release.yml

name: Release

on:
    workflow_dispatch:
        inputs:
            dry_run:
                description: "Build, sign, and assemble everything but publish nothing (no GCS upload, no GitHub release, no installer-bucket write, no channel advance)."
                type: boolean
                default: false
            skip_ci_verify:
                description: "Bypass the verify-ci gate that requires this commit's five lane aggregators to be green. Admin override for a commit whose checks are known-good but unreported."
                type: boolean
                default: false
    # Invoked by nightly.yml, which depends on this run completing before it
    # flips the `nightly` channel. Inputs default to a real, verified release.
    workflow_call:
        inputs:
            dry_run:
                type: boolean
                default: false
            skip_ci_verify:
                type: boolean
                default: false
    # Push a version tag (vMAJOR.MINOR.PATCH, optionally a `-prerelease` suffix) to
    # cut a real, versioned GitHub Release.
    # Does not release to any channel but unstable.
    push:
        tags:
            - "v[0-9]*.[0-9]*.[0-9]*"

env:
    CARGO_TERM_COLOR: always
    # The GitHub App client id baked into every binary that links the `github`
    # crate (crates/github/build.rs registers the rebuild trigger;
    # crates/github/src/config.rs reads it via `option_env!`). Set at workflow
    # level so it reaches every build job — including the minimald-linux-*
    # binaries that build-release-initramfs repacks as the guest daemon, which
    # boots with an empty environment and so could not be configured any other
    # way.
    #
    # A repo VARIABLE, not a secret: a GitHub App client id is public (the
    # device flow is a public-client flow with no client secret) and shipping it
    # inside the binary discloses nothing. Never move this to `secrets` — a
    # masked value would be unreadable in build logs for no benefit.
    #
    # Unset resolves to the empty string, which the crate treats as "no App
    # configured": those builds fail closed with `Error::NotConfigured` exactly
    # as they did before this seam existed.
    MINIMAL_GITHUB_CLIENT_ID: ${{ vars.MINIMAL_GITHUB_CLIENT_ID }}

# Serialize release runs so two manual dispatches can't race to cut a release
# from different commits at the same time.
concurrency:
    group: release-${{ github.ref }}
    cancel-in-progress: false

permissions:
    contents: read

jobs:
    verify-ci:
        # Gate the release on the required CI checks having passed for the EXACT
        # commit being released, instead of re-running the workspace suite here
        # (the old `test` job duplicated ci-linux-native's `core-tests`). The five
        # lane aggregators are the required checks on `main` (ruleset 14240442);
        # assert each reported success on HEAD. The job always runs so `release`'s
        # `needs` is satisfied; `skip_ci_verify` short-circuits it to a pass for a
        # commit whose checks are green but unreported (admin override).
        runs-on: ubuntu-latest
        timeout-minutes: 10
        permissions:
            contents: read
            checks: read
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  persist-credentials: false
            - name: Verify required checks are green on this commit
              env:
                  GH_TOKEN: ${{ github.token }}
                  SKIP: ${{ inputs.skip_ci_verify }}
              run: |
                  set -euo pipefail
                  if [ "$SKIP" = "true" ]; then
                    echo "::warning::skip_ci_verify set — bypassing the required-checks gate"
                    exit 0
                  fi
                  required="ci-success ci-linux-native-success ci-linux-kvm-success ci-macos-success ci-shell-installer-success"
                  sha="$(git rev-parse HEAD)"
                  # Latest conclusion per check-run name for this commit.
                  runs="$(gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs" --paginate \
                    --jq '.check_runs[] | "\(.name)\t\(.conclusion)"')"
                  fail=0
                  for name in $required; do
                    c="$(printf '%s\n' "$runs" | awk -F'\t' -v n="$name" '$1==n {print $2}' | tail -1)"
                    if [ "$c" != "success" ]; then
                      echo "::error::required check '$name' is '${c:-missing}' on $sha (need success)"
                      fail=1
                    fi
                  done
                  [ "$fail" -eq 0 ] && echo "all five required checks are green on $sha"
                  exit "$fail"

    build-release-linux-amd64:
        runs-on: ubuntu-latest
        # 90m, matching arm64. The build step below links the three binaries one
        # at a time, so LTO links that used to overlap now serialize, and this
        # job builds minvmd natively on top of them. The old 60m cap was only
        # ever measured against the combined build, so it is not evidence this
        # shape fits; a cap only bounds a hang, and an early finish bills for the
        # time actually used.
        timeout-minutes: 90
        # `CARGO_TARGET_<TRIPLE>_LINKER` is the documented env equivalent of the
        # `[target.<triple>] linker` config key (triple uppercased, dashes to
        # underscores). Set here rather than appended to `.cargo/config.toml` so
        # the build never mutates the checkout. Job-level env merges with the
        # workflow-level block above rather than replacing it.
        env:
            CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
        steps:
            - name: Free Disk Space
              # Static release build of the full workspace; the cargo target dir
              # is the largest in any of the linux jobs. `remove_tool_cache: true`
              # is safe even without a `dtolnay/rust-toolchain` step — the
              # pre-installed Rust toolchain on ubuntu-latest lives in
              # `~/.rustup` + `~/.cargo`, not `/opt/hostedtoolcache`, so
              # `rustup target add` below still resolves.
              uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3
              with:
                  remove_android: true
                  remove_dotnet: true
                  remove_haskell: true
                  remove_tool_cache: true
            # Full history + tags so crates/version's build.rs can figure out the version.
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  fetch-depth: 0
                  persist-credentials: false
                  fetch-tags: true
            - name: Install dependencies
              run: sudo apt-get update && sudo apt-get install -y musl-tools protobuf-compiler
            - name: Add Rust target
              run: rustup target add x86_64-unknown-linux-musl
            - name: Cache Rust build artifacts (dependency-pruned)
              # Was a raw actions/cache of the entire target/ — the largest target
              # dir in the repo (multi-GB). Cached whole into the 10 GB per-repo
              # LRU it shares with every PR lane, it was evicted fast, so release
              # builds kept starting cold. rust-cache prunes target/ to just the
              # dependency artifacts (the costly aws-lc-sys/crypto compiles),
              # shrinking the entry so it survives; save-if keeps branch/dry-run
              # dispatches read-only so they don't churn the budget and evict
              # main's warm cache. Registry + git caches come for free.
              uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # zizmor: ignore[cache-poisoning] trusted-ref release build; save-if gates writes, provenance verified downstream
              with:
                  shared-key: release-amd64
                  save-if: ${{ github.ref == 'refs/heads/main' }}
            - name: Build static release binaries
              # One invocation per package, not one combined build.
              # `[profile.release]` is fat LTO with codegen-units = 1, so a
              # combined build lets cargo schedule all three final LTO links
              # concurrently at -j4. That peak is what got the arm64 job
              # SIGTERMed (exit 143) immediately after its last workspace crate
              # compiled; this job has the same profile on a runner with the same
              # 16 GB, so it was clearing the ceiling on headroom rather than by
              # design. Sequential invocations share dependency artifacts through
              # the same target/ dir, so the cost is three graph resolutions, not
              # three builds — while the LTO links run one at a time. Do not
              # recollapse these without cutting the release profile's link-time
              # memory first.
              run: |
                  cargo build --release --locked --target x86_64-unknown-linux-musl --package mip
                  cargo build --release --locked --target x86_64-unknown-linux-musl --package minimal
                  cargo build --release --locked --target x86_64-unknown-linux-musl --package minimald
            - name: Rename binaries with platform suffix
              # download-artifact merge-multiple flattens every artifact into one
              # directory using each file's basename, so the uploaded files must
              # already carry a unique platform-suffixed name to avoid amd64/arm64
              # collisions and to match the paths used by the release job.
              run: |
                  cd target/x86_64-unknown-linux-musl/release
                  mv mip mip-linux-amd64
                  mv min minimal-linux-amd64
                  mv minimald minimald-linux-amd64
            - name: Upload binary (mip)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: mip-linux-amd64
                  path: target/x86_64-unknown-linux-musl/release/mip-linux-amd64
                  retention-days: 7
            - name: Upload binary (minimal)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minimal-linux-amd64
                  path: target/x86_64-unknown-linux-musl/release/minimal-linux-amd64
                  retention-days: 7
            - name: Upload binary (minimald)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minimald-linux-amd64
                  path: target/x86_64-unknown-linux-musl/release/minimald-linux-amd64
                  retention-days: 7
            - name: Build static libkrun (musl)
              # Static libkrun.a from the vendored pin, so minvmd JOINS the
              # static-musl build instead of being the one binary that can't.
              # Publishes LIBKRUN_PREFIX; build.rs reads the .a there, selects a
              # static link and records no rpath. libkrunfw is not involved —
              # minvmd supplies its own kernel, and a static musl binary cannot
              # dlopen one anyway. See gominimal/minimal#1065.
              uses: ./.github/actions/build-libkrun-static-linux
              with:
                  target: x86_64-unknown-linux-musl
            - name: Build static minvmd binary
              # Same musl target as the three above, and self-contained for the
              # same reason: nothing to resolve at load time, no lib/ sibling, no
              # glibc floor. Its own cargo invocation so the fat-LTO link does
              # not overlap theirs (see the build step above).
              #
              # MINVMD_REQUIRE_LIBKRUN=static: without it, a build.rs that fails
              # to find libkrun quietly emits a runtime-bailing STUB that
              # compiles and links perfectly well. That default keeps stock
              # Linux CI green, but here it would ship. Demanding the static
              # link turns the regression into a build error naming the prefix.
              env:
                  MINVMD_REQUIRE_LIBKRUN: static
              run: |
                  cargo build --release --locked --target x86_64-unknown-linux-musl -p minvmd --bin minvmd
                  mv target/x86_64-unknown-linux-musl/release/minvmd target/x86_64-unknown-linux-musl/release/minvmd-linux-amd64
            - name: Verify minvmd is static and links libkrun
              # Both halves matter and neither is implied by a successful build:
              # a stub minvmd (build.rs found no libkrun) also compiles and
              # links, and would ship as a binary that bails at VM boot.
              run: |
                  set -euo pipefail
                  bin=target/x86_64-unknown-linux-musl/release/minvmd-linux-amd64
                  syms="$RUNNER_TEMP/minvmd-amd64.strings"
                  # Both spellings are static. x86_64-musl emits a static PIE,
                  # which file(1) calls "static-pie linked"; aarch64-musl emits a
                  # plain static executable, "statically linked". Neither has a
                  # PT_INTERP or a DT_NEEDED, which is the property we want.
                  file "$bin" | grep -qE 'statically linked|static-pie linked' \
                    || { echo "::error::$bin is not statically linked"; file "$bin"; exit 1; }
                  # The KVM backend's bindgen types are only present when libkrun
                  # is really linked in; the stub carries none of them.
                  #
                  # Dump once, then assert against the FILE, never against a live
                  # pipe: `grep -q` exits at its first match and SIGPIPEs the
                  # `strings -a` walking a ~10 MB binary, and under `pipefail`
                  # that producer's death fails the step — so a PASSING check
                  # reads as a stub build and kills a good release. Same reason
                  # scripts/build-libkrun-linux.sh materializes its nm output.
                  strings -a "$bin" > "$syms"
                  grep -q 'kvm_run' "$syms" \
                    || { echo "::error::$bin does not contain libkrun's KVM backend (stub build?)"; exit 1; }
                  echo "minvmd OK: static, libkrun linked ($(stat -c%s "$bin") bytes)"
            - name: Upload binary (minvmd)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minvmd-linux-amd64
                  path: target/x86_64-unknown-linux-musl/release/minvmd-linux-amd64
                  retention-days: 7

    build-release-linux-arm64:
        runs-on: ubuntu-26.04-arm
        timeout-minutes: 90
        # See the amd64 job: cargo's env equivalent of `[target.<triple>]
        # linker`, so the build leaves the checkout untouched.
        env:
            CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
        steps:
            - name: Free Disk Space
              # Static release build of the full workspace; the cargo target dir
              # is the largest in any of the linux jobs.
              #
              # Runs BEFORE checkout: the action copies a `bc` binary into its
              # working dir, which dirty's the checkout.
              uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3
              with:
                  remove_android: true
                  remove_dotnet: true
                  remove_haskell: true
                  remove_tool_cache: true
            # Full history + tags so crates/version's build.rs can figure out the version.
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  fetch-depth: 0
                  persist-credentials: false
                  fetch-tags: true
            - name: Install dependencies
              run: sudo apt-get update && sudo apt-get install -y musl-tools protobuf-compiler
            - name: Add Rust target
              run: rustup target add aarch64-unknown-linux-musl
            - name: Cache Rust build artifacts (dependency-pruned)
              # See the amd64 job: rust-cache replaces a raw multi-GB target/ cache
              # the 10 GB LRU evicted, which is why this build kept running
              # cold (~65m). Pruned to dependency artifacts so it survives; save-if
              # keeps branch/dry-run dispatches read-only. writes target/ and
              # reads ~/.cargo on the host, so rust-cache caches them the same as a
              # native build.
              uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # zizmor: ignore[cache-poisoning] trusted-ref release build; save-if gates writes, provenance verified downstream
              with:
                  shared-key: release-arm64
                  save-if: ${{ github.ref == 'refs/heads/main' }}
            - name: Build static release binaries
              # See the amd64 job: one invocation per package so the fat-LTO
              # links run one at a time. Recollapsing them into a single build is
              # what got this job SIGTERMed (exit 143) on the 16 GB runner, right
              # after the last workspace crate compiled.
              run: |
                  cargo build --release --locked --target aarch64-unknown-linux-musl --package mip
                  cargo build --release --locked --target aarch64-unknown-linux-musl --package minimal
                  cargo build --release --locked --target aarch64-unknown-linux-musl --package minimald
            - name: Rename binaries with platform suffix
              # Platform-suffixed so download-artifact's merge-multiple basename
              # flatten does not collide with the amd64 build.
              run: |
                  cd target/aarch64-unknown-linux-musl/release
                  mv min minimal-linux-arm64
                  mv mip mip-linux-arm64
                  mv minimald minimald-linux-arm64
            - name: Upload binary (minimal)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minimal-linux-arm64
                  path: target/aarch64-unknown-linux-musl/release/minimal-linux-arm64
                  retention-days: 7
            - name: Upload binary (mip)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: mip-linux-arm64
                  path: target/aarch64-unknown-linux-musl/release/mip-linux-arm64
                  retention-days: 7
            - name: Upload binary (minimald)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minimald-linux-arm64
                  path: target/aarch64-unknown-linux-musl/release/minimald-linux-arm64
                  retention-days: 7
            - name: Build static libkrun (musl)
              # See the amd64 job. arm64 had no minvmd artifact at all before
              # this — the dynamic build needed a native glibc host per arch, and
              # only amd64 got one. A static musl build has no such constraint,
              # so the two Linux arches finally ship the same set of binaries.
              uses: ./.github/actions/build-libkrun-static-linux
              with:
                  target: aarch64-unknown-linux-musl
            - name: Build static minvmd binary
              # See the amd64 job for MINVMD_REQUIRE_LIBKRUN.
              env:
                  MINVMD_REQUIRE_LIBKRUN: static
              run: |
                  cargo build --release --locked --target aarch64-unknown-linux-musl -p minvmd --bin minvmd
                  mv target/aarch64-unknown-linux-musl/release/minvmd target/aarch64-unknown-linux-musl/release/minvmd-linux-arm64
            - name: Verify minvmd is static and links libkrun
              # See the amd64 job: a stub minvmd builds and links cleanly too, so
              # neither half of this is implied by the build succeeding.
              run: |
                  set -euo pipefail
                  bin=target/aarch64-unknown-linux-musl/release/minvmd-linux-arm64
                  syms="$RUNNER_TEMP/minvmd-arm64.strings"
                  # See the amd64 job for why both file(1) spellings are accepted,
                  # and why the symbol check runs against a dumped file rather
                  # than a live `strings | grep -q` pipe under pipefail.
                  file "$bin" | grep -qE 'statically linked|static-pie linked' \
                    || { echo "::error::$bin is not statically linked"; file "$bin"; exit 1; }
                  strings -a "$bin" > "$syms"
                  grep -q 'kvm_run' "$syms" \
                    || { echo "::error::$bin does not contain libkrun's KVM backend (stub build?)"; exit 1; }
                  echo "minvmd OK: static, libkrun linked ($(stat -c%s "$bin") bytes)"
            - name: Upload binary (minvmd)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minvmd-linux-arm64
                  path: target/aarch64-unknown-linux-musl/release/minvmd-linux-arm64
                  retention-days: 7

    build-release-macos-arm64:
        # Self-hosted Apple Silicon runner. minvmd links libkrun (Hypervisor.framework
        # backend) via `#[link(name = "krun")]` and builds the real (non-stub) impl
        # only on macOS against a provisioned libkrun — it can't join the static-musl
        # cross builds above, so it's built natively here (mirrors ci-macos.yml's
        # build-macos). Gated on RUN_MACOS_CI so it's skipped while the single
        # self-hosted runner is offline — a skip here also skips `release`, which
        # needs it.
        runs-on: [self-hosted, macOS, ARM64]
        timeout-minutes: 45
        if: vars.RUN_MACOS_CI != 'false'
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  # Don't leave git credentials on the persistent self-hosted runner.
                  persist-credentials: false
                  # Full history + tags so crates/version's build.rs can figure out the version.
                  fetch-depth: 0
                  fetch-tags: true
            - name: Toolchain
              uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
              with:
                  toolchain: stable
            - name: Provision libkrun (pinned own build)
              uses: ./.github/actions/setup-libkrun-macos
            - name: Build release minvmd binary
              run: cargo build --release --locked -p minvmd --bin minvmd
            - name: Rewrite + verify minvmd libkrun linkage (@rpath)
              # Retarget Homebrew's absolute libkrun install name to the shipped
              # bin/../lib layout and verify the result (rpath entries, no
              # non-system deps). Extracted to scripts/ so a future CI lane can
              # exercise the production rewrite per-PR; release is currently its
              # only consumer. Signing happens below, as the last mutation
              # before upload.
              run: scripts/rewrite-macos-linkage.sh target/release/minvmd
            - name: Build release minimal binary
              # Separate cargo invocation from minvmd above, so its default
              # `libkrun` feature can't unify into the CLI (which opts out via
              # default-features = false). Gated next.
              run: cargo build --release --locked -p minimal --bin min
            - name: Verify minimal links only system libraries
              # The CLI calls no libkrun (it spawns minvmd as a subprocess), so
              # every dependency must be under /usr/lib or /System. A krun line
              # means the default-features = false opt-out regressed.
              run: |
                  otool -L target/release/min
                  bad="$(otool -L target/release/min | tail -n +2 | awk '{print $1}' \
                    | grep -vE '^(/usr/lib/|/System/)' || true)"
                  if [ -n "$bad" ]; then
                    echo "::error::minimal links non-system libraries (allowed: /usr/lib, /System):" >&2
                    printf '%s\n' "$bad" >&2
                    exit 1
                  fi
            - name: Rename binaries with platform suffix
              # download-artifact merge-multiple flattens on basename, so the uploaded
              # file must already carry the platform-suffixed name the release job expects.
              run: |
                  mv target/release/minvmd target/release/minvmd-macos-arm64
                  mv target/release/min target/release/minimal-macos-arm64
            - name: Codesign binaries with Developer ID
              # Sign the two shipped Mach-O binaries with the Developer ID
              # Application identity held in the runner's signing keychain. This
              # is the LAST mutation before upload.
              # Hardened runtime (--options runtime) + a secure --timestamp so the
              # artifacts are notarization-ready.
              env:
                  KC_PW: ${{ secrets.KC_PW }}
              run: |
                  KC=minimal-signing.keychain-db
                  IDENTITY="Developer ID Application: Minimal Software Research Ltd. (3G47C5HY64)"

                  # Unlock the signing keychain and put it on the search list so
                  # codesign can resolve the identity by name.
                  security unlock-keychain -p "$KC_PW" "$KC"
                  security list-keychains -d user -s "$KC" login.keychain-db

                  codesign --force --timestamp --options runtime \
                    --sign "$IDENTITY" \
                    --entitlements crates/minvmd/minvmd.entitlements \
                    target/release/minvmd-macos-arm64
                  codesign --force --timestamp --options runtime \
                    --sign "$IDENTITY" \
                    target/release/minimal-macos-arm64

                  codesign --verify --strict --verbose=2 target/release/minvmd-macos-arm64
                  codesign --verify --strict --verbose=2 target/release/minimal-macos-arm64
            - name: Upload binary (minvmd)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minvmd-macos-arm64
                  path: target/release/minvmd-macos-arm64
                  retention-days: 7
            - name: Upload binary (minimal)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minimal-macos-arm64
                  path: target/release/minimal-macos-arm64
                  retention-days: 7

    build-libkrun-macos-arm64:
        # Build the TRIMMED libkrun.dylib to SHIP in the release, so macOS users
        # don't have to `brew install` it themselves. Same setup-libkrun-macos
        # composite (scripts/build-libkrun-macos.sh at the vendor/libkrun/
        # libkrun.lock pin) that every macOS CI lane links and boots against —
        # the shipped dylib is BY CONSTRUCTION the one CI tested. GitHub-hosted
        # macos-latest is Apple Silicon (arm64).
        runs-on: macos-latest
        timeout-minutes: 45
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  persist-credentials: false
            - name: Toolchain
              uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
              with:
                  toolchain: stable
            - name: Provision libkrun (pinned own build)
              uses: ./.github/actions/setup-libkrun-macos
            - name: Stage the dylib for signing
              # The build script already asserted self-containment (no
              # /opt/homebrew or /usr/local deps) and the krun_add_disk3 API
              # floor, set the @rpath/libkrun.1.dylib install name, and ad-hoc
              # signed it.
              run: cp "$LIBKRUN_PREFIX/libkrun.1.dylib" "$RUNNER_TEMP/temp-libkrun-macos-arm64.dylib"
            - name: Upload ad-hoc-signed libkrun dylib (temp)
              # This GitHub-hosted runner has no access to the Developer ID signing
              # keychain, so the dylib leaves here only ad-hoc signed, under a
              # `temp-` prefixed name. sign-macos-artifacts (self-hosted) downloads
              # it, re-signs with Developer ID, and re-uploads under the final
              # `libkrun-macos-arm64` name. The release job drops any leftover
              # `temp-` artifact so the ad-hoc copy never ships.
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: temp-libkrun-macos-arm64
                  path: ${{ runner.temp }}/temp-libkrun-macos-arm64.dylib
                  if-no-files-found: error
                  retention-days: 7

    sign-macos-artifacts:
        # Developer ID signing for the macOS artifacts built on normal runners.
        #
        # Artifacts come as the output of other jobs under a `temp-` prefixed
        # artifact, are signed on the self-hosted runner that holds the keychain,
        # then are re-uploaded under their final names.
        runs-on: [self-hosted, macOS, ARM64]
        timeout-minutes: 15
        if: vars.RUN_MACOS_CI != 'false'
        needs: [build-libkrun-macos-arm64, fetch-release-guest-artifacts]
        steps:
            - name: Download unsigned macOS artifacts (temp)
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  pattern: temp-*
                  path: ${{ runner.temp }}/unsigned
                  merge-multiple: true
            - name: Codesign macOS artifacts with Developer ID
              # Sign with the same Developer ID identity, secure --timestamp, and
              # hardened runtime (--options runtime) as the binaries so the whole
              # install is notarization-ready. --force replaces each file's existing
              # signature (build-libkrun-macos.sh's ad-hoc on libkrun, the Go
              # linker's ad-hoc on gvproxy). No entitlements: neither libkrun (a library) nor gvproxy
              # (the network switch) is the hypervisor entry point. The temp- prefix
              # is dropped so each file carries the final basename the
              # archive/installer expect.
              env:
                  KC_PW: ${{ secrets.KC_PW }}
              run: |
                  KC=minimal-signing.keychain-db
                  IDENTITY="Developer ID Application: Minimal Software Research Ltd. (3G47C5HY64)"

                  security unlock-keychain -p "$KC_PW" "$KC"
                  security list-keychains -d user -s "$KC" login.keychain-db

                  in="$RUNNER_TEMP/unsigned"
                  out="$RUNNER_TEMP/signed"
                  mkdir -p "$out"
                  cp "$in/temp-libkrun-macos-arm64.dylib" "$out/libkrun-macos-arm64.dylib"
                  cp "$in/temp-gvproxy-darwin-arm64"      "$out/gvproxy-darwin-arm64"

                  for f in "$out/libkrun-macos-arm64.dylib" "$out/gvproxy-darwin-arm64"; do
                    codesign --force --timestamp --options runtime --sign "$IDENTITY" "$f"
                    codesign --verify --strict --verbose=2 "$f"
                  done
            - name: Upload signed libkrun dylib
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: libkrun-macos-arm64
                  path: ${{ runner.temp }}/signed/libkrun-macos-arm64.dylib
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload signed gvproxy (darwin-arm64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: gvproxy-darwin-arm64
                  path: ${{ runner.temp }}/signed/gvproxy-darwin-arm64
                  if-no-files-found: error
                  retention-days: 7

    fetch-release-guest-artifacts:
        # Fetched guest microVM artifacts shipped in the release: the raw guest
        # kernel Image, the ext4 rootfs image, and the pinned gvproxy switch
        # binary. These are already produced piecemeal in the CI lanes
        # (ci-macos.yml, ci-linux-kvm.yml, ci-gvproxy.yml); this job gathers them
        # into the release. The initramfs is packed separately in
        # build-release-initramfs, which reuses the minimald-linux-* binaries.
        #
        # None require the target host's arch to produce: the kernel and rootfs are
        # cache pulls keyed by the pinned upstream commit (the materialize action
        # pulls any guest arch on an x86_64 runner), and gvproxy is a pin-verified
        # download of the upstream release binary. So a single x86_64 runner emits
        # both the amd64 and arm64 variants, covering every release host
        # (linux-amd64/arm64, macos-arm64). Files are arch-suffixed so
        # download-artifact's merge-multiple basename-flatten in the release job
        # doesn't collide.
        runs-on: ubuntu-latest
        timeout-minutes: 35
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  persist-credentials: false
            # NOTE: the `arch` input is the kernel-style target arch
            # (x86_64/aarch64); only the emitted file/artifact names use the
            # amd64/arm64 suffixes the release binaries already use.
            - name: Materialize guest kernel (raw Image, amd64)
              uses: ./.github/actions/materialize
              with:
                  output: virtio-kernel
                  dest: ${{ runner.temp }}/vmlinuz-amd64
                  arch: x86_64
                  channel: unstable
            - name: Materialize guest kernel (raw Image, arm64)
              uses: ./.github/actions/materialize
              with:
                  output: virtio-kernel
                  dest: ${{ runner.temp }}/vmlinuz-arm64
                  arch: aarch64
                  channel: unstable
            - name: Materialize guest rootfs (ext4 image, amd64)
              uses: ./.github/actions/materialize
              with:
                  output: minvmd-rootfs
                  dest: ${{ runner.temp }}/rootfs-amd64.img
                  arch: x86_64
                  channel: unstable
            - name: Materialize guest rootfs (ext4 image, arm64)
              uses: ./.github/actions/materialize
              with:
                  output: minvmd-rootfs
                  dest: ${{ runner.temp }}/rootfs-arm64.img
                  arch: aarch64
                  channel: unstable
            - name: Fetch pinned gvproxy (linux-amd64)
              run: ./scripts/fetch-gvproxy.sh "$RUNNER_TEMP/gvproxy-linux-amd64" gvproxy-linux-amd64
            - name: Fetch pinned gvproxy (linux-arm64)
              run: ./scripts/fetch-gvproxy.sh "$RUNNER_TEMP/gvproxy-linux-arm64" gvproxy-linux-arm64
            - name: Fetch pinned gvproxy (darwin-arm64)
              # Stashed as a `temp-` so sign-macos-artifacts (self-hosted) can sign it
              run: ./scripts/fetch-gvproxy.sh "$RUNNER_TEMP/temp-gvproxy-darwin-arm64" gvproxy-darwin
            - name: Upload kernel (amd64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: virtio-kernel-amd64
                  path: ${{ runner.temp }}/vmlinuz-amd64
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload kernel (arm64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: virtio-kernel-arm64
                  path: ${{ runner.temp }}/vmlinuz-arm64
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload rootfs (amd64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minvmd-rootfs-amd64
                  path: ${{ runner.temp }}/rootfs-amd64.img
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload rootfs (arm64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minvmd-rootfs-arm64
                  path: ${{ runner.temp }}/rootfs-arm64.img
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload gvproxy (linux-amd64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: gvproxy-linux-amd64
                  path: ${{ runner.temp }}/gvproxy-linux-amd64
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload gvproxy (linux-arm64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: gvproxy-linux-arm64
                  path: ${{ runner.temp }}/gvproxy-linux-arm64
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload gvproxy (darwin-arm64, temp/unsigned)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: temp-gvproxy-darwin-arm64
                  path: ${{ runner.temp }}/temp-gvproxy-darwin-arm64
                  if-no-files-found: error
                  retention-days: 7

    build-release-initramfs:
        # Pack the guest initramfs (minimald as pid-1 /init) from the SAME static
        # musl minimald binaries the build-release-linux-* jobs already built and
        # ship, instead of recompiling minimald just for the initramfs. Downloads
        # those artifacts and stamps each into a newc cpio via build-initramfs.sh's
        # MINIMALD_BIN mode (no cargo/cross toolchain needed — just cpio). Files are
        # arch-suffixed to match the amd64/arm64 naming and avoid a
        # merge-multiple basename collision in the release job.
        runs-on: ubuntu-latest
        timeout-minutes: 10
        needs: [build-release-linux-amd64, build-release-linux-arm64]
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  persist-credentials: false
            - name: Install cpio
              run: sudo apt-get update && sudo apt-get install -y --no-install-recommends cpio
            - name: Download minimald (amd64)
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: minimald-linux-amd64
                  path: prebuilt
            - name: Download minimald (arm64)
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: minimald-linux-arm64
                  path: prebuilt
            - name: Pack initramfs (amd64)
              run: |
                  chmod +x prebuilt/minimald-linux-amd64
                  MINIMALD_BIN="$PWD/prebuilt/minimald-linux-amd64" \
                    ./scripts/build-initramfs.sh "$RUNNER_TEMP/initramfs-amd64.cpio"
            - name: Pack initramfs (arm64)
              run: |
                  chmod +x prebuilt/minimald-linux-arm64
                  MINIMALD_BIN="$PWD/prebuilt/minimald-linux-arm64" \
                    ./scripts/build-initramfs.sh "$RUNNER_TEMP/initramfs-arm64.cpio"
            - name: Upload initramfs (amd64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minimald-initramfs-amd64
                  path: ${{ runner.temp }}/initramfs-amd64.cpio
                  if-no-files-found: error
                  retention-days: 7
            - name: Upload initramfs (arm64)
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: minimald-initramfs-arm64
                  path: ${{ runner.temp }}/initramfs-arm64.cpio
                  if-no-files-found: error
                  retention-days: 7

    compute-version-string:
        # Read the version straight out of a shipped binary so the GitHub Release
        # NAME is exactly what `min -V` reports — one source of truth.
        runs-on: ubuntu-latest
        timeout-minutes: 5
        needs: [build-release-linux-amd64]
        outputs:
            version: ${{ steps.read.outputs.version }}
        steps:
            - name: Download minimald (amd64)
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: minimald-linux-amd64
            - name: Read version from the built binary
              id: read
              run: |
                  set -euo pipefail
                  chmod +x minimald-linux-amd64
                  # "-V" => "minimald <version>"; take the version field.
                  ver="$(./minimald-linux-amd64 -V | awk '{print $2}')"
                  [ -n "$ver" ] || { echo "::error::could not read version from binary"; exit 1; }
                  echo "version=$ver" >> "$GITHUB_OUTPUT"
                  echo "resolved release version: $ver"

    release:
        runs-on: ubuntu-latest
        timeout-minutes: 30
        needs:
            [
                verify-ci,
                build-release-linux-amd64,
                build-release-linux-arm64,
                build-release-macos-arm64,
                sign-macos-artifacts,
                fetch-release-guest-artifacts,
                build-release-initramfs,
                compute-version-string,
            ]
        permissions:
            contents: write
            id-token: write
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  persist-credentials: false
            - name: Generate release info
              id: release_info
              env:
                  REF_TYPE: ${{ github.ref_type }}
                  REF_NAME: ${{ github.ref_name }}
              run: |
                  # A version-tag push releases AT that tag (e.g. v1.2.3). The
                  # SHA-based dispatch/nightly flow keeps its release-<sha> tag, which
                  # the installer bucket layout and channel pointers key off. Either
                  # way the release NAME uses the version string (Create Release step).
                  SHORT_SHA=$(git rev-parse --short=8 HEAD)
                  echo "short_sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
                  if [ "$REF_TYPE" = "tag" ]; then
                    echo "tag=$REF_NAME" >> "$GITHUB_OUTPUT"
                  else
                    echo "tag=release-$SHORT_SHA" >> "$GITHUB_OUTPUT"
                  fi
            - name: Download artifacts
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  pattern: "*-*-*"
                  path: artifacts/
                  merge-multiple: true
            - name: Drop temp-prefixed artifacts
              run: rm -f artifacts/temp-*
            - name: Make binaries executable
              run: chmod +x artifacts/*-*-*
            - name: Generate completions
              # `min` splits printing from installing (`completions print
              # <shell>`); `mip` and `minimald` keep the flat verb. The `min`
              # files are named for the `min` binary, not the crate — the shim
              # it prints registers the command `min`, so a shell only autoloads
              # it from a file of that name.
              run: |
                  mkdir -p artifacts/completions/{bash,zsh,fish}
                  artifacts/mip-linux-amd64 completions bash > artifacts/completions/bash/mip
                  artifacts/mip-linux-amd64 completions zsh  > artifacts/completions/zsh/_mip
                  artifacts/mip-linux-amd64 completions fish > artifacts/completions/fish/mip.fish
                  artifacts/minimal-linux-amd64 completions print bash > artifacts/completions/bash/min
                  artifacts/minimal-linux-amd64 completions print zsh  > artifacts/completions/zsh/_min
                  artifacts/minimal-linux-amd64 completions print fish > artifacts/completions/fish/min.fish
                  artifacts/minimald-linux-amd64 completions bash > artifacts/completions/bash/minimald
                  artifacts/minimald-linux-amd64 completions zsh  > artifacts/completions/zsh/_minimald
                  artifacts/minimald-linux-amd64 completions fish > artifacts/completions/fish/minimald.fish
            - name: Authenticate to Google Cloud
              uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
              with:
                  project_id: "289724348228"
                  workload_identity_provider: "projects/289724348228/locations/global/workloadIdentityPools/github/providers/gominimal"
            - name: Package and upload archive to GCS
              env:
                  DRY_RUN: ${{ inputs.dry_run }}
              run: |
                  SHA=$(git rev-parse --short=8 HEAD)
                  tar --zstd -cf "minimalone-${SHA}.tar.zst" -C artifacts .
                  if [ "$DRY_RUN" = "true" ]; then
                    echo "::notice::dry_run — packaged minimalone-${SHA}.tar.zst but skipping GCS upload"
                    exit 0
                  fi
                  gcloud storage cp \
                    --cache-control="public, max-age=31536000, immutable" \
                    "minimalone-${SHA}.tar.zst" gs://minimal-shim/archives/
            - name: Create Release
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  DRY_RUN: ${{ inputs.dry_run }}
                  REL_TAG: ${{ steps.release_info.outputs.tag }}
                  REL_TITLE: minimal ${{ needs.compute-version-string.outputs.version }}
                  REF_TYPE: ${{ github.ref_type }}
                  REF_NAME: ${{ github.ref_name }}
              run: |
                  tar -C artifacts/completions -czf artifacts/completions.tar.gz .
                  if [ "$DRY_RUN" = "true" ]; then
                    echo "::notice::dry_run — assembled release artifacts but skipping GitHub release create"
                    exit 0
                  fi
                  # A pre-release version tag (e.g. v0.5.0-rc1, i.e. one with a `-`
                  # suffix) is marked a GitHub prerelease so it doesn't show as
                  # "Latest"; an exact vX.Y.Z becomes the latest release.
                  extra=()
                  if [ "$REF_TYPE" = "tag" ]; then
                    case "$REF_NAME" in
                      *-*) extra+=(--prerelease) ;;
                    esac
                  fi
                  cd artifacts/
                  # find output is intentionally word-split so each artifact becomes
                  # its own positional arg to `gh release create`; quoting would break it.
                  # shellcheck disable=SC2046
                  gh release create "$REL_TAG" \
                    $(find . -maxdepth 1 -type f) \
                    --repo="${GITHUB_REPOSITORY}" \
                    --title="$REL_TITLE" \
                    "${extra[@]}"

    stage-installer:
        # Publish the release into gs://minimal-one in the layout the curl|bash
        # installer reads (docs/specs/07-spec-installer). It re-fetches the same
        # build artifacts and touches only gs://minimal-one. Wholly a publish
        # step, so it is skipped entirely on a dry run.
        runs-on: ubuntu-latest
        timeout-minutes: 20
        needs: [release]
        if: ${{ !inputs.dry_run }}
        permissions:
            contents: read
            id-token: write
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
              with:
                  persist-credentials: false
            - name: Generate release info
              id: release_info
              run: |
                  SHORT_SHA=$(git rev-parse --short=8 HEAD)
                  echo "short_sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
            - name: Download artifacts
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  pattern: "*-*-*"
                  path: artifacts/
                  merge-multiple: true
            - name: Authenticate to Google Cloud (installer bucket)
              # Distinct project + workload-identity pool from the release job's
              # minimal-shim auth; this one grants write to gs://minimal-one.
              uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
              with:
                  project_id: "524228262772"
                  workload_identity_provider: "projects/524228262772/locations/global/workloadIdentityPools/github/providers/gominimal"
            - name: Stage release into installer bucket
              # Upload versions/<sha>/{components,<artifacts>}. Inert on its own:
              # changes nothing users receive until a channel points at it.
              env:
                  SHORT_SHA: ${{ steps.release_info.outputs.short_sha }}
              run: |
                  scripts/stage-release.sh \
                    --artifacts-dir artifacts \
                    --version "$SHORT_SHA" \
                    --bucket gs://minimal-one
            - name: Stage the installer script into the versioned folder
              # Keep a version-pinned copy of the curl|sh installer next to the
              # components it reads, so each version's install path is immutable
              # and self-contained. Same immutable cache header as the other
              # versions/<sha>/ artifacts. Done before the channel advances so the
              # versioned folder is complete when anything points at it.
              env:
                  SHORT_SHA: ${{ steps.release_info.outputs.short_sha }}
              run: |
                  gcloud storage cp \
                    --cache-control="public, max-age=31536000, immutable" \
                    scripts/install.sh \
                    "gs://minimal-one/versions/$SHORT_SHA/install.sh"
            - name: Point unstable channel at this release
              # `unstable` auto-advances to every fresh build — it is the
              # bleeding-edge channel, so no approval gate. Promotion to `stable`
              # is the manual, gated promote-cli workflow.
              env:
                  SHORT_SHA: ${{ steps.release_info.outputs.short_sha }}
              run: |
                  scripts/set-channel.sh \
                    --channel unstable \
                    --version "$SHORT_SHA" \
                    --bucket gs://minimal-one