release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  # Single source of truth for binary targets (also update the binaries.yml matrix).
  BINARY_TARGETS: "linux-x86_64-gnu linux-x86_64-musl linux-aarch64-gnu linux-aarch64-musl macos-arm64 macos-x86_64 windows-x86_64"

jobs:
  validate:
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - id: version
        name: Validate tag and package version
        run: |
          set -euo pipefail
          VERSION=$(cat cloudsmith_cli/data/VERSION)
          test "${GITHUB_REF_NAME}" = "v${VERSION}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

  binaries:
    name: Binaries
    needs: validate
    uses: ./.github/workflows/binaries.yml
    # Publishing authenticates via OIDC (no API key). The online smoketest is a
    # separate read-only check that does still need CLOUDSMITH_API_KEY: with
    # online_smoketest: true the reusable workflow fails fast if it is missing.
    # The OIDC online path is covered separately by the binaries `oidc` job.
    with:
      online_smoketest: true
    permissions:
      contents: read
      id-token: write
    secrets:
      CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}

  python-distributions:
    needs: validate
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"

      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.1.0 # zizmor: ignore[cache-poisoning]
        with:
          enable-cache: true

      - name: Build and validate once
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          uv sync --locked --group release
          uv build --clear
          SDIST="dist/cloudsmith_cli-${VERSION}.tar.gz"
          WHEEL="dist/cloudsmith_cli-${VERSION}-py3-none-any.whl"
          test -f "${SDIST}"
          test -f "${WHEEL}"
          uv run --group release twine check "${SDIST}" "${WHEEL}"
          uv run --group release check-wheel-contents "${WHEEL}"
          python - <<'PY'
          import os
          import zipfile

          wheel = f"dist/cloudsmith_cli-{os.environ['VERSION']}-py3-none-any.whl"
          with zipfile.ZipFile(wheel) as archive:
              names = archive.namelist()
          forbidden = [
              name
              for name in names
              if name.startswith("packaging/")
              or "/tests/" in name
              or name.startswith("tests/")
          ]
          if forbidden:
              raise SystemExit(f"wheel contains non-runtime files: {forbidden}")
          PY
          python -m venv /tmp/cloudsmith-release-install
          /tmp/cloudsmith-release-install/bin/python -m pip install "${WHEEL}"
          OUTPUT=$(/tmp/cloudsmith-release-install/bin/cloudsmith --version)
          printf '%s\n' "${OUTPUT}"
          printf '%s\n' "${OUTPUT}" | grep -Fq "CLI Package Version: ${VERSION}"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: python-distributions
          path: dist/
          retention-days: 14
          if-no-files-found: error

  sign-linux:
    needs: [validate, binaries]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    env:
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cloudsmith-linux-*
          merge-multiple: true
          path: binaries

      - name: Import signing key and create detached signatures
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          set -euo pipefail
          export GNUPGHOME="$(mktemp -d)"
          chmod 700 "$GNUPGHOME"
          printf 'allow-loopback-pinentry\n' > "$GNUPGHOME/gpg-agent.conf"
          printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
          gpg --batch --armor --export > binaries/cloudsmith-cli-release-key.asc
          test -s binaries/cloudsmith-cli-release-key.asc
          for TARGET in ${BINARY_TARGETS}; do
            case "${TARGET}" in
              linux-*) ;;
              *) continue ;;
            esac
            ARCHIVE="binaries/cloudsmith-${VERSION}-${TARGET}.tar.gz"
            test -f "${ARCHIVE}"
            printf '%s' "${GPG_PASSPHRASE}" \
              | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 \
                --detach-sign --output "${ARCHIVE}.sig" "${ARCHIVE}"
            gpg --verify "${ARCHIVE}.sig" "${ARCHIVE}"
          done
          gpgconf --kill gpg-agent || true

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: linux-signatures
          path: |
            binaries/*.sig
            binaries/cloudsmith-cli-release-key.asc
          if-no-files-found: error
          retention-days: 14

  stage-github:
    needs: [validate, binaries, python-distributions, sign-linux]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GH_REPO: ${{ github.repository }}
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cloudsmith-*
          merge-multiple: true
          path: binaries

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: python

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: linux-signatures
          path: binaries

      - name: Stage verified assets on a draft release
        run: |
          set -euo pipefail
          ASSETS=()
          SUM_ARCHIVES=()
          for TARGET in ${BINARY_TARGETS}; do
            EXT=.tar.gz
            if [ "${TARGET}" = windows-x86_64 ]; then
              EXT=.zip
            fi
            ARCHIVE="binaries/cloudsmith-${VERSION}-${TARGET}${EXT}"
            CHECKSUM="${ARCHIVE}.sha256"
            test -f "${ARCHIVE}"
            test -f "${CHECKSUM}"
            ASSETS+=("${ARCHIVE}" "${CHECKSUM}")
            SUM_ARCHIVES+=("cloudsmith-${VERSION}-${TARGET}${EXT}")
            SIGNATURE="${ARCHIVE}.sig"
            if [ -f "${SIGNATURE}" ]; then
              ASSETS+=("${SIGNATURE}")
            fi
          done
          SDIST="python/cloudsmith_cli-${VERSION}.tar.gz"
          WHEEL="python/cloudsmith_cli-${VERSION}-py3-none-any.whl"
          test -f "${SDIST}"
          test -f "${WHEEL}"
          ASSETS+=("${SDIST}" "${WHEEL}")
          test -s binaries/cloudsmith-cli-release-key.asc
          ASSETS+=("binaries/cloudsmith-cli-release-key.asc")
          (
            cd binaries
            sha256sum "${SUM_ARCHIVES[@]}" > SHA256SUMS
          )
          ASSETS+=("binaries/SHA256SUMS")

          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
            test "$(gh release view "${GITHUB_REF_NAME}" --json isDraft -q .isDraft)" = true
          else
            gh release create "${GITHUB_REF_NAME}" \
              --draft \
              --verify-tag \
              --title "Release ${GITHUB_REF_NAME}" \
              --generate-notes
          fi
          gh release upload "${GITHUB_REF_NAME}" --clobber "${ASSETS[@]}"

  publish-cloudsmith:
    needs: [validate, stage-github, python-distributions, sign-linux]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
    env:
      CLOUDSMITH_NAMESPACE: ${{ vars.CLOUDSMITH_NAMESPACE }}
      CLOUDSMITH_REPO: ${{ vars.CLOUDSMITH_REPO }}
      CLOUDSMITH_ORG: ${{ vars.CLOUDSMITH_NAMESPACE }}
      CLOUDSMITH_SERVICE_SLUG: ${{ vars.CLOUDSMITH_SERVICE_SLUG }}
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cloudsmith-*
          merge-multiple: true
          path: binaries

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: python

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: linux-signatures
          path: binaries

      - name: Set up the built cloudsmith binary on the runner
        uses: ./.github/actions/setup-cloudsmith-binary
        with:
          version: ${{ needs.validate.outputs.version }}

      - name: Pre-authenticate with OIDC
        run: |
          set -euo pipefail
          cloudsmith whoami

      - name: Publish binaries and Python distributions
        run: |
          set -euo pipefail

          # Immutable repo: skip already-published files (no overwrite). Existence
          # via the OIDC-authed CLI, anchored filename query, counting results.
          package_count() {
            # Args: <namespace/repo> <basename>. filename:^...$ is exact here
            # (Cloudsmith search isn't PCRE; escaping dots breaks it).
            cloudsmith ls packages "$1" -q "filename:^$2\$" -F json \
              | python3 -c 'import sys, json; print(len(json.load(sys.stdin).get("data", [])))'
          }

          push_raw_if_absent() {
            # Args: <namespace/repo> <file> <package-name> <comma-separated-tags>
            local repo="$1" file="$2" name="$3" tags="$4"
            local base
            base="$(basename "${file}")"
            if [ "$(package_count "${repo}" "${base}")" != "0" ]; then
              echo "skip (already published): ${file}"
              return 0
            fi
            cloudsmith push raw \
              "${repo}" \
              "${file}" \
              --name "${name}" \
              --version "${VERSION}" \
              --tags "${tags}"
          }

          push_python_if_absent() {
            # Args: <namespace/repo> <file>
            local repo="$1" file="$2"
            local base
            base="$(basename "${file}")"
            if [ "$(package_count "${repo}" "${base}")" != "0" ]; then
              echo "skip (already published): ${file}"
              return 0
            fi
            cloudsmith push python \
              "${repo}" \
              "${file}"
          }

          package_version_count() {
            # Args: <namespace/repo> <package-name> <version>. Manifests all share
            # the filename manifest.txt, so existence is checked by name + version.
            cloudsmith ls packages "$1" -q "name:^$2\$ AND version:^$3\$" -F json \
              | python3 -c 'import sys, json; print(len(json.load(sys.stdin).get("data", [])))'
          }

          push_manifest_if_absent() {
            # Args: <namespace/repo> <file> <package-name> <comma-separated-tags>
            local repo="$1" file="$2" name="$3" tags="$4"
            if [ "$(package_version_count "${repo}" "${name}" "${VERSION}")" != "0" ]; then
              echo "skip (already published): ${name}@${VERSION}"
              return 0
            fi
            cloudsmith push raw \
              "${repo}" \
              "${file}" \
              --name "${name}" \
              --version "${VERSION}" \
              --tags "${tags}"
          }

          for TARGET in ${BINARY_TARGETS}; do
            EXT=.tar.gz
            if [ "${TARGET}" = windows-x86_64 ]; then
              EXT=.zip
            fi
            ARCHIVE="binaries/cloudsmith-${VERSION}-${TARGET}${EXT}"
            test -f "${ARCHIVE}"

            # Queryable tags for CI artifact selection (e.g. version:X AND tag:linux
            # AND tag:x86_64 AND tag:musl): type, os, arch, libc (linux), full-target.
            OS="${TARGET%%-*}"
            REST="${TARGET#*-}"
            case "${OS}" in
              linux)
                ARCH="${REST%-*}"
                LIBC="${REST##*-}"
                COMMON="${OS},${ARCH},${LIBC},${TARGET}"
                ;;
              *)
                ARCH="${REST}"
                COMMON="${OS},${ARCH},${TARGET}"
                ;;
            esac

            push_raw_if_absent \
              "${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_REPO}" \
              "${ARCHIVE}" \
              "cloudsmith-cli-${TARGET}" \
              "standalone-binary,${COMMON}"
            case "${TARGET}" in
              linux-*)
                test -f "${ARCHIVE}.sig"
                push_raw_if_absent \
                  "${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_REPO}" \
                  "${ARCHIVE}.sig" \
                  "cloudsmith-cli-${TARGET}-sig" \
                  "signature,${COMMON}"
                ;;
            esac

            # Per-target install manifest, fetched by the install scripts at
            # .../raw/names/cloudsmith-cli-manifest-<target>/versions/{<v>|latest}/manifest.txt.
            # Pushed after the archive so it never references a missing archive.
            ARCHIVE_BASE="cloudsmith-${VERSION}-${TARGET}${EXT}"
            ARCHIVE_SHA256="$(sha256sum "${ARCHIVE}" | awk '{print $1}')"
            RECORDED_SHA256="$(awk '{print $1}' "${ARCHIVE}.sha256")"
            test "${ARCHIVE_SHA256}" = "${RECORDED_SHA256}"
            ARCHIVE_URL="https://dl.cloudsmith.io/public/${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_REPO}/raw/names/cloudsmith-cli-${TARGET}/versions/${VERSION}/${ARCHIVE_BASE}"
            mkdir -p "manifests/${TARGET}"
            {
              printf '# Generated by the standalone CLI release workflow. Do not edit manually.\n'
              printf 'schema=1\n'
              printf 'version=%s\n' "${VERSION}"
              printf 'target=%s\n' "${TARGET}"
              printf 'archive=%s\n' "${ARCHIVE_BASE}"
              printf 'url=%s\n' "${ARCHIVE_URL}"
              printf 'sha256=%s\n' "${ARCHIVE_SHA256}"
            } > "manifests/${TARGET}/manifest.txt"
            push_manifest_if_absent \
              "${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_REPO}" \
              "manifests/${TARGET}/manifest.txt" \
              "cloudsmith-cli-manifest-${TARGET}" \
              "install-manifest,${COMMON}"
          done
          push_python_if_absent \
            "${CLOUDSMITH_NAMESPACE}/cli" \
            "python/cloudsmith_cli-${VERSION}.tar.gz"
          push_python_if_absent \
            "${CLOUDSMITH_NAMESPACE}/cli" \
            "python/cloudsmith_cli-${VERSION}-py3-none-any.whl"

  publish-pypi:
    needs: [validate, stage-github, python-distributions]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    environment: release
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: dist

      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: dist/
          skip-existing: true

  publish-containers:
    needs: [validate, stage-github]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
    env:
      CLOUDSMITH_NAMESPACE: ${{ vars.CLOUDSMITH_NAMESPACE }}
      CLOUDSMITH_REPO: ${{ vars.CLOUDSMITH_REPO }}
      CLOUDSMITH_SERVICE_SLUG: ${{ vars.CLOUDSMITH_SERVICE_SLUG }}
      CLOUDSMITH_ORG: ${{ vars.CLOUDSMITH_NAMESPACE }}
      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
      HAS_DOCKERHUB: ${{ secrets.DOCKERHUB_PAT != '' }}
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cloudsmith-linux-*-musl
          merge-multiple: true
          path: binaries

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cloudsmith-linux-x86_64-gnu
          merge-multiple: true
          path: binaries

      - name: Set up the built cloudsmith binary on the runner
        uses: ./.github/actions/setup-cloudsmith-binary
        with:
          version: ${{ needs.validate.outputs.version }}
          add-local-bin: "true"

      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Authenticate to docker.cloudsmith.io via OIDC credential helper
        run: |
          set -euo pipefail
          cloudsmith whoami
          cloudsmith credential-helper install docker

      - name: Authenticate to Docker Hub
        if: env.HAS_DOCKERHUB == 'true'
        env:
          DOCKERHUB_PAT: ${{ secrets.DOCKERHUB_PAT }}
        run: |
          set -euo pipefail
          echo "${DOCKERHUB_PAT}" \
            | docker login \
              -u "${DOCKERHUB_USER}" \
              --password-stdin

      - name: Build once and push the same image to both registries
        run: |
          set -euo pipefail
          AMD64="binaries/cloudsmith-${VERSION}-linux-x86_64-musl.tar.gz"
          ARM64="binaries/cloudsmith-${VERSION}-linux-aarch64-musl.tar.gz"
          test -f "${AMD64}"
          test -f "${AMD64}.sha256"
          test -f "${ARM64}"
          test -f "${ARM64}.sha256"

          # Immutable Cloudsmith repo: push the tag only if absent (inspect runs
          # post-auth, so non-zero = not present). Docker Hub is mutable.
          CLOUDSMITH_IMAGE="docker.cloudsmith.io/${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_REPO}/cloudsmith-cli:${VERSION}"
          TAGS=()
          if docker buildx imagetools inspect "${CLOUDSMITH_IMAGE}" >/dev/null 2>&1; then
            echo "skip (already published): ${CLOUDSMITH_IMAGE}"
          else
            TAGS+=(-t "${CLOUDSMITH_IMAGE}")
          fi
          # Docker Hub (mutable): pinned + floating tags (latest/major/major.minor).
          # Cloudsmith (immutable) keeps only the pinned :${VERSION} tag.
          if [ "${HAS_DOCKERHUB}" = "true" ]; then
            HUB="cloudsmith/cloudsmith-cli"
            MAJOR="${VERSION%%.*}"
            MINOR="${VERSION#*.}"; MINOR="${MINOR%%.*}"
            TAGS+=(-t "${HUB}:${VERSION}")
            TAGS+=(-t "${HUB}:${MAJOR}" -t "${HUB}:${MAJOR}.${MINOR}" -t "${HUB}:latest")
          fi

          if [ "${#TAGS[@]}" -eq 0 ]; then
            echo "image ${VERSION} already published; skipping"
            exit 0
          fi

          docker buildx build \
            --platform linux/amd64,linux/arm64 \
            --build-arg "CLOUDSMITH_CLI_VERSION=${VERSION}" \
            --build-arg "VCS_REF=${GITHUB_SHA}" \
            "${TAGS[@]}" \
            --push .

  publish-homebrew:
    # Renders packaging/homebrew/cloudsmith-cli.rb.tmpl against the archives
    # that publish-cloudsmith just made live and opens a bump pull request
    # against the Homebrew tap (<owner>/homebrew-cloudsmith-cli). When the tap
    # checks pass, the job squash-merges the pull request with --admin.
    # Without TAP_PUSH_TOKEN the rendered formula is only staged as a
    # workflow artifact.
    needs: [validate, publish-cloudsmith]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    env:
      CLOUDSMITH_NAMESPACE: ${{ vars.CLOUDSMITH_NAMESPACE }}
      CLOUDSMITH_REPO: ${{ vars.CLOUDSMITH_REPO }}
      HAS_TAP_TOKEN: ${{ secrets.TAP_PUSH_TOKEN != '' }}
      VERSION: ${{ needs.validate.outputs.version }}
      # Targets shipped via Homebrew (subset of BINARY_TARGETS; Homebrew on
      # Linux is glibc-based, so the gnu builds).
      HOMEBREW_TARGETS: "macos-arm64 macos-x86_64 linux-x86_64-gnu linux-aarch64-gnu"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cloudsmith-macos-*
          merge-multiple: true
          path: binaries

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cloudsmith-linux-*-gnu
          merge-multiple: true
          path: binaries

      - name: Render the formula from the template
        run: |
          set -euo pipefail
          FORMULA=rendered/cloudsmith-cli.rb
          mkdir -p rendered
          cp packaging/homebrew/cloudsmith-cli.rb.tmpl "${FORMULA}"
          sed -i \
            -e "s/__VERSION__/${VERSION}/g" \
            -e "s/__NAMESPACE__/${CLOUDSMITH_NAMESPACE}/g" \
            -e "s/__REPO__/${CLOUDSMITH_REPO}/g" \
            "${FORMULA}"
          for TARGET in ${HOMEBREW_TARGETS}; do
            SHA_FILE="binaries/cloudsmith-${VERSION}-${TARGET}.tar.gz.sha256"
            test -f "${SHA_FILE}"
            SHA256="$(awk '{print $1}' "${SHA_FILE}")"
            KEY="SHA256_$(printf '%s' "${TARGET}" | tr 'a-z-' 'A-Z_')"
            sed -i "s/__${KEY}__/${SHA256}/g" "${FORMULA}"
          done
          if grep -n '__' "${FORMULA}"; then
            echo "FAIL: unrendered placeholders remain"
            exit 1
          fi
          ruby -c "${FORMULA}"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: homebrew-formula
          path: rendered/cloudsmith-cli.rb
          retention-days: 14
          if-no-files-found: error

      - name: Verify the published downloads match the formula checksums
        run: |
          set -euo pipefail
          for TARGET in ${HOMEBREW_TARGETS}; do
            URL="https://dl.cloudsmith.io/public/${CLOUDSMITH_NAMESPACE}/${CLOUDSMITH_REPO}/raw/names/cloudsmith-cli-${TARGET}/versions/${VERSION}/cloudsmith-${VERSION}-${TARGET}.tar.gz"
            EXPECTED="$(awk '{print $1}' "binaries/cloudsmith-${VERSION}-${TARGET}.tar.gz.sha256")"
            ACTUAL=""
            # Retry to absorb post-publish sync delay.
            for ATTEMPT in 1 2 3 4 5 6 7 8 9 10; do
              if ACTUAL="$(curl -fsSL "${URL}" | sha256sum | awk '{print $1}')"; then
                break
              fi
              echo "attempt ${ATTEMPT}: ${URL} not ready; retrying"
              sleep 30
            done
            test "${ACTUAL}" = "${EXPECTED}"
            echo "verified ${URL}"
          done

      - name: Open and merge a bump pull request against the tap repository
        if: env.HAS_TAP_TOKEN == 'true'
        env:
          GH_TOKEN: ${{ secrets.TAP_PUSH_TOKEN }}
          CLOUDSMITH_BOT_SSH_KEY: ${{ secrets.CLOUDSMITH_BOT_SSH_KEY }}
          TAP_REPO: ${{ github.repository_owner }}/homebrew-cloudsmith-cli
        run: |
          set -euo pipefail
          BRANCH="release/cloudsmith-cli-v${VERSION}"
          gh auth setup-git
          git clone --depth 1 "https://github.com/${TAP_REPO}.git" tap
          mkdir -p tap/Formula tap/Aliases
          cp rendered/cloudsmith-cli.rb tap/Formula/cloudsmith-cli.rb
          ln -sfn ../Formula/cloudsmith-cli.rb tap/Aliases/cloudsmith
          if [ -z "$(git -C tap status --porcelain)" ]; then
            echo "tap already up to date; skipping"
            exit 0
          fi
          SIGNING_KEY="${RUNNER_TEMP}/cloudsmith-bot-signing-key"
          printf '%s\n' "${CLOUDSMITH_BOT_SSH_KEY}" > "${SIGNING_KEY}"
          chmod 600 "${SIGNING_KEY}"
          ssh-keygen -y -f "${SIGNING_KEY}" > "${SIGNING_KEY}.pub"
          git -C tap config user.name "Cloudsmith Bot"
          git -C tap config user.email "vftbot@cloudsmith.io"
          git -C tap config gpg.format ssh
          git -C tap config user.signingkey "${SIGNING_KEY}.pub"
          git -C tap config commit.gpgsign true
          git -C tap checkout -b "${BRANCH}"
          git -C tap add Formula/cloudsmith-cli.rb Aliases/cloudsmith
          git -C tap commit -m "Bump cloudsmith-cli to v${VERSION}"
          git -C tap push --force origin "${BRANCH}"
          if [ -z "$(gh pr list --repo "${TAP_REPO}" --head "${BRANCH}" --state open --json number --jq '.[].number')" ]; then
            gh pr create --repo "${TAP_REPO}" \
              --head "${BRANCH}" --base main \
              --title "Bump cloudsmith-cli to v${VERSION}" \
              --body "Automated formula update for cloudsmith-cli v${VERSION}. The release workflow verified the formula checksums against the published downloads. The workflow merges it when the checks pass."
          else
            echo "pull request for ${BRANCH} already open"
          fi
          # The tap checks start when the pull request opens. Give them time to
          # register, because gh pr checks fails when it finds no checks.
          sleep 60
          gh pr checks "${BRANCH}" --repo "${TAP_REPO}" --watch --fail-fast
          gh pr merge "${BRANCH}" --repo "${TAP_REPO}" --admin --squash \
            --match-head-commit "$(git -C tap rev-parse HEAD)"

      - name: Report a skipped tap update
        if: env.HAS_TAP_TOKEN != 'true'
        run: echo "TAP_PUSH_TOKEN not configured; formula staged as a workflow artifact only."

  publish-github:
    needs:
      - validate
      - stage-github
      - publish-cloudsmith
      - publish-pypi
      - publish-containers
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GH_REPO: ${{ github.repository }}
      VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - name: Assert every expected asset is present
        run: |
          set -euo pipefail
          PRESENT=$(gh release view "${GITHUB_REF_NAME}" --json assets -q '.assets[].name')
          EXPECTED=()
          for TARGET in ${BINARY_TARGETS}; do
            EXT=.tar.gz
            if [ "${TARGET}" = windows-x86_64 ]; then
              EXT=.zip
            fi
            EXPECTED+=("cloudsmith-${VERSION}-${TARGET}${EXT}")
            EXPECTED+=("cloudsmith-${VERSION}-${TARGET}${EXT}.sha256")
            case "${TARGET}" in
              linux-*) EXPECTED+=("cloudsmith-${VERSION}-${TARGET}${EXT}.sig") ;;
            esac
          done
          EXPECTED+=("SHA256SUMS")
          EXPECTED+=("cloudsmith-cli-release-key.asc")
          EXPECTED+=("cloudsmith_cli-${VERSION}.tar.gz")
          EXPECTED+=("cloudsmith_cli-${VERSION}-py3-none-any.whl")
          MISSING=()
          for ASSET in "${EXPECTED[@]}"; do
            if ! printf '%s\n' "${PRESENT}" | grep -Fxq "${ASSET}"; then
              MISSING+=("${ASSET}")
            fi
          done
          if [ "${#MISSING[@]}" -ne 0 ]; then
            echo "FAIL: release is missing expected assets:"
            printf '  %s\n' "${MISSING[@]}"
            exit 1
          fi
          echo "All ${#EXPECTED[@]} expected assets present."

      - name: Publish the fully replicated draft release
        run: gh release edit "${GITHUB_REF_NAME}" --draft=false