build.yml

name: Build & Package

# Stable tag-release workflow.
#
# Triggers on `v*` tags → builds macOS (arm64 + x64), Windows x64, and Linux
# (x64 + arm64) packages, then creates a real GitHub Release (NOT a prerelease)
# whose body is RELEASE_NOTES.md.
# The internal tester channel lives in `preview-build.yml` / `preview-release.yml`
# (artifacts-only / prerelease) — those are intentionally separate and untouched.
#
# Fail-closed gates preserved from the refactor's CI:
#   - package.json version == tag version
#   - Codex app-server must NOT use `--listen`
#   - ClaudeCode canonicalizes bare `sonnet` -> `claude-sonnet-4-6`
#   - P0 startup regression pins (codex binary discovery, app-server client
#     fast-fail, provider resolver / catalog)
#   - packaged better-sqlite3 native ABI loads under the Electron runtime
#   - every packaged standalone server boots and contains no source maps

on:
  workflow_dispatch:
    inputs:
      platform:
        description: "Target platform"
        required: true
        default: "all"
        type: choice
        options:
          - all
          - windows
          - macos
          - linux
      telemetry_smoke:
        description: "Compile and run isolated Sentry smoke fixtures (manual macOS only)"
        required: true
        default: false
        type: boolean
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  verify-source:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.ver.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve expected version (tag on push, package.json otherwise)
        id: ver
        run: |
          set -euo pipefail
          if [ "${GITHUB_REF_TYPE:-}" = "tag" ]; then
            VERSION="${GITHUB_REF_NAME#v}"
          else
            VERSION="$(node -p "require('./package.json').version")"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Expected release version: $VERSION"

      - name: Fail-closed gate A — version matches tag + Codex has no --listen
        env:
          EXPECTED_VERSION: ${{ steps.ver.outputs.version }}
        run: |
          set -euo pipefail
          # Match an actual CLI-arg literal ('--listen' / "--listen"), NOT prose
          # comments that merely mention the removed flag (e.g. a backtick `--listen`).
          if grep -REn "['\"]--listen['\"]" src/lib/codex/app-server-manager.ts; then
            echo "::error::Codex app-server still passes --listen as a CLI arg"
            exit 1
          fi
          node -e '
            const v = require("./package.json").version;
            if (v !== process.env.EXPECTED_VERSION) {
              console.error(`::error::package.json version ${v} != tag/expected ${process.env.EXPECTED_VERSION}`);
              process.exit(1);
            }
            console.log(`✓ package version ${v}`);
          '

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Fail-closed gate B — ClaudeCode canonicalizes bare sonnet
        run: |
          set -euo pipefail
          trap 'rm -f release-gate-sonnet.ts' EXIT
          cat > release-gate-sonnet.ts <<'TS'
          import { toClaudeCodeEnv } from './src/lib/provider-resolver';
          const resolved: any = {
            provider: {
              id: 'gate',
              name: 'Legacy Gateway',
              provider_type: 'anthropic',
              protocol: 'anthropic',
              base_url: 'https://gateway.example.com/anthropic',
              api_key: 'key',
              is_active: 1,
              sort_order: 0,
              extra_env: '{}',
              headers_json: '{}',
              env_overrides_json: '',
              role_models_json: JSON.stringify({ default: 'sonnet', sonnet: 'sonnet', haiku: 'haiku', opus: 'opus' }),
              notes: '',
              created_at: '',
              updated_at: '',
              options_json: '{}',
            },
            protocol: 'anthropic',
            authStyle: 'api_key',
            model: 'sonnet',
            upstreamModel: 'claude-sonnet-4-6',
            modelDisplayName: 'Sonnet 4.6',
            headers: {},
            envOverrides: {},
            roleModels: { default: 'sonnet', sonnet: 'sonnet', haiku: 'haiku', opus: 'opus' },
            hasCredentials: true,
            availableModels: [
              { modelId: 'sonnet', upstreamModelId: 'claude-sonnet-4-6', displayName: 'Sonnet 4.6' },
              { modelId: 'haiku', upstreamModelId: 'claude-haiku-4-5-20251001', displayName: 'Haiku 4.5' },
              { modelId: 'opus', upstreamModelId: 'claude-opus-4-7', displayName: 'Opus 4.7' },
            ],
            settingSources: ['user'],
          };
          const env = toClaudeCodeEnv({}, resolved);
          if (env.ANTHROPIC_MODEL !== 'claude-sonnet-4-6') {
            console.error(`::error::expected claude-sonnet-4-6, got ${env.ANTHROPIC_MODEL}`);
            process.exit(1);
          }
          console.log(`✓ sonnet -> ${env.ANTHROPIC_MODEL}`);
          TS
          CODEX_DISABLED=1 npx tsx release-gate-sonnet.ts

      - name: P0 regression pins
        run: |
          CODEX_DISABLED=1 npx tsx --test --import ./src/__tests__/db-isolation.setup.ts \
            src/__tests__/unit/codex-binary-discovery.test.ts \
            src/__tests__/unit/codex-app-server-client.test.ts \
            src/__tests__/unit/provider-resolver.test.ts

      # Full unit + lint coverage is enforced by the local pre-commit hook on the
      # tagged commit. The release CI keeps the remote gate focused on version
      # identity + P0 startup regressions + packaged ABI so a tag build can't be
      # blocked by unrelated Linux-runner test hangs or React-compiler lint debt.

  build-macos:
    needs: verify-source
    if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'macos' }}
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - run: npm ci

      - name: Build macOS release bundles
        timeout-minutes: 45
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
          CODEPILOT_APP_CHANNEL: stable
          CODEPILOT_SOURCE_MAPS: "1"
          CODEPILOT_TELEMETRY_SMOKE: ${{ inputs.telemetry_smoke && '1' || '0' }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        run: npm run electron:build

      - name: Upload macOS source maps to Sentry
        env:
          CODEPILOT_APP_CHANNEL: stable
          CODEPILOT_SOURCE_MAPS: "1"
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        run: npm run sentry:sourcemaps:upload

      - name: Package macOS (arm64 + x64)
        timeout-minutes: 45
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
        run: npx electron-builder --mac --arm64 --x64 --config electron-builder.yml --publish never

      - name: Verify packaged version, native ABI, and server startup
        env:
          EXPECTED_VERSION: ${{ needs.verify-source.outputs.version }}
        run: |
          set -euo pipefail
          # Both arch DMGs must exist and carry the version in their names.
          for ARCH in arm64 x64; do
            DMG=$(find release -name "CodePilot-*-${ARCH}.dmg" | head -1)
            [ -n "$DMG" ] || { echo "::error::no ${ARCH} DMG produced"; exit 1; }
            case "$DMG" in *"$EXPECTED_VERSION"*) ;; *) echo "::error::${ARCH} DMG name lacks $EXPECTED_VERSION"; exit 1 ;; esac
            echo "✓ ${ARCH} DMG: $DMG"
          done
          # Full ABI load check on the runner-native arm64 .app. Cross-arch exec
          # of the x64 binary is not reliable on an Apple-Silicon runner, so the
          # x64 DMG is verified structurally (existence + version) above.
          APP=$(find release -maxdepth 4 -path "*mac-arm64*" -name "CodePilot.app" -type d | head -1)
          [ -n "$APP" ] || APP=$(find release -maxdepth 4 -name "CodePilot.app" -type d | head -1)
          [ -n "$APP" ] || { echo "::error::CodePilot.app not found"; exit 1; }
          PLIST_VER=$(plutil -extract CFBundleShortVersionString raw "$APP/Contents/Info.plist")
          [ "$PLIST_VER" = "$EXPECTED_VERSION" ] || { echo "::error::Info.plist $PLIST_VER != $EXPECTED_VERSION"; exit 1; }
          SQLITE=$(find "$APP/Contents/Resources" -path "*better-sqlite3*" -name "*.node" | head -1)
          [ -n "$SQLITE" ] || { echo "::error::better-sqlite3 .node not found"; exit 1; }
          ELECTRON_RUN_AS_NODE=1 "$APP/Contents/MacOS/CodePilot" -e "const path = require('node:path'); require(path.resolve(process.argv[1])); console.log('better-sqlite3 OK, ABI=' + process.versions.modules)" "$SQLITE"
          node scripts/verify-packaged-server.mjs "$APP/Contents/MacOS/CodePilot" "$APP/Contents/Resources"

      - name: Run packaged Sentry synthetic events
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.telemetry_smoke }}
        shell: bash
        run: |
          set -euo pipefail
          APP=$(find release -maxdepth 4 -path "*mac-arm64*" -name "CodePilot.app" -type d | head -1)
          [ -n "$APP" ] || APP=$(find release -maxdepth 4 -name "CodePilot.app" -type d | head -1)
          [ -n "$APP" ] || { echo "::error::CodePilot.app not found for telemetry smoke"; exit 1; }
          LOG="$RUNNER_TEMP/codepilot-telemetry-smoke.log"
          "$APP/Contents/MacOS/CodePilot" >"$LOG" 2>&1 &
          APP_PID=$!
          for _ in $(seq 1 45); do
            if grep -q "layer=next_server" "$LOG" && grep -q "layer=electron_main" "$LOG"; then
              break
            fi
            if ! kill -0 "$APP_PID" 2>/dev/null; then
              echo "::error::packaged telemetry smoke app exited early"
              tail -80 "$LOG"
              exit 1
            fi
            sleep 1
          done
          grep -q "layer=next_server" "$LOG" || { echo "::error::Next server smoke event missing"; tail -80 "$LOG"; exit 1; }
          grep -q "layer=electron_main" "$LOG" || { echo "::error::Electron main smoke event missing"; tail -80 "$LOG"; exit 1; }
          sleep 8
          kill "$APP_PID" 2>/dev/null || true
          wait "$APP_PID" 2>/dev/null || true
          echo "Packaged JS telemetry smoke emitted; renderer delivery is verified in Sentry"

      - name: Run packaged Sentry native crash fixture
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.telemetry_smoke }}
        shell: bash
        run: |
          set -euo pipefail
          APP=$(find release -maxdepth 4 -path "*mac-arm64*" -name "CodePilot.app" -type d | head -1)
          [ -n "$APP" ] || APP=$(find release -maxdepth 4 -name "CodePilot.app" -type d | head -1)
          [ -n "$APP" ] || { echo "::error::CodePilot.app not found for native crash smoke"; exit 1; }
          LOG="$RUNNER_TEMP/codepilot-native-crash-smoke.log"
          set +e
          CODEPILOT_NATIVE_CRASH_SMOKE=1 "$APP/Contents/MacOS/CodePilot" >"$LOG" 2>&1
          STATUS=$?
          set -e
          [ "$STATUS" -ne 0 ] || { echo "::error::native crash fixture exited successfully"; exit 1; }
          grep -q "native crash fixture armed" "$LOG" || { echo "::error::native crash fixture did not arm"; tail -80 "$LOG"; exit 1; }
          # SentryMinidump deliberately sets Electron crashReporter uploadToServer=false;
          # the SDK reads and uploads completed Crashpad dumps on the next app start.
          # Relaunch without the runtime crash flag so the pending dump can drain.
          RECOVERY_LOG="$RUNNER_TEMP/codepilot-native-crash-recovery.log"
          "$APP/Contents/MacOS/CodePilot" >"$RECOVERY_LOG" 2>&1 &
          RECOVERY_PID=$!
          for _ in $(seq 1 20); do
            if grep -q "layer=electron_main" "$RECOVERY_LOG"; then
              break
            fi
            if ! kill -0 "$RECOVERY_PID" 2>/dev/null; then
              echo "::error::native crash recovery launch exited early"
              tail -80 "$RECOVERY_LOG"
              exit 1
            fi
            sleep 1
          done
          grep -q "layer=electron_main" "$RECOVERY_LOG" || { echo "::error::Sentry did not initialize on native crash recovery launch"; tail -80 "$RECOVERY_LOG"; exit 1; }
          sleep 20
          kill "$RECOVERY_PID" 2>/dev/null || true
          wait "$RECOVERY_PID" 2>/dev/null || true
          echo "Native crash fixture exited with expected non-zero status $STATUS; recovery launch drained pending minidumps"

      - name: Checksums
        run: cd release && shasum -a 256 CodePilot-*.dmg CodePilot-*.zip 2>/dev/null | tee checksums-macos.sha256

      - uses: actions/upload-artifact@v4
        if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.telemetry_smoke) }}
        with:
          name: release-macos
          path: |
            release/CodePilot-*.dmg
            release/CodePilot-*.zip
            release/checksums-macos.sha256
          retention-days: 7

  build-windows:
    needs: verify-source
    if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'windows' }}
    # Pinned to windows-2022 (VS 2022 / MSVC v17). `windows-latest` rolled to a
    # VS 18 image whose toolchain the bundled node-gyp can't detect ("unknown
    # version undefined"), breaking native builds (zlib-sync / better-sqlite3)
    # at `npm ci`. See v0.56.1 release failure.
    runs-on: windows-2022
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - run: npm ci

      - name: Build Windows release bundles
        timeout-minutes: 35
        env:
          CODEPILOT_APP_CHANNEL: stable
          CODEPILOT_SOURCE_MAPS: "1"
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        run: npm run electron:build

      - name: Upload Windows source maps to Sentry
        env:
          CODEPILOT_APP_CHANNEL: stable
          CODEPILOT_SOURCE_MAPS: "1"
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        run: npm run sentry:sourcemaps:upload

      - name: Package Windows x64
        timeout-minutes: 35
        run: npx electron-builder --win --x64 --config electron-builder.yml --publish never

      - name: Verify packaged version, native ABI, and server startup
        shell: bash
        env:
          EXPECTED_VERSION: ${{ needs.verify-source.outputs.version }}
        run: |
          set -euo pipefail
          EXE=$(find release -name "CodePilot.Setup.*.exe" | head -1)
          [ -n "$EXE" ] || { echo "::error::no NSIS installer produced"; exit 1; }
          case "$EXE" in *"$EXPECTED_VERSION"*) ;; *) echo "::error::installer name lacks $EXPECTED_VERSION"; exit 1 ;; esac
          SQLITE=$(find release/win-unpacked -path "*better-sqlite3*" -name "*.node" 2>/dev/null | head -1)
          [ -n "$SQLITE" ] || { echo "::error::better-sqlite3 .node not found"; exit 1; }
          BIN=$(find release/win-unpacked -maxdepth 1 -name "CodePilot.exe" | head -1)
          ELECTRON_RUN_AS_NODE=1 "$BIN" -e "const path = require('node:path'); require(path.resolve(process.argv[1])); console.log('better-sqlite3 OK, ABI=' + process.versions.modules)" "$SQLITE"
          node scripts/verify-packaged-server.mjs "$BIN" "$(dirname "$BIN")/resources"

      - name: Checksums
        shell: bash
        run: cd release && sha256sum CodePilot.Setup.*.exe 2>/dev/null | tee checksums-windows.sha256

      - uses: actions/upload-artifact@v4
        with:
          name: release-windows
          path: |
            release/CodePilot.Setup.*.exe
            release/checksums-windows.sha256
          retention-days: 7

  build-linux:
    needs: verify-source
    if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'linux' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64
            runner: ubuntu-22.04
            deb_arch: amd64
            rpm_arch: x86_64
            file_arch: x86-64
          - arch: arm64
            runner: ubuntu-22.04-arm
            deb_arch: arm64
            rpm_arch: aarch64
            file_arch: ARM aarch64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install RPM packaging support
        run: sudo apt-get update && sudo apt-get install -y rpm

      - run: npm ci

      - name: Build Linux release bundle
        timeout-minutes: 35
        env:
          CODEPILOT_APP_CHANNEL: stable
          CODEPILOT_SOURCE_MAPS: "1"
          CODEPILOT_TELEMETRY_SMOKE: "0"
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        run: npm run electron:build

      - name: Upload Linux source maps to Sentry
        env:
          CODEPILOT_APP_CHANNEL: stable
          CODEPILOT_SOURCE_MAPS: "1"
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        run: npm run sentry:sourcemaps:upload

      - name: Package Linux ${{ matrix.arch }}
        timeout-minutes: 35
        run: npx electron-builder --linux --${{ matrix.arch }} --config electron-builder.yml --publish never

      - name: Verify Linux package architecture, native ABI, and server startup
        env:
          EXPECTED_VERSION: ${{ needs.verify-source.outputs.version }}
          EXPECTED_DEB_ARCH: ${{ matrix.deb_arch }}
          EXPECTED_RPM_ARCH: ${{ matrix.rpm_arch }}
          EXPECTED_FILE_ARCH: ${{ matrix.file_arch }}
        run: |
          set -euo pipefail
          APPIMAGE=$(find release -maxdepth 1 -name "CodePilot-*.AppImage" | head -1)
          DEB=$(find release -maxdepth 1 -name "CodePilot-*.deb" | head -1)
          RPM=$(find release -maxdepth 1 -name "CodePilot-*.rpm" | head -1)
          for PACKAGE in "$APPIMAGE" "$DEB" "$RPM"; do
            [ -n "$PACKAGE" ] || { echo "::error::missing Linux package"; exit 1; }
            case "$PACKAGE" in *"$EXPECTED_VERSION"*) ;; *) echo "::error::$PACKAGE lacks version $EXPECTED_VERSION"; exit 1 ;; esac
          done
          [ "$(dpkg-deb -f "$DEB" Architecture)" = "$EXPECTED_DEB_ARCH" ] || {
            echo "::error::DEB architecture does not match $EXPECTED_DEB_ARCH"
            exit 1
          }
          [ "$(rpm -qp --qf '%{ARCH}' "$RPM")" = "$EXPECTED_RPM_ARCH" ] || {
            echo "::error::RPM architecture does not match $EXPECTED_RPM_ARCH"
            exit 1
          }
          UNPACKED=$(find release -maxdepth 1 -type d -name "linux*unpacked" | head -1)
          [ -n "$UNPACKED" ] || { echo "::error::Linux unpacked app not found"; exit 1; }
          BIN="$UNPACKED/codepilot"
          [ -x "$BIN" ] || BIN="$UNPACKED/CodePilot"
          [ -x "$BIN" ] || { echo "::error::CodePilot Linux executable not found"; exit 1; }
          file "$BIN" | grep -F "$EXPECTED_FILE_ARCH" || {
            echo "::error::Linux executable architecture does not match $EXPECTED_FILE_ARCH"
            file "$BIN"
            exit 1
          }
          SQLITE=$(find "$UNPACKED/resources" -path "*better-sqlite3*" -name "*.node" | head -1)
          [ -n "$SQLITE" ] || { echo "::error::better-sqlite3 .node not found"; exit 1; }
          ELECTRON_RUN_AS_NODE=1 "$BIN" -e "const path = require('node:path'); require(path.resolve(process.argv[1])); console.log('better-sqlite3 OK, ABI=' + process.versions.modules)" "$SQLITE"
          node scripts/verify-packaged-server.mjs "$BIN" "$UNPACKED/resources"
          echo "Linux build baseline: $(getconf GNU_LIBC_VERSION)"

      - name: Checksums
        run: cd release && sha256sum CodePilot-*.AppImage CodePilot-*.deb CodePilot-*.rpm | tee "checksums-linux-${{ matrix.arch }}.sha256"

      - uses: actions/upload-artifact@v4
        with:
          name: release-linux-${{ matrix.arch }}
          path: |
            release/CodePilot-*.AppImage
            release/CodePilot-*.deb
            release/CodePilot-*.rpm
            release/checksums-linux-${{ matrix.arch }}.sha256
          retention-days: 7

  release:
    # Only on a `v*` tag push, and only after all build jobs succeed (default
    # `needs` semantics skip this job if any dependency fails).
    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
    needs: [build-macos, build-windows, build-linux]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download all build artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: List artifacts
        run: find artifacts -type f | sort

      - name: Create stable GitHub Release + upload assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"

          # Release body is RELEASE_NOTES.md from the repo (must be present for a
          # stable release — no silent fallback).
          [ -f RELEASE_NOTES.md ] || { echo "::error::RELEASE_NOTES.md missing — cannot create stable release"; exit 1; }

          # Merge per-platform checksums into one file.
          echo "## SHA-256 Checksums" > artifacts/SHA256SUMS.txt
          echo "" >> artifacts/SHA256SUMS.txt
          for cs in artifacts/checksums-*.sha256; do
            [ -f "$cs" ] || continue
            cat "$cs" >> artifacts/SHA256SUMS.txt
          done
          echo "=== Combined checksums ==="
          cat artifacts/SHA256SUMS.txt

          # Collect installers + checksum file (skip blockmap / update metadata).
          FILES=()
          while IFS= read -r f; do
            FILES+=("$f")
          done < <(find artifacts -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" -o -name "*.rpm" \) | sort)
          FILES+=("artifacts/SHA256SUMS.txt")
          echo "=== Release assets ==="
          printf '%s\n' "${FILES[@]}"

          gh release create "${GITHUB_REF_NAME}" \
            --title "CodePilot v${VERSION}" \
            --notes-file RELEASE_NOTES.md \
            --latest \
            "${FILES[@]}"