release.yaml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Exact Cargo version to verify without publishing
        required: true
        type: string
  push:
    tags:
      - "v*"

permissions: {}

concurrency:
  group: cli-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  context:
    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      publish: ${{ steps.release.outputs.publish }}
      minimum-supported-cli-version: ${{ steps.release.outputs.minimum-supported-cli-version }}
      source-date-epoch: ${{ steps.release.outputs.source-date-epoch }}
      source-ref: ${{ steps.release.outputs.source-ref }}
      tag: ${{ steps.release.outputs.tag }}
      verified-channels: ${{ steps.release.outputs.verified-channels }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: Check out complete source history
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Resolve immutable release context
        id: release
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          node scripts/resolve-release-context.mjs >> "$GITHUB_OUTPUT"
          source_date_epoch=$(git show -s --format=%ct "$GITHUB_SHA")
          printf 'source-date-epoch=%s\n' "$source_date_epoch" >> "$GITHUB_OUTPUT"
          test -s "docs/releases/v${RELEASE_VERSION:-${GITHUB_REF_NAME#v}}.md"
          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
            test "$(git cat-file -t "refs/tags/$GITHUB_REF_NAME")" = "tag"
            git fetch --no-tags origin '+refs/heads/main:refs/remotes/origin/main'
            git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main
          fi

  build-macos:
    needs: context
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            runner: macos-15
          - target: x86_64-apple-darwin
            runner: macos-15-intel
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install exact Rust toolchain
        shell: bash
        run: |
          set -euo pipefail
          rustup toolchain install 1.85.0 --profile minimal
          rustc +1.85.0 -vV | grep -F "host: ${{ matrix.target }}"
      - name: Build and compare independent archives
        id: package
        env:
          SOURCE_DATE_EPOCH: ${{ needs.context.outputs.source-date-epoch }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          target="${{ matrix.target }}"
          first_target="$RUNNER_TEMP/stack-target-first"
          second_target="$RUNNER_TEMP/stack-target-second"
          export CARGO_INCREMENTAL=0
          export MACOSX_DEPLOYMENT_TARGET=13.0
          export RUSTFLAGS="--remap-path-prefix=$GITHUB_WORKSPACE=/workspace --remap-path-prefix=$HOME/.cargo=/cargo"
          CARGO_TARGET_DIR="$first_target" cargo +1.85.0 build --release --locked --target "$target"
          CARGO_TARGET_DIR="$second_target" cargo +1.85.0 build --release --locked --target "$target"
          first_binary="$first_target/$target/release/stack"
          second_binary="$second_target/$target/release/stack"
          python3 scripts/normalize_macos_binary.py --binary "$first_binary" --target "$target"
          python3 scripts/normalize_macos_binary.py --binary "$second_binary" --target "$target"
          cmp "$first_binary" "$second_binary"
          python3 scripts/verify_release_binary.py --binary "$first_binary" --target "$target" --version "$VERSION"
          python3 -m scripts.smoke_installed_cli --binary "$first_binary" --target "$target" --version "$VERSION" --source-root "$GITHUB_WORKSPACE"
          first_archive=$(python3 scripts/package_release.py create \
            --binary "$first_binary" \
            --target "$target" \
            --version "$VERSION" \
            --source-date-epoch "$SOURCE_DATE_EPOCH" \
            --output-directory "$RUNNER_TEMP/package-first")
          second_archive=$(python3 scripts/package_release.py create \
            --binary "$second_binary" \
            --target "$target" \
            --version "$VERSION" \
            --source-date-epoch "$SOURCE_DATE_EPOCH" \
            --output-directory "$RUNNER_TEMP/package-second")
          cmp "$first_archive" "$second_archive"
          shasum -a 256 "$first_archive"
          printf 'archive=%s\n' "$first_archive" >> "$GITHUB_OUTPUT"
      - name: Upload reproducible archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-${{ matrix.target }}
          path: ${{ steps.package.outputs.archive }}
          if-no-files-found: error
          retention-days: 7

  build-linux:
    needs: context
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    container:
      image: rust:1.85.0-slim-bullseye@sha256:a78439ac2ee14dc1c2c188fef0ff0b197e1cc1918d4b3daf486776ac0f60029a
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-22.04-arm
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-22.04
    steps:
      - name: Install snapshot-pinned release tools
        shell: bash
        run: |
          set -euo pipefail
          sed -i \
            -e 's|^# deb http://snapshot.debian.org/archive/debian/20250317T000000Z bullseye main$|deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20250317T000000Z bullseye main|' \
            -e 's|^# deb http://snapshot.debian.org/archive/debian-security/20250317T000000Z bullseye-security main$|deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20250317T000000Z bullseye-security main|' \
            -e 's|^# deb http://snapshot.debian.org/archive/debian/20250317T000000Z bullseye-updates main$|deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20250317T000000Z bullseye-updates main|' \
            -e '/^deb http:\/\/deb.debian.org\//s/^/# /' \
            -e '/^deb http:\/\/deb.debian.org\/debian-security/s/^/# /' \
            /etc/apt/sources.list
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
            file=1:5.39-3+deb11u1 \
            git=1:2.30.2-1+deb11u4 \
            python3=3.9.2-3
          test "$(dpkg-query -W -f='${Version}' file)" = '1:5.39-3+deb11u1'
          test "$(dpkg-query -W -f='${Version}' git)" = '1:2.30.2-1+deb11u4'
          test "$(dpkg-query -W -f='${Version}' python3)" = '3.9.2-3'
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Verify exact native Rust toolchain
        shell: bash
        run: |
          set -euo pipefail
          test "$(rustc --version)" = "rustc 1.85.0 (4d91de4e4 2025-02-17)"
          rustc -vV | grep -F "host: ${{ matrix.target }}"
      - name: Build and compare independent archives
        id: package
        env:
          SOURCE_DATE_EPOCH: ${{ needs.context.outputs.source-date-epoch }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          target="${{ matrix.target }}"
          first_target="$RUNNER_TEMP/stack-target-first"
          second_target="$RUNNER_TEMP/stack-target-second"
          export CARGO_INCREMENTAL=0
          export RUSTFLAGS="--remap-path-prefix=$GITHUB_WORKSPACE=/workspace --remap-path-prefix=$HOME/.cargo=/cargo"
          CARGO_TARGET_DIR="$first_target" cargo build --release --locked --target "$target"
          CARGO_TARGET_DIR="$second_target" cargo build --release --locked --target "$target"
          first_binary="$first_target/$target/release/stack"
          second_binary="$second_target/$target/release/stack"
          cmp "$first_binary" "$second_binary"
          python3 scripts/verify_release_binary.py --binary "$first_binary" --target "$target" --version "$VERSION"
          python3 -m scripts.smoke_installed_cli --binary "$first_binary" --target "$target" --version "$VERSION" --source-root "$GITHUB_WORKSPACE"
          first_archive=$(python3 scripts/package_release.py create \
            --binary "$first_binary" \
            --target "$target" \
            --version "$VERSION" \
            --source-date-epoch "$SOURCE_DATE_EPOCH" \
            --output-directory "$RUNNER_TEMP/package-first")
          second_archive=$(python3 scripts/package_release.py create \
            --binary "$second_binary" \
            --target "$target" \
            --version "$VERSION" \
            --source-date-epoch "$SOURCE_DATE_EPOCH" \
            --output-directory "$RUNNER_TEMP/package-second")
          cmp "$first_archive" "$second_archive"
          sha256sum "$first_archive"
          printf 'archive=%s\n' "$first_archive" >> "$GITHUB_OUTPUT"
      - name: Upload reproducible archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-${{ matrix.target }}
          path: ${{ steps.package.outputs.archive }}
          if-no-files-found: error
          retention-days: 7

  attest:
    needs: [context, build-macos, build-linux]
    name: Attest ${{ matrix.target }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        target:
          - aarch64-apple-darwin
          - x86_64-apple-darwin
          - aarch64-unknown-linux-gnu
          - x86_64-unknown-linux-gnu
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Download target archive
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-${{ matrix.target }}
          path: dist/release
      - name: Verify archive metadata
        env:
          SOURCE_DATE_EPOCH: ${{ needs.context.outputs.source-date-epoch }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          python3 scripts/package_release.py verify \
            --archive "dist/release/stack-v${VERSION}-${{ matrix.target }}.tar.gz" \
            --target "${{ matrix.target }}" \
            --version "$VERSION" \
            --source-date-epoch "$SOURCE_DATE_EPOCH"
      - name: Install Syft
        id: syft
        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
        with:
          syft-version: v1.51.1
      - name: Generate SPDX SBOM
        env:
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          archive="stack-v${VERSION}-${{ matrix.target }}.tar.gz"
          sbom="dist/release/stack-v${VERSION}-${{ matrix.target }}.spdx.json"
          "${{ steps.syft.outputs.cmd }}" scan dir:. \
            --exclude './.git/**' \
            --exclude './dist/**' \
            --source-name "$archive" \
            --source-version "$VERSION" \
            --output "spdx-json=$sbom"
          jq -e --arg archive "$archive" '
            .spdxVersion == "SPDX-2.3" and
            .dataLicense == "CC0-1.0" and
            .SPDXID == "SPDXRef-DOCUMENT" and
            .name == $archive and
            (.packages | type == "array" and length > 0)
          ' "$sbom" > /dev/null
      - name: Attest provenance
        id: provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/release/stack-v${{ needs.context.outputs.version }}-${{ matrix.target }}.tar.gz
      - name: Preserve provenance bundle
        shell: bash
        run: |
          set -euo pipefail
          install -m 0644 \
            "${{ steps.provenance.outputs.bundle-path }}" \
            "dist/release/stack-v${{ needs.context.outputs.version }}-${{ matrix.target }}.provenance.sigstore.json"
      - name: Attest SBOM
        id: sbom-attestation
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/release/stack-v${{ needs.context.outputs.version }}-${{ matrix.target }}.tar.gz
          sbom-path: dist/release/stack-v${{ needs.context.outputs.version }}-${{ matrix.target }}.spdx.json
      - name: Preserve SBOM bundle
        shell: bash
        run: |
          set -euo pipefail
          install -m 0644 \
            "${{ steps.sbom-attestation.outputs.bundle-path }}" \
            "dist/release/stack-v${{ needs.context.outputs.version }}-${{ matrix.target }}.sbom.sigstore.json"
      - name: Verify target attestations
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_REF: ${{ needs.context.outputs.source-ref }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          archive="dist/release/stack-v${VERSION}-${{ matrix.target }}.tar.gz"
          gh attestation verify "$archive" \
            --repo stack-sh/cli \
            --bundle "dist/release/stack-v${VERSION}-${{ matrix.target }}.provenance.sigstore.json" \
            --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
            --source-ref "$SOURCE_REF" \
            --deny-self-hosted-runners
          gh attestation verify "$archive" \
            --repo stack-sh/cli \
            --bundle "dist/release/stack-v${VERSION}-${{ matrix.target }}.sbom.sigstore.json" \
            --predicate-type https://spdx.dev/Document/v2.3 \
            --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
            --source-ref "$SOURCE_REF" \
            --deny-self-hosted-runners
      - name: Upload target materials
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: materials-${{ matrix.target }}
          path: dist/release
          if-no-files-found: error
          retention-days: 7

  assemble:
    needs: [context, attest]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Download all target materials
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: materials-*
          path: dist/release
          merge-multiple: true
      - name: Generate release manifest and checksums
        env:
          SOURCE_DATE_EPOCH: ${{ needs.context.outputs.source-date-epoch }}
          MINIMUM_SUPPORTED_CLI_VERSION: ${{ needs.context.outputs.minimum-supported-cli-version }}
          VERIFIED_CHANNELS: ${{ needs.context.outputs.verified-channels }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          node scripts/release-security.mjs generate \
            --directory dist/release \
            --version "$VERSION" \
            --commit "$GITHUB_SHA" \
            --minimum-supported-version "$MINIMUM_SUPPORTED_CLI_VERSION" \
            --source-date-epoch "$SOURCE_DATE_EPOCH" \
            --builder-workflow stack-sh/cli/.github/workflows/release.yaml \
            --verified-channels "$VERIFIED_CHANNELS"
      - name: Attest release manifest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/release/stack-v${{ needs.context.outputs.version }}-release-manifest.json
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: v3.1.3
      - name: Sign checksum inventory
        env:
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          cosign sign-blob \
            --yes \
            --bundle "dist/release/stack-v${VERSION}-checksums.txt.sigstore.json" \
            "dist/release/stack-v${VERSION}-checksums.txt"
      - name: Verify complete release bundle
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_DATE_EPOCH: ${{ needs.context.outputs.source-date-epoch }}
          SOURCE_REF: ${{ needs.context.outputs.source-ref }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          identity="https://github.com/stack-sh/cli/.github/workflows/release.yaml@${SOURCE_REF}"
          node scripts/release-security.mjs verify --directory dist/release
          cosign verify-blob \
            --bundle "dist/release/stack-v${VERSION}-checksums.txt.sigstore.json" \
            --certificate-identity "$identity" \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            "dist/release/stack-v${VERSION}-checksums.txt"
          gh attestation verify "dist/release/stack-v${VERSION}-release-manifest.json" \
            --repo stack-sh/cli \
            --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
            --source-ref "$SOURCE_REF" \
            --predicate-type https://slsa.dev/provenance/v1 \
            --deny-self-hosted-runners
          (
            cd dist/release
            sha256sum --check "stack-v${VERSION}-checksums.txt"
          )
          for target in \
            aarch64-apple-darwin \
            x86_64-apple-darwin \
            aarch64-unknown-linux-gnu \
            x86_64-unknown-linux-gnu; do
            archive="dist/release/stack-v${VERSION}-${target}.tar.gz"
            python3 scripts/package_release.py verify \
              --archive "$archive" \
              --target "$target" \
              --version "$VERSION" \
              --source-date-epoch "$SOURCE_DATE_EPOCH"
            gh attestation verify "$archive" \
              --repo stack-sh/cli \
              --bundle "dist/release/stack-v${VERSION}-${target}.provenance.sigstore.json" \
              --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
              --source-ref "$SOURCE_REF" \
              --deny-self-hosted-runners
            gh attestation verify "$archive" \
              --repo stack-sh/cli \
              --bundle "dist/release/stack-v${VERSION}-${target}.sbom.sigstore.json" \
              --predicate-type https://spdx.dev/Document/v2.3 \
              --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
              --source-ref "$SOURCE_REF" \
              --deny-self-hosted-runners
          done
      - name: Upload complete release bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-bundle-v${{ needs.context.outputs.version }}
          path: dist/release
          if-no-files-found: error
          retention-days: 14

  publish:
    if: needs.context.outputs.publish == 'true'
    needs: [context, assemble]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
      attestations: read
    steps:
      - name: Check out tagged source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Download complete release bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-bundle-v${{ needs.context.outputs.version }}
          path: dist/release
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: v3.1.3
      - name: Verify bundle before draft upload
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_DATE_EPOCH: ${{ needs.context.outputs.source-date-epoch }}
          SOURCE_REF: ${{ needs.context.outputs.source-ref }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          identity="https://github.com/stack-sh/cli/.github/workflows/release.yaml@${SOURCE_REF}"
          node scripts/release-security.mjs verify --directory dist/release
          cosign verify-blob \
            --bundle "dist/release/stack-v${VERSION}-checksums.txt.sigstore.json" \
            --certificate-identity "$identity" \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            "dist/release/stack-v${VERSION}-checksums.txt"
          gh attestation verify "dist/release/stack-v${VERSION}-release-manifest.json" \
            --repo stack-sh/cli \
            --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
            --source-ref "$SOURCE_REF" \
            --predicate-type https://slsa.dev/provenance/v1 \
            --deny-self-hosted-runners
          for target in \
            aarch64-apple-darwin \
            x86_64-apple-darwin \
            aarch64-unknown-linux-gnu \
            x86_64-unknown-linux-gnu; do
            archive="dist/release/stack-v${VERSION}-${target}.tar.gz"
            python3 scripts/package_release.py verify \
              --archive "$archive" \
              --target "$target" \
              --version "$VERSION" \
              --source-date-epoch "$SOURCE_DATE_EPOCH"
            gh attestation verify "$archive" \
              --repo stack-sh/cli \
              --bundle "dist/release/stack-v${VERSION}-${target}.provenance.sigstore.json" \
              --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
              --source-ref "$SOURCE_REF" \
              --deny-self-hosted-runners
            gh attestation verify "$archive" \
              --repo stack-sh/cli \
              --bundle "dist/release/stack-v${VERSION}-${target}.sbom.sigstore.json" \
              --predicate-type https://spdx.dev/Document/v2.3 \
              --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
              --source-ref "$SOURCE_REF" \
              --deny-self-hosted-runners
          done
      - name: Create or resume exact draft release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.context.outputs.tag }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          existing="$RUNNER_TEMP/existing-release"
          mkdir -p "$existing"
          if gh release view "$TAG" --json isDraft --jq '.isDraft' > "$RUNNER_TEMP/existing-draft" 2>/dev/null; then
            test "$(cat "$RUNNER_TEMP/existing-draft")" = "true"
            gh release download "$TAG" --dir "$existing"
            test "$(find "$existing" -maxdepth 1 -type f | wc -l | tr -d ' ')" = "19"
            for source in dist/release/*; do
              cmp "$source" "$existing/$(basename "$source")"
            done
          else
            release_arguments=(
              --draft
              --verify-tag
              --title "Stack CLI $VERSION"
              --notes-file "docs/releases/v${VERSION}.md"
            )
            if [[ "$VERSION" == *-rc.* ]]; then
              release_arguments+=(--prerelease --latest=false)
            fi
            gh release create "$TAG" dist/release/* "${release_arguments[@]}"
          fi
      - name: Verify draft download and native install
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_DATE_EPOCH: ${{ needs.context.outputs.source-date-epoch }}
          SOURCE_REF: ${{ needs.context.outputs.source-ref }}
          TAG: ${{ needs.context.outputs.tag }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          downloaded="$RUNNER_TEMP/draft-release"
          mkdir -p "$downloaded"
          gh release download "$TAG" --dir "$downloaded"
          test "$(find "$downloaded" -maxdepth 1 -type f | wc -l | tr -d ' ')" = "19"
          for source in dist/release/*; do
            cmp "$source" "$downloaded/$(basename "$source")"
          done
          node scripts/release-security.mjs verify --directory "$downloaded"
          identity="https://github.com/stack-sh/cli/.github/workflows/release.yaml@${SOURCE_REF}"
          cosign verify-blob \
            --bundle "$downloaded/stack-v${VERSION}-checksums.txt.sigstore.json" \
            --certificate-identity "$identity" \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            "$downloaded/stack-v${VERSION}-checksums.txt"
          gh attestation verify "$downloaded/stack-v${VERSION}-release-manifest.json" \
            --repo stack-sh/cli \
            --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
            --source-ref "$SOURCE_REF" \
            --predicate-type https://slsa.dev/provenance/v1 \
            --deny-self-hosted-runners
          for target in \
            aarch64-apple-darwin \
            x86_64-apple-darwin \
            aarch64-unknown-linux-gnu \
            x86_64-unknown-linux-gnu; do
            archive="$downloaded/stack-v${VERSION}-${target}.tar.gz"
            python3 scripts/package_release.py verify \
              --archive "$archive" \
              --target "$target" \
              --version "$VERSION" \
              --source-date-epoch "$SOURCE_DATE_EPOCH"
            gh attestation verify "$archive" \
              --repo stack-sh/cli \
              --bundle "$downloaded/stack-v${VERSION}-${target}.provenance.sigstore.json" \
              --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
              --source-ref "$SOURCE_REF" \
              --deny-self-hosted-runners
            gh attestation verify "$archive" \
              --repo stack-sh/cli \
              --bundle "$downloaded/stack-v${VERSION}-${target}.sbom.sigstore.json" \
              --predicate-type https://spdx.dev/Document/v2.3 \
              --signer-workflow stack-sh/cli/.github/workflows/release.yaml \
              --source-ref "$SOURCE_REF" \
              --deny-self-hosted-runners
          done
          archive="$downloaded/stack-v${VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          install_root="$RUNNER_TEMP/install-smoke"
          mkdir -p "$install_root"
          tar -xzf "$archive" -C "$install_root"
          python3 scripts/verify_release_binary.py \
            --binary "$install_root/stack-v${VERSION}-x86_64-unknown-linux-gnu/stack" \
            --target x86_64-unknown-linux-gnu \
            --version "$VERSION"
      - name: Publish verified draft
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.context.outputs.tag }}
          VERSION: ${{ needs.context.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$VERSION" == *-rc.* ]]; then
            gh release edit "$TAG" --draft=false --prerelease --latest=false
          else
            gh release edit "$TAG" --draft=false --latest
          fi
          test "$(gh release view "$TAG" --json isDraft --jq '.isDraft')" = "false"

  native-install:
    if: needs.context.outputs.publish == 'true' && !contains(needs.context.outputs.version, '-rc.')
    needs: [context, publish]
    permissions:
      contents: read
      attestations: read
    uses: ./.github/workflows/distribution-smoke.yaml
    with:
      scope: native
      version: ${{ needs.context.outputs.version }}
      source_commit: ${{ github.sha }}

  completion:
    name: release completion
    if: always()
    needs: [context, build-macos, build-linux, attest, assemble, publish, native-install]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Require all applicable build, publication, and installation results
        env:
          PUBLICATION_NEEDS: ${{ toJSON(needs) }}
        run: node scripts/publication-completion.mjs release >> "$GITHUB_STEP_SUMMARY"