release-dry-run.yml

name: Release Dry Run

# Builds release artifacts for review without cache-poisoning the real release.
# Proves binary starts and archives contain expected entries; cannot prove GitHub-Release upload.
# pull_request trigger on artifact-shape paths lets this run pre-merge for the PRs that need it.
on:
  workflow_dispatch:
    inputs:
      version:
        description: Semver version to name the archives with, for example 0.9.0
        required: true
        type: string
  pull_request:
    paths:
      - '.github/workflows/release.yml'
      - '.github/workflows/release-dry-run.yml'
      - 'npm/**'
      - 'crates/ffi/Cargo.toml'

permissions: {}

env:
  CARGO_TERM_COLOR: always

jobs:
  cli:
    name: Dry-run CLI (${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            runner: macos-latest
          - target: x86_64-apple-darwin
            runner: macos-latest
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
          - target: aarch64-pc-windows-msvc
            runner: windows-11-arm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          rustup show
          rustup target add ${{ matrix.target }}

      - name: Build release binary (macOS)
        if: runner.os == 'macOS'
        run: |
          cargo build --locked --release -p agent-desktop --target ${{ matrix.target }}
          cargo build --locked --release -p agent-desktop-macos --bin agent-desktop-macos-helper --target ${{ matrix.target }}

      - name: Build release binary (Windows)
        if: runner.os == 'Windows'
        run: cargo build --locked --release -p agent-desktop --target ${{ matrix.target }}

      - name: Smoke-run the built binary (macOS)
        if: runner.os == 'macOS'
        run: target/${{ matrix.target }}/release/agent-desktop version

      - name: Smoke-run the built binary (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: '& "target/${{ matrix.target }}/release/agent-desktop.exe" version'

      - name: Create tarball (macOS)
        if: runner.os == 'macOS'
        env:
          VERSION: ${{ inputs.version || format('0.0.0-pr{0}', github.event.pull_request.number) }}
        run: |
          TARBALL="agent-desktop-v${VERSION}-${{ matrix.target }}.tar.gz"
          tar -czf "${TARBALL}" -C "target/${{ matrix.target }}/release" \
            agent-desktop agent-desktop-macos-helper
          tar -tzf "${TARBALL}" | sort > listing.txt
          printf 'agent-desktop\nagent-desktop-macos-helper\n' | sort > expected.txt
          diff -u expected.txt listing.txt
          shasum -a 256 "${TARBALL}" > "${TARBALL}.sha256"

      - name: Create tarball (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          VERSION: ${{ inputs.version || format('0.0.0-pr{0}', github.event.pull_request.number) }}
        run: |
          $tarball = "agent-desktop-v${env:VERSION}-${{ matrix.target }}.tar.gz"
          & tar -czf $tarball -C "target/${{ matrix.target }}/release" agent-desktop.exe
          $listing = @(@(& tar -tzf $tarball) | Where-Object { $_ -ne '' })
          if (@($listing).Count -ne 1 -or $listing[0] -ne 'agent-desktop.exe') {
            Write-Host "FAIL: archive entries are '$($listing -join ", ")', expected exactly agent-desktop.exe"
            exit 1
          }
          $hash = (Get-FileHash $tarball -Algorithm SHA256).Hash.ToLower()
          "$hash  $tarball" | Out-File -Encoding ascii "${tarball}.sha256"

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dry-run-binary-${{ matrix.target }}
          path: |
            agent-desktop-v*.tar.gz
            agent-desktop-v*.tar.gz.sha256
          retention-days: 1

  ffi:
    name: Dry-run FFI (${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
          - target: aarch64-pc-windows-msvc
            runner: windows-11-arm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: |
          rustup show
          rustup target add ${{ matrix.target }}

      - name: Build FFI cdylib
        run: >
          cargo build --locked --profile release-ffi
          -p agent-desktop-ffi --target ${{ matrix.target }}

      # The import library is what an MSVC-linking consumer needs and what the
      # release archive omitted until this sub-phase; assert it exists here
      # rather than discovering its absence from a published zip.
      - name: Stage and verify archive contents
        shell: pwsh
        env:
          VERSION: ${{ inputs.version || format('0.0.0-pr{0}', github.event.pull_request.number) }}
        run: |
          $stage = "agent-desktop-ffi-v${env:VERSION}-${{ matrix.target }}"
          New-Item -ItemType Directory -Path "$stage/lib", "$stage/include" | Out-Null
          $out = "target/${{ matrix.target }}/release-ffi"
          Copy-Item "$out/agent_desktop_ffi.dll" "$stage/lib/"
          Copy-Item "$out/agent_desktop_ffi.dll.lib" "$stage/lib/"
          Copy-Item "crates/ffi/include/agent_desktop.h" "$stage/include/"
          foreach ($required in @('agent_desktop_ffi.dll', 'agent_desktop_ffi.dll.lib')) {
            if (-not (Test-Path "$stage/lib/$required")) {
              Write-Host "FAIL: $required was not staged into $stage/lib"
              exit 1
            }
          }
          Compress-Archive -Path $stage -DestinationPath "$stage.zip"

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dry-run-ffi-${{ matrix.target }}
          path: agent-desktop-ffi-v*.zip
          retention-days: 1