release.yml

name: release

on:
  push:
    tags: ["v*"]
    branches: [main]
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Build and verify everything, publish nothing"
        type: boolean
        default: true
      record_hashes:
        description: "Record artifact hashes instead of verifying them"
        type: boolean
        default: false
      targets:
        description: "Comma-separated target triples to build (empty = all). Iterating on one lane should not build six."
        type: string
        default: ""
      skip_napi:
        description: "Skip the @dcl/abgen-node matrix"
        type: boolean
        default: false

permissions:
  contents: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"

  SOURCE_DATE_EPOCH: "315532800"

  ABGEN_GIT_REV: ${{ github.sha }}

jobs:
  build-id:
    name: build id
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      actions: read
    outputs:
      value: ${{ steps.eval.outputs.value }}
      matrix: ${{ steps.matrix.outputs.value }}
      has_build: ${{ steps.matrix.outputs.has_build }}
      promote: ${{ steps.matrix.outputs.promote }}
      has_promote: ${{ steps.matrix.outputs.has_promote }}
      napi_promote: ${{ steps.matrix.outputs.napi_promote }}
      napi_ids: ${{ steps.matrix.outputs.napi_ids }}
      image_docker: ${{ steps.matrix.outputs.image_docker }}
      image_lambda: ${{ steps.matrix.outputs.image_lambda }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
      - name: evaluate .#buildId
        id: eval
        run: |
          set -eu
          flags=(--extra-experimental-features nix-command
                 --extra-experimental-features flakes)
          # Evaluation only, no build: .#buildId is a content id over the
          # filtered source tree, so it is a pure function of what will be
          # compiled and is identical on every runner.
          value="$(nix eval --raw "${flags[@]}" .#buildId)"
          case "$value" in
            *[!0-9a-f]*)
              echo "buildId is not lowercase hex: $value" >&2; exit 1 ;;
          esac
          if [ "${#value}" -ne 12 ]; then
            echo "buildId must be 12 chars, got ${#value}: $value" >&2; exit 1
          fi
          echo "ABGEN_BUILD_ID=$value"
          echo "value=$value" >> "$GITHUB_OUTPUT"

      - name: select targets and locate promotable artifacts
        id: matrix
        env:
          GH_TOKEN: ${{ github.token }}
          WANT: ${{ inputs.targets }}
          RECORDING: ${{ inputs.record_hashes }}
          BUILD_ID: ${{ steps.eval.outputs.value }}
        run: |
          set -eu
          # buildId is global: any source change moves every target's artifacts.
          # Recording a filtered subset would leave the unbuilt targets' hashes
          # describing a tree that no longer exists, and the next tag would fail
          # the gate on them. Narrowing is for iteration, not for recording.
          if [ -n "${WANT:-}" ] && [ "${RECORDING:-false}" = "true" ]; then
            echo "record_hashes needs the full matrix; drop 'targets'" >&2
            exit 1
          fi
          all='[
            {"target":"x86_64-unknown-linux-gnu","runner":"ubuntu-24.04","builder":"nix"},
            {"target":"aarch64-unknown-linux-gnu","runner":"ubuntu-24.04-arm","builder":"nix"},
            {"target":"x86_64-pc-windows-gnu","runner":"ubuntu-24.04","builder":"rustup","bin":"abgen.exe"},
            {"target":"aarch64-pc-windows-gnullvm","runner":"ubuntu-24.04","builder":"rustup","bin":"abgen.exe"},
            {"target":"aarch64-apple-darwin","runner":"macos-15","builder":"rustup","bin":"abgen"},
            {"target":"x86_64-apple-darwin","runner":"macos-15","builder":"rustup","bin":"abgen"}
          ]'
          if [ -z "${WANT:-}" ]; then
            sel=$(echo "$all" | jq -c .)
          else
            sel=$(echo "$all" | jq -c --arg w "$WANT" \
              '($w | split(",") | map(gsub("^\\s+|\\s+$";""))) as $want
               | map(select(.target as $t | $want | index($t))) as $sel
               | if ($sel | length) == 0
                 then error("no target matched: \($w)")
                 else $sel end')
          fi

          # Input-addressed lookup: buildId is a content hash of everything
          # that reaches the compiler, so an unexpired artifact named
          # <kind>-<buildId>-<target> from a finished main run holds
          # byte-identical outputs for THIS tree. Promotion re-proves that
          # against the committed hash manifests before shipping a byte.
          # The current ref is also accepted so rehearsals on a branch can
          # promote their own previous build. Only this repo's own runs
          # count: a fork-PR run executes the fork's workflow files, can
          # upload arbitrary bytes under a precomputable name, and reports
          # the fork's branch name (often "main") as head_branch — but its
          # head_repository_id differs. Recording always builds.
          lookup() {
            [ "${RECORDING:-false}" = "true" ] && { echo ""; return; }
            gh api "/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$1&per_page=10" \
              --jq '[.artifacts[]
                     | select(.expired == false)
                     | select(.workflow_run.head_repository_id == .workflow_run.repository_id)
                     | select(.workflow_run.head_branch == "main"
                              or .workflow_run.head_branch == env.GITHUB_REF_NAME)
                     | select((.workflow_run.id | tostring) != env.GITHUB_RUN_ID)]
                    | sort_by(.created_at) | reverse
                    | if length == 0 then "" else (.[0].id | tostring) end' \
              || echo ""
          }

          build_inc='[]'
          promote='[]'
          while read -r entry; do
            t=$(echo "$entry" | jq -r .target)
            id=$(lookup "archives-$BUILD_ID-$t")
            if [ -n "$id" ]; then
              promote=$(echo "$promote" | jq -c --argjson e "$entry" --arg id "$id" \
                '. + [$e + {artifact_id: $id}]')
            else
              build_inc=$(echo "$build_inc" | jq -c --argjson e "$entry" '. + [$e]')
            fi
          done < <(echo "$sel" | jq -c '.[]')

          napi_ids='[]'
          napi_promote=true
          for t in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu \
                   aarch64-apple-darwin x86_64-apple-darwin x86_64-pc-windows-msvc; do
            id=$(lookup "napi-$BUILD_ID-$t")
            if [ -z "$id" ]; then napi_promote=false; break; fi
            napi_ids=$(echo "$napi_ids" | jq -c --arg id "$id" '. + [$id]')
          done
          [ "$napi_promote" = "true" ] || napi_ids='[]'

          image_docker=$(lookup "image-$BUILD_ID-dockerImage")
          image_lambda=$(lookup "image-$BUILD_ID-lambdaImage")

          {
            echo "value=$(jq -cn --argjson b "$build_inc" '{include: $b}')"
            echo "has_build=$(echo "$build_inc" | jq 'length > 0')"
            echo "promote=$promote"
            echo "has_promote=$(echo "$promote" | jq 'length > 0')"
            echo "napi_promote=$napi_promote"
            echo "napi_ids=$napi_ids"
            echo "image_docker=$image_docker"
            echo "image_lambda=$image_lambda"
          } | tee -a "$GITHUB_OUTPUT"

  build:
    name: ${{ matrix.target }}
    needs: build-id
    if: needs.build-id.outputs.has_build == 'true'
    runs-on: ${{ matrix.runner }}
    env:
      ABGEN_BUILD_ID: ${{ needs.build-id.outputs.value }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.build-id.outputs.matrix) }}

    steps:
      - name: setup (checkout + toolchains)
        run: |
          git init -q .
          git remote add origin "https://github.com/$GITHUB_REPOSITORY"
          git fetch -q --depth 1 origin "$GITHUB_SHA"
          git checkout -q FETCH_HEAD

          # SOURCE_DATE_EPOCH is pinned at the workflow level and nothing here
          # derives it. ABGEN_BUILD_ID comes from the build-id job; an empty
          # one would make crate/build.rs fall back to `git rev-parse` and put
          # us straight back into per-commit binaries, so fail here instead of
          # discovering it at hash-verify time.
          test -n "${ABGEN_BUILD_ID:-}" \
            || { echo "ABGEN_BUILD_ID is empty (build-id job output)" >&2; exit 1; }
          echo "build id: $ABGEN_BUILD_ID  rev: $ABGEN_GIT_REV  epoch: $SOURCE_DATE_EPOCH"

          # Rustup legs only (nix legs exit below and never read these):
          # reproduces what the nix sandbox gives for free — a fixed
          # /build/source and $HOME — so a runner build doesn't bake
          # /home/runner/work/... into paths. Overwritten below with target
          # additions; the later GITHUB_ENV write wins.
          #
          # $HOME before $PWD is load-bearing: $PWD ($HOME/work/abgen/abgen)
          # nests inside $HOME, and gcc applies the LAST matching
          # -ffile-prefix-map, so reversing the order breaks the /build
          # mapping. The $HOME map covers vendored C built from ~/.cargo
          # (e.g. cxx's cxx.cc).
          {
            echo "RUSTFLAGS=--remap-path-prefix $PWD=/build --remap-path-prefix $HOME=/home"
            echo "CFLAGS=-ffile-prefix-map=$HOME=/home -ffile-prefix-map=$PWD=/build"
            echo "CXXFLAGS=-ffile-prefix-map=$HOME=/home -ffile-prefix-map=$PWD=/build"
          } >> "$GITHUB_ENV"

          if [ "${{ matrix.builder }}" = "nix" ]; then
            exit 0
          fi

          (
            if ! command -v rustup >/dev/null 2>&1; then
              curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
                | sh -s -- -y --default-toolchain none --profile minimal --no-modify-path
              echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
              export PATH="$HOME/.cargo/bin:$PATH"
            fi
            rustup toolchain install 1.97.1 --profile minimal --no-self-update
            rustup default 1.97.1
            rustup target add ${{ matrix.target }}
          ) > /tmp/rustup.log 2>&1 &
          rustup_pid=$!

          if [ "${{ matrix.target }}" = "x86_64-pc-windows-gnu" ]; then
            sudo apt-get update
            sudo apt-get install -y --no-install-recommends g++-mingw-w64-x86-64-posix cmake

            # A search directory holding ONLY libstdc++.a, so `-lstdc++` cannot
            # resolve to an import library.
            #
            # -L is the only non-positional lever here: three build scripts
            # (link-cplusplus, meshopt, crunch) emit dylib-kind
            # `rustc-link-lib=stdc++` too early in argv for -C link-arg or
            # -Bstatic to retract, and meshopt hardcodes
            # .cpp_link_stdlib("stdc++") so no CXXSTDLIB override works
            # either. A search dir containing only libstdc++.a forces ld to
            # prefer it over libstdc++.dll.a for every emitter. Same trick as
            # aarch64-gnullvm below.
            STDCXX_A="$(x86_64-w64-mingw32-g++-posix -print-file-name=libstdc++.a)"
            case "$STDCXX_A" in
              /*) ;;
              *) echo "libstdc++.a unresolved: $STDCXX_A" >&2; exit 1 ;;
            esac
            # Its bytes end up inside abgen.dll, so it is a pinned build input:
            # record the digest alongside the artifact hashes.
            sha256sum "$STDCXX_A"
            sudo mkdir -p /opt/mingw-static-cxx
            sudo cp "$STDCXX_A" /opt/mingw-static-cxx/libstdc++.a
            ls -1 /opt/mingw-static-cxx

            cat > /tmp/mingw-toolchain.cmake <<'EOF'
          set(CMAKE_SYSTEM_NAME Windows)
          set(CMAKE_SYSTEM_PROCESSOR x86_64)
          set(CMAKE_C_COMPILER x86_64-w64-mingw32-gcc-posix)
          set(CMAKE_CXX_COMPILER x86_64-w64-mingw32-g++-posix)
          set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
          EOF
            {
              echo "CMAKE_TOOLCHAIN_FILE=/tmp/mingw-toolchain.cmake"
              echo "CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER=x86_64-w64-mingw32-gcc-posix"
              echo "CC_x86_64_pc_windows_gnu=x86_64-w64-mingw32-gcc-posix"
              echo "CXX_x86_64_pc_windows_gnu=x86_64-w64-mingw32-g++-posix"
              echo "AR_x86_64_pc_windows_gnu=x86_64-w64-mingw32-ar"
              # Read by ci/stable-dlltool.sh, which -C dlltool= points at
              # below. Named here so the wrapper and the rest of the lane's
              # binutils cannot drift apart.
              echo "ABGEN_REAL_DLLTOOL=x86_64-w64-mingw32-dlltool"
            } >> "$GITHUB_ENV"
          fi

          if [ "${{ matrix.target }}" = "aarch64-pc-windows-gnullvm" ]; then
            curl -fsSL -o llvm-mingw.tar.xz https://github.com/mstorsjo/llvm-mingw/releases/download/20260616/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64.tar.xz
            echo "534b92e067b22a6b4441f48ae9240a3341b17825d04d577eab0cf85c44b4deda  llvm-mingw.tar.xz" | sha256sum -c
            sudo tar -xJf llvm-mingw.tar.xz -C /opt && rm llvm-mingw.tar.xz
            cat > /tmp/aarch64-mingw-toolchain.cmake <<'EOF'
          set(CMAKE_SYSTEM_NAME Windows)
          set(CMAKE_SYSTEM_PROCESSOR aarch64)
          set(CMAKE_C_COMPILER aarch64-w64-mingw32-clang)
          set(CMAKE_CXX_COMPILER aarch64-w64-mingw32-clang++)
          set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
          EOF
            sudo rm /opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32/lib/libc++.dll.a \
                    /opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32/lib/libunwind.dll.a
            echo "/opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/bin" >> "$GITHUB_PATH"
            {
              echo "CMAKE_TOOLCHAIN_FILE=/tmp/aarch64-mingw-toolchain.cmake"
              echo "CARGO_TARGET_AARCH64_PC_WINDOWS_GNULLVM_LINKER=aarch64-w64-mingw32-clang"
              echo "CC_aarch64_pc_windows_gnullvm=aarch64-w64-mingw32-clang"
              echo "CXX_aarch64_pc_windows_gnullvm=aarch64-w64-mingw32-clang++"
              echo "AR_aarch64_pc_windows_gnullvm=aarch64-w64-mingw32-ar"
              echo "BINDGEN_EXTRA_CLANG_ARGS=--target=aarch64-w64-mingw32 --sysroot=/opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32"
            } >> "$GITHUB_ENV"
          fi

          wait "$rustup_pid" || { cat /tmp/rustup.log; exit 1; }
          cat /tmp/rustup.log

          rustflags="--remap-path-prefix $PWD=/build --remap-path-prefix $HOME=/home"
          if [ "${{ matrix.target }}" = "x86_64-pc-windows-gnu" ]; then
            rustflags="$rustflags -C link-arg=-Wl,--no-insert-timestamp"
            # Self-contained abgen.dll: +crt-static swaps -lgcc_s for the
            # static -lgcc_eh/-l:libpthread.a (removing libgcc_s_seh-1 and
            # libwinpthread-1); -static-libgcc is honoured by the gcc driver
            # (-static-libstdc++ is g++-only, a no-op here); the -L above
            # forces libstdc++ to resolve to the archive.
            rustflags="$rustflags -C target-feature=+crt-static -C link-arg=-static-libgcc"
            rustflags="$rustflags -L native=/opt/mingw-static-cxx"
            # rustc's raw-dylib import libs bake dlltool's per-invocation temp
            # path into their symbols, making builds nondeterministic;
            # ci/stable-dlltool.sh gives dlltool a content-addressed path
            # instead. -C dlltool=llvm-dlltool is NOT a fix — it leaves import
            # descriptors missing under GNU ld. Only this lane runs dlltool;
            # aarch64-pc-windows-gnullvm uses LLVM's in-process COFF writer.
            rustflags="$rustflags -C dlltool=$PWD/ci/stable-dlltool.sh"
          fi
          if [ "${{ matrix.target }}" = "aarch64-pc-windows-gnullvm" ]; then
            rustflags="$rustflags -C target-feature=+crt-static -C link-arg=-Wl,--no-insert-timestamp"
          fi
          {
            echo "RUSTFLAGS=$rustflags"
            # $HOME first — see the ordering note in the earlier flags step.
            echo "CFLAGS=-ffile-prefix-map=$HOME=/home -ffile-prefix-map=$PWD=/build"
            echo "CXXFLAGS=-ffile-prefix-map=$HOME=/home -ffile-prefix-map=$PWD=/build"
          } >> "$GITHUB_ENV"

      - if: matrix.builder == 'nix'
        uses: ./.github/actions/nix-store-cache

      - if: matrix.builder == 'rustup'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ matrix.target }}-1.97.1-${{ hashFiles('Cargo.lock') }}
          restore-keys: cargo-${{ matrix.target }}-1.97.1-

      - name: build
        run: |
          if [ "${{ matrix.builder }}" = "nix" ]; then
            flags=(--extra-experimental-features nix-command
                   --extra-experimental-features flakes)
            # All four artifacts build in one sandboxed derivation — splitting
            # them across `nix build` and `nix develop --command cargo build`
            # breaks hermeticity, since SOURCE_DATE_EPOCH only applies inside
            # the sandbox.
            # Quiet unless it fails; the retry rebuilds only the failed
            # derivation with its full log.
            nix build .#abgen-native "${flags[@]}" \
              || nix build .#abgen-native --print-build-logs "${flags[@]}"

            if ! [[ "$GITHUB_REF" =~ ^refs/tags/ ]]; then
              case "${{ matrix.target }}" in
                x86_64-unknown-linux-gnu) image=dockerImage ;;
                aarch64-unknown-linux-gnu) image=lambdaImage ;;
              esac
              nix build ".#$image" --out-link image-result "${flags[@]}" \
                || nix build ".#$image" --out-link image-result --print-build-logs "${flags[@]}"
              cp -L image-result "$image.tar.gz"
            fi

            # crane's installFromCargoBuildLog puts executables in bin/ and
            # cdylib/staticlib in lib/. Stage them where every later step
            # already looks, so the gate, packaging and the hash manifest stay
            # target-relative and identical across all six legs.
            out="target/${{ matrix.target }}/release"
            mkdir -p "$out"
            install -m755 result/bin/abgen "$out/abgen"
            install -m755 result/bin/abgen-host "$out/abgen-host"
            install -m644 result/lib/libabgen.so "$out/libabgen.so"
            install -m644 result/lib/libabgen.a "$out/libabgen.a"
          else
            cargo build --release --locked --target ${{ matrix.target }} --bin abgen
            cargo build --release --locked --target ${{ matrix.target }} -p abgen-native
          fi

      - name: windows self-containment
        if: matrix.target == 'x86_64-pc-windows-gnu'
        run: |
          set -eu
          rc=0
          for f in abgen.dll abgen.exe abgen-host.exe; do
            imports=$(x86_64-w64-mingw32-objdump -p \
              "target/${{ matrix.target }}/release/$f" \
              | sed -n 's/^\tDLL Name: //p' | sort -u)
            echo "$f imports:"; echo "$imports" | sed 's/^/  /'
            if echo "$imports" | grep -qiE '^(libstdc\+\+-6|libgcc_s_seh-1|libwinpthread-1)\.dll$'; then
              echo "$f imports the MinGW runtime; it is not self-contained" >&2
              rc=1
            fi
          done
          [ "$rc" -eq 0 ] || exit 1
          echo "windows-gnu artifacts are self-contained"

      - name: verify artifact hashes
        env:
          ABGEN_RECORD_HASHES: ${{ inputs.record_hashes && '1' || '0' }}
          # Hard only where bytes ship: every buildId-rotating merge turned
          # main's release lane red until a manual record cycle — pure
          # alarm fatigue, since main pushes publish nothing. Tags still
          # verify hard (and additionally require the ci-green gate).
          ABGEN_HASH_SOFT: ${{ startsWith(github.ref, 'refs/tags/') && '0' || '1' }}
        run: |
          set -eu
          # One artifact list for all six legs; nothing here is lane-specific.
          artifacts=("target/${{ matrix.target }}/release/${{ matrix.bin || 'abgen' }}")
          for f in libabgen.so libabgen.dylib abgen.dll libabgen.a abgen-host abgen-host.exe; do
            src="target/${{ matrix.target }}/release/$f"
            [ -f "$src" ] && artifacts+=("$src")
          done
          echo "artifacts: ${artifacts[*]}"
          bash ci/verify-artifact-hashes.sh "${{ matrix.target }}" "${artifacts[@]}"

      - name: upload recorded hashes
        if: ${{ inputs.record_hashes }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: hashes-${{ matrix.target }}
          path: ci/artifact-hashes/${{ matrix.target }}.sha256
          if-no-files-found: error

      - name: package and smoke test
        env:
          GH_TOKEN: ${{ github.token }}
          ABGEN_RELEASE: ${{ github.ref_name }}
        run: |
          # Slashes in branch names are flattened: a nested archive path would
          # dodge the root-level upload glob below, and the input-addressed
          # artifact store would silently hold nothing (exactly what happened
          # to every branch dispatch under the old `mkdir -p` approach). Tags
          # never contain a slash, so their names are unchanged.
          refsafe="${GITHUB_REF_NAME:-dev}"; refsafe="${refsafe//\//-}"
          dist="abgen-${refsafe}-${{ matrix.target }}"
          mkdir -p "$dist"
          # No template/ or shader/ in the archive: those assets are compiled
          # into the binary. ABGEN_ROOT is a hard error when unreadable, so
          # shipping a directory risks a wrapper pointing at whatever a
          # partial extraction or relocation left behind.
          cp LICENSE README.md "$dist/"

          if [ "${{ matrix.builder }}" = "nix" ]; then
            mkdir -p "$dist/bin" "$dist/lib"
            install -m755 result/bin/abgen "$dist/bin/abgen.bin"
            for lib in $(ldd result/bin/abgen | awk '$3 ~ /^\// {print $3}'); do
              install -m644 "$lib" "$dist/lib/"
            done
            interp=$(readelf -l result/bin/abgen | sed -n 's/.*interpreter: \(.*\)]/\1/p')
            install -m755 "$interp" "$dist/lib/ld.so"
            # Sets no ABGEN_ROOT / ABGEN_SHADER_BUNDLE: the assets are compiled
            # in, and pointing those at a shipped directory would only create a
            # way to fail. A user who genuinely wants to override still can —
            # the binary reads both, and an unreadable one is a loud error
            # rather than a silent fallback.
            cat > "$dist/abgen" <<'EOF'
          #!/bin/sh
          here="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)"
          exec "$here/lib/ld.so" --library-path "$here/lib" "$here/bin/abgen.bin" "$@"
          EOF
            chmod 755 "$dist/abgen"
          else
            cp "target/${{ matrix.target }}/release/${{ matrix.bin }}" "$dist/"
          fi

          # The rev is not in the binaries any more, so it ships next to them.
          bash ci/write-build-info.sh "$dist" "${{ matrix.target }}"

          bash ci/pack-archive.sh "$dist" "$dist.tar.gz" "$SOURCE_DATE_EPOCH"
          # The sidecar is the only remaining answer to "which commit is this",
          # so assert it survived packing rather than trusting that it did.
          # Not piped into grep -q on purpose: the default shell here is
          # `bash -eo pipefail`, and grep exiting early would SIGPIPE tar into
          # a spurious 141.
          members="$(tar -tzf "$dist.tar.gz")"
          case "$members" in
            *"/BUILD-INFO.txt"*) ;;
            *) echo "BUILD-INFO.txt missing from $dist.tar.gz" >&2; exit 1 ;;
          esac
          shasum -a 256 "$dist.tar.gz" > "$dist.tar.gz.sha256"
          bash ci/verify-reproducible.sh "$dist" "$dist.tar.gz" "$SOURCE_DATE_EPOCH"

          # Cross-compiled legs (windows from linux, x86_64-apple-darwin from
          # the arm64 macos-15 runner) cannot exec their own output; smoke
          # only when the target matches the runner's arch. Rosetta would make
          # the x86_64 darwin binary "work" here, but only incidentally.
          case "${{ matrix.target }}" in
            x86_64-*)  want_arch=x86_64 ;;
            aarch64-*) want_arch=arm64 ;;
            *)         want_arch=none ;;
          esac
          run_arch="$(uname -m)"
          [ "$run_arch" = aarch64 ] && run_arch=arm64
          can_smoke=false
          if [ "$run_arch" = "$want_arch" ] && ! echo "${{ matrix.target }}" | grep -q windows; then
            can_smoke=true
          fi

          if [ "$can_smoke" = true ]; then
            rm -rf /tmp/smoke && mkdir /tmp/smoke
            tar -xzf "$dist.tar.gz" -C /tmp/smoke
            (
              cd "/tmp/smoke/$dist"
              ./abgen --version
              HTTP_SERVER_PORT=5199 ./abgen &
              server=$!
              for _ in $(seq 1 40); do
                curl -sf http://127.0.0.1:5199/readyz && ok=1 && break
                sleep 0.5
              done
              kill "$server" || true
              test "${ok:-0}" = 1
            )
          fi

          nat="abgen-native-${refsafe}-${{ matrix.target }}"
          mkdir -p "$nat/lib" "$nat/include"
          cp crate/abgen-native/include/abgen.h "$nat/include/"
          cp LICENSE "$nat/"
          cp unity/README.md "$nat/README.md"
          # No libabgen.a: large, and `cargo build -p abgen-native` already
          # covers the need it would serve.
          for f in libabgen.so libabgen.dylib abgen.dll; do
            src="target/${{ matrix.target }}/release/$f"
            [ -f "$src" ] && cp "$src" "$nat/lib/"
          done
          # No MinGW runtime beside it: the windows-gnu binaries link the C++
          # runtime statically and import nothing but system DLLs, which the
          # self-containment gate enforces. Shipping the DLLs anyway would
          # document a dependency that no longer exists.
          test -n "$(ls -A "$nat/lib")" || { echo "no native library built" >&2; exit 1; }

          # Unlike abgen-host below, a library dlopen'd into Unity runs on the
          # host process's glibc and cannot bundle its own, so the highest
          # GLIBC_x.y in its verneed table is the oldest distribution it loads
          # on. Gate the copy that actually ships, not a build-tree artifact.
          # Linux legs only: .dylib and .dll have no verneed table.
          if [ -f "$nat/lib/libabgen.so" ]; then
            bash ci/check-glibc-floor.sh 2.34 "$nat/lib/libabgen.so"
          fi
          # abgen-host, and on the nix legs its own glibc with it.
          #
          # A nix-built ELF's PT_INTERP is an absolute /nix/store path, so
          # without bundling the loader the helper only runs on the build
          # machine — and the smoke test below couldn't catch that, since it
          # also runs there. Bundling decouples it from the host's glibc
          # entirely, which libabgen.so can't do since it's dlopen'd into
          # someone else's process.
          #
          # The wrapper must forward the real command explicitly: abgen-host
          # re-execs itself so RLIMIT_AS binds before mimalloc reserves
          # arenas, and current_exe() under a loader is the loader itself, so
          # a naive re-exec form drops the args.
          if [ "${{ matrix.builder }}" = "nix" ]; then
            hb="target/${{ matrix.target }}/release/abgen-host"
            mkdir -p "$nat/bin" "$nat/host-lib"
            install -m755 "$hb" "$nat/bin/abgen-host.bin"
            for lib in $(ldd "$hb" | awk '$3 ~ /^\// {print $3}'); do
              install -m644 "$lib" "$nat/host-lib/"
            done
            interp=$(readelf -lW "$hb" | sed -n 's/.*interpreter: \(.*\)]/\1/p')
            install -m755 "$interp" "$nat/host-lib/ld.so"
            cat > "$nat/abgen-host" <<'EOF'
          #!/bin/sh
          here="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)"
          ABGEN_HOST_LOADER="$here/host-lib/ld.so"
          ABGEN_HOST_LIBPATH="$here/host-lib"
          ABGEN_HOST_BIN="$here/bin/abgen-host.bin"
          export ABGEN_HOST_LOADER ABGEN_HOST_LIBPATH ABGEN_HOST_BIN
          exec "$ABGEN_HOST_LOADER" --library-path "$ABGEN_HOST_LIBPATH" \
               "$ABGEN_HOST_BIN" "$@"
          EOF
            chmod 755 "$nat/abgen-host"
          else
            for f in abgen-host abgen-host.exe; do
              src="target/${{ matrix.target }}/release/$f"
              [ -f "$src" ] && install -m755 "$src" "$nat/"
            done
          fi

          bash ci/write-build-info.sh "$nat" "${{ matrix.target }}"

          bash ci/pack-archive.sh "$nat" "$nat.tar.gz" "$SOURCE_DATE_EPOCH"
          nat_members="$(tar -tzf "$nat.tar.gz")"
          case "$nat_members" in
            *"/BUILD-INFO.txt"*) ;;
            *) echo "BUILD-INFO.txt missing from $nat.tar.gz" >&2; exit 1 ;;
          esac
          shasum -a 256 "$nat.tar.gz" > "$nat.tar.gz.sha256"
          bash ci/verify-reproducible.sh "$nat" "$nat.tar.gz" "$SOURCE_DATE_EPOCH"

          # Windows legs cross-compile from Linux and are covered by the
          # windows CI job instead; cross-arch legs are skipped by the same
          # can_smoke computed above.
          if [ "$can_smoke" = true ]; then
            rm -rf /tmp/natsmoke && mkdir /tmp/natsmoke
            tar -xzf "$nat.tar.gz" -C /tmp/natsmoke
            got=$("/tmp/natsmoke/$nat/abgen-host" --version)
            test -n "$got" || { echo "abgen-host printed no version" >&2; exit 1; }
            echo "native smoke: abgen-host $got"

            # --version returns before apply_memory_limit, so the check above
            # cannot see a broken re-exec. Drive the real path: an empty stdin
            # makes the re-executed image fail reading its request, which is
            # EXIT_PROTOCOL (64). Anything else — notably ld.so's exit 1 on
            # "unrecognized option" — means the cap never bound.
            set +e
            "/tmp/natsmoke/$nat/abgen-host" --max-memory-mb 512 </dev/null
            rc=$?
            set -e
            case "$(uname -s)" in
              Darwin)
                # Darwin enforces no per-process memory rlimit — setrlimit
                # returns EINVAL at every size — so the helper refuses the flag
                # rather than pretending, and exits EXIT_LIMIT. Asserting the
                # refusal rather than skipping: a cap that silently did nothing
                # is exactly what the refusal exists to prevent.
                want=65; what="refusal" ;;
              *)
                # Linux re-execs to make RLIMIT_AS bind before mimalloc reserves
                # its arenas, then fails reading the request from empty stdin,
                # which is EXIT_PROTOCOL. Anything else — notably ld.so's exit 1
                # on "unrecognized option" — means the cap never bound.
                want=64; what="re-exec" ;;
            esac
            test "$rc" -eq "$want" || {
              echo "abgen-host $what is broken: expected $want, got $rc" >&2; exit 1; }
            echo "native smoke: --max-memory-mb $what ok"

            # And prove the artifacts do not depend on this machine. A nix leg
            # ships its own loader precisely so the archive works off NixOS;
            # if anything still names a build-machine path as its interpreter,
            # it runs here and nowhere else, and this smoke would not notice.
            if [ "${{ matrix.builder }}" = "nix" ]; then
              bad=$(readelf -lW "/tmp/natsmoke/$nat/bin/abgen-host.bin" \
                    | sed -n 's/.*interpreter: \(.*\)]/\1/p')
              case "$bad" in
                /nix/store/*) ;;  # expected: the bundled loader handles it
                *) echo "unexpected interpreter $bad" >&2; exit 1 ;;
              esac
              test -x "/tmp/natsmoke/$nat/host-lib/ld.so" \
                || { echo "bundled loader missing from the archive" >&2; exit 1; }
              echo "native smoke: bundled loader present"
            fi
          fi

      - name: publish archives to draft release
        if: startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          dist="abgen-${GITHUB_REF_NAME}-${{ matrix.target }}"
          nat="abgen-native-${GITHUB_REF_NAME}-${{ matrix.target }}"
          # Created as a DRAFT and published only once every asset is in
          # place, because immutable releases freeze assets at publication:
          # after that only the title and notes can change. Published here,
          # the first target to finish would seal the release and the other
          # five would fail to upload.
          gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 \
            || gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft \
                 --title "$GITHUB_REF_NAME" --notes-file .github/release-notes.md \
            || gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null
          gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber \
            "$dist.tar.gz" "$dist.tar.gz.sha256" \
            "$nat.tar.gz" "$nat.tar.gz.sha256"

      - name: upload archives (input-addressed)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: archives-${{ needs.build-id.outputs.value }}-${{ matrix.target }}
          path: |
            abgen-*.tar.gz
            abgen-native-*.tar.gz
          if-no-files-found: error

      - name: upload Docker image (input-addressed)
        if: matrix.target == 'x86_64-unknown-linux-gnu' && !startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: image-${{ needs.build-id.outputs.value }}-dockerImage
          path: dockerImage.tar.gz
          if-no-files-found: error

      - name: upload Lambda image (input-addressed)
        if: matrix.target == 'aarch64-unknown-linux-gnu' && !startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: image-${{ needs.build-id.outputs.value }}-lambdaImage
          path: lambdaImage.tar.gz
          if-no-files-found: error

  # Building races ahead of the test verdict; SHIPPING is what gates on it.
  # A tag's commit already ran ci when it landed on main — this waits for
  # that verdict and fails closed if it is missing or red.
  ci-green:
    name: ci green gate
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04
    timeout-minutes: 40
    permissions:
      actions: read
      contents: read
    steps:
      - name: wait for the commit's ci verdict
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          for _ in $(seq 1 40); do
            run="$(gh api "/repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$GITHUB_SHA&per_page=1" \
              --jq '"\(.workflow_runs[0].status // "none") \(.workflow_runs[0].conclusion // "")"')"
            status="${run%% *}"; conclusion="${run#* }"
            [ "$conclusion" = "success" ] && exit 0
            if [ "$status" = "completed" ]; then
              echo "ci for $GITHUB_SHA concluded: ${conclusion:-none}" >&2
              exit 1
            fi
            echo "ci for $GITHUB_SHA: $status — waiting"
            sleep 60
          done
          echo "timed out waiting for the ci verdict" >&2
          exit 1

  promote:
    name: promote prebuilt targets
    needs: build-id
    if: needs.build-id.outputs.has_promote == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      actions: read
    env:
      ABGEN_BUILD_ID: ${{ needs.build-id.outputs.value }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
      - name: fetch, verify and repack
        env:
          GH_TOKEN: ${{ github.token }}
          PROMOTE: ${{ needs.build-id.outputs.promote }}
        run: |
          set -eu
          mkdir -p out
          while read -r entry; do
            t=$(echo "$entry" | jq -r .target)
            id=$(echo "$entry" | jq -r .artifact_id)
            echo "::group::promote $t (artifact $id)"
            gh api "/repos/$GITHUB_REPOSITORY/actions/artifacts/$id/zip" > "a-$t.zip"
            bash ci/promote-target.sh "$t" "a-$t.zip" out
            echo "::endgroup::"
          done < <(echo "$PROMOTE" | jq -c '.[]')
          ls -l out

      - name: publish archives to draft release
        if: startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 \
            || gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft \
                 --title "$GITHUB_REF_NAME" --notes-file .github/release-notes.md \
            || gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null
          gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber out/*

  napi:
    name: abgen-node ${{ matrix.target }}
    needs: build-id
    if: ${{ !inputs.skip_napi && needs.build-id.outputs.napi_promote != 'true' }}
    runs-on: ${{ matrix.runner }}
    env:
      ABGEN_BUILD_ID: ${{ needs.build-id.outputs.value }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # cache on the linux legs only: x86 primes ci's node-addon job
          # (same shared-key) and each linux leg warms its successor across
          # main pushes; mac/windows stay uncached (quota over win).
          - { target: x86_64-unknown-linux-gnu,  runner: ubuntu-24.04, cache: "true" }
          - { target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm, cache: "true" }
          - { target: aarch64-apple-darwin,      runner: macos-15 }
          - { target: x86_64-apple-darwin,       runner: macos-15 }
          - { target: x86_64-pc-windows-msvc,    runner: windows-2025 }
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
      - uses: ./.github/actions/rust-setup
        with:
          targets: ${{ matrix.target }}
          cache: ${{ matrix.cache || 'false' }}
          workspaces: crate/abgen-node
          shared-key: abgen-node
          # saves only from main pushes: shareable by every PR and the next
          # merge build; branch/dispatch rehearsal saves would be scoped
          # quota waste.
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: 24
      - name: install addon deps
        working-directory: crate/abgen-node
        run: npm i --no-audit --no-fund
      - name: build the addon
        working-directory: crate/abgen-node
        run: npx napi build --platform --release --target ${{ matrix.target }}
      - name: smoke the addon
        if: matrix.target == 'x86_64-unknown-linux-gnu' || matrix.target == 'aarch64-apple-darwin'
        working-directory: crate/abgen-node
        run: node test/smoke.mjs
      - name: glibc floor
        if: endsWith(matrix.target, '-unknown-linux-gnu')
        working-directory: crate/abgen-node
        run: bash ../../ci/check-glibc-floor.sh 2.34 ./*.node
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: napi-${{ needs.build-id.outputs.value }}-${{ matrix.target }}
          path: crate/abgen-node/*.node
          if-no-files-found: error

  image:
    name: ghcr image
    needs: [build-id, ci-green]
    # Tags always run (they push) but only with a green ci verdict for the
    # commit; otherwise only when no prebuilt artifact exists yet — a
    # non-tag run with a prebuilt would skip every step and burn a runner
    # fetching an artifact it discards.
    if: >-
      !cancelled() && needs.build-id.result == 'success' &&
      ((startsWith(github.ref, 'refs/tags/') && needs.ci-green.result == 'success') ||
       (!startsWith(github.ref, 'refs/tags/') && needs.build-id.outputs.image_docker == ''))
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      actions: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
      - if: needs.build-id.outputs.image_docker == ''
        uses: ./.github/actions/nix-store-cache
      - name: build image
        if: needs.build-id.outputs.image_docker == ''
        run: |
          ref="${GITHUB_REF_NAME:-dev}"
          # Quiet unless it fails; the retry rebuilds only the failed
          # derivation with its full log.
          nix build .#dockerImage || nix build .#dockerImage --print-build-logs
          echo "store path : $(readlink -f result)"
          echo "compressed : $(ls -lLh result | awk '{print $5}')"
          cp -L result image.tar.gz
          {
            echo "REF=${ref}"
            echo "IMG_SIZE=$(ls -lLh result | awk '{print $5}')"
          } >> "$GITHUB_ENV"
      - name: upload image artifact (input-addressed)
        if: needs.build-id.outputs.image_docker == ''
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: image-${{ needs.build-id.outputs.value }}-dockerImage
          path: image.tar.gz
          if-no-files-found: error
      - name: fetch prebuilt image
        if: needs.build-id.outputs.image_docker != ''
        env:
          GH_TOKEN: ${{ github.token }}
          ARTIFACT_ID: ${{ needs.build-id.outputs.image_docker }}
        run: |
          gh api "/repos/$GITHUB_REPOSITORY/actions/artifacts/$ARTIFACT_ID/zip" > i.zip
          unzip -q i.zip
          # The nix legs upload the tarball as <package>.tar.gz; normalize.
          [ -f dockerImage.tar.gz ] && mv dockerImage.tar.gz image.tar.gz
          test -f image.tar.gz || { echo "no image tarball in artifact $ARTIFACT_ID" >&2; ls -l >&2; exit 1; }
          {
            echo "REF=${GITHUB_REF_NAME:-dev}"
            echo "IMG_SIZE=$(ls -lh image.tar.gz | awk '{print $5}')"
          } >> "$GITHUB_ENV"
      - if: needs.build-id.outputs.image_docker != '' && startsWith(github.ref, 'refs/tags/')
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
      - name: push to ghcr
        if: startsWith(github.ref, 'refs/tags/') && inputs.dry_run != true
        run: |
          repo="${GITHUB_REPOSITORY,,}"
          conf="$(mktemp)"
          echo 'unqualified-search-registries = []' > "$conf"
          for tag in "${REF}" latest; do
            # --inputs-from .: skopeo comes from the flake's locked nixpkgs,
            # not whatever the flake registry resolves to today.
            nix run --inputs-from . nixpkgs#skopeo -- --registries-conf "$conf" --insecure-policy copy \
              --dest-creds "${{ github.actor }}:${{ github.token }}" \
              "docker-archive:$PWD/image.tar.gz" \
              "docker://ghcr.io/${repo}:${tag}"
          done
          {
            echo "### abgen container image"
            echo ""
            echo "| | |"
            echo "|---|---|"
            echo "| image | \`ghcr.io/${repo}:${REF}\` (and \`:latest\`) |"
            echo "| size | ${IMG_SIZE} compressed, no base OS |"
            echo "| build | \`nix build .#dockerImage\` — deterministic, pinned \`flake.lock\` |"
          } >> "$GITHUB_STEP_SUMMARY"

  lambda-image:
    name: ECR lambda image
    needs: [build-id, ci-green]
    # Same gate as the ghcr image: tags push (green ci only), non-tag runs
    # only build.
    if: >-
      !cancelled() && needs.build-id.result == 'success' &&
      ((startsWith(github.ref, 'refs/tags/') && needs.ci-green.result == 'success') ||
       (!startsWith(github.ref, 'refs/tags/') && needs.build-id.outputs.image_lambda == ''))
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read
      id-token: write
      actions: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
      - if: needs.build-id.outputs.image_lambda == ''
        uses: ./.github/actions/nix-store-cache
      - name: build image
        if: needs.build-id.outputs.image_lambda == ''
        run: |
          ref="${GITHUB_REF_NAME:-dev}"
          nix build .#lambdaImage || nix build .#lambdaImage --print-build-logs
          echo "store path : $(readlink -f result)"
          echo "compressed : $(ls -lLh result | awk '{print $5}')"
          cp -L result image.tar.gz
          {
            echo "REF=${ref}"
            echo "IMG_SIZE=$(ls -lLh result | awk '{print $5}')"
          } >> "$GITHUB_ENV"
      - name: upload image artifact (input-addressed)
        if: needs.build-id.outputs.image_lambda == ''
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: image-${{ needs.build-id.outputs.value }}-lambdaImage
          path: image.tar.gz
          if-no-files-found: error
      - name: fetch prebuilt image
        if: needs.build-id.outputs.image_lambda != ''
        env:
          GH_TOKEN: ${{ github.token }}
          ARTIFACT_ID: ${{ needs.build-id.outputs.image_lambda }}
        run: |
          gh api "/repos/$GITHUB_REPOSITORY/actions/artifacts/$ARTIFACT_ID/zip" > i.zip
          unzip -q i.zip
          # The nix legs upload the tarball as <package>.tar.gz; normalize.
          [ -f lambdaImage.tar.gz ] && mv lambdaImage.tar.gz image.tar.gz
          test -f image.tar.gz || { echo "no image tarball in artifact $ARTIFACT_ID" >&2; ls -l >&2; exit 1; }
          {
            echo "REF=${GITHUB_REF_NAME:-dev}"
            echo "IMG_SIZE=$(ls -lh image.tar.gz | awk '{print $5}')"
          } >> "$GITHUB_ENV"
      - if: needs.build-id.outputs.image_lambda != '' && startsWith(github.ref, 'refs/tags/')
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
      - name: assume ECR push role (OIDC)
        if: startsWith(github.ref, 'refs/tags/') && inputs.dry_run != true
        run: |
          role="${{ vars.ABGEN_LAMBDA_ECR_ROLE_ARN }}"
          region="${{ vars.ABGEN_LAMBDA_AWS_REGION }}"
          if [ -z "$role" ] || [ -z "$region" ]; then
            echo "::error::ABGEN_LAMBDA_ECR_ROLE_ARN / ABGEN_LAMBDA_AWS_REGION repository variables are not set"
            exit 1
          fi
          token="$(curl -sS -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=sts.amazonaws.com" | jq -r .value)"
          creds="$(aws sts assume-role-with-web-identity \
            --role-arn "$role" \
            --role-session-name "abgen-lambda-ci-${GITHUB_RUN_ID}" \
            --web-identity-token "$token" \
            --duration-seconds 3600 \
            --query Credentials --output json)"
          {
            echo "AWS_ACCESS_KEY_ID=$(echo "$creds" | jq -r .AccessKeyId)"
            echo "AWS_SECRET_ACCESS_KEY=$(echo "$creds" | jq -r .SecretAccessKey)"
            echo "AWS_SESSION_TOKEN=$(echo "$creds" | jq -r .SessionToken)"
            echo "AWS_REGION=${region}"
          } >> "$GITHUB_ENV"
      - name: push to ECR
        if: startsWith(github.ref, 'refs/tags/') && inputs.dry_run != true
        run: |
          repo="${{ vars.ABGEN_LAMBDA_ECR_REPOSITORY }}"
          registry="${repo%%/*}"
          password="$(aws ecr get-login-password)"
          conf="$(mktemp)"
          echo 'unqualified-search-registries = []' > "$conf"
          for tag in "${REF}" latest; do
            nix run --inputs-from . nixpkgs#skopeo -- \
              --registries-conf "$conf" --insecure-policy copy \
              --dest-creds "AWS:${password}" \
              "docker-archive:$PWD/image.tar.gz" \
              "docker://${repo}:${tag}"
          done
          digest="$(nix run --inputs-from . nixpkgs#skopeo -- \
            --registries-conf "$conf" --insecure-policy inspect \
            --creds "AWS:${password}" --format '{{.Digest}}' \
            "docker://${repo}:${REF}")"
          {
            echo "### abgen-lambda container image"
            echo ""
            echo "| | |"
            echo "|---|---|"
            echo "| image | \`${repo}:${REF}\` (and \`:latest\`) |"
            echo "| digest | \`${digest}\` |"
            echo "| size | ${IMG_SIZE} compressed, no base OS |"
            echo "| arch | arm64 (Graviton Lambda) |"
            echo "| build | \`nix build .#lambdaImage\` — deterministic, pinned \`flake.lock\` |"
            echo "| roll out | update the Lambda function to \`${repo}:${REF}\` — see lambda/README.md |"
          } >> "$GITHUB_STEP_SUMMARY"

  napi-publish:
    name: publish @dcl/abgen-node
    needs: [build-id, napi, ci-green]
    runs-on: ubuntu-24.04
    if: >-
      !cancelled() &&
      startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true &&
      needs.ci-green.result == 'success' &&
      (needs.napi.result == 'success' ||
       (needs.napi.result == 'skipped' && needs.build-id.outputs.napi_promote == 'true'))
    permissions:
      contents: write
      id-token: write
      actions: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: 24

      - run: npm install -g npm@^11.5.1

      - if: needs.napi.result == 'success'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          pattern: napi-*
          path: crate/abgen-node/artifacts

      - name: fetch promoted napi artifacts
        if: needs.napi.result == 'skipped'
        env:
          GH_TOKEN: ${{ github.token }}
          NAPI_IDS: ${{ needs.build-id.outputs.napi_ids }}
        working-directory: crate/abgen-node
        run: |
          set -eu
          mkdir -p artifacts
          i=0
          while read -r id; do
            gh api "/repos/$GITHUB_REPOSITORY/actions/artifacts/$id/zip" > "napi-$i.zip"
            unzip -q "napi-$i.zip" -d "artifacts/promoted-$i"
            i=$((i + 1))
          done < <(echo "$NAPI_IDS" | jq -r '.[]')
          test "$i" -eq 5
          find artifacts -name '*.node' | sed 's/^/promoted: /'
          test "$(find artifacts -name '*.node' | wc -l)" -eq 5
      - name: publish
        working-directory: crate/abgen-node
        env:
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          npm i --no-audit --no-fund
          # napi reads the version from this package.json, not from the tag, and
          # prepublish propagates it to the per-platform manifests.
          npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version --ignore-scripts --allow-same-version
          # `napi artifacts` writes into npm/<platform>/, which must already
          # exist — those dirs are committed, from `napi create-npm-dir -t .`.
          # index.js/index.d.ts are committed for the same reason: nothing here
          # runs `napi build`, and they are the package's entry point.
          npx napi artifacts --dir artifacts
          ls -R ./npm
          # npm's prepublishOnly hook runs `napi prepublish`, which publishes
          # the per-platform packages and rewires optionalDependencies but
          # does NOT publish @dcl/abgen-node itself — `npm publish` below
          # does that.
          npm publish --access public

  publish:
    needs: [build, promote, ci-green]
    runs-on: ubuntu-24.04
    if: >-
      !cancelled() &&
      startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true &&
      needs.ci-green.result == 'success' &&
      needs.build.result != 'failure' && needs.build.result != 'cancelled' &&
      needs.promote.result != 'failure' && needs.promote.result != 'cancelled'
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: 24

      - run: npm install -g npm@^11.5.1

      - name: verify, checksums, npm
        env:
          GH_TOKEN: ${{ github.token }}
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
        run: |
          git init -q .
          git remote add origin "https://github.com/$GITHUB_REPOSITORY"
          git fetch -q --depth 1 origin "$GITHUB_SHA"
          git checkout -q FETCH_HEAD

          # Kept in separate directories: `dist` must hold the six runtime
          # archives and nothing else, because npm/publish.sh reads it. The
          # counts are asserted per set so neither can silently go missing —
          # a single glob over both would let three of one and nine of the
          # other still total twelve.
          gh release download "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
            --pattern 'abgen-v*.tar.gz' --pattern 'abgen-v*.tar.gz.sha256' -D dist
          gh release download "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
            --pattern 'abgen-native-v*.tar.gz' --pattern 'abgen-native-v*.tar.gz.sha256' -D native

          dist_archives=(dist/*.tar.gz)
          native_archives=(native/*.tar.gz)
          test "${#dist_archives[@]}" -eq 6
          test "${#native_archives[@]}" -eq 6
          (cd dist && sha256sum -c ./*.sha256)
          (cd native && sha256sum -c ./*.sha256)

          # One manifest covering everything the release ships, so a reader
          # can't mistake a partial file for the complete one.
          cat dist/*.sha256 native/*.sha256 > SHA256SUMS.txt
          test "$(wc -l < SHA256SUMS.txt)" -eq 12
          cat SHA256SUMS.txt
          gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber SHA256SUMS.txt
          for f in dist/*.sha256 native/*.sha256; do
            gh release delete-asset "$GITHUB_REF_NAME" "$(basename "$f")" --repo "$GITHUB_REPOSITORY" --yes
          done

          bash npm/publish.sh "${GITHUB_REF_NAME#v}" dist

      - name: attest build provenance
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
        with:
          subject-path: "dist/*.tar.gz,native/*.tar.gz"

      - name: publish the release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft=false
          gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json isDraft \
            --jq 'if .isDraft then error("release is still a draft") else "published" end'