release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: stable-release
  cancel-in-progress: false
  # Queue every pending tag run instead of replacing the one pending run.
  queue: max

jobs:
  authorize:
    name: Authorize owner release tag
    permissions: {}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Verify immutable owner and public repository identity
        env:
          EXPECTED_ACTOR_ID: "894119"
          # hraness-release-tagger[bot]: auto-tag.yml creates the tag once a
          # version bump passes CI on main.
          TAGGER_ACTOR_ID: "337004703"
          EXPECTED_REPOSITORY: "hraness/ghostget"
          EXPECTED_REPOSITORY_ID: "1316443113"
          REF_PROTECTED: ${{ github.ref_protected }}
        run: |
          set -euo pipefail
          if [[ "$GITHUB_EVENT_NAME" != push || \
                ( "$GITHUB_ACTOR_ID" != "$EXPECTED_ACTOR_ID" && "$GITHUB_ACTOR_ID" != "$TAGGER_ACTOR_ID" ) || \
                "$GITHUB_REPOSITORY" != "$EXPECTED_REPOSITORY" || \
                "$GITHUB_REPOSITORY_ID" != "$EXPECTED_REPOSITORY_ID" || \
                "$REF_PROTECTED" != true ]]; then
            echo "::error::Release requires an owner- or tagger-created protected tag in the exact public repository"
            exit 1
          fi
          EXPECTED_ACTOR_ID="$EXPECTED_ACTOR_ID" \
            EXPECTED_REPOSITORY="$EXPECTED_REPOSITORY" \
            EXPECTED_REPOSITORY_ID="$EXPECTED_REPOSITORY_ID" \
            TAGGER_ACTOR_ID="$TAGGER_ACTOR_ID" node <<'NODE'
          const { readFileSync } = require("node:fs");
          const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, "utf8"));
          if (
            ((event.sender?.id !== Number(process.env.EXPECTED_ACTOR_ID) || event.sender?.type !== "User")
              && (event.sender?.id !== Number(process.env.TAGGER_ACTOR_ID) || event.sender?.type !== "Bot"))
            || event.sender?.id !== Number(process.env.GITHUB_ACTOR_ID)
            || event.repository?.id !== Number(process.env.EXPECTED_REPOSITORY_ID)
            || event.repository?.full_name !== process.env.EXPECTED_REPOSITORY
            || event.repository?.visibility !== "public"
            || event.repository?.private !== false
            || event.repository?.default_branch !== "main"
          ) throw new Error("Tag-push sender or public repository identity is not the immutable release authority");
          NODE

  verify:
    name: Verify
    needs: authorize
    permissions:
      actions: read
      contents: read
      checks: read
      pull-requests: read
      security-events: read
    runs-on: ubuntu-latest
    timeout-minutes: 75
    outputs:
      verified_sha: ${{ steps.identity.outputs.sha }}
      verified_tag: ${{ steps.identity.outputs.tag }}
      workflow_sha: ${{ steps.identity.outputs.main_sha }}
      archive_name: ${{ steps.identity.outputs.archive_name }}
      artifact_hashes: ${{ steps.canonical.outputs.artifact_hashes }}
      build_artifact_id: ${{ steps.build_artifact.outputs.artifact-id }}
      release_notes_sha256: ${{ steps.notes.outputs.notes_sha256 }}
    steps:
      - name: Resolve release request
        id: request
        env:
          EVENT_NAME: ${{ github.event_name }}
          EVENT_REF: ${{ github.ref }}
          EVENT_REF_NAME: ${{ github.ref_name }}
          EVENT_REF_TYPE: ${{ github.ref_type }}
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" != "push" || "$EVENT_REF_TYPE" != "tag" || "$EVENT_REF" != "refs/tags/$EVENT_REF_NAME" ]]; then
            echo "::error::Release request is not one exact tag push"
            exit 1
          fi
          if [[ ! "$EVENT_REF_NAME" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "::error::Release request is not one stable semantic-version tag"
            exit 1
          fi
          if ! EVENT_REF_NAME="$EVENT_REF_NAME" node -e '
            const match = /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.exec(process.env.EVENT_REF_NAME ?? "");
            if (match === null || match.slice(1).some(part => BigInt(part) > BigInt(Number.MAX_SAFE_INTEGER))) process.exit(1);
          '; then
            echo "::error::Release request exceeds npm's supported semantic-version range"
            exit 1
          fi
          printf 'tag=%s\n' "$EVENT_REF_NAME" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 1
          fetch-tags: false
          persist-credentials: false
          ref: refs/tags/${{ steps.request.outputs.tag }}
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24.20.0"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.3.14"
      - name: Pin npm
        run: |
          set -euo pipefail
          npm install --global npm@11.19.0 \
            --ignore-scripts \
            --registry=https://registry.npmjs.org
          test "$(npm --version)" = "11.19.0"
          node -p 'JSON.stringify({ node: process.version, zlib: process.versions.zlib, platform: process.platform, arch: process.arch })'
      - name: Verify release identity
        id: identity
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          REQUESTED_TAG: ${{ steps.request.outputs.tag }}
        run: |
          set -euo pipefail
          authority_output="$(node --experimental-strip-types \
            ./scripts/release-ref-authority.ts release "$REQUESTED_TAG")"
          authority=()
          while IFS= read -r line; do authority+=("$line"); done < <(
            printf '%s\n' "$authority_output"
          )
          if [[ ${#authority[@]} -ne 3 || \
                ! "${authority[0]}" =~ ^sha=([a-f0-9]{40})$ ]]; then
            echo "::error::Release ref authority output is malformed"
            exit 1
          fi
          tag_commit="${BASH_REMATCH[1]}"
          if [[ "${authority[1]}" != "tag=$REQUESTED_TAG" || \
                ! "${authority[2]}" =~ ^main_sha=([a-f0-9]{40})$ ]]; then
            echo "::error::Release ref authority did not bind tag below protected current main"
            exit 1
          fi
          verified_main_sha="${BASH_REMATCH[1]}"
          package_version="$(bun -e 'const value = await Bun.file("package.json").json(); if (typeof value.version !== "string") process.exit(1); process.stdout.write(value.version)')"
          if [[ ! "$package_version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "::error::Package version $package_version is not a stable semantic version"
            exit 1
          fi
          if ! PACKAGE_VERSION="$package_version" node -e '
            const match = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.exec(process.env.PACKAGE_VERSION ?? "");
            if (match === null || match.slice(1).some(part => BigInt(part) > BigInt(Number.MAX_SAFE_INTEGER))) process.exit(1);
          '; then
            echo "::error::Package version $package_version exceeds npm's supported semantic-version range"
            exit 1
          fi
          expected_tag="v$package_version"
          if [[ "$REQUESTED_TAG" != "$expected_tag" ]]; then
            echo "::error::Tag $REQUESTED_TAG does not match package version $expected_tag"
            exit 1
          fi
          head_commit="$(git rev-parse --verify "HEAD^{commit}")"
          if [[ "$tag_commit" != "$head_commit" ]]; then
            echo "::error::Checked-out source $head_commit does not match tag commit $tag_commit"
            exit 1
          fi
          printf 'tag=%s\n' "$REQUESTED_TAG" >> "$GITHUB_OUTPUT"
          printf 'sha=%s\n' "$tag_commit" >> "$GITHUB_OUTPUT"
          printf 'main_sha=%s\n' "$verified_main_sha" >> "$GITHUB_OUTPUT"
          printf 'archive_name=hraness-ghostget-%s.tgz\n' "$package_version" >> "$GITHUB_OUTPUT"
      - name: Admit exact source CI and security
        env:
          GH_TOKEN: ${{ github.token }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          VERIFIED_SOURCE_SHA: ${{ steps.identity.outputs.sha }}
          VERIFIED_MAIN_SHA: ${{ steps.identity.outputs.main_sha }}
        run: bun run ./scripts/release-source-ci.ts admit
      - run: bun install --frozen-lockfile --ignore-scripts
      - run: bun run build
      - run: |
          generated_status="$(git status --porcelain --untracked-files=all -- dist bun.lock)"
          if [[ -n "$generated_status" ]]; then
            printf '%s\n' "$generated_status"
            exit 1
          fi
      - name: Render release notes from the tagged changelog
        id: notes
        env:
          VERIFIED_SHA: ${{ steps.identity.outputs.sha }}
          VERIFIED_TAG: ${{ steps.identity.outputs.tag }}
        run: |
          set -euo pipefail
          node ./website/release-notes.mjs render "$VERIFIED_TAG" "$VERIFIED_SHA"
          node ./website/release-notes.mjs notes-sha256 "$VERIFIED_TAG" "$VERIFIED_SHA" >> "$GITHUB_OUTPUT"
      - run: bun pm pack --dry-run --ignore-scripts
      - run: node --input-type=module -e 'await Promise.all(["./dist/index.js","./dist/client.js","./dist/beeper-client.js","./dist/apple-photos-client.js","./dist/whatsapp-client.js","./dist/omni-client.js","./dist/messaging.js","./dist/messaging-automation-api.js","./dist/contracts.js"].map((path) => import(path)))'
      - name: Prepare and install the exact canonical archive
        id: canonical
        env:
          VERIFIED_SHA: ${{ steps.identity.outputs.sha }}
          VERIFIED_TAG: ${{ steps.identity.outputs.tag }}
          WORKFLOW_SHA: ${{ steps.identity.outputs.main_sha }}
        run: |
          set -euo pipefail
          directory="$RUNNER_TEMP/ghostget-canonical"
          mkdir -m 700 "$directory"
          npm pack --ignore-scripts --json --pack-destination "$directory" \
            --registry=https://registry.npmjs.org > "$directory/npm-pack.json"
          bun run ./scripts/github-release-artifact.ts prepare "$directory"
          bun run ./scripts/package-smoke.ts \
            --archive "$directory/hraness-ghostget-${VERIFIED_TAG#v}.tgz" \
            --pack-json "$directory/npm-pack.json"
          DIRECTORY="$directory" node <<'NODE'
          const fs = require("node:fs"); const path = require("node:path"); const crypto = require("node:crypto");
          const names = fs.readdirSync(process.env.DIRECTORY).sort();
          const hashes = Object.fromEntries(names.map(name => [name, crypto.createHash("sha256").update(fs.readFileSync(path.join(process.env.DIRECTORY, name))).digest("hex")]));
          fs.appendFileSync(process.env.GITHUB_OUTPUT, `artifact_hashes=${JSON.stringify(hashes)}\n`);
          NODE
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        id: build_artifact
        with:
          name: canonical-build-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/ghostget-canonical
          if-no-files-found: error
          retention-days: 30

  attest:
    name: Attest exact canonical build files
    outputs:
      artifact_id: ${{ steps.attested_artifact.outputs.artifact-id }}
      bundle_sha256: ${{ steps.bundle.outputs.bundle_sha256 }}
    needs: verify
    permissions:
      actions: read
      contents: read
      id-token: write
      attestations: write
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      DEFAULT_BRANCH: main
      GH_TOKEN: ${{ github.token }}
      VERIFIED_SHA: ${{ needs.verify.outputs.verified_sha }}
      VERIFIED_TAG: ${{ needs.verify.outputs.verified_tag }}
    steps:
      - name: Reauthorize current release attempt
        env:
          EXPECTED_ACTOR_ID: "894119"
          EXPECTED_REPOSITORY: "hraness/ghostget"
          EXPECTED_REPOSITORY_ID: "1316443113"
          EXPECTED_WORKFLOW_ID: "323493609"
          EXPECTED_WORKFLOW_PATH: ".github/workflows/release.yml"
        run: |
          set -euo pipefail
          if [[ ! "$GITHUB_RUN_ID" =~ ^[1-9][0-9]*$ || \
                ! "$GITHUB_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ || \
                ! "$VERIFIED_SHA" =~ ^[a-f0-9]{40}$ || \
                ! "$VERIFIED_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ || \
                "$GITHUB_EVENT_NAME" != push || \
                "$GITHUB_REPOSITORY" != "$EXPECTED_REPOSITORY" || \
                "$GITHUB_REPOSITORY_ID" != "$EXPECTED_REPOSITORY_ID" || \
                "$GITHUB_REF" != "refs/tags/$VERIFIED_TAG" || \
                "$GITHUB_SHA" != "$VERIFIED_SHA" ]]; then
            echo "::error::Current release attempt is not the exact protected tag run"
            exit 1
          fi
          if ! VERIFIED_TAG="$VERIFIED_TAG" node -e '
            const value = process.env.VERIFIED_TAG ?? "";
            const match = /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.exec(value);
            if (match === null || match.slice(1).some(part => BigInt(part) > BigInt(Number.MAX_SAFE_INTEGER))) process.exit(1);
          '; then
            echo "::error::Current release attempt has an unsupported stable version"
            exit 1
          fi
          attempt_json="$(mktemp "$RUNNER_TEMP/ghostget-release-attempt.XXXXXX")"
          workflow_json="$(mktemp "$RUNNER_TEMP/ghostget-release-workflow.XXXXXX")"
          repository_json="$(mktemp "$RUNNER_TEMP/ghostget-release-repository.XXXXXX")"
          tag_ref_json="$(mktemp "$RUNNER_TEMP/ghostget-release-tag-ref.XXXXXX")"
          trap 'rm -f "$attempt_json" "$workflow_json" "$repository_json" "$tag_ref_json"' EXIT
          gh api --method GET \
            "/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT" \
            > "$attempt_json"
          gh api --method GET \
            "/repos/$GITHUB_REPOSITORY/actions/workflows/$EXPECTED_WORKFLOW_ID" \
            > "$workflow_json"
          gh api --method GET "/repos/$GITHUB_REPOSITORY" > "$repository_json"
          ATTEMPT_JSON="$attempt_json" \
            WORKFLOW_JSON="$workflow_json" \
            REPOSITORY_JSON="$repository_json" \
            EXPECTED_ACTOR_ID="$EXPECTED_ACTOR_ID" \
            EXPECTED_REPOSITORY="$EXPECTED_REPOSITORY" \
            EXPECTED_REPOSITORY_ID="$EXPECTED_REPOSITORY_ID" \
            EXPECTED_RUN_ID="$GITHUB_RUN_ID" \
            EXPECTED_RUN_ATTEMPT="$GITHUB_RUN_ATTEMPT" \
            EXPECTED_SHA="$VERIFIED_SHA" \
            EXPECTED_TAG="$VERIFIED_TAG" \
            EXPECTED_WORKFLOW_ID="$EXPECTED_WORKFLOW_ID" \
            EXPECTED_WORKFLOW_PATH="$EXPECTED_WORKFLOW_PATH" node <<'NODE'
          const { readFileSync } = require("node:fs");
          const positiveInteger = (name) => {
            const value = process.env[name] ?? "";
            if (!/^[1-9][0-9]*$/u.test(value)) throw new Error(`Invalid ${name}`);
            const number = Number(value);
            if (!Number.isSafeInteger(number)) throw new Error(`Unsafe ${name}`);
            return number;
          };
          const attempt = JSON.parse(readFileSync(process.env.ATTEMPT_JSON, "utf8"));
          const workflow = JSON.parse(readFileSync(process.env.WORKFLOW_JSON, "utf8"));
          const repository = JSON.parse(readFileSync(process.env.REPOSITORY_JSON, "utf8"));
          const actorId = positiveInteger("EXPECTED_ACTOR_ID");
          const taggerId = 337004703;
          const repositoryId = positiveInteger("EXPECTED_REPOSITORY_ID");
          const runId = positiveInteger("EXPECTED_RUN_ID");
          const runAttempt = positiveInteger("EXPECTED_RUN_ATTEMPT");
          const workflowId = positiveInteger("EXPECTED_WORKFLOW_ID");
          if (
            attempt.id !== runId
            || attempt.run_attempt !== runAttempt
            || attempt.workflow_id !== workflowId
            || attempt.path !== process.env.EXPECTED_WORKFLOW_PATH
            || attempt.event !== "push"
            || attempt.head_branch !== process.env.EXPECTED_TAG
            || attempt.head_sha !== process.env.EXPECTED_SHA
            || attempt.status !== "in_progress"
            || attempt.conclusion !== null
            || ((attempt.actor?.id !== actorId || attempt.actor?.type !== "User")
              && (attempt.actor?.id !== taggerId || attempt.actor?.type !== "Bot"))
            || ((attempt.triggering_actor?.id !== actorId || attempt.triggering_actor?.type !== "User")
              && (attempt.triggering_actor?.id !== taggerId || attempt.triggering_actor?.type !== "Bot"))
            || attempt.repository?.id !== repositoryId
            || attempt.repository?.full_name !== process.env.EXPECTED_REPOSITORY
            || attempt.repository?.private !== false
            || workflow.id !== workflowId
            || workflow.path !== process.env.EXPECTED_WORKFLOW_PATH
            || workflow.state !== "active"
            || repository.id !== repositoryId
            || repository.full_name !== process.env.EXPECTED_REPOSITORY
            || repository.visibility !== "public"
            || repository.private !== false
            || repository.default_branch !== "main"
          ) throw new Error("Current release attempt is not owner-authorized for this exact public workflow");
          NODE
          gh api --method GET "/repos/$GITHUB_REPOSITORY/git/ref/tags/$VERIFIED_TAG" \
            > "$tag_ref_json"
          TAG_REF_JSON="$tag_ref_json" EXPECTED_SHA="$VERIFIED_SHA" node -e '
            const value = JSON.parse(require("node:fs").readFileSync(process.env.TAG_REF_JSON, "utf8"));
            if (value?.object?.type !== "commit" || value.object.sha !== process.env.EXPECTED_SHA) process.exit(1);
          '
          current_default_sha="$(gh api --method GET --jq '.sha' \
            "/repos/$GITHUB_REPOSITORY/commits/$DEFAULT_BRANCH")"
          if [[ ! "$current_default_sha" =~ ^[a-f0-9]{40}$ ]]; then
            echo "::error::Current protected main identity is malformed"
            exit 1
          fi
          comparison_status="$(gh api --method GET --jq '.status' \
            "/repos/$GITHUB_REPOSITORY/compare/$VERIFIED_SHA...$current_default_sha")"
          if [[ "$comparison_status" != ahead && "$comparison_status" != identical ]]; then
            echo "::error::Tag $VERIFIED_TAG is no longer reachable from $DEFAULT_BRANCH"
            exit 1
          fi
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          name: canonical-build-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/ghostget-canonical
      - name: Bind source-free attestation input
        env:
          DIRECTORY: ${{ runner.temp }}/ghostget-canonical
          EXPECTED_WORKFLOW_SHA: ${{ needs.verify.outputs.workflow_sha }}
          EXPECTED_ARTIFACT_HASHES: ${{ needs.verify.outputs.artifact_hashes }}
        run: |
          set -euo pipefail
          node <<'NODE'
          const fs = require('node:fs'); const path = require('node:path'); const crypto = require('node:crypto');
          const directory = process.env.DIRECTORY;
          const names = [`hraness-ghostget-${process.env.VERIFIED_TAG.slice(1)}.tgz`, 'npm-pack.json', 'release-manifest.json', 'SHA256SUMS'];
          const [major, minor, patch] = process.env.VERIFIED_TAG.slice(1).split('.').map(BigInt);
          const bundledMessaging = major > 0n || minor > 18n || (minor === 18n && patch >= 1n);
          const byteLimit = (name) => name === names[0] ? (bundledMessaging ? 12 : 8) * 1024 * 1024
            : ['npm-pack.json', 'release-manifest.json'].includes(name) ? 1024 * 1024 : 8 * 1024 * 1024;
          if (fs.readdirSync(directory).sort().join(',') !== [...names].sort().join(',')) throw new Error('Attestation input inventory differs');
          const hashes = JSON.parse(process.env.EXPECTED_ARTIFACT_HASHES);
          if (hashes === null || typeof hashes !== 'object' || Array.isArray(hashes) || Object.keys(hashes).sort().join(',') !== [...names].sort().join(',')) throw new Error('Trusted build hashes are malformed');
          for (const name of names) {
            const stat = fs.lstatSync(path.join(directory, name));
            if (!stat.isFile() || stat.isSymbolicLink() || stat.size <= 0 || stat.size > byteLimit(name)) throw new Error('Attestation input is not a bounded regular file');
            if (typeof hashes[name] !== 'string' || !/^[a-f0-9]{64}$/u.test(hashes[name]) || crypto.createHash('sha256').update(fs.readFileSync(path.join(directory, name))).digest('hex') !== hashes[name]) throw new Error('Attestation input differs from verified build output');
          }
          const manifest = JSON.parse(fs.readFileSync(path.join(directory, 'release-manifest.json'), 'utf8'));
          if (manifest.sourceSha !== process.env.VERIFIED_SHA || manifest.tag !== process.env.VERIFIED_TAG || manifest.workflowSha !== process.env.EXPECTED_WORKFLOW_SHA || manifest.runId !== Number(process.env.GITHUB_RUN_ID) || manifest.runAttempt !== Number(process.env.GITHUB_RUN_ATTEMPT) || manifest.repositoryId !== 1316443113 || manifest.package !== '@hraness/ghostget') throw new Error('Attestation input belongs to another build');
          const expected = names.slice(0, 3).map(name => `${crypto.createHash('sha256').update(fs.readFileSync(path.join(directory, name))).digest('hex')}  ${name}\n`).join('');
          if (fs.readFileSync(path.join(directory, 'SHA256SUMS'), 'utf8') !== expected) throw new Error('Attestation input checksums differ');
          NODE
      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        id: provenance
        with:
          subject-path: |
            ${{ runner.temp }}/ghostget-canonical/${{ needs.verify.outputs.archive_name }}
            ${{ runner.temp }}/ghostget-canonical/npm-pack.json
            ${{ runner.temp }}/ghostget-canonical/release-manifest.json
            ${{ runner.temp }}/ghostget-canonical/SHA256SUMS
          push-to-registry: false
          create-storage-record: false
      - name: Retain verified provenance bundle
        id: bundle
        env:
          BUNDLE_PATH: ${{ steps.provenance.outputs.bundle-path }}
        run: |
          set -euo pipefail
          cp -- "$BUNDLE_PATH" "$RUNNER_TEMP/ghostget-canonical/provenance.jsonl"
          bundle_sha256="$(sha256sum "$RUNNER_TEMP/ghostget-canonical/provenance.jsonl" | awk '{ print $1 }')"
          printf 'bundle_sha256=%s\n' "$bundle_sha256" >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        id: attested_artifact
        with:
          name: canonical-attested-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/ghostget-canonical
          if-no-files-found: error
          retention-days: 30

  publish:
    name: Publish immutable GitHub Release
    needs: [verify, attest]
    permissions:
      actions: read
      contents: write
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      DEFAULT_BRANCH: main
      GH_REPO: ${{ github.repository }}
      GH_TOKEN: ${{ github.token }}
      VERIFIED_SHA: ${{ needs.verify.outputs.verified_sha }}
      VERIFIED_TAG: ${{ needs.verify.outputs.verified_tag }}
      WORKFLOW_SHA: ${{ needs.verify.outputs.workflow_sha }}
      EXPECTED_ARTIFACT_HASHES: ${{ needs.verify.outputs.artifact_hashes }}
      EXPECTED_BUNDLE_SHA256: ${{ needs.attest.outputs.bundle_sha256 }}
      EXPECTED_RELEASE_NOTES_SHA256: ${{ needs.verify.outputs.release_notes_sha256 }}
    steps:
      - name: Reauthorize current release attempt
        env:
          EXPECTED_ACTOR_ID: "894119"
          EXPECTED_REPOSITORY: "hraness/ghostget"
          EXPECTED_REPOSITORY_ID: "1316443113"
          EXPECTED_WORKFLOW_ID: "323493609"
          EXPECTED_WORKFLOW_PATH: ".github/workflows/release.yml"
        run: |
          set -euo pipefail
          if [[ ! "$GITHUB_RUN_ID" =~ ^[1-9][0-9]*$ || \
                ! "$GITHUB_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ || \
                ! "$VERIFIED_SHA" =~ ^[a-f0-9]{40}$ || \
                ! "$VERIFIED_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ || \
                "$GITHUB_EVENT_NAME" != push || \
                "$GITHUB_REPOSITORY" != "$EXPECTED_REPOSITORY" || \
                "$GITHUB_REPOSITORY_ID" != "$EXPECTED_REPOSITORY_ID" || \
                "$GITHUB_REF" != "refs/tags/$VERIFIED_TAG" || \
                "$GITHUB_SHA" != "$VERIFIED_SHA" ]]; then
            echo "::error::Current release attempt is not the exact protected tag run"
            exit 1
          fi
          if ! VERIFIED_TAG="$VERIFIED_TAG" node -e '
            const value = process.env.VERIFIED_TAG ?? "";
            const match = /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.exec(value);
            if (match === null || match.slice(1).some(part => BigInt(part) > BigInt(Number.MAX_SAFE_INTEGER))) process.exit(1);
          '; then
            echo "::error::Current release attempt has an unsupported stable version"
            exit 1
          fi
          attempt_json="$(mktemp "$RUNNER_TEMP/ghostget-release-attempt.XXXXXX")"
          workflow_json="$(mktemp "$RUNNER_TEMP/ghostget-release-workflow.XXXXXX")"
          repository_json="$(mktemp "$RUNNER_TEMP/ghostget-release-repository.XXXXXX")"
          tag_ref_json="$(mktemp "$RUNNER_TEMP/ghostget-release-tag-ref.XXXXXX")"
          trap 'rm -f "$attempt_json" "$workflow_json" "$repository_json" "$tag_ref_json"' EXIT
          gh api --method GET \
            "/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT" \
            > "$attempt_json"
          gh api --method GET \
            "/repos/$GITHUB_REPOSITORY/actions/workflows/$EXPECTED_WORKFLOW_ID" \
            > "$workflow_json"
          gh api --method GET "/repos/$GITHUB_REPOSITORY" > "$repository_json"
          ATTEMPT_JSON="$attempt_json" \
            WORKFLOW_JSON="$workflow_json" \
            REPOSITORY_JSON="$repository_json" \
            EXPECTED_ACTOR_ID="$EXPECTED_ACTOR_ID" \
            EXPECTED_REPOSITORY="$EXPECTED_REPOSITORY" \
            EXPECTED_REPOSITORY_ID="$EXPECTED_REPOSITORY_ID" \
            EXPECTED_RUN_ID="$GITHUB_RUN_ID" \
            EXPECTED_RUN_ATTEMPT="$GITHUB_RUN_ATTEMPT" \
            EXPECTED_SHA="$VERIFIED_SHA" \
            EXPECTED_TAG="$VERIFIED_TAG" \
            EXPECTED_WORKFLOW_ID="$EXPECTED_WORKFLOW_ID" \
            EXPECTED_WORKFLOW_PATH="$EXPECTED_WORKFLOW_PATH" node <<'NODE'
          const { readFileSync } = require("node:fs");
          const positiveInteger = (name) => {
            const value = process.env[name] ?? "";
            if (!/^[1-9][0-9]*$/u.test(value)) throw new Error(`Invalid ${name}`);
            const number = Number(value);
            if (!Number.isSafeInteger(number)) throw new Error(`Unsafe ${name}`);
            return number;
          };
          const attempt = JSON.parse(readFileSync(process.env.ATTEMPT_JSON, "utf8"));
          const workflow = JSON.parse(readFileSync(process.env.WORKFLOW_JSON, "utf8"));
          const repository = JSON.parse(readFileSync(process.env.REPOSITORY_JSON, "utf8"));
          const actorId = positiveInteger("EXPECTED_ACTOR_ID");
          const taggerId = 337004703;
          const repositoryId = positiveInteger("EXPECTED_REPOSITORY_ID");
          const runId = positiveInteger("EXPECTED_RUN_ID");
          const runAttempt = positiveInteger("EXPECTED_RUN_ATTEMPT");
          const workflowId = positiveInteger("EXPECTED_WORKFLOW_ID");
          if (
            attempt.id !== runId
            || attempt.run_attempt !== runAttempt
            || attempt.workflow_id !== workflowId
            || attempt.path !== process.env.EXPECTED_WORKFLOW_PATH
            || attempt.event !== "push"
            || attempt.head_branch !== process.env.EXPECTED_TAG
            || attempt.head_sha !== process.env.EXPECTED_SHA
            || attempt.status !== "in_progress"
            || attempt.conclusion !== null
            || ((attempt.actor?.id !== actorId || attempt.actor?.type !== "User")
              && (attempt.actor?.id !== taggerId || attempt.actor?.type !== "Bot"))
            || ((attempt.triggering_actor?.id !== actorId || attempt.triggering_actor?.type !== "User")
              && (attempt.triggering_actor?.id !== taggerId || attempt.triggering_actor?.type !== "Bot"))
            || attempt.repository?.id !== repositoryId
            || attempt.repository?.full_name !== process.env.EXPECTED_REPOSITORY
            || attempt.repository?.private !== false
            || workflow.id !== workflowId
            || workflow.path !== process.env.EXPECTED_WORKFLOW_PATH
            || workflow.state !== "active"
            || repository.id !== repositoryId
            || repository.full_name !== process.env.EXPECTED_REPOSITORY
            || repository.visibility !== "public"
            || repository.private !== false
            || repository.default_branch !== "main"
          ) throw new Error("Current release attempt is not owner-authorized for this exact public workflow");
          NODE
          gh api --method GET "/repos/$GITHUB_REPOSITORY/git/ref/tags/$VERIFIED_TAG" \
            > "$tag_ref_json"
          TAG_REF_JSON="$tag_ref_json" EXPECTED_SHA="$VERIFIED_SHA" node -e '
            const value = JSON.parse(require("node:fs").readFileSync(process.env.TAG_REF_JSON, "utf8"));
            if (value?.object?.type !== "commit" || value.object.sha !== process.env.EXPECTED_SHA) process.exit(1);
          '
          current_default_sha="$(gh api --method GET --jq '.sha' \
            "/repos/$GITHUB_REPOSITORY/commits/$DEFAULT_BRANCH")"
          if [[ ! "$current_default_sha" =~ ^[a-f0-9]{40}$ ]]; then
            echo "::error::Current protected main identity is malformed"
            exit 1
          fi
          comparison_status="$(gh api --method GET --jq '.status' \
            "/repos/$GITHUB_REPOSITORY/compare/$VERIFIED_SHA...$current_default_sha")"
          if [[ "$comparison_status" != ahead && "$comparison_status" != identical ]]; then
            echo "::error::Tag $VERIFIED_TAG is no longer reachable from $DEFAULT_BRANCH"
            exit 1
          fi
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 1
          fetch-tags: false
          persist-credentials: false
          ref: ${{ needs.verify.outputs.verified_sha }}
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24.20.0"
          package-manager-cache: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.3.14"
      - name: Bind carried attested artifact identity
        env:
          EXPECTED_ARTIFACT_ID: ${{ needs.attest.outputs.artifact_id }}
        run: |
          set -euo pipefail
          # Rerunning failed jobs carries attest's outputs and artifact from the
          # attesting attempt; an empty ID would download every run artifact.
          if [[ ! "$EXPECTED_ARTIFACT_ID" =~ ^[1-9][0-9]*$ || \
                ! "$EXPECTED_BUNDLE_SHA256" =~ ^[a-f0-9]{64}$ || \
                ! "$EXPECTED_RELEASE_NOTES_SHA256" =~ ^[a-f0-9]{64}$ || \
                ! "$VERIFIED_SHA" =~ ^[a-f0-9]{40}$ || \
                ! "$WORKFLOW_SHA" =~ ^[a-f0-9]{40}$ || \
                ! "$VERIFIED_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ || \
                ! "$GITHUB_RUN_ID" =~ ^[1-9][0-9]*$ || \
                ! "$GITHUB_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]; then
            echo "::error::Attested canonical artifact has no exact immutable identity"
            exit 1
          fi
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          artifact-ids: ${{ needs.attest.outputs.artifact_id }}
          merge-multiple: true
          path: ${{ runner.temp }}/ghostget-canonical
      - name: Verify signed canonical assets and publish exact immutable Release
        run: bun run ./scripts/github-release-publish.ts "$RUNNER_TEMP/ghostget-canonical"

  publish_npm:
    name: Publish exact npm package through OIDC
    needs: [verify, attest, publish]
    permissions:
      actions: read
      contents: read
      id-token: write
    environment: npm-release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      npm_state: ${{ steps.registry.outputs.npm_state }}
      published_identity: ${{ steps.npm_publish.outputs.published_identity }}
    env:
      DEFAULT_BRANCH: main
      GH_TOKEN: ${{ github.token }}
      VERIFIED_SHA: ${{ needs.verify.outputs.verified_sha }}
      VERIFIED_TAG: ${{ needs.verify.outputs.verified_tag }}
      WORKFLOW_SHA: ${{ needs.verify.outputs.workflow_sha }}
      EXPECTED_ARTIFACT_HASHES: ${{ needs.verify.outputs.artifact_hashes }}
      EXPECTED_BUNDLE_SHA256: ${{ needs.attest.outputs.bundle_sha256 }}
      EXPECTED_RELEASE_NOTES_SHA256: ${{ needs.verify.outputs.release_notes_sha256 }}
    steps:
      - name: Reauthorize current release attempt
        env:
          EXPECTED_ACTOR_ID: "894119"
          EXPECTED_REPOSITORY: "hraness/ghostget"
          EXPECTED_REPOSITORY_ID: "1316443113"
          EXPECTED_WORKFLOW_ID: "323493609"
          EXPECTED_WORKFLOW_PATH: ".github/workflows/release.yml"
        run: |
          set -euo pipefail
          if [[ ! "$GITHUB_RUN_ID" =~ ^[1-9][0-9]*$ || \
                ! "$GITHUB_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ || \
                ! "$VERIFIED_SHA" =~ ^[a-f0-9]{40}$ || \
                ! "$VERIFIED_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ || \
                "$GITHUB_EVENT_NAME" != push || \
                "$GITHUB_REPOSITORY" != "$EXPECTED_REPOSITORY" || \
                "$GITHUB_REPOSITORY_ID" != "$EXPECTED_REPOSITORY_ID" || \
                "$GITHUB_REF" != "refs/tags/$VERIFIED_TAG" || \
                "$GITHUB_SHA" != "$VERIFIED_SHA" ]]; then
            echo "::error::Current release attempt is not the exact protected tag run"
            exit 1
          fi
          if ! VERIFIED_TAG="$VERIFIED_TAG" node -e '
            const value = process.env.VERIFIED_TAG ?? "";
            const match = /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.exec(value);
            if (match === null || match.slice(1).some(part => BigInt(part) > BigInt(Number.MAX_SAFE_INTEGER))) process.exit(1);
          '; then
            echo "::error::Current release attempt has an unsupported stable version"
            exit 1
          fi
          attempt_json="$(mktemp "$RUNNER_TEMP/ghostget-release-attempt.XXXXXX")"
          workflow_json="$(mktemp "$RUNNER_TEMP/ghostget-release-workflow.XXXXXX")"
          repository_json="$(mktemp "$RUNNER_TEMP/ghostget-release-repository.XXXXXX")"
          tag_ref_json="$(mktemp "$RUNNER_TEMP/ghostget-release-tag-ref.XXXXXX")"
          trap 'rm -f "$attempt_json" "$workflow_json" "$repository_json" "$tag_ref_json"' EXIT
          gh api --method GET \
            "/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT" \
            > "$attempt_json"
          gh api --method GET \
            "/repos/$GITHUB_REPOSITORY/actions/workflows/$EXPECTED_WORKFLOW_ID" \
            > "$workflow_json"
          gh api --method GET "/repos/$GITHUB_REPOSITORY" > "$repository_json"
          ATTEMPT_JSON="$attempt_json" \
            WORKFLOW_JSON="$workflow_json" \
            REPOSITORY_JSON="$repository_json" \
            EXPECTED_ACTOR_ID="$EXPECTED_ACTOR_ID" \
            EXPECTED_REPOSITORY="$EXPECTED_REPOSITORY" \
            EXPECTED_REPOSITORY_ID="$EXPECTED_REPOSITORY_ID" \
            EXPECTED_RUN_ID="$GITHUB_RUN_ID" \
            EXPECTED_RUN_ATTEMPT="$GITHUB_RUN_ATTEMPT" \
            EXPECTED_SHA="$VERIFIED_SHA" \
            EXPECTED_TAG="$VERIFIED_TAG" \
            EXPECTED_WORKFLOW_ID="$EXPECTED_WORKFLOW_ID" \
            EXPECTED_WORKFLOW_PATH="$EXPECTED_WORKFLOW_PATH" node <<'NODE'
          const { readFileSync } = require("node:fs");
          const positiveInteger = (name) => {
            const value = process.env[name] ?? "";
            if (!/^[1-9][0-9]*$/u.test(value)) throw new Error(`Invalid ${name}`);
            const number = Number(value);
            if (!Number.isSafeInteger(number)) throw new Error(`Unsafe ${name}`);
            return number;
          };
          const attempt = JSON.parse(readFileSync(process.env.ATTEMPT_JSON, "utf8"));
          const workflow = JSON.parse(readFileSync(process.env.WORKFLOW_JSON, "utf8"));
          const repository = JSON.parse(readFileSync(process.env.REPOSITORY_JSON, "utf8"));
          const actorId = positiveInteger("EXPECTED_ACTOR_ID");
          const taggerId = 337004703;
          const repositoryId = positiveInteger("EXPECTED_REPOSITORY_ID");
          const runId = positiveInteger("EXPECTED_RUN_ID");
          const runAttempt = positiveInteger("EXPECTED_RUN_ATTEMPT");
          const workflowId = positiveInteger("EXPECTED_WORKFLOW_ID");
          if (
            attempt.id !== runId
            || attempt.run_attempt !== runAttempt
            || attempt.workflow_id !== workflowId
            || attempt.path !== process.env.EXPECTED_WORKFLOW_PATH
            || attempt.event !== "push"
            || attempt.head_branch !== process.env.EXPECTED_TAG
            || attempt.head_sha !== process.env.EXPECTED_SHA
            || attempt.status !== "in_progress"
            || attempt.conclusion !== null
            || ((attempt.actor?.id !== actorId || attempt.actor?.type !== "User")
              && (attempt.actor?.id !== taggerId || attempt.actor?.type !== "Bot"))
            || ((attempt.triggering_actor?.id !== actorId || attempt.triggering_actor?.type !== "User")
              && (attempt.triggering_actor?.id !== taggerId || attempt.triggering_actor?.type !== "Bot"))
            || attempt.repository?.id !== repositoryId
            || attempt.repository?.full_name !== process.env.EXPECTED_REPOSITORY
            || attempt.repository?.private !== false
            || workflow.id !== workflowId
            || workflow.path !== process.env.EXPECTED_WORKFLOW_PATH
            || workflow.state !== "active"
            || repository.id !== repositoryId
            || repository.full_name !== process.env.EXPECTED_REPOSITORY
            || repository.visibility !== "public"
            || repository.private !== false
            || repository.default_branch !== "main"
          ) throw new Error("Current release attempt is not owner-authorized for this exact public workflow");
          NODE
          gh api --method GET "/repos/$GITHUB_REPOSITORY/git/ref/tags/$VERIFIED_TAG" \
            > "$tag_ref_json"
          TAG_REF_JSON="$tag_ref_json" EXPECTED_SHA="$VERIFIED_SHA" node -e '
            const value = JSON.parse(require("node:fs").readFileSync(process.env.TAG_REF_JSON, "utf8"));
            if (value?.object?.type !== "commit" || value.object.sha !== process.env.EXPECTED_SHA) process.exit(1);
          '
          current_default_sha="$(gh api --method GET --jq '.sha' \
            "/repos/$GITHUB_REPOSITORY/commits/$DEFAULT_BRANCH")"
          if [[ ! "$current_default_sha" =~ ^[a-f0-9]{40}$ ]]; then
            echo "::error::Current protected main identity is malformed"
            exit 1
          fi
          comparison_status="$(gh api --method GET --jq '.status' \
            "/repos/$GITHUB_REPOSITORY/compare/$VERIFIED_SHA...$current_default_sha")"
          if [[ "$comparison_status" != ahead && "$comparison_status" != identical ]]; then
            echo "::error::Tag $VERIFIED_TAG is no longer reachable from $DEFAULT_BRANCH"
            exit 1
          fi
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24.20.0"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false
      - name: Pin npm
        run: |
          set -euo pipefail
          npm install --global npm@11.19.0 \
            --ignore-scripts \
            --registry=https://registry.npmjs.org
          test "$(npm --version)" = "11.19.0"
      - name: Establish clean npm publication defaults
        id: npm_config
        run: |
          set -euo pipefail
          clean_directory="$RUNNER_TEMP/ghostget-clean-npm"
          user_config="$RUNNER_TEMP/ghostget-npm-userconfig"
          global_config="$RUNNER_TEMP/ghostget-npm-globalconfig"
          mkdir -p "$clean_directory"
          : > "$user_config"
          : > "$global_config"
          chmod 600 "$user_config" "$global_config"
          unset NPM_CONFIG_TAG npm_config_tag
          configured_tag="$(cd "$clean_directory" && \
            NPM_CONFIG_USERCONFIG="$user_config" \
            NPM_CONFIG_GLOBALCONFIG="$global_config" \
            npm config get tag)"
          if [[ "$configured_tag" != latest ]]; then
            echo "::error::Pinned npm does not have the clean default publication tag latest"
            exit 1
          fi
          printf 'directory=%s\nuserconfig=%s\nglobalconfig=%s\n' \
            "$clean_directory" "$user_config" "$global_config" >> "$GITHUB_OUTPUT"
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          artifact-ids: ${{ needs.attest.outputs.artifact_id }}
          merge-multiple: true
          path: ${{ runner.temp }}/ghostget-canonical
      - name: Bind attested canonical artifact
        id: canonical
        env:
          DIRECTORY: ${{ runner.temp }}/ghostget-canonical
          EXPECTED_ARTIFACT_ID: ${{ needs.attest.outputs.artifact_id }}
          HANDOFF_DIRECTORY: ${{ runner.temp }}/ghostget-npm-package
        run: |
          set -euo pipefail
          if [[ ! "$EXPECTED_ARTIFACT_ID" =~ ^[1-9][0-9]*$ || \
                ! "$EXPECTED_BUNDLE_SHA256" =~ ^[a-f0-9]{64}$ || \
                ! "$EXPECTED_RELEASE_NOTES_SHA256" =~ ^[a-f0-9]{64}$ || \
                ! "$VERIFIED_SHA" =~ ^[a-f0-9]{40}$ || \
                ! "$WORKFLOW_SHA" =~ ^[a-f0-9]{40}$ || \
                ! "$VERIFIED_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ || \
                ! "$GITHUB_RUN_ID" =~ ^[1-9][0-9]*$ || \
                ! "$GITHUB_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]; then
            echo "::error::Attested canonical artifact has no exact immutable identity"
            exit 1
          fi
          mkdir -m 700 "$HANDOFF_DIRECTORY"
          node <<'NODE'
          const fs = require("node:fs"); const path = require("node:path"); const crypto = require("node:crypto");
          const directory = process.env.DIRECTORY; const handoff = process.env.HANDOFF_DIRECTORY;
          const version = process.env.VERIFIED_TAG.slice(1);
          const archiveName = `hraness-ghostget-${version}.tgz`;
          const names = [archiveName, "npm-pack.json", "release-manifest.json", "SHA256SUMS", "provenance.jsonl"];
          const [major, minor, patch] = version.split('.').map(BigInt);
          const bundledMessaging = major > 0n || minor > 18n || (minor === 18n && patch >= 1n);
          const byteLimit = (name) => name === names[0] ? (bundledMessaging ? 12 : 8) * 1024 * 1024
            : ['npm-pack.json', 'release-manifest.json'].includes(name) ? 1024 * 1024 : 8 * 1024 * 1024;
          if (fs.readdirSync(directory).sort().join(",") !== [...names].sort().join(",")) throw new Error("Attested canonical inventory differs");
          const hashes = JSON.parse(process.env.EXPECTED_ARTIFACT_HASHES);
          const built = names.slice(0, 4);
          if (hashes === null || typeof hashes !== "object" || Array.isArray(hashes) || Object.keys(hashes).sort().join(",") !== [...built].sort().join(",")) throw new Error("Trusted build hashes are malformed");
          const digest = (name) => crypto.createHash("sha256").update(fs.readFileSync(path.join(directory, name))).digest("hex");
          for (const name of names) {
            const stat = fs.lstatSync(path.join(directory, name));
            if (!stat.isFile() || stat.isSymbolicLink() || stat.size <= 0 || stat.size > byteLimit(name)) throw new Error("Attested canonical file is not a bounded regular file");
            const expected = name === "provenance.jsonl" ? process.env.EXPECTED_BUNDLE_SHA256 : hashes[name];
            if (typeof expected !== "string" || !/^[a-f0-9]{64}$/u.test(expected) || digest(name) !== expected) throw new Error("Attested canonical file differs from verified build output");
          }
          const manifest = JSON.parse(fs.readFileSync(path.join(directory, "release-manifest.json"), "utf8"));
          const runAttempt = Number(process.env.GITHUB_RUN_ATTEMPT);
          if (manifest.sourceSha !== process.env.VERIFIED_SHA || manifest.tag !== process.env.VERIFIED_TAG || manifest.workflowSha !== process.env.WORKFLOW_SHA
            || manifest.runId !== Number(process.env.GITHUB_RUN_ID) || !Number.isSafeInteger(manifest.runAttempt) || manifest.runAttempt < 1 || manifest.runAttempt > runAttempt
            || manifest.repositoryId !== 1316443113 || manifest.package !== "@hraness/ghostget" || manifest.version !== version
            || manifest.archive?.name !== archiveName || manifest.archive?.sha256 !== hashes[archiveName]) throw new Error("Attested canonical manifest belongs to another build");
          const expectedSums = built.slice(0, 3).map(name => `${hashes[name]}  ${name}\n`).join("");
          if (fs.readFileSync(path.join(directory, "SHA256SUMS"), "utf8") !== expectedSums) throw new Error("Attested canonical checksums differ");
          fs.copyFileSync(path.join(directory, archiveName), path.join(handoff, archiveName), fs.constants.COPYFILE_EXCL);
          fs.copyFileSync(path.join(directory, "npm-pack.json"), path.join(handoff, "npm-pack.json"), fs.constants.COPYFILE_EXCL);
          fs.writeFileSync(path.join(handoff, "npm-package.sha256"), `${hashes[archiveName]}\n`, { flag: "wx", mode: 0o600 });
          fs.appendFileSync(process.env.GITHUB_OUTPUT, `tarball_name=${archiveName}\nversion=${version}\nrelease_attempt=${manifest.runAttempt}\narchive_sha256=${hashes[archiveName]}\n`);
          NODE
      - name: Bind downloaded artifact
        id: artifact
        env:
          EXPECTED_TARBALL_NAME: ${{ steps.canonical.outputs.tarball_name }}
          EXPECTED_VERSION: ${{ steps.canonical.outputs.version }}
        run: |
          set -euo pipefail
          artifact_directory="$RUNNER_TEMP/ghostget-npm-package"
          pack_json="$artifact_directory/npm-pack.json"
          sha256_file="$artifact_directory/npm-package.sha256"
          tarball="$artifact_directory/$EXPECTED_TARBALL_NAME"
          artifact_entries=()
          while IFS= read -r -d '' artifact_entry; do
            artifact_entries+=("$artifact_entry")
          done < <(find "$artifact_directory" -mindepth 1 -maxdepth 1 -print0 | sort -z)
          if [[ ${#artifact_entries[@]} -ne 3 ]]; then
            echo "::error::Downloaded npm artifact must contain exactly the tarball, npm-pack.json, and npm-package.sha256"
            exit 1
          fi
          for required_file in "$pack_json" "$sha256_file" "$tarball"; do
            if [[ ! -f "$required_file" || -L "$required_file" ]]; then
              echo "::error::Downloaded npm artifact contains an unsafe or unexpected entry"
              exit 1
            fi
          done
          PACK_JSON="$pack_json" TARBALL="$tarball" \
            EXPECTED_TARBALL_NAME="$EXPECTED_TARBALL_NAME" \
            EXPECTED_VERSION="$EXPECTED_VERSION" node <<'NODE'
          const fs = require("node:fs");
          const crypto = require("node:crypto");
          const zlib = require("node:zlib");
          const value = JSON.parse(fs.readFileSync(process.env.PACK_JSON, "utf8"));
          if (!Array.isArray(value) || value.length !== 1) throw new Error("npm-pack.json must contain exactly one package");
          const record = value[0];
          if (record?.name !== "@hraness/ghostget") throw new Error("npm-pack.json has the wrong package name");
          if (record?.version !== process.env.EXPECTED_VERSION) throw new Error("npm-pack.json has the wrong package version");
          if (record?.filename !== process.env.EXPECTED_TARBALL_NAME) throw new Error("npm-pack.json has the wrong tarball name");
          if (!/^hraness-ghostget-(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.tgz$/u.test(record.filename)) throw new Error("npm-pack.json has an unsafe tarball name");
          for (const field of ["entryCount", "size", "unpackedSize"]) {
            if (!Number.isSafeInteger(record[field]) || record[field] < 0) throw new Error(`npm-pack.json has invalid ${field}`);
          }
          if (!Array.isArray(record.files) || record.files.length !== record.entryCount) throw new Error("npm-pack.json has an invalid file inventory");
          const bytes = fs.readFileSync(process.env.TARBALL);
          if (bytes.byteLength !== record.size) throw new Error("Downloaded tarball size differs from npm-pack.json");
          const integrity = `sha512-${crypto.createHash("sha512").update(bytes).digest("base64")}`;
          const shasum = crypto.createHash("sha1").update(bytes).digest("hex");
          if (record.integrity !== integrity || record.shasum !== shasum) throw new Error("Downloaded tarball digest differs from npm-pack.json");
          const tar = zlib.gunzipSync(bytes, {
            maxOutputLength: 32 * 1024 * 1024 + 512 * 1_280,
          });
          const tarText = (header, start, length) => {
            const field = header.subarray(start, start + length);
            const zero = field.indexOf(0);
            const selected = zero < 0 ? field : field.subarray(0, zero);
            if (selected.some(byte => byte > 0x7f)) throw new Error("Packed package.json tar header is not ASCII");
            return selected.toString("ascii");
          };
          const tarOctal = (header, start, length, label) => {
            const text = tarText(header, start, length).trim();
            if (!/^[0-7]+$/u.test(text)) throw new Error(`Packed package.json has an invalid ${label}`);
            const value = Number.parseInt(text, 8);
            if (!Number.isSafeInteger(value) || value < 0) throw new Error(`Packed package.json has an unsafe ${label}`);
            return value;
          };
          let offset = 0;
          let zeroBlocks = 0;
          let entries = 0;
          let manifestBytes;
          while (offset < tar.length) {
            if (tar.length - offset < 512) throw new Error("Packed package.json tar header is truncated");
            const header = tar.subarray(offset, offset + 512);
            offset += 512;
            if (header.every(byte => byte === 0)) {
              zeroBlocks += 1;
              if (zeroBlocks === 2) {
                if (tar.subarray(offset).some(byte => byte !== 0)) throw new Error("Packed package.json tar has trailing data");
                break;
              }
              continue;
            }
            if (zeroBlocks !== 0) throw new Error("Packed package.json tar terminator is invalid");
            const expectedChecksum = tarOctal(header, 148, 8, "checksum");
            let checksum = 0;
            for (let index = 0; index < header.length; index += 1) {
              checksum += index >= 148 && index < 156 ? 0x20 : header[index];
            }
            if (
              checksum !== expectedChecksum
              || !header.subarray(257, 263).equals(Buffer.from("ustar\0", "ascii"))
              || !header.subarray(263, 265).equals(Buffer.from("00", "ascii"))
            ) {
              throw new Error("Packed package.json tar header is invalid");
            }
            const name = tarText(header, 0, 100);
            const prefix = tarText(header, 345, header[475] === 0 ? 130 : 155);
            const path = prefix === "" ? name : `${prefix}/${name}`;
            if (path.startsWith("/") || path.includes("\\") || path.split("/").some(part => part === "" || part === "." || part === "..")) {
              throw new Error("Packed package.json tar path is unsafe");
            }
            const size = tarOctal(header, 124, 12, "size");
            const type = header[156];
            if (type !== 0 && type !== 0x30 && type !== 0x35) throw new Error("Packed package.json tar contains a non-regular entry");
            if (type === 0x35 && size !== 0) throw new Error("Packed package.json tar directory has data");
            if (size > tar.length - offset) throw new Error("Packed package.json tar entry is truncated");
            const padded = Math.ceil(size / 512) * 512;
            if (padded > tar.length - offset || tar.subarray(offset + size, offset + padded).some(byte => byte !== 0)) {
              throw new Error("Packed package.json tar padding is invalid");
            }
            if (path === "package/package.json") {
              if ((type !== 0 && type !== 0x30) || manifestBytes !== undefined || size < 1 || size > 256 * 1024) {
                throw new Error("Packed package.json is missing, duplicated, or unsafe");
              }
              manifestBytes = Buffer.from(tar.subarray(offset, offset + size));
            }
            offset += padded;
            entries += 1;
            if (entries > 1_280) throw new Error("Packed package.json tar contains too many entries");
          }
          if (zeroBlocks !== 2 || manifestBytes === undefined) throw new Error("Packed package.json is missing");
          const manifest = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(manifestBytes));
          const publishConfig = manifest?.publishConfig;
          if (
            manifest?.name !== "@hraness/ghostget"
            || manifest?.version !== process.env.EXPECTED_VERSION
            || (Object.hasOwn(manifest, "private") && manifest.private !== false)
            || Object.hasOwn(manifest, "contentPolicy")
            || Object.hasOwn(manifest, "tag")
            || publishConfig === null
            || typeof publishConfig !== "object"
            || Array.isArray(publishConfig)
            || JSON.stringify(Object.keys(publishConfig).sort()) !== JSON.stringify(["access", "registry"])
            || publishConfig.access !== "public"
            || publishConfig.registry !== "https://registry.npmjs.org"
          ) throw new Error("Packed Ghostget can publish only to the canonical public npm registry");
          NODE
          expected_sha256="$(tr -d '\n' < "$sha256_file")"
          if [[ ! "$expected_sha256" =~ ^[a-f0-9]{64}$ ]]; then
            echo "::error::Downloaded npm-package.sha256 is invalid"
            exit 1
          fi
          actual_sha256="$(sha256sum "$tarball" | awk '{ print $1 }')"
          if [[ "$actual_sha256" != "$expected_sha256" ]]; then
            echo "::error::Downloaded tarball does not match the verified SHA-256"
            exit 1
          fi
          printf 'sha256=%s\ntarball=%s\n' "$actual_sha256" "$tarball" >> "$GITHUB_OUTPUT"
      - name: Admit absent or exact public registry state
        id: registry
        env:
          EXPECTED_TARBALL_SHA256: ${{ steps.artifact.outputs.sha256 }}
          EXPECTED_VERSION: ${{ steps.canonical.outputs.version }}
          NPM_DIRECTORY: ${{ steps.npm_config.outputs.directory }}
          NPM_GLOBALCONFIG: ${{ steps.npm_config.outputs.globalconfig }}
          NPM_USERCONFIG: ${{ steps.npm_config.outputs.userconfig }}
          TARBALL: ${{ steps.artifact.outputs.tarball }}
        run: |
          set -euo pipefail
          unset NPM_CONFIG_TAG npm_config_tag
          if [[ "$(sha256sum "$TARBALL" | awk '{ print $1 }')" != "$EXPECTED_TARBALL_SHA256" ]]; then
            echo "::error::Handed-off tarball changed before registry admission"
            exit 1
          fi
          expected_integrity="$(TARBALL="$TARBALL" node -e 'process.stdout.write(`sha512-${require("node:crypto").createHash("sha512").update(require("node:fs").readFileSync(process.env.TARBALL)).digest("base64")}`)')"
          version_json="$(mktemp "$RUNNER_TEMP/ghostget-registry-version.XXXXXX")"
          version_error="$(mktemp "$RUNNER_TEMP/ghostget-registry-error.XXXXXX")"
          latest_json="$(mktemp "$RUNNER_TEMP/ghostget-registry-latest.XXXXXX")"
          trap 'rm -f "$version_json" "$version_error" "$latest_json"' EXIT
          cd "$NPM_DIRECTORY"
          if NPM_CONFIG_USERCONFIG="$NPM_USERCONFIG" NPM_CONFIG_GLOBALCONFIG="$NPM_GLOBALCONFIG" \
            npm view "@hraness/ghostget@$EXPECTED_VERSION" --json \
              --registry=https://registry.npmjs.org > "$version_json" 2> "$version_error"; then
            if [[ -z "$(tr -d '[:space:]' < "$version_json")" ]]; then
              npm_state=absent
            else
              npm_state=published
            fi
          elif grep -q 'E404' "$version_error"; then
            npm_state=absent
          else
            cat "$version_error"
            echo "::error::Could not prove the public registry state of @hraness/ghostget@$EXPECTED_VERSION"
            exit 1
          fi
          NPM_CONFIG_USERCONFIG="$NPM_USERCONFIG" NPM_CONFIG_GLOBALCONFIG="$NPM_GLOBALCONFIG" \
            npm view @hraness/ghostget dist-tags.latest --json \
              --registry=https://registry.npmjs.org > "$latest_json"
          NPM_STATE="$npm_state" VERSION_JSON="$version_json" LATEST_JSON="$latest_json" \
            EXPECTED_INTEGRITY="$expected_integrity" node <<'NODE'
          const { readFileSync, appendFileSync } = require("node:fs");
          const parseStable = (value, label) => {
            if (typeof value !== "string") throw new Error(`${label} is not a string`);
            const match = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.exec(value);
            if (match === null || match.slice(1).some(part => BigInt(part) > BigInt(Number.MAX_SAFE_INTEGER))) throw new Error(`${label} is not a supported stable semantic version`);
            return match.slice(1).map(BigInt);
          };
          const expectedValue = process.env.EXPECTED_VERSION ?? "";
          const expected = parseStable(expectedValue, "Candidate version");
          const latestValue = JSON.parse(readFileSync(process.env.LATEST_JSON, "utf8"));
          const latest = parseStable(latestValue, "Public npm latest");
          const compare = (left, right) => { for (let i = 0; i < 3; i += 1) { if (left[i] !== right[i]) return left[i] > right[i] ? 1 : -1; } return 0; };
          if (process.env.NPM_STATE === "absent") {
            if (compare(expected, latest) <= 0) throw new Error(`Candidate ${expectedValue} is not newer than public npm latest ${latestValue}`);
            appendFileSync(process.env.GITHUB_OUTPUT, "npm_state=absent\n");
            console.log(`@hraness/ghostget@${expectedValue} is absent from the public registry; latest is ${latestValue}`);
          } else {
            const value = JSON.parse(readFileSync(process.env.VERSION_JSON, "utf8"));
            if (value === null || typeof value !== "object" || Array.isArray(value) || value.name !== "@hraness/ghostget" || value.version !== expectedValue
              || value.dist?.integrity !== process.env.EXPECTED_INTEGRITY || value.dist?.tarball !== `https://registry.npmjs.org/@hraness/ghostget/-/ghostget-${expectedValue}.tgz`) {
              throw new Error(`@hraness/ghostget@${expectedValue} is already public with different bytes; never overwrite a published version`);
            }
            if (compare(latest, expected) < 0) throw new Error(`Public npm latest ${latestValue} is older than the already published ${expectedValue}`);
            appendFileSync(process.env.GITHUB_OUTPUT, "npm_state=exact\n");
            console.log(`@hraness/ghostget@${expectedValue} is already public with the exact canonical bytes; nothing to publish`);
          }
          NODE
      - name: Publish exact canonical archive through npm trusted publishing
        id: npm_publish
        env:
          EXPECTED_ARCHIVE_SHA256: ${{ steps.canonical.outputs.archive_sha256 }}
          EXPECTED_RELEASE_ATTEMPT: ${{ steps.canonical.outputs.release_attempt }}
          EXPECTED_TARBALL_SHA256: ${{ steps.artifact.outputs.sha256 }}
          EXPECTED_VERSION: ${{ steps.canonical.outputs.version }}
          NPM_DIRECTORY: ${{ steps.npm_config.outputs.directory }}
          NPM_GLOBALCONFIG: ${{ steps.npm_config.outputs.globalconfig }}
          NPM_STATE: ${{ steps.registry.outputs.npm_state }}
          NPM_USERCONFIG: ${{ steps.npm_config.outputs.userconfig }}
          TARBALL: ${{ steps.artifact.outputs.tarball }}
        run: |
          set -euo pipefail
          unset NPM_CONFIG_TAG npm_config_tag
          if [[ "$GITHUB_REPOSITORY" != "hraness/ghostget" || "$DEFAULT_BRANCH" != "main" || "$GITHUB_REF" != "refs/tags/$VERIFIED_TAG" || "$GITHUB_SHA" != "$VERIFIED_SHA" ]]; then
            echo "::error::npm publication must run in the exact Ghostget release tag context"
            exit 1
          fi
          if [[ "$NPM_STATE" == exact ]]; then
            echo "Skipping npm publication: @hraness/ghostget@$EXPECTED_VERSION already carries the exact canonical bytes"
            printf 'published_identity=%s\n' "@hraness/ghostget@$EXPECTED_VERSION exact-prior-publication" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if [[ "$NPM_STATE" != absent ]]; then
            echo "::error::Registry admission did not record an exact npm state"
            exit 1
          fi
          current_tarball_sha256="$(sha256sum "$TARBALL" | awk '{ print $1 }')"
          if [[ "$current_tarball_sha256" != "$EXPECTED_TARBALL_SHA256" || "$current_tarball_sha256" != "$EXPECTED_ARCHIVE_SHA256" ]]; then
            echo "::error::Handed-off tarball changed before npm publication"
            exit 1
          fi
          configured_tag="$(cd "$NPM_DIRECTORY" && \
            NPM_CONFIG_USERCONFIG="$NPM_USERCONFIG" \
            NPM_CONFIG_GLOBALCONFIG="$NPM_GLOBALCONFIG" \
            npm config get tag)"
          if [[ "$configured_tag" != latest ]]; then
            echo "::error::Clean npm publication default moved at the terminal publication boundary"
            exit 1
          fi
          canonical_release_json="$(mktemp "$RUNNER_TEMP/ghostget-terminal-canonical-release.XXXXXX")"
          publish_result="$(mktemp "$RUNNER_TEMP/ghostget-publish-result.XXXXXX")"
          trap 'rm -f "$canonical_release_json" "$publish_result"' EXIT
          gh api --method GET "/repos/$GITHUB_REPOSITORY/releases/tags/$VERIFIED_TAG" > "$canonical_release_json"
          CANONICAL_RELEASE_JSON="$canonical_release_json" node <<'NODE'
          const fs = require("node:fs");
          const release = JSON.parse(fs.readFileSync(process.env.CANONICAL_RELEASE_JSON, "utf8"));
          const version = process.env.EXPECTED_VERSION;
          const names = [`hraness-ghostget-${version}.tgz`, "npm-pack.json", "release-manifest.json", "SHA256SUMS", "provenance.jsonl"];
          const receipt = `wrench-release-source-v1 repository=hraness/ghostget tag=v${version} source_sha=${process.env.VERIFIED_SHA} workflow_run_id=${process.env.GITHUB_RUN_ID}`;
          // The page is the rendered changelog notes, then the identity record as the final HTML comment.
          const identity = `\n\n<!-- ${receipt}\n\nghostget-release-attempt-v1 run_attempt=${process.env.EXPECTED_RELEASE_ATTEMPT} -->`;
          const body = typeof release.body === "string" ? release.body : "";
          const notes = body.endsWith(identity) ? body.slice(0, -identity.length) : "";
          if (notes.trim() === "" || notes !== notes.trim() || notes.includes("<!--") || notes.includes("-->")
            || !/^[0-9a-f]{64}$/u.test(process.env.EXPECTED_RELEASE_NOTES_SHA256 ?? "")
            || require("node:crypto").createHash("sha256").update(notes, "utf8").digest("hex") !== process.env.EXPECTED_RELEASE_NOTES_SHA256) {
            throw new Error("Canonical Release page is not the rendered changelog notes with this attempt's identity record");
          }
          if (!Number.isSafeInteger(release.id) || release.id < 1 || release.target_commitish !== process.env.VERIFIED_SHA
            || release.tag_name !== `v${version}` || release.draft !== false || release.prerelease !== false || release.immutable !== true
            || release.author?.id !== 41898282 || release.author?.type !== "Bot"
            || !Array.isArray(release.assets) || release.assets.length !== 5) throw new Error("Immutable canonical Release is not the exact publication authority for npm");
          const seen = new Set();
          for (const asset of release.assets) {
            if (!names.includes(asset.name) || seen.has(asset.name) || asset.state !== "uploaded"
              || !/^sha256:[0-9a-f]{64}$/u.test(asset.digest ?? "")) throw new Error("Canonical asset inventory differs before npm publication");
            seen.add(asset.name);
          }
          const archive = release.assets.find(asset => asset.name === names[0]);
          if (archive.digest !== `sha256:${process.env.EXPECTED_TARBALL_SHA256}`
            || archive.size !== fs.statSync(process.env.TARBALL).size) throw new Error("npm package is not the exact canonical archive bytes");
          NODE
          (cd "$NPM_DIRECTORY" && \
            NPM_CONFIG_USERCONFIG="$NPM_USERCONFIG" \
            NPM_CONFIG_GLOBALCONFIG="$NPM_GLOBALCONFIG" \
            npm publish "$TARBALL" \
              --access public \
              --ignore-scripts \
              --json \
              --provenance \
              --registry=https://registry.npmjs.org) > "$publish_result"
          expected_integrity="$(TARBALL="$TARBALL" node -e 'process.stdout.write(`sha512-${require("node:crypto").createHash("sha512").update(require("node:fs").readFileSync(process.env.TARBALL)).digest("base64")}`)')"
          published_identity="$(PUBLISH_RESULT="$publish_result" EXPECTED_INTEGRITY="$expected_integrity" node <<'NODE'
          const { readFileSync } = require("node:fs");
          const result = JSON.parse(readFileSync(process.env.PUBLISH_RESULT, "utf8"));
          const expectedName = "@hraness/ghostget";
          // npm 11 keys its --json publish receipt by package name.
          if (result === null || typeof result !== "object" || Array.isArray(result)
            || JSON.stringify(Object.keys(result)) !== JSON.stringify([expectedName])) throw new Error("npm did not return the one exact published Ghostget identity");
          const output = result[expectedName];
          if (
            output === null || typeof output !== "object" || Array.isArray(output)
            || output.name !== expectedName || output.version !== process.env.EXPECTED_VERSION
            || output.id !== `${expectedName}@${process.env.EXPECTED_VERSION}`
            || output.integrity !== process.env.EXPECTED_INTEGRITY
          ) throw new Error("npm did not return the one exact published Ghostget identity");
          process.stdout.write(`${output.id} ${output.integrity}`);
          NODE
          )"
          printf 'published_identity=%s\n' "$published_identity" >> "$GITHUB_OUTPUT"

  admit_npm:
    name: Admit exact public npm package
    needs: [verify, attest, publish_npm]
    permissions:
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      EXPECTED_ARTIFACT_HASHES: ${{ needs.verify.outputs.artifact_hashes }}
      NPM_STATE: ${{ needs.publish_npm.outputs.npm_state }}
      PUBLISHED_IDENTITY: ${{ needs.publish_npm.outputs.published_identity }}
      VERIFIED_SHA: ${{ needs.verify.outputs.verified_sha }}
      VERIFIED_TAG: ${{ needs.verify.outputs.verified_tag }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 1
          fetch-tags: false
          persist-credentials: false
          ref: ${{ needs.verify.outputs.verified_sha }}
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24.20.0"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.3.14"
      - name: Pin npm
        run: |
          set -euo pipefail
          npm install --global npm@11.19.0 \
            --ignore-scripts \
            --registry=https://registry.npmjs.org
          test "$(npm --version)" = "11.19.0"
      - run: bun install --frozen-lockfile --ignore-scripts
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          artifact-ids: ${{ needs.attest.outputs.artifact_id }}
          merge-multiple: true
          path: ${{ runner.temp }}/ghostget-canonical
      - name: Verify the exact public registry package and its provenance
        env:
          CANONICAL_DIRECTORY: ${{ runner.temp }}/ghostget-canonical
        run: |
          set -euo pipefail
          if [[ "$NPM_STATE" != absent && "$NPM_STATE" != exact ]]; then
            echo "::error::npm publication did not record an exact registry state"
            exit 1
          fi
          if [[ "$GITHUB_REPOSITORY" != "hraness/ghostget" || "$GITHUB_REF" != "refs/tags/$VERIFIED_TAG" || "$GITHUB_SHA" != "$VERIFIED_SHA" || "$(git rev-parse --verify HEAD^{commit})" != "$VERIFIED_SHA" ]]; then
            echo "::error::npm admission must verify the exact release tag source"
            exit 1
          fi
          version="${VERIFIED_TAG#v}"
          archive_name="hraness-ghostget-$version.tgz"
          if [[ "$PUBLISHED_IDENTITY" != "@hraness/ghostget@$version "* ]]; then
            echo "::error::npm publication identity is not the exact package coordinate"
            exit 1
          fi
          expected_sha256="$(EXPECTED_ARTIFACT_HASHES="$EXPECTED_ARTIFACT_HASHES" ARCHIVE_NAME="$archive_name" node -e '
            const hashes = JSON.parse(process.env.EXPECTED_ARTIFACT_HASHES ?? "null");
            const value = hashes?.[process.env.ARCHIVE_NAME];
            if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) process.exit(1);
            process.stdout.write(value);
          ')"
          if [[ "$(sha256sum "$CANONICAL_DIRECTORY/$archive_name" | awk '{ print $1 }')" != "$expected_sha256" ]]; then
            echo "::error::Downloaded canonical archive does not match the verified build hash"
            exit 1
          fi
          propagation_deadline=$((SECONDS + 840))
          until npm view "@hraness/ghostget@$version" version \
              --registry=https://registry.npmjs.org 2>/dev/null \
              | grep -Fqx "$version"; do
            if (( SECONDS >= propagation_deadline )); then
              echo "::error::npm registry did not publish @hraness/ghostget@$version inside the bounded propagation window"
              exit 1
            fi
            echo "Waiting for npm registry propagation of @hraness/ghostget@$version"
            sleep 20
          done
          registry_directory="$RUNNER_TEMP/ghostget-registry"
          mkdir -m 700 "$registry_directory"
          (cd "$registry_directory" && npm pack "@hraness/ghostget@$version" --ignore-scripts --json \
            --registry=https://registry.npmjs.org > npm-pack.json)
          npm view "@hraness/ghostget@$version" --json --registry=https://registry.npmjs.org > "$registry_directory/npm-view.json"
          bun run ./scripts/npm-package-identity.ts \
            --expected-name @hraness/ghostget \
            --expected-version "$version" \
            --registry-archive "$registry_directory/$archive_name" \
            --registry-pack-json "$registry_directory/npm-pack.json" \
            --registry-view-json "$registry_directory/npm-view.json" \
            --source-archive "$CANONICAL_DIRECTORY/$archive_name" \
            --source-pack-json "$CANONICAL_DIRECTORY/npm-pack.json"
          consumer_directory="$RUNNER_TEMP/ghostget-registry-consumer"
          mkdir -m 700 "$consumer_directory"
          (cd "$consumer_directory" \
            && printf '{ "name": "ghostget-registry-consumer", "version": "0.0.0", "private": true }\n' > package.json \
            && npm install "@hraness/ghostget@$version" --ignore-scripts --no-audit --no-fund \
              --registry=https://registry.npmjs.org \
            && npm audit signatures --json --include-attestations --omit=dev \
              --registry=https://registry.npmjs.org > npm-audit.json)
          bun run ./scripts/npm-provenance-identity.ts \
            --audit-json "$consumer_directory/npm-audit.json" \
            --expected-event push \
            --expected-name @hraness/ghostget \
            --expected-owner-id 307125679 \
            --expected-ref "refs/tags/$VERIFIED_TAG" \
            --expected-repository hraness/ghostget \
            --expected-repository-id 1316443113 \
            --expected-source-sha "$VERIFIED_SHA" \
            --expected-version "$version" \
            --expected-workflow-path .github/workflows/release.yml \
            --registry-archive "$registry_directory/$archive_name"