lastcode-intel-artifact.yml

name: LastCode Intel artifact

run-name: Build Intel package · ${{ inputs.installable_tag }} · ${{ inputs.request_token }}

on:
  workflow_dispatch:
    inputs:
      installable_tag:
        description: Exact lastcode/checkpoint or lastcode/revision tag
        required: true
        type: string
      installable_commit:
        description: Full commit SHA advertised for the installable tag
        required: true
        type: string
      request_token:
        description: Unique token used to correlate this dispatch to one workflow run
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: lastcode-intel-artifact-${{ inputs.installable_tag }}
  cancel-in-progress: false

jobs:
  build:
    name: Validate and build macOS x64
    runs-on: macos-15-intel
    # The full workspace gate and packaging can exceed 90 minutes on hosted Intel.
    timeout-minutes: 180
    outputs:
      needs_build: ${{ steps.release.outputs.needs_build }}
      version: ${{ steps.target.outputs.version }}
    env:
      INSTALLABLE_TAG: ${{ inputs.installable_tag }}
      INSTALLABLE_COMMIT: ${{ inputs.installable_commit }}
      REQUEST_TOKEN: ${{ inputs.request_token }}
    steps:
      - name: Checkout workflow automation
        uses: actions/checkout@v6
        with:
          fetch-depth: 1
          path: automation
          persist-credentials: false
          ref: ${{ github.workflow_sha }}
          sparse-checkout: |
            /package.json
            /scripts/lastcode-intel-release.mjs
          sparse-checkout-cone-mode: false

      - name: Setup Node for release validation
        uses: actions/setup-node@v6
        with:
          node-version-file: automation/package.json

      - name: Checkout exact installable
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          path: target
          persist-credentials: false
          ref: ${{ inputs.installable_commit }}
          sparse-checkout: |
            /*
            !/.repos/
          sparse-checkout-cone-mode: false

      - name: Validate immutable tag and commit
        id: target
        shell: bash
        working-directory: target
        run: |
          set -euo pipefail

          if [[ ! "$INSTALLABLE_TAG" =~ ^lastcode/(checkpoint|revision)/v[0-9]+\.[0-9]+\.[0-9]+-nightly\.[0-9]{8}\.[0-9]+(\.[0-9]+)?$ ]]; then
            echo "Unsupported installable tag: $INSTALLABLE_TAG" >&2
            exit 1
          fi
          if [[ ! "$INSTALLABLE_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
            echo "installable_commit must be a full lowercase commit SHA." >&2
            exit 1
          fi
          if [[ ! "$REQUEST_TOKEN" =~ ^intel-[0-9a-f-]{36}$ ]]; then
            echo "request_token must be an intel-prefixed UUID." >&2
            exit 1
          fi

          version="${INSTALLABLE_TAG#lastcode/checkpoint/v}"
          version="${version#lastcode/revision/v}"
          upstream_tag="v${version}"
          if [[ "$INSTALLABLE_TAG" == lastcode/revision/* ]]; then
            upstream_tag="v${version%.*}"
          fi

          git fetch --force --no-tags origin \
            "refs/tags/${INSTALLABLE_TAG}:refs/tags/${INSTALLABLE_TAG}"
          git fetch --force --no-tags https://github.com/pingdotgg/t3code.git \
            "refs/tags/${upstream_tag}:refs/tags/${upstream_tag}"
          resolved_commit="$(git rev-parse "${INSTALLABLE_TAG}^{commit}")"
          if [[ "$resolved_commit" != "$INSTALLABLE_COMMIT" ]]; then
            echo "Tag/commit mismatch: expected $INSTALLABLE_COMMIT, resolved $resolved_commit" >&2
            exit 1
          fi
          if [[ "$(git rev-parse HEAD)" != "$resolved_commit" ]]; then
            echo "Checkout does not match validated installable commit." >&2
            exit 1
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Reuse a validated exact-tag release
        id: release
        shell: bash
        working-directory: automation
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          encoded_tag="${INSTALLABLE_TAG//\//%2F}"
          set +e
          probe="$(
            gh api --include --silent \
              "repos/${GITHUB_REPOSITORY}/releases/tags/${encoded_tag}" 2>&1
          )"
          probe_exit=$?
          set -e
          http_status="$(
            printf '%s\n' "$probe" |
              awk '$1 ~ /^HTTP\// { status = $2 } END { print status }'
          )"

          if [[ "$http_status" == "404" ]]; then
            echo "needs_build=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if [[ "$probe_exit" -ne 0 || "$http_status" != "200" ]]; then
            printf '%s\n' "$probe" >&2
            echo "Could not determine whether the exact-tag release exists." >&2
            exit 1
          fi

          release_dir="$RUNNER_TEMP/existing-intel-release"
          release_json="$RUNNER_TEMP/existing-intel-release.json"
          mkdir -p "$release_dir"
          gh release view "$INSTALLABLE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --json assets,isDraft,isImmutable,isPrerelease,tagName > "$release_json"
          gh release download "$INSTALLABLE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --dir "$release_dir"
          node scripts/lastcode-intel-release.mjs validate \
            --directory "$release_dir" \
            --tag "$INSTALLABLE_TAG" \
            --commit "$INSTALLABLE_COMMIT" \
            --release-json "$release_json"
          echo "Exact-tag Intel release is already complete; skipping CI and packaging."
          echo "needs_build=false" >> "$GITHUB_OUTPUT"

      - name: Setup Vite+
        if: steps.release.outputs.needs_build == 'true'
        uses: voidzero-dev/setup-vp@v1
        with:
          working-directory: target
          node-version-file: package.json
          cache: true
          run-install: true

      - name: Setup Rust x64 target
        if: steps.release.outputs.needs_build == 'true'
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
          targets: x86_64-apple-darwin

      - name: Install mobile CI prerequisites
        if: steps.release.outputs.needs_build == 'true'
        working-directory: target
        run: brew bundle install --file apps/mobile/Brewfile

      - name: Install Chromium for server browser integration tests
        if: steps.release.outputs.needs_build == 'true'
        working-directory: target
        run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium

      - name: Run full checkpoint gate
        if: steps.release.outputs.needs_build == 'true'
        working-directory: target
        run: env -u ELECTRON_RUN_AS_NODE node scripts/lastcode-local-ci.ts --full --checkpoint "$INSTALLABLE_TAG"

      - name: Build certificate-free x64 DMG
        if: steps.release.outputs.needs_build == 'true'
        working-directory: target
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: github-actions[bot]
          T3CODE_DESKTOP_UPDATE_REPOSITORY: lastobelus/lastCode
        run: >-
          env -u ELECTRON_RUN_AS_NODE node scripts/lastcode-build-mac.ts
          --arch x64
          --checkpoint "$INSTALLABLE_TAG"
          --output-root release-lastcode
          --verbose

      - name: Validate built exact-tag assets
        id: artifact
        if: steps.release.outputs.needs_build == 'true'
        shell: bash
        working-directory: target
        run: |
          set -euo pipefail

          short_commit="$(git rev-parse --short=10 "$INSTALLABLE_COMMIT")"
          artifact_dir="release-lastcode/v${{ steps.target.outputs.version }}/${short_commit}"
          node "$GITHUB_WORKSPACE/automation/scripts/lastcode-intel-release.mjs" validate \
            --directory "$artifact_dir" \
            --tag "$INSTALLABLE_TAG" \
            --commit "$INSTALLABLE_COMMIT"
          echo "directory=$artifact_dir" >> "$GITHUB_OUTPUT"

      - name: Transfer validated assets to publisher
        if: steps.release.outputs.needs_build == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: intel-release
          path: target/${{ steps.artifact.outputs.directory }}/*
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish immutable exact-tag assets
    needs: build
    if: needs.build.outputs.needs_build == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    env:
      INSTALLABLE_TAG: ${{ inputs.installable_tag }}
      INSTALLABLE_COMMIT: ${{ inputs.installable_commit }}
    steps:
      - name: Checkout workflow automation
        uses: actions/checkout@v6
        with:
          fetch-depth: 1
          persist-credentials: false
          ref: ${{ github.workflow_sha }}
          sparse-checkout: |
            /package.json
            /scripts/lastcode-intel-release.mjs
          sparse-checkout-cone-mode: false

      - name: Setup Node for release validation
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Download isolated build assets
        uses: actions/download-artifact@v8
        with:
          name: intel-release
          path: release

      - name: Validate isolated build assets
        run: >-
          node scripts/lastcode-intel-release.mjs validate
          --directory release
          --tag "$INSTALLABLE_TAG"
          --commit "$INSTALLABLE_COMMIT"

      - name: Reuse a release created during the build
        id: release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          encoded_tag="${INSTALLABLE_TAG//\//%2F}"
          set +e
          probe="$(
            gh api --include --silent \
              "repos/${GITHUB_REPOSITORY}/releases/tags/${encoded_tag}" 2>&1
          )"
          probe_exit=$?
          set -e
          http_status="$(
            printf '%s\n' "$probe" |
              awk '$1 ~ /^HTTP\// { status = $2 } END { print status }'
          )"

          if [[ "$http_status" == "404" ]]; then
            echo "needs_publish=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if [[ "$probe_exit" -ne 0 || "$http_status" != "200" ]]; then
            printf '%s\n' "$probe" >&2
            echo "Could not determine whether the exact-tag release exists." >&2
            exit 1
          fi

          release_dir="$RUNNER_TEMP/existing-intel-release"
          release_json="$RUNNER_TEMP/existing-intel-release.json"
          mkdir -p "$release_dir"
          gh release view "$INSTALLABLE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --json assets,isDraft,isImmutable,isPrerelease,tagName > "$release_json"
          gh release download "$INSTALLABLE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --dir "$release_dir"
          node scripts/lastcode-intel-release.mjs validate \
            --directory "$release_dir" \
            --tag "$INSTALLABLE_TAG" \
            --commit "$INSTALLABLE_COMMIT" \
            --release-json "$release_json"
          echo "Exact-tag Intel release was completed during the build; skipping publication."
          echo "needs_publish=false" >> "$GITHUB_OUTPUT"

      - name: Revalidate immutable tag before publication
        if: steps.release.outputs.needs_publish == 'true'
        shell: bash
        run: |
          set -euo pipefail

          git fetch --force --no-tags origin \
            "refs/tags/${INSTALLABLE_TAG}:refs/tags/${INSTALLABLE_TAG}"
          publish_commit="$(git rev-parse "${INSTALLABLE_TAG}^{commit}")"
          if [[ "$publish_commit" != "$INSTALLABLE_COMMIT" ]]; then
            echo "Tag moved during the build: expected $INSTALLABLE_COMMIT, resolved $publish_commit" >&2
            exit 1
          fi

      - name: Publish and verify exact-tag assets
        if: steps.release.outputs.needs_publish == 'true'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          release_notes="$(printf '%s\n%s\n' \
            "Certificate-free LastCode macOS x64 artifacts for ${INSTALLABLE_TAG}." \
            "Exact commit: ${INSTALLABLE_COMMIT}")"
          gh release create "$INSTALLABLE_TAG" release/* \
            --repo "$GITHUB_REPOSITORY" \
            --verify-tag \
            --prerelease \
            --latest=false \
            --title "LastCode Intel ${{ needs.build.outputs.version }}" \
            --notes "$release_notes"

          verify_dir="$RUNNER_TEMP/published-intel-release"
          release_json="$RUNNER_TEMP/published-intel-release.json"
          mkdir -p "$verify_dir"
          gh release view "$INSTALLABLE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --json assets,isDraft,isImmutable,isPrerelease,tagName > "$release_json"
          gh release download "$INSTALLABLE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --dir "$verify_dir"
          node scripts/lastcode-intel-release.mjs validate \
            --directory "$verify_dir" \
            --tag "$INSTALLABLE_TAG" \
            --commit "$INSTALLABLE_COMMIT" \
            --release-json "$release_json"