw-${version}-amd64.AppImage" \
            --output "${RUNNER_TEMP}/linux-packaged-runtime" \
            --require-fuse \
            "${runtime_args[@]}" \
            --shell-container \
              "archlinux@sha256:4e77cf2ea5f410e6f8be5abf93ccf17ce2436e87a138c167208356711a405dbd"

      # Diagnostic bytes never use the qualified artifact IDs consumed by signing.
      - name: Retain completed unqualified Linux bundles
        if: ${{ failure() && steps.bundle-build.outcome == 'success' }}
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          TAG_SHA: ${{ needs.validate_release.outputs.tag_sha }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
          FINALIZE_OUTCOME: ${{ steps.finalize-appimage.outcome }}
          STAGING_OUTCOME: ${{ steps.stage-bundles.outcome }}
          RUNTIME_OUTCOME: ${{ steps.packaged-runtime.outcome }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          output="$RUNNER_TEMP/linux-unqualified-bundles"
          mkdir -p "$output/bundles"
          bundles=(apps/linux/src-tauri/target/release/bundle/deb/*.deb apps/linux/src-tauri/target/release/bundle/appimage/*.AppImage)
          for bundle in "${bundles[@]}"; do
            [[ -f "$bundle" && ! -L "$bundle" ]]
            cp "$bundle" "$output/bundles/"
          done
          if [[ ${#bundles[@]} -eq 0 ]]; then
            echo "::warning::No completed Linux bundle files remain for diagnostics."
            exit 0
          fi
          (cd "$output" && sha256sum bundles/* > SHA256SUMS)
          jq -n --arg repository "$GITHUB_REPOSITORY" --arg tag "$RELEASE_TAG" \
            --arg sourceSha "$TAG_SHA" --arg toolingSha "$WORKFLOW_SHA" \
            --arg runId "$GITHUB_RUN_ID" --arg runAttempt "$GITHUB_RUN_ATTEMPT" \
            --arg finalize "$FINALIZE_OUTCOME" --arg staging "$STAGING_OUTCOME" --arg runtime "$RUNTIME_OUTCOME" \
            '{schemaVersion: 1, qualification: "unqualified", repository: $repository, tag: $tag,
              sourceSha: $sourceSha, toolingSha: $toolingSha, runId: $runId, runAttempt: $runAttempt,
              checks: {finalize: $finalize, staging: $staging, packagedRuntime: $runtime}}' \
            > "$output/identity.json"
          echo "- Linux: completed bundles retained for diagnostics only; not eligible for signing or publication. Verify identity.json and SHA256SUMS before rerunning the packaging checker on these exact bytes." >> "$GITHUB_STEP_SUMMARY"

      - name: Upload unqualified Linux bundle diagnostics
        if: ${{ failure() && steps.bundle-build.outcome == 'success' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-app-release-unqualified-${{ github.run_id }}-${{ github.run_attempt }}
          retention-days: 14
          compression-level: 0
          if-no-files-found: warn
          path: ${{ runner.temp }}/linux-unqualified-bundles

      - name: Upload packaged runtime failure evidence
        if: failure() && steps.packaged-runtime.outcome == 'failure'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-app-release-runtime-failure
          retention-days: 14
          if-no-files-found: warn
          path: ${{ runner.temp }}/linux-packaged-runtime

      - name: Upload Debian bundle
        id: upload_deb
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-app-release-deb
          path: dist/linux-app/release/*.deb
          if-no-files-found: error

      - name: Upload finalized unsigned AppImage
        id: upload_appimage
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-app-release-unsigned-appimage
          path: dist/linux-app/unsigned/*.AppImage
          if-no-files-found: error

  # Signing secrets enter only this fresh artifact-only runner; selected-tag
  # source and trusted packaging helpers never cross the job boundary.
  sign_linux:
    name: Sign finalized Linux AppImage
    needs:
      - validate_release
      - build_linux
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions: {}
    outputs:
      signed_appimage_artifact_id: ${{ steps.upload_signed_appimage.outputs.artifact-id }}
    steps:
      - name: Install trusted signing tools
        run: |
          set -euo pipefail
          minisign_archive="${RUNNER_TEMP}/minisign-0.12-linux.tar.gz"
          tauri_archive="${RUNNER_TEMP}/cargo-tauri-x86_64-unknown-linux-gnu.tgz"
          mkdir -p "${RUNNER_TEMP}/bin"
          curl --fail --location --silent --show-error --proto '=https' --tlsv1.2 \
            --connect-timeout 10 --max-time 120 --retry 3 --retry-all-errors \
            --output "$minisign_archive" "$MINISIGN_URL"
          printf '%s  %s\n' "$MINISIGN_ARCHIVE_SHA256" "$minisign_archive" | sha256sum --check -
          tar -xzf "$minisign_archive" -C "${RUNNER_TEMP}/bin" --strip-components=2 \
            minisign-linux/x86_64/minisign
          printf '%s  %s\n' "$MINISIGN_BINARY_SHA256" "${RUNNER_TEMP}/bin/minisign" |
            sha256sum --check -
          curl --fail --location --silent --show-error --proto '=https' --tlsv1.2 \
            --connect-timeout 10 --max-time 120 --retry 3 --retry-all-errors \
            --output "$tauri_archive" "$TAURI_CLI_URL"
          printf '%s  %s\n' "$TAURI_CLI_ARCHIVE_SHA256" "$tauri_archive" | sha256sum --check -
          tar -xzf "$tauri_archive" -C "${RUNNER_TEMP}/bin" cargo-tauri
          printf '%s  %s\n' "$TAURI_CLI_BINARY_SHA256" "${RUNNER_TEMP}/bin/cargo-tauri" |
            sha256sum --check -
          chmod 0555 "${RUNNER_TEMP}/bin/cargo-tauri" "${RUNNER_TEMP}/bin/minisign"
          "${RUNNER_TEMP}/bin/cargo-tauri" --version
          "${RUNNER_TEMP}/bin/minisign" -v

      - name: Download finalized unsigned AppImage
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.build_linux.outputs.unsigned_appimage_artifact_id }}
          path: dist/signing-input

      - name: Sign finalized AppImage
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          TAG_SHA: ${{ needs.validate_release.outputs.tag_sha }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          UPDATER_PUBLIC_KEY: ${{ needs.validate_release.outputs.updater_pubkey }}
        run: |
          set -euo pipefail
          # Artifact download follows installation; revalidate exact tool bytes before using credentials.
          printf '%s  %s\n' "$TAURI_CLI_BINARY_SHA256" "${RUNNER_TEMP}/bin/cargo-tauri" |
            sha256sum --check -
          printf '%s  %s\n' "$MINISIGN_BINARY_SHA256" "${RUNNER_TEMP}/bin/minisign" |
            sha256sum --check -
          version="${RELEASE_TAG#v}"
          appimage="dist/signing-input/OpenClaw-${version}-amd64.AppImage"
          mapfile -d '' inputs < <(find dist/signing-input -mindepth 1 -maxdepth 1 -print0)
          if [[ ! "${TAG_SHA}" =~ ^[0-9a-f]{40}$ || ${#inputs[@]} -ne 1 || ! -f "$appimage" || -L "$appimage" ]]; then
            echo "Signing input must be exactly one regular AppImage for validated tag ${RELEASE_TAG}"
            exit 1
          fi
          before=$(sha256sum "$appimage")
          "${RUNNER_TEMP}/bin/cargo-tauri" signer sign "$appimage"
          # Signature verification must not inherit production signing credentials.
          unset TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD
          after=$(sha256sum "$appimage")
          verify_dir=$(mktemp -d)
          trap 'rm -rf "$verify_dir"' EXIT
          printf '%s' "$UPDATER_PUBLIC_KEY" | base64 --decode > "$verify_dir/updater.pub"
          base64 --decode < "${appimage}.sig" > "$verify_dir/appimage.minisig"
          if [[ "$before" != "$after" || ! -s "${appimage}.sig" ]] ||
             ! "${RUNNER_TEMP}/bin/minisign" -Vm "$appimage" -x "$verify_dir/appimage.minisig" \
               -p "$verify_dir/updater.pub"; then
            echo "Signing must preserve the finalized AppImage bytes and create its signature"
            exit 1
          fi
          mkdir -p dist/linux-app/release dist/linux-app/signatures
          cp "$appimage" "dist/linux-app/release/OpenClaw-${version}-amd64.AppImage"
          cp "${appimage}.sig" \
            "dist/linux-app/signatures/OpenClaw-${version}-amd64.AppImage.sig"

      - name: Upload signed AppImage
        id: upload_signed_appimage
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-app-release-signed-appimage
          path: dist/linux-app
          if-no-files-found: error

  # TEST-ONLY bundles: no Apple codesigning/notarization or Authenticode.
  # Users must bypass Gatekeeper or SmartScreen before running them.
  build_macos:
    name: Build unsigned macOS test bundles
    if: ${{ needs.validate_release.outputs.desktop_test_bundles == 'true' }}
    needs: validate_release
    runs-on: xcode-27
    timeout-minutes: 45
    env:
      MACOSX_DEPLOYMENT_TARGET: "13.0"
    permissions:
      contents: read
    outputs:
      dmg_artifact_id: ${{ steps.upload_dmg.outputs.artifact-id }}
      unsigned_updater_artifact_id: ${{ steps.upload_updater.outputs.artifact-id }}
    steps:
      - name: Install Rust
        run: rustup toolchain install stable --profile minimal

      - name: Setup trusted Node runtime
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24.22.1

      - name: Checkout selected tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.validate_release.outputs.tag_sha }}
          persist-credentials: false

      - name: Install selected-tag dependencies
        run: |
          corepack enable
          pnpm install --frozen-lockfile --prefer-offline \
            --config.ignore-scripts=false --config.engine-strict=false \
            --config.enable-pre-post-scripts=true --config.side-effects-cache=true

      - name: Build macOS test bundles
        working-directory: apps/linux/src-tauri
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          RELEASE_SHA: ${{ needs.validate_release.outputs.tag_sha }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          pnpm dlx @tauri-apps/cli@2.11.4 build --bundles app,dmg \
            --config "{\"version\":\"${version}\",\"bundle\":{\"createUpdaterArtifacts\":false}}"

      - name: Verify and stage unsigned macOS bundles
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          version="${RELEASE_TAG#v}"
          apps=(apps/linux/src-tauri/target/release/bundle/macos/*.app)
          archives=(apps/linux/src-tauri/target/release/bundle/macos/*.app.tar.gz)
          dmgs=(apps/linux/src-tauri/target/release/bundle/dmg/*.dmg)
          signatures=(apps/linux/src-tauri/target/release/bundle/macos/*.sig)
          if [[ ${#apps[@]} -ne 1 || ${#archives[@]} -ne 0 || ${#dmgs[@]} -ne 1 || ${#signatures[@]} -ne 0 ]]; then
            echo "Expected one app, one dmg, and no updater artifacts from the keyless build"
            exit 1
          fi
          bundle_version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' \
            "${apps[0]}/Contents/Info.plist")
          if [[ "${bundle_version}" != "${version}" ]]; then
            echo "macOS bundle version '${bundle_version}' does not match release version '${version}'"
            exit 1
          fi
          archive="dist/macos-app/unsigned/OpenClaw-${version}-darwin-aarch64.app.tar.gz"
          mkdir -p dist/macos-app/release dist/macos-app/unsigned
          cp "${dmgs[0]}" "dist/macos-app/release/OpenClaw-${version}-darwin-aarch64.dmg"
          # Match Tauri's updater archive contract: one .app root, gzip,
          # symlinks preserved rather than followed.
          tar -czf "$archive" -C "$(dirname "${apps[0]}")" "$(basename "${apps[0]}")"
          [[ -s "$archive" ]]

      - name: Upload macOS DMG
        id: upload_dmg
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: macos-app-release-dmg
          path: dist/macos-app/release/*.dmg
          if-no-files-found: error

      - name: Upload unsigned macOS updater archive
        id: upload_updater
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: macos-app-release-unsigned-updater
          path: dist/macos-app/unsigned/*.app.tar.gz
          if-no-files-found: error

  build_windows:
    name: Build Windows installer
    if: ${{ needs.validate_release.outputs.already_published != 'true' && needs.validate_release.outputs.windows_build == 'true' }}
    needs: validate_release
    runs-on: windows-2022
    timeout-minutes: 45
    permissions:
      contents: read
    outputs:
      unsigned_updater_artifact_id: ${{ steps.upload_updater.outputs.artifact-id }}
    steps:
      - name: Install Rust
        run: rustup toolchain install stable --profile minimal

      - name: Setup trusted Node runtime
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24.22.1

      - name: Checkout selected tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.validate_release.outputs.tag_sha }}
          persist-credentials: false

      - name: Install selected-tag dependencies
        shell: bash
        run: |
          corepack enable
          pnpm install --frozen-lockfile --prefer-offline \
            --config.ignore-scripts=false --config.engine-strict=false \
            --config.enable-pre-post-scripts=true --config.side-effects-cache=true

      - name: Build Windows installer
        working-directory: apps/linux/src-tauri
        shell: bash
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          RELEASE_SHA: ${{ needs.validate_release.outputs.tag_sha }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          pnpm dlx @tauri-apps/cli@2.11.4 build --bundles nsis \
            --config "{\"version\":\"${version}\",\"bundle\":{\"createUpdaterArtifacts\":false}}"

      - name: Verify and stage unsigned Windows bundle
        shell: pwsh
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
        run: |
          $ErrorActionPreference = "Stop"
          $version = $env:RELEASE_TAG.Substring(1)
          $installers = @(Get-ChildItem "apps/linux/src-tauri/target/release/bundle/nsis/*.exe")
          if ($installers.Count -ne 1) {
            throw "Expected one NSIS installer; found $($installers.Count)"
          }
          $installer = $installers[0]
          $signatures = @(Get-ChildItem "apps/linux/src-tauri/target/release/bundle/nsis/*.sig" -ErrorAction SilentlyContinue)
          if ($signatures.Count -ne 0) {
            throw "Expected no updater signatures from the keyless build; found $($signatures.Count)"
          }
          if (-not $installer.VersionInfo.ProductVersion.StartsWith($version)) {
            throw "Windows bundle version '$($installer.VersionInfo.ProductVersion)' does not match release version '$version'"
          }
          New-Item -ItemType Directory -Force -Path "dist/windows-app/unsigned" | Out-Null
          Copy-Item -LiteralPath $installer.FullName -Destination "dist/windows-app/unsigned/OpenClaw-$version-windows-x86_64.exe"

      - name: Upload unsigned Windows updater installer
        id: upload_updater
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: windows-app-release-unsigned-updater
          path: dist/windows-app/unsigned/*.exe
          if-no-files-found: error

  # Authenticode is opt-in until Foundation signing is configured in this repository.
  # A configured signer must succeed; updater signing never falls back to unsigned bytes.
  sign_windows:
    name: Authenticode-sign Windows installer
    needs: [validate_release, build_windows]
    if: ${{ vars.OPENCLAW_RELEASE_WINDOWS_SIGNED == 'true' && needs.build_windows.result == 'success' }}
    runs-on: windows-2025
    timeout-minutes: 15
    environment: release-signing
    permissions:
      contents: read
      id-token: write
    outputs:
      signed_installer_artifact_id: ${{ steps.upload_signed.outputs.artifact-id }}
    steps:
      - name: Download unsigned Windows installer
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.build_windows.outputs.unsigned_updater_artifact_id }}
          path: dist/windows

      - name: Validate Windows signing input
        shell: pwsh
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
        run: |
          $ErrorActionPreference = "Stop"
          $version = $env:RELEASE_TAG.Substring(1)
          $files = @(Get-ChildItem dist/windows -File -Recurse)
          if ($files.Count -ne 1 -or $files[0].FullName -cne (Join-Path (Resolve-Path dist/windows).Path "OpenClaw-$version-windows-x86_64.exe")) {
            throw "Expected exactly the selected Windows installer before signing"
          }

      - name: Azure OIDC login
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Sign Windows installer
        uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2
        with:
          endpoint: https://eus.codesigning.azure.net/
          signing-account-name: openclaw
          certificate-profile-name: openclaw
          files-folder: dist/windows
          files-folder-filter: exe
          files-folder-recurse: true
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify Foundation Authenticode signature
        shell: pwsh
        env:
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
        run: |
          $ErrorActionPreference = "Stop"
          $version = $env:RELEASE_TAG.Substring(1)
          $signature = Get-AuthenticodeSignature -LiteralPath "dist/windows/OpenClaw-$version-windows-x86_64.exe"
          if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -cne 'CN=OpenClaw Foundation, O=OpenClaw Foundation, L=Mill Valley, S=California, C=US' -or -not $signature.TimeStamperCertificate) {
            throw "Expected a valid OpenClaw Foundation Authenticode signature"
          }

      - name: Upload Authenticode-signed installer
        id: upload_signed
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: windows-app-release-authenticode
          path: dist/windows/*.exe
          if-no-files-found: error

  # Windows and optional macOS bundles use the production updater trust root.
  # Only finalized artifacts enter this fresh signing job.
  sign_desktop:
    name: Sign finalized desktop updater bundles
    if: >-
      ${{ always() && needs.build_windows.result == 'success' &&
          (needs.validate_release.outputs.desktop_test_bundles != 'true' || needs.build_macos.result == 'success') &&
          (vars.OPENCLAW_RELEASE_WINDOWS_SIGNED != 'true' || needs.sign_windows.result == 'success') }}
    needs:
      - validate_release
      - build_macos
      - build_windows
      - sign_windows
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions: {}
    outputs:
      signed_desktop_artifact_id: ${{ steps.upload_signed_desktop.outputs.artifact-id }}
    steps:
      - name: Install trusted signing tools
        run: |
          set -euo pipefail
          minisign_archive="${RUNNER_TEMP}/minisign-0.12-linux.tar.gz"
          tauri_archive="${RUNNER_TEMP}/cargo-tauri-x86_64-unknown-linux-gnu.tgz"
          mkdir -p "${RUNNER_TEMP}/bin"
          curl --fail --location --silent --show-error --proto '=https' --tlsv1.2 \
            --connect-timeout 10 --max-time 120 --retry 3 --retry-all-errors \
            --output "$minisign_archive" "$MINISIGN_URL"
          printf '%s  %s\n' "$MINISIGN_ARCHIVE_SHA256" "$minisign_archive" | sha256sum --check -
          tar -xzf "$minisign_archive" -C "${RUNNER_TEMP}/bin" --strip-components=2 \
            minisign-linux/x86_64/minisign
          printf '%s  %s\n' "$MINISIGN_BINARY_SHA256" "${RUNNER_TEMP}/bin/minisign" |
            sha256sum --check -
          curl --fail --location --silent --show-error --proto '=https' --tlsv1.2 \
            --connect-timeout 10 --max-time 120 --retry 3 --retry-all-errors \
            --output "$tauri_archive" "$TAURI_CLI_URL"
          printf '%s  %s\n' "$TAURI_CLI_ARCHIVE_SHA256" "$tauri_archive" | sha256sum --check -
          tar -xzf "$tauri_archive" -C "${RUNNER_TEMP}/bin" cargo-tauri
          printf '%s  %s\n' "$TAURI_CLI_BINARY_SHA256" "${RUNNER_TEMP}/bin/cargo-tauri" |
            sha256sum --check -
          chmod 0555 "${RUNNER_TEMP}/bin/cargo-tauri" "${RUNNER_TEMP}/bin/minisign"
          "${RUNNER_TEMP}/bin/cargo-tauri" --version
          "${RUNNER_TEMP}/bin/minisign" -v

      - name: Download finalized macOS updater archive
        if: ${{ needs.validate_release.outputs.desktop_test_bundles == 'true' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.build_macos.outputs.unsigned_updater_artifact_id }}
          path: dist/signing-input/macos

      - name: Download finalized Windows updater installer
        if: ${{ vars.OPENCLAW_RELEASE_WINDOWS_SIGNED != 'true' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.build_windows.outputs.unsigned_updater_artifact_id }}
          path: dist/signing-input/windows

      - name: Download Authenticode-signed Windows updater installer
        if: ${{ vars.OPENCLAW_RELEASE_WINDOWS_SIGNED == 'true' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.sign_windows.outputs.signed_installer_artifact_id }}
          path: dist/signing-input/windows

      - name: Sign finalized desktop updater bundles
        env:
          DESKTOP_TEST_BUNDLES: ${{ needs.validate_release.outputs.desktop_test_bundles }}
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          TAG_SHA: ${{ needs.validate_release.outputs.tag_sha }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          UPDATER_PUBLIC_KEY: ${{ needs.validate_release.outputs.updater_pubkey }}
        run: |
          set -euo pipefail
          # Artifact download follows installation; revalidate exact tool bytes before using credentials.
          printf '%s  %s\n' "$TAURI_CLI_BINARY_SHA256" "${RUNNER_TEMP}/bin/cargo-tauri" |
            sha256sum --check -
          printf '%s  %s\n' "$MINISIGN_BINARY_SHA256" "${RUNNER_TEMP}/bin/minisign" |
            sha256sum --check -
          version="${RELEASE_TAG#v}"
          macos="dist/signing-input/macos/OpenClaw-${version}-darwin-aarch64.app.tar.gz"
          windows="dist/signing-input/windows/OpenClaw-${version}-windows-x86_64.exe"
          mapfile -d '' inputs < <(find dist/signing-input -type f -print0 | sort -z)
          expected=1
          if [[ "$DESKTOP_TEST_BUNDLES" == true ]]; then
            expected=2
            [[ -f "$macos" && ! -L "$macos" ]]
          fi
          if [[ ! "${TAG_SHA}" =~ ^[0-9a-f]{40}$ || ${#inputs[@]} -ne "$expected" ||
                ! -f "$windows" || -L "$windows" ]]; then
            echo "Signing input must be exactly the admitted desktop bundles for ${RELEASE_TAG}"
            exit 1
          fi
          verify_dir=$(mktemp -d)
          trap 'rm -rf "$verify_dir"' EXIT
          printf '%s' "$UPDATER_PUBLIC_KEY" | base64 --decode > "$verify_dir/updater.pub"
          for input in "${inputs[@]}"; do
            before=$(sha256sum "$input")
            "${RUNNER_TEMP}/bin/cargo-tauri" signer sign "$input"
            [[ "$before" == "$(sha256sum "$input")" && -s "${input}.sig" ]]
          done
          # Signature verification must not inherit production signing credentials.
          unset TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD
          for input in "${inputs[@]}"; do
            base64 --decode < "${input}.sig" > "$verify_dir/bundle.minisig"
            "${RUNNER_TEMP}/bin/minisign" -Vm "$input" -x "$verify_dir/bundle.minisig" -p "$verify_dir/updater.pub"
            platform=$(basename "$(dirname "$input")")
            mkdir -p "dist/desktop-test/$platform/release" "dist/desktop-test/$platform/signatures"
            cp "$input" "dist/desktop-test/$platform/release/"
            cp "${input}.sig" "dist/desktop-test/$platform/signatures/"
          done

      - name: Upload signed desktop updater bundles
        id: upload_signed_desktop
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: desktop-test-release-signed-updaters
          path: dist/desktop-test
          if-no-files-found: error

  publish:
    name: Publish companion bundles and updater manifest
    if: >-
      ${{
        always() &&
        (needs.validate_release.outputs.already_published == 'true' ||
          (needs.build_linux.result == 'success' &&
            needs.sign_linux.result == 'success')) &&
        (needs.validate_release.outputs.desktop_test_bundles != 'true' ||
          needs.build_macos.result == 'success') &&
        (needs.validate_release.outputs.already_published == 'true' ||
          needs.validate_release.outputs.windows_build != 'true' ||
          (needs.build_windows.result == 'success' && needs.sign_desktop.result == 'success'))
      }}
    needs:
      - validate_release
      - build_linux
      - sign_linux
      - build_macos
      - build_windows
      - sign_desktop
    # Core activation and Linux updates share this short publication queue.
    concurrency:
      group: linux-app-release-publish
      cancel-in-progress: false
      queue: max
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
    steps:
      - name: Checkout trusted Linux updater publication tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          fetch-depth: 1
          persist-credentials: false
          sparse-checkout: |
            scripts/linux-updater-manifest.mjs
            scripts/linux-app-channel.mjs
            scripts/release-tooling-identity.mjs
            scripts/lib/record-shared.mjs
            scripts/lib/release-version.mjs
            apps/linux/src-tauri/tauri.conf.json
          sparse-checkout-cone-mode: false

      - name: Install pinned public signature verifier
        run: |
          set -euo pipefail
          archive="${RUNNER_TEMP}/minisign.tar.gz"
          mkdir -p "${RUNNER_TEMP}/minisign"
          curl --fail --location --silent --show-error --proto '=https' --proto-redir '=https' \
            --connect-timeout 10 --max-time 120 "$MINISIGN_URL" -o "$archive"
          printf '%s  %s\n' "$MINISIGN_ARCHIVE_SHA256" "$archive" | sha256sum --check -
          tar -xzf "$archive" -C "${RUNNER_TEMP}/minisign" --strip-components=2 minisign-linux/x86_64/minisign
          printf '%s  %s\n' "$MINISIGN_BINARY_SHA256" "${RUNNER_TEMP}/minisign/minisign" | sha256sum --check -
          chmod 0555 "${RUNNER_TEMP}/minisign/minisign"
          echo "${RUNNER_TEMP}/minisign" >> "$GITHUB_PATH"

      - name: Download Debian bundle
        if: ${{ needs.validate_release.outputs.already_published != 'true' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.build_linux.outputs.deb_artifact_id }}
          path: dist/input/linux/release

      - name: Download signed AppImage
        if: ${{ needs.validate_release.outputs.already_published != 'true' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.sign_linux.outputs.signed_appimage_artifact_id }}
          path: dist/input/linux

      - name: Download macOS test DMG
        if: ${{ needs.validate_release.outputs.desktop_test_bundles == 'true' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.build_macos.outputs.dmg_artifact_id }}
          path: dist/input/macos/release

      - name: Download signed desktop updater bundles
        if: ${{ needs.validate_release.outputs.already_published != 'true' && needs.validate_release.outputs.windows_build == 'true' }}
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.sign_desktop.outputs.signed_desktop_artifact_id }}
          path: dist/input

      - name: Assemble release assets and updater manifest
        if: ${{ needs.validate_release.outputs.already_published != 'true' }}
        env:
          DESKTOP_TEST_BUNDLES: ${{ needs.validate_release.outputs.desktop_test_bundles }}
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          WINDOWS_BUILD: ${{ needs.validate_release.outputs.windows_build }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          mkdir -p dist/release
          cp dist/input/linux/release/* dist/release/
          if [[ "${WINDOWS_BUILD}" == "true" ]]; then
            cp dist/input/windows/release/* dist/release/
          fi
          if [[ "${DESKTOP_TEST_BUNDLES}" == "true" ]]; then
            cp dist/input/macos/release/* dist/release/
          fi

          # Checksums cover only immutable downloadable bundles.
          (cd dist/release && sha256sum ./* > SHA256SUMS.linux-app.txt)
          cat dist/release/SHA256SUMS.linux-app.txt
          # Linux updater metadata is written by the publisher; only Windows and
          # desktop-test manifests are assembled here.
          if [[ "${WINDOWS_BUILD}" != "true" ]]; then
            exit 0
          fi

          url_base="https://github.com/${GITHUB_REPOSITORY}/releases/download/${RELEASE_TAG}"
          release_json=$(gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --json body,publishedAt)
          pub_date=$(jq -er '.publishedAt' <<< "$release_json")
          notes=$(jq -r '.body // ""' <<< "$release_json")
          windows_signature=$(cat "dist/input/windows/signatures/OpenClaw-${version}-windows-x86_64.exe.sig")
          windows_manifest="${RUNNER_TEMP}/latest-windows.json"
          jq -n \
            --arg version "${version}" \
            --arg notes "${notes}" \
            --arg pub_date "${pub_date}" \
            --arg windows_signature "${windows_signature}" \
            --arg windows_url "${url_base}/OpenClaw-${version}-windows-x86_64.exe" \
            '{version: $version, notes: ($notes | .[0:2000]), pub_date: $pub_date, platforms: {"windows-x86_64": {signature: $windows_signature, url: $windows_url}}}' \
            > "$windows_manifest"
          if [[ "${WINDOWS_COMPANION_RELEASE}" == "true" ]]; then
            cp "$windows_manifest" dist/release/latest-windows.json
          fi
          if [[ "${DESKTOP_TEST_BUNDLES}" == "true" ]]; then
            macos_signature=$(cat "dist/input/macos/signatures/OpenClaw-${version}-darwin-aarch64.app.tar.gz.sig")
            jq --arg signature "$macos_signature" \
              --arg url "${url_base}/OpenClaw-${version}-darwin-aarch64.app.tar.gz" \
              '.platforms["darwin-aarch64"] = {signature: $signature, url: $url}' \
              "$windows_manifest" > dist/release/latest-desktop-test.json
          fi

      # The control tag can target release-branch workflows. Its existing
      # release owner needs workflows:write; GITHUB_TOKEN cannot grant it.
      - name: Create Linux publication token
        id: publication_token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: Iv23liOECG0slfuhz093
          private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }}
          owner: openclaw
          repositories: openclaw
          permission-actions: read
          permission-contents: write
          permission-workflows: write

      - name: Setup supported Node runtime
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24.22.1"
          package-manager-cache: false

      - name: Publish immutable bundles, canonical Linux channel, and legacy mirror
        env:
          GH_TOKEN: ${{ steps.publication_token.outputs.token }}
          RELEASE_TAG: ${{ needs.validate_release.outputs.release_tag }}
          DESKTOP_TEST_BUNDLES: ${{ needs.validate_release.outputs.desktop_test_bundles }}
          LOCAL_INPUTS: ${{ needs.validate_release.outputs.already_published != 'true' }}
          TAG_SHA: ${{ needs.validate_release.outputs.tag_sha }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
          WORKFLOW_REF: ${{ github.ref_name }}
          WORKFLOW_FULL_REF: ${{ github.ref }}
          REQUEST_RUN_ID: ${{ github.event.workflow_run.id }}
          REQUEST_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
        run: |
          set -euo pipefail
          input_args=()
          local_args=(--assets dist/release --signature "dist/input/linux/signatures/OpenClaw-${RELEASE_TAG#v}-amd64.AppImage.sig")
          publication_state="$(node scripts/linux-updater-manifest.mjs status \
            --tag "$RELEASE_TAG" --repository "$GITHUB_REPOSITORY" \
            --output "$RUNNER_TEMP/linux-release-before-upload")"
          if [[ "$(jq -r '.assetsComplete' <<< "$publication_state")" == true ]]; then
            if [[ "$DESKTOP_TEST_BUNDLES" == true ]]; then
              echo "Linux bundles already exist; refusing to replace published bytes. Recover only the missing desktop assets." >&2
              exit 1
            fi
            if [[ "$LOCAL_INPUTS" == true ]]; then
              # This run's signed inputs are the only copy of unpublished desktop metadata
              # after an interrupted publication; the publisher refuses any byte mismatch.
              input_args+=("${local_args[@]}")
              echo "- Linux: complete same-tag bundles exist; verifying this run's signed inputs against them before completing publication." >> "$GITHUB_STEP_SUMMARY"
            else
              echo "- Linux: a complete same-tag release exists; reusing its published bytes." >> "$GITHUB_STEP_SUMMARY"
            fi
          elif [[ "$(jq -er '.state' <<< "$publication_state")" == pending ]]; then
            input_args+=("${local_args[@]}")
          else
            echo "Linux publication state does not permit a new upload." >&2
            exit 1
          fi
          actual_sha="$(gh api "repos/$GITHUB_REPOSITORY/commits/$RELEASE_TAG" --jq .sha)"
          if [[ "$actual_sha" != "$TAG_SHA" ]]; then
            echo "Release tag moved after the Linux build; refusing publication." >&2
            exit 1
          fi
          printf '%s  %s\n' "$MINISIGN_BINARY_SHA256" "${RUNNER_TEMP}/minisign/minisign" | sha256sum --check -
          node scripts/linux-app-channel.mjs publish \
            --tag "$RELEASE_TAG" --source-sha "$TAG_SHA" --tooling-sha "$WORKFLOW_SHA" \
            --workflow-ref "$WORKFLOW_REF" --workflow-full-ref "$WORKFLOW_FULL_REF" \
            --request-run-id "$REQUEST_RUN_ID" --request-run-attempt "$REQUEST_RUN_ATTEMPT" \
            "${input_args[@]}" --public-key-config apps/linux/src-tauri/tauri.conf.json \
            --desktop-test "$DESKTOP_TEST_BUNDLES" --windows "$WINDOWS_COMPANION_RELEASE" \
            2> >(tee "$RUNNER_TEMP/linux-publication.log" >&2) | tee "$RUNNER_TEMP/linux-publication.json"

      - name: Record incomplete Linux publication
        if: ${{ failure() }}
        run: |
          echo "::warning::Linux publication is incomplete. Inspect canonical and legacy readbacks before retry; immutable bundle conflicts must not be overwritten."
          echo "- Linux channel: incomplete; reconcile this run. Core publication remains independent." >> "$GITHUB_STEP_SUMMARY"

      - name: Retain Linux updater publication evidence
        if: ${{ always() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-updater-publication-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            ${{ runner.temp }}/linux-publication.json
            ${{ runner.temp }}/linux-publication.log
            ${{ runner.temp }}/linux-release-before-upload
          if-no-files-found: ignore