node-github-release.yml

name: node-github-release
run-name: Publish ${{ inputs.tag }}

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing stable npm release tag
        required: true
        type: string
      run_id:
        description: Successful node-release run to use for backfill
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: node-github-release
  queue: max

jobs:
  release:
    if: >-
      github.repository == 'openai/codex-security' &&
      github.ref == 'refs/heads/main'
    name: publish verified GitHub release
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
    outputs:
      version: ${{ steps.release.outputs.version }}
      sha: ${{ steps.release.outputs.sha }}
      integrity: ${{ steps.artifact.outputs.integrity }}
      has-action: ${{ steps.action.outputs.present }}
      has-container: ${{ steps.container.outputs.present }}

    steps:
      - name: Checkout release automation
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.sha }}

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24.15.0"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false

      - name: Install provenance-capable npm
        shell: bash
        run: |
          set -euo pipefail
          npm_tools="$RUNNER_TEMP/codex-security-provenance-npm"
          npm install \
            --prefix "$npm_tools" \
            --ignore-scripts \
            --no-audit \
            --no-fund \
            --registry=https://openai.firewall.socket.dev/npm/ \
            npm@11.12.1

          if [[ "$("$npm_tools/node_modules/.bin/npm" --version)" != "11.12.1" ]]; then
            echo "npm 11.12.1 is required to verify Sigstore attestations." >&2
            exit 1
          fi
          printf '%s\n' "$npm_tools/node_modules/.bin" >> "$GITHUB_PATH"

      - name: Verify bundled provenance-capable npm
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$(npm --version)" != "11.12.1" ]]; then
            echo "npm 11.12.1 is required to verify Sigstore attestations." >&2
            exit 1
          fi

      - name: Resolve the successful protected release
        id: release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          INPUT_TAG: ${{ inputs.tag }}
          INPUT_RUN_ID: ${{ inputs.run_id }}
        run: |
          set -euo pipefail

          release_tag="${INPUT_TAG:-}"
          release_run="${INPUT_RUN_ID:-}"

          if [[ ! "$release_tag" =~ ^npm-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "GitHub releases require an existing stable npm-vX.Y.Z tag." >&2
            exit 1
          fi

          if ! tag_ref="$(
            gh api \
              "repos/$GITHUB_REPOSITORY/git/ref/tags/$release_tag" \
              --jq '[.object.type, .object.sha] | @tsv'
          )"; then
            echo "GitHub releases require an existing stable npm-vX.Y.Z tag." >&2
            exit 1
          fi

          IFS=$'\t' read -r tag_type tag_object <<< "$tag_ref"
          if [[ ! "$tag_object" =~ ^[0-9a-fA-F]{40}$ ]]; then
            echo "GitHub releases require a valid Git tag object." >&2
            exit 1
          fi

          case "$tag_type" in
            commit)
              release_sha="$tag_object"
              ;;
            tag)
              if ! release_sha="$(
                gh api \
                  "repos/$GITHUB_REPOSITORY/git/tags/$tag_object" \
                  --jq 'if .object.type == "commit" then .object.sha else empty end'
              )"; then
                echo "GitHub releases require a tag pointing to a commit." >&2
                exit 1
              fi
              ;;
            *)
              echo "GitHub releases require a tag pointing to a commit." >&2
              exit 1
              ;;
          esac

          if [[ ! "$release_sha" =~ ^[0-9a-fA-F]{40}$ ]]; then
            echo "GitHub releases require a tag pointing to a commit." >&2
            exit 1
          fi

          if [[ -z "$release_run" ]]; then
            release_run="$(
              gh run list \
                --repo "$GITHUB_REPOSITORY" \
                --workflow node-release.yml \
                --commit "$release_sha" \
                --limit 20 \
                --json databaseId,status,conclusion \
                --jq '[.[] | select(.status == "completed" and .conclusion == "success")] | first | .databaseId // empty'
            )"
          fi

          if [[ ! "$release_run" =~ ^[1-9][0-9]*$ ]]; then
            echo "No successful protected npm release exists for $release_tag." >&2
            exit 1
          fi

          for ((attempt = 1; attempt <= 30; attempt++)); do
            run_fields="$(
              gh api "repos/$GITHUB_REPOSITORY/actions/runs/$release_run" \
                --jq '[.name, .status, (.conclusion // "pending"), .head_sha, .head_branch] | @tsv'
            )"
            IFS=$'\t' read -r run_name run_status run_conclusion run_sha run_tag <<< "$run_fields"

            if [[ "$run_name" != "node-release" ||
                  "$run_sha" != "$release_sha" ||
                  "$run_tag" != "$release_tag" ]]; then
              echo "The release run must successfully publish the exact tagged commit." >&2
              exit 1
            fi

            if [[ "$run_status" == "completed" ]]; then
              break
            fi

            if (( attempt == 30 )); then
              echo "Timed out waiting for protected npm release $release_run to complete." >&2
              exit 1
            fi
            sleep 2
          done

          if [[ "$run_conclusion" != "success" ]]; then
            echo "The release run must successfully publish the exact tagged commit." >&2
            exit 1
          fi

          {
            printf 'tag=%s\n' "$release_tag"
            printf 'version=%s\n' "${release_tag#npm-v}"
            printf 'sha=%s\n' "$release_sha"
            printf 'run-id=%s\n' "$release_run"
          } >> "$GITHUB_OUTPUT"

      - name: Wait for the published npm package
        shell: bash
        env:
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
        run: |
          set -euo pipefail

          # npm can finish publishing before its registry makes the version available.
          for attempt in {1..21}; do
            if metadata="$(
              npm view "@openai/codex-security@$RELEASE_VERSION" version \
                --json --prefer-online --registry=https://registry.npmjs.org/
            )"; then
              exit 0
            fi
            printf '%s\n' "$metadata" >&2
            if ! printf '%s\n' "$metadata" | node --input-type=module --eval '
              import { readFileSync } from "node:fs";
              const result = JSON.parse(readFileSync(0, "utf8"));
              process.exit(result?.error?.code === "E404" ? 0 : 1);
            '; then
              exit 1
            fi
            if (( attempt == 21 )); then
              echo "The published npm version did not become available within ten minutes." >&2
              exit 1
            fi
            echo "Waiting for npm publication to become available." >&2
            sleep 30
          done

      - name: Download the verified or durable npm release artifact
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_RUN_ID: ${{ steps.release.outputs.run-id }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
        run: |
          set -euo pipefail
          mkdir -p dist
          if ! gh run download "$RELEASE_RUN_ID" \
            --repo "$GITHUB_REPOSITORY" \
            --name npm-release-tarball \
            --dir dist; then
            echo "Release artifact expired; retrieving the public npm tarball."
            npm pack "@openai/codex-security@$RELEASE_VERSION" \
              --ignore-scripts \
              --pack-destination dist \
              --registry=https://registry.npmjs.org/
          fi

      - name: Verify the public npm package and signed provenance
        id: artifact
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_RUN_ID: ${{ steps.release.outputs.run-id }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
          RELEASE_SHA: ${{ steps.release.outputs.sha }}
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          shopt -s nullglob

          archives=(dist/*.tgz)
          if (( ${#archives[@]} != 1 )); then
            echo "Expected exactly one verified npm release tarball." >&2
            exit 1
          fi
          archive="${archives[0]}"

          metadata="$(
            npm view "@openai/codex-security@$RELEASE_VERSION" \
              name version gitHead dist.integrity dist.attestations \
              --json \
              --registry=https://registry.npmjs.org/
          )"

          consumer="$(mktemp -d)"
          trap 'rm -rf "$consumer"' EXIT
          npm install \
            --prefix "$consumer" \
            --ignore-scripts \
            --omit=optional \
            --no-audit \
            --no-fund \
            --registry=https://registry.npmjs.org/ \
            "@openai/codex-security@$RELEASE_VERSION"
          signature_report="$(
            npm audit signatures \
              --prefix "$consumer" \
              --registry=https://registry.npmjs.org/ \
              --json \
              --include-attestations
          )"

          if verified_provenance="$(
            printf '%s\n' "$signature_report" |
              node sdk/typescript/scripts/release-automation.mjs \
                verify-provenance \
                "$archive" \
                "$RELEASE_VERSION" \
                "$RELEASE_SHA" \
                "$GITHUB_REPOSITORY" \
                "$RELEASE_RUN_ID"
          )"; then
            verified_run_id="$RELEASE_RUN_ID"
            printf '%s\n' "$verified_provenance"
            echo "Verified npm provenance for the resolved release run."
          else
            recovery_conclusion="$(
              gh api \
                "repos/$GITHUB_REPOSITORY/actions/runs/$RELEASE_RUN_ID/jobs?per_page=100" \
                --paginate \
                --jq '.jobs[] | select(.name == "publish") | .steps[] | select(.name == "Verify recovered npm release provenance") | .conclusion'
            )"
            if [[ "$recovery_conclusion" != "success" ]]; then
              echo "Signed npm provenance must identify the resolved successful release run." >&2
              exit 1
            fi

            verified_provenance="$(
              printf '%s\n' "$signature_report" |
                node sdk/typescript/scripts/release-automation.mjs \
                  verify-recovered-provenance \
                  "$archive" \
                  "$RELEASE_VERSION" \
                  "$RELEASE_SHA" \
                  "$GITHUB_REPOSITORY"
            )"
            original_run_id="$(
              printf '%s\n' "$verified_provenance" |
                node --input-type=module --eval '
                  import { readFileSync } from "node:fs";
                  const provenance = JSON.parse(readFileSync(0, "utf8"));
                  if (!/^[1-9][0-9]*$/.test(provenance.runId)) {
                    throw new Error("The signing run must be a valid workflow run.");
                  }
                  process.stdout.write(provenance.runId);
                '
            )"
            original_run_fields="$(
              gh api \
                "repos/$GITHUB_REPOSITORY/actions/runs/$original_run_id" \
                --jq '[.name, .status, .head_sha, .head_branch] | @tsv'
            )"
            IFS=$'\t' read -r original_name original_status original_sha original_tag <<< "$original_run_fields"
            if [[ "$original_name" != "node-release" ||
                  "$original_status" != "completed" ||
                  "$original_sha" != "$RELEASE_SHA" ||
                  "$original_tag" != "$RELEASE_TAG" ]]; then
              echo "Recovered npm provenance must identify the exact protected release." >&2
              exit 1
            fi

            verified_run_id="$original_run_id"
            printf '%s\n' "$verified_provenance"
            echo "Verified protected recovery provenance from its original signing run."
          fi

          printf '%s\n' "$metadata" |
            CODEX_SECURITY_VERIFIED_PROVENANCE="$verified_provenance" \
              node sdk/typescript/scripts/release-automation.mjs \
                verify-github-publication \
                "$archive" \
                "$RELEASE_VERSION" \
                "$RELEASE_SHA" \
                "$GITHUB_REPOSITORY" \
                "$verified_run_id"

          printf 'archive=%s\n' "$archive" >> "$GITHUB_OUTPUT"
          printf 'integrity=%s\n' "$(jq -r '."dist.integrity" // .dist.integrity' <<< "$metadata")" >> "$GITHUB_OUTPUT"

      - name: Detect Action release source
        id: action
        env:
          RELEASE_SHA: ${{ steps.release.outputs.sha }}
        run: |
          if git cat-file -e "$RELEASE_SHA:action.yml" 2>/dev/null; then
            echo 'present=true' >> "$GITHUB_OUTPUT"
          fi

      - name: Detect container release source
        id: container
        env:
          RELEASE_SHA: ${{ steps.release.outputs.sha }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
        run: |
          # Coordinated container publication starts at 0.5.0. Earlier releases
          # use older container/native build contracts and retain npm/Action recovery.
          if [[ "$RELEASE_VERSION" =~ ^0\.[0-4]\. ]]; then
            exit 0
          fi
          if git cat-file -e "$RELEASE_SHA:Dockerfile" 2>/dev/null; then
            echo 'present=true' >> "$GITHUB_OUTPUT"
          fi

      - name: Resolve published release history
        id: history
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
          RELEASE_SHA: ${{ steps.release.outputs.sha }}
        run: |
          set -euo pipefail

          published_versions="$(
            npm view @openai/codex-security versions \
              --json \
              --registry=https://registry.npmjs.org/
          )"
          published_github_tags="$(
            gh api --paginate \
              "repos/$GITHUB_REPOSITORY/releases?per_page=100" \
              --jq '.[] | select(.draft == false and .prerelease == false) | .tag_name'
          )"
          reachable_tags=""
          if git rev-parse "$RELEASE_SHA^" >/dev/null 2>&1; then
            reachable_tags="$(
              git tag --merged "$RELEASE_SHA^" \
                --list 'npm-v*' \
                --sort=-version:refname
            )"
          fi

          history="$(
            CODEX_SECURITY_PUBLISHED_NPM_VERSIONS="$published_versions" \
            CODEX_SECURITY_PUBLISHED_GITHUB_TAGS="$published_github_tags" \
            CODEX_SECURITY_REACHABLE_RELEASE_TAGS="$reachable_tags" \
              node sdk/typescript/scripts/release-automation.mjs \
                release-history "$RELEASE_TAG"
          )"

          previous_tag="$(
            printf '%s\n' "$history" |
              node --input-type=module --eval '
                import { readFileSync } from "node:fs";
                const history = JSON.parse(readFileSync(0, "utf8"));
                process.stdout.write(history.previousTag ?? "");
              '
          )"
          make_latest="$(
            printf '%s\n' "$history" |
              node --input-type=module --eval '
                import { readFileSync } from "node:fs";
                const history = JSON.parse(readFileSync(0, "utf8"));
                if (typeof history.makeLatest !== "boolean") {
                  throw new Error("Release latest status must be explicit.");
                }
                process.stdout.write(String(history.makeLatest));
              '
          )"

          {
            printf 'previous-tag=%s\n' "$previous_tag"
            printf 'make-latest=%s\n' "$make_latest"
          } >> "$GITHUB_OUTPUT"

      - name: Publish GitHub Release and generated notes
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
          RELEASE_SHA: ${{ steps.release.outputs.sha }}
          RELEASE_ARCHIVE: ${{ steps.artifact.outputs.archive }}
          PREVIOUS_TAG: ${{ steps.history.outputs.previous-tag }}
          MAKE_LATEST: ${{ steps.history.outputs.make-latest }}
        run: |
          set -euo pipefail
          release_workspace="$(mktemp -d)"
          trap 'rm -rf "$release_workspace"' EXIT

          node --input-type=module --eval '
            import { publishGitHubRelease } from "./sdk/typescript/scripts/publish-github-release.mjs";
            try {
              publishGitHubRelease(process.env, process.argv[1]);
            } catch (error) {
              if (error.status === undefined) throw error;
              process.exit(error.status);
            }
          ' "$release_workspace"

  installed:
    name: verify published installation
    needs: release
    uses: ./.github/workflows/published-install-smoke.yml
    with:
      version: ${{ needs.release.outputs.version }}
      # Use current checks when recovering releases that predate exact-version smoke.
      ref: ${{ github.sha }}

  action-verify:
    name: verify matching Action
    needs: [release, installed]
    if: needs.release.outputs.has-action == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    outputs:
      runtime-lock-artifact: ${{ steps.runtime-lock.outputs.artifact-id }}
    env:
      RELEASE_VERSION: ${{ needs.release.outputs.version }}
      RELEASE_SHA: ${{ needs.release.outputs.sha }}
      CLI_INTEGRITY: ${{ needs.release.outputs.integrity }}

    steps:
      - &action-checkout-automation
        name: Checkout release automation
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          path: automation
          persist-credentials: false

      - &action-checkout-source
        name: Checkout verified CLI source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.release.outputs.sha }}
          path: release-source
          fetch-depth: 0
          persist-credentials: false

      - &action-setup-node
        name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          package-manager-cache: false

      - name: Set up Socket Firewall
        uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
        with:
          mode: firewall-free
          firewall-version: "1.15.0"

      - name: Set up the Ubuntu sandbox
        run: |
          sudo apt-get update
          sudo apt-get install --yes bubblewrap apparmor-profiles
          sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict

      - &action-reuse-distribution
        name: Reuse an existing immutable Action distribution
        id: distribution
        working-directory: release-source
        shell: bash
        run: |
          set -euo pipefail
          action_tag="action-v$RELEASE_VERSION"
          if git show-ref --verify --quiet "refs/tags/$action_tag"; then
            action_sha="$(git rev-parse "$action_tag^{commit}")"
            if [[ "$(git rev-parse "$action_sha^")" != "$RELEASE_SHA" ]]; then
              echo 'The existing Action tag must derive from the exact CLI source.' >&2
              exit 1
            fi
            changed_source="$(git diff --name-only "$RELEASE_SHA" "$action_sha" -- . \
              ':!github-action/package.json' ':!github-action/package-lock.json' \
              ':!github-action/runtime/package.json' ':!github-action/runtime/package-lock.json' \
              ':!github-action/dist/index.cjs' ':!github-action/dist/post.cjs')"
            if [[ -n "$changed_source" ]]; then
              echo 'The existing Action tag contains changes outside release packaging.' >&2
              exit 1
            fi
            git checkout --detach "$action_sha"
            node "$GITHUB_WORKSPACE/automation/github-action/scripts/release.mjs" verify \
              "$RELEASE_VERSION" "$RELEASE_SHA" "$CLI_INTEGRITY" \
              "$GITHUB_WORKSPACE/release-source/github-action"
            echo 'existing=true' >> "$GITHUB_OUTPUT"
          fi

      - name: Resolve the verified CLI runtime lock
        if: steps.distribution.outputs.existing != 'true'
        run: |
          node automation/github-action/scripts/release.mjs prepare \
            "$RELEASE_VERSION" "$RELEASE_SHA" "$CLI_INTEGRITY" \
            "$GITHUB_WORKSPACE/release-source/github-action"

      - name: Install Action and CLI dependencies
        working-directory: release-source/github-action
        run: |
          npm ci --ignore-scripts --no-audit --no-fund
          runtime_cache="$(mktemp -d "$RUNNER_TEMP/action-runtime-firewall-cache.XXXXXX")"
          trap 'rm -rf "$runtime_cache"' EXIT
          sfw npm ci --prefix runtime --ignore-scripts --include=optional --no-audit --no-fund \
            --registry=https://registry.npmjs.org/ --cache="$runtime_cache"

      - name: Build Action distribution
        if: steps.distribution.outputs.existing != 'true'
        working-directory: release-source/github-action
        run: npm run build

      - name: Validate the packaged Action
        working-directory: release-source/github-action
        run: |
          npm run validate
          npm run test:cli
          node scripts/linux-smoke.mjs
          npm audit --audit-level=high
          npm audit --prefix runtime --omit=dev --audit-level=high
          npm run check-dist

      - name: Save verified CLI runtime lock
        id: runtime-lock
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: action-runtime-lock
          path: release-source/github-action/runtime/package-lock.json
          if-no-files-found: error
          retention-days: 7

  action:
    name: publish matching Action
    needs: [release, action-verify]
    if: needs.release.outputs.has-action == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    env:
      RELEASE_VERSION: ${{ needs.release.outputs.version }}
      RELEASE_SHA: ${{ needs.release.outputs.sha }}
      CLI_INTEGRITY: ${{ needs.release.outputs.integrity }}

    steps:
      - *action-checkout-automation
      - *action-checkout-source
      - *action-setup-node
      - *action-reuse-distribution

      - name: Download verified CLI runtime lock
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.action-verify.outputs.runtime-lock-artifact }}
          path: ${{ runner.temp }}/action-runtime-lock
          merge-multiple: true

      - name: Stage verified CLI runtime lock
        run: |
          node automation/github-action/scripts/release.mjs stage \
            "$RELEASE_VERSION" "$RELEASE_SHA" "$CLI_INTEGRITY" \
            "$RUNNER_TEMP/action-runtime-lock/package-lock.json" \
            "$GITHUB_WORKSPACE/release-source/github-action"

      # Rebuild from reviewed source in a fresh job; never run the CLI here.
      - name: Install Action build dependencies
        working-directory: release-source/github-action
        run: npm ci --ignore-scripts --no-audit --no-fund

      - name: Build Action distribution
        if: steps.distribution.outputs.existing != 'true'
        working-directory: release-source/github-action
        run: npm run build

      - name: Check Action distribution before publication
        working-directory: release-source/github-action
        run: npm run check-dist

      - name: Commit and verify release metadata
        working-directory: release-source
        env:
          EXISTING: ${{ steps.distribution.outputs.existing }}
        run: |
          set -euo pipefail
          if [[ "$EXISTING" != true ]]; then
            git add github-action/package.json github-action/package-lock.json \
              github-action/runtime/package.json github-action/runtime/package-lock.json \
              github-action/dist/index.cjs github-action/dist/post.cjs
            git -c user.name='github-actions[bot]' \
              -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
              -c commit.gpgsign=false commit --allow-empty -m "chore(release): package Action $RELEASE_VERSION"
          fi
          node "$GITHUB_WORKSPACE/automation/github-action/scripts/release.mjs" metadata \
            "$RELEASE_VERSION" "$RELEASE_SHA" "$CLI_INTEGRITY" "$(git rev-parse HEAD)" \
            "$GITHUB_WORKSPACE/release-source/github-action"

      - name: Publish immutable Action tag and metadata
        working-directory: release-source
        env:
          GH_TOKEN: ${{ github.token }}
          EXISTING: ${{ steps.distribution.outputs.existing }}
        run: |
          set -euo pipefail
          if [[ "$EXISTING" != true ]]; then
            git -c credential.helper= -c 'credential.helper=!gh auth git-credential' \
              push origin "HEAD:refs/tags/action-v$RELEASE_VERSION"
          fi
          cp github-action/build/release-manifest.json "$RUNNER_TEMP/action-release-manifest.json"
          cp github-action/build/sbom.cdx.json "$RUNNER_TEMP/action-sbom.cdx.json"
          action_tag="action-v$RELEASE_VERSION"
          if release_state="$(gh release view "$action_tag" --repo "$GITHUB_REPOSITORY" --json isDraft,assets)"; then
            existing_assets="$(jq -r '.assets[].name' <<< "$release_state")"
            is_draft="$(jq -r '.isDraft' <<< "$release_state")"
            comparison="$(mktemp -d)"
            trap 'rm -rf "$comparison"' EXIT
            for asset in action-release-manifest.json action-sbom.cdx.json; do
              if grep -Fxq "$asset" <<< "$existing_assets"; then
                gh release download "$action_tag" --repo "$GITHUB_REPOSITORY" \
                  --pattern "$asset" --dir "$comparison"
                if ! cmp "$RUNNER_TEMP/$asset" "$comparison/$asset"; then
                  echo "Published Action metadata differs: $asset" >&2
                  exit 1
                fi
              elif [[ "$is_draft" == true ]]; then
                gh release upload "$action_tag" --repo "$GITHUB_REPOSITORY" "$RUNNER_TEMP/$asset"
              else
                echo "Published Action release is missing metadata: $asset" >&2
                exit 1
              fi
            done
            if [[ "$is_draft" == true ]]; then
              gh release edit "$action_tag" --repo "$GITHUB_REPOSITORY" --draft=false --latest=false
            fi
          else
            notes="$RUNNER_TEMP/action-release-notes.md"
            {
              printf 'GitHub Action for [Codex Security %s](%s/%s/releases/tag/npm-v%s).\n\n' \
                "$RELEASE_VERSION" "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$RELEASE_VERSION"
              printf 'Installs `@openai/codex-security@%s`.\n\n' "$RELEASE_VERSION"
              printf '```yaml\nuses: %s@%s # %s\n```\n' \
                "$GITHUB_REPOSITORY" "$(git rev-parse HEAD)" "$action_tag"
            } > "$notes"
            # gh attaches both assets to a draft before publishing the immutable release.
            gh release create "$action_tag" \
              "$RUNNER_TEMP/action-release-manifest.json" "$RUNNER_TEMP/action-sbom.cdx.json" \
              --repo "$GITHUB_REPOSITORY" --verify-tag --latest=false \
              --title "Codex Security GitHub Action $RELEASE_VERSION" --notes-file "$notes"
          fi
          {
            printf '### Codex Security %s\n\n' "$RELEASE_VERSION"
            printf 'CLI source: `%s`\n\n' "$RELEASE_SHA"
            printf 'Action: `uses: %s@%s` (`action-v%s`)\n' "$GITHUB_REPOSITORY" "$(git rev-parse HEAD)" "$RELEASE_VERSION"
          } >> "$GITHUB_STEP_SUMMARY"

  container:
    name: publish matching container
    needs: [release, installed]
    if: needs.release.outputs.has-container == 'true'
    permissions:
      contents: read
      packages: write
      attestations: write
      artifact-metadata: write
      id-token: write
    uses: ./.github/workflows/container-release.yml
    with:
      release-sha: ${{ needs.release.outputs.sha }}
      release-version: ${{ needs.release.outputs.version }}

  complete:
    name: release status
    if: always()
    needs: [release, installed, action, container]
    runs-on: ubuntu-latest
    env:
      RELEASE_RESULT: ${{ needs.release.result }}
      INSTALL_RESULT: ${{ needs.installed.result }}
      ACTION_RESULT: ${{ needs.action.result }}
      HAS_ACTION: ${{ needs.release.outputs.has-action }}
      CONTAINER_RESULT: ${{ needs.container.result }}
      HAS_CONTAINER: ${{ needs.release.outputs.has-container }}
    steps:
      - name: Summarize release channels
        continue-on-error: true
        env:
          RELEASE_VERSION: ${{ needs.release.outputs.version }}
        run: |
          {
            printf '## Release publication status\n\n'
            printf '| Channel | Result |\n| --- | --- |\n'
            printf '| npm package and CLI GitHub release | %s |\n' "$RELEASE_RESULT"
            printf '| Published package installation checks | %s |\n' "$INSTALL_RESULT"
            printf '| GitHub Action release | %s |\n' "$ACTION_RESULT"
            printf '| GitHub Marketplace | Not checked; publish and verify separately |\n'
            printf '| Container image | %s |\n\n' "$CONTAINER_RESULT"
            if [[ "$HAS_ACTION" == true && "$ACTION_RESULT" == success ]]; then
              printf 'Marketplace: [edit the Action release](%s/%s/releases/edit/action-v%s) to publish or verify its listing.\n\n' \
                "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$RELEASE_VERSION"
            fi
            printf 'See the [release process](%s/%s/blob/main/RELEASING.md#publish-to-github-marketplace) for Marketplace publication.\n' \
              "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Require completed release channels
        run: |
          test "$RELEASE_RESULT" = success
          test "$INSTALL_RESULT" = success
          if [[ "$HAS_ACTION" == true ]]; then
            test "$ACTION_RESULT" = success
          fi
          if [[ "$HAS_CONTAINER" == true ]]; then
            test "$CONTAINER_RESULT" = success
          fi