candidate.yml

name: candidate
run-name: Rootform candidate ${{ inputs.version }}

# A release request is a commit on main: package.json names the version and
# public-export.json the Engine commit that builds it. The Engine release
# handoff answers it with a handoff draft and dispatches this workflow, which
# assembles and qualifies the exact draft release that publish may publish.
# A failed job resumes with "Re-run failed jobs"; a new dispatch replaces the
# draft of the same version.
# Registry evidence is attached to the assembled draft before qualification
# can complete. Re-running failed jobs preserves the assembled assets.
on:
  workflow_dispatch:
    inputs:
      version:
        description: Version named by the release request on main
        required: true
        type: string
      handoff_release_id:
        description: Engine handoff draft release ID; found from the version and commit when empty
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: candidate-${{ inputs.version }}
  cancel-in-progress: false

jobs:
  qualify:
    name: assemble and qualify candidate
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: write
      pull-requests: read
    outputs:
      evidence: ${{ steps.candidate-evidence.outputs.body }}
      handoff_release_id: ${{ steps.request.outputs.handoff_release_id }}
      pull-request: ${{ steps.pull-request.outputs.number }}
      release_id: ${{ steps.final-release.outputs.release_id }}

    steps:
      - name: Check out distribution
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install exact Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.0

      - name: Read exact release request
        id: request
        env:
          GH_TOKEN: ${{ github.token }}
          HANDOFF_RELEASE_ID: ${{ inputs.handoff_release_id }}
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          fail() { echo "::error::$1"; exit 1; }
          [[ "$GITHUB_REF" == refs/heads/main ]] || fail "Qualify candidates from main."
          main="$(gh api "repos/$GITHUB_REPOSITORY/branches/main" --jq .commit.sha)"
          [[ "$main" == "$GITHUB_SHA" ]] || fail "main moved to $main. Request a handoff for that commit."
          request="$(bun scripts/prepare-release.ts --check)" ||
            fail "$GITHUB_SHA does not request a release. Prepare one in a pull request into dev, then promote it."
          requested="$(jq -r .version <<<"$request")"
          [[ "$requested" == "$ROOTFORM_VERSION" ]] || fail "main requests Rootform $requested, not $ROOTFORM_VERSION."
          tag="v$ROOTFORM_VERSION"
          if gh api "repos/$GITHUB_REPOSITORY/releases/tags/$tag" >/dev/null 2>&1; then
            fail "$tag is already published."
          fi
          releases="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" | jq -cs '[.[][]]')"
          handoff="$HANDOFF_RELEASE_ID"
          if [[ -z "$handoff" ]]; then
            handoff="$(jq -r --arg tag "engine-handoff-$tag" '
              [.[] | select(.draft and .tag_name == $tag and .target_commitish == env.GITHUB_SHA)]
              | if length == 1 then .[0].id else "" end' <<<"$releases")"
          fi
          [[ "$handoff" =~ ^[1-9][0-9]*$ ]] ||
            fail "No Engine handoff draft answers $GITHUB_SHA for $tag. Request the Engine release handoff for this commit."
          jq -e --argjson id "$handoff" --arg tag "engine-handoff-$tag" '
            any(.[]; .id == $id and .draft and .tag_name == $tag and .target_commitish == env.GITHUB_SHA)' \
            <<<"$releases" >/dev/null ||
            fail "Release $handoff is not the Engine handoff draft for $tag at $GITHUB_SHA."
          printf 'handoff_release_id=%s\n' "$handoff" >> "$GITHUB_OUTPUT"
          engine="$(jq -r .engine_commit <<<"$request")"
          echo "Rootform \`$GITHUB_SHA\` requests $ROOTFORM_VERSION built by Engine \`$engine\`; handoff draft $handoff." >> "$GITHUB_STEP_SUMMARY"

      - name: Resolve promotion pull request
        id: pull-request
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          # Evidence goes to the promotion that put this commit on main, when GitHub links it.
          number="$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" --jq '
            [.[] | select(.base.ref == "main" and .merged_at != null and .head.sha == env.GITHUB_SHA)]
            | if length == 1 then .[0].number else "" end')"
          [[ -z "$number" || "$number" =~ ^[1-9][0-9]*$ ]]
          printf 'number=%s\n' "$number" >> "$GITHUB_OUTPUT"

      - name: Install exact QEMU emulation
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
        with:
          cache-image: false
          image: docker.io/tonistiigi/binfmt:latest@sha256:400a4873b838d1b89194d982c45e5fb3cda4593fbfd7e08a02e76b03b21166f0
          platforms: arm64

      - name: Install exact Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          driver-opts: image=moby/buildkit:v0.32.2@sha256:28a898719c18a33f4e8000685287fa36fd0dd9560c6440227d3a732d79bb41d8

      - name: Install exact distribution dependencies
        run: bun install --frozen-lockfile

      - name: Install verified repository tools
        env:
          ACTIONLINT_ARCHIVE: actionlint_1.7.12_linux_amd64.tar.gz
          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
          ACTIONLINT_VERSION: 1.7.12
          GITLEAKS_ARCHIVE: gitleaks_8.30.1_linux_x64.tar.gz
          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
          GITLEAKS_VERSION: 8.30.1
          ORAS_ARCHIVE: oras_1.3.4_linux_amd64.tar.gz
          ORAS_SHA256: f27adb935022d94df8dc77719c322dda592c78a0d57a6f7dcdd8d900b248c454
          ORAS_VERSION: 1.3.4
          TRIVY_ARCHIVE: trivy_0.74.0_Linux-64bit.tar.gz
          TRIVY_SHA256: 2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
          TRIVY_VERSION: 0.74.0
        run: |
          set -euo pipefail
          curl --fail --silent --show-error --location \
            --output "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" \
            "https://github.com/gitleaks/gitleaks/releases/download/v$GITLEAKS_VERSION/$GITLEAKS_ARCHIVE"
          printf '%s  %s\n' "$GITLEAKS_SHA256" "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" | sha256sum --check --strict
          tar --extract --gzip --file "$RUNNER_TEMP/$GITLEAKS_ARCHIVE" --directory "$RUNNER_TEMP" gitleaks
          curl --fail --silent --show-error --location \
            --output "$RUNNER_TEMP/$ACTIONLINT_ARCHIVE" \
            "https://github.com/rhysd/actionlint/releases/download/v$ACTIONLINT_VERSION/$ACTIONLINT_ARCHIVE"
          printf '%s  %s\n' "$ACTIONLINT_SHA256" "$RUNNER_TEMP/$ACTIONLINT_ARCHIVE" | sha256sum --check --strict
          tar --extract --gzip --file "$RUNNER_TEMP/$ACTIONLINT_ARCHIVE" --directory "$RUNNER_TEMP" actionlint
          curl --fail --silent --show-error --location \
            --output "$RUNNER_TEMP/$ORAS_ARCHIVE" \
            "https://github.com/oras-project/oras/releases/download/v$ORAS_VERSION/$ORAS_ARCHIVE"
          printf '%s  %s\n' "$ORAS_SHA256" "$RUNNER_TEMP/$ORAS_ARCHIVE" | sha256sum --check --strict
          tar --extract --gzip --file "$RUNNER_TEMP/$ORAS_ARCHIVE" --directory "$RUNNER_TEMP" oras
          curl --fail --silent --show-error --location \
            --output "$RUNNER_TEMP/$TRIVY_ARCHIVE" \
            "https://github.com/aquasecurity/trivy/releases/download/v$TRIVY_VERSION/$TRIVY_ARCHIVE"
          printf '%s  %s\n' "$TRIVY_SHA256" "$RUNNER_TEMP/$TRIVY_ARCHIVE" | sha256sum --check --strict
          tar --extract --gzip --file "$RUNNER_TEMP/$TRIVY_ARCHIVE" --directory "$RUNNER_TEMP" trivy
          printf '%s\n' "$RUNNER_TEMP" >> "$GITHUB_PATH"

      - name: Verify distribution repository boundary
        run: |
          set -euo pipefail
          bun run check
          actionlint -no-color -oneline
          git diff --check
          gitleaks dir --no-banner --redact --config .gitleaks.toml .
          gitleaks git --no-banner --redact --config .gitleaks.toml .

      - name: Download exact opaque handoff
        env:
          GITHUB_TOKEN: ${{ github.token }}
          HANDOFF_RELEASE_ID: ${{ steps.request.outputs.handoff_release_id }}
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          bun scripts/download-handoff.ts \
            --version "$ROOTFORM_VERSION" \
            --release-id "$HANDOFF_RELEASE_ID" \
            --output build/handoff \
            --metadata build/handoff-assets.json

      - name: Assemble exact final assets
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          bun scripts/assemble-release.ts \
            --version "$ROOTFORM_VERSION" \
            --handoff build/handoff \
            --github-assets build/handoff-assets.json \
            --output build/release

      - name: Extract verified Linux binary
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          bun scripts/extract-release-binary.ts \
            --version "$ROOTFORM_VERSION" \
            --release build/release \
            --target linux-amd64 \
            --output build/bin/rootform

      - name: Verify contracts and examples
        timeout-minutes: 15
        env:
          ROOTFORM_BIN: ${{ github.workspace }}/build/bin/rootform
        run: bun run verify

      - name: Qualify Explorer and self-contained HTML in a real browser
        timeout-minutes: 10
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          browser="$(command -v google-chrome || command -v chromium)"
          test -x "$browser"
          bun scripts/verify-explorer-browser.ts \
            --version "$ROOTFORM_VERSION" \
            --binary build/bin/rootform \
            --browser "$browser" \
            --evidence build/browser-evidence/qualification.json

      - name: Retain browser qualification evidence
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-browser-${{ inputs.version }}-${{ github.sha }}
          path: build/browser-evidence/qualification.json
          if-no-files-found: error
          retention-days: 90

      - name: Reverify final assets
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          bun scripts/assemble-release.ts \
            --check \
            --version "$ROOTFORM_VERSION" \
            --handoff build/handoff \
            --github-assets build/handoff-assets.json \
            --output build/release

      - name: Generate release-bound installation metadata
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          bun scripts/generate-installation.ts \
            --version "$ROOTFORM_VERSION" \
            --release build/release \
            --output build/installers

      - name: Build and audit official OCI image
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          bun scripts/build-image.ts \
            --version "$ROOTFORM_VERSION" \
            --release build/release \
            --revision "$GITHUB_SHA" \
            --output build/image

      - name: Qualify OCI image runtime and third-party Dialect acquisition
        env:
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          bun run test:oci-registry-e2e \
            --version "$ROOTFORM_VERSION" \
            --revision "$GITHUB_SHA" \
            --image build/image \
            --rootform-bin build/bin/rootform \
            --oras "$RUNNER_TEMP/oras" \
            --trivy "$RUNNER_TEMP/trivy" \
            --evidence build/image-evidence/qualification.json

      - name: Preserve OCI image qualification evidence
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-image-qualification-${{ inputs.version }}-${{ github.sha }}
          path: |
            build/image/rootform_${{ inputs.version }}_image.json
            build/image-evidence/*.json
          if-no-files-found: error
          retention-days: 90

      - name: Create final draft release
        id: final-release
        env:
          GH_TOKEN: ${{ github.token }}
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          tag="v$ROOTFORM_VERSION"
          # A draft holds the assets of one qualification. A new qualification of
          # this version replaces it; a published release is never touched.
          for id in $(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" |
            jq -rs --arg tag "$tag" '.[][] | select(.draft and .tag_name == $tag) | .id'); do
            gh api -X DELETE "repos/$GITHUB_REPOSITORY/releases/$id"
            echo "Replaced earlier draft $id of $tag." >> "$GITHUB_STEP_SUMMARY"
          done
          if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$tag" >/dev/null 2>&1; then
            printf 'tag already exists: %s\n' "$tag" >&2
            exit 1
          fi
          bun scripts/prepare-release.ts --notes > build/release-notes.md
          kind=()
          [[ "$ROOTFORM_VERSION" != *-* ]] || kind=(--prerelease)
          gh release create "$tag" build/release/* \
            --repo "$GITHUB_REPOSITORY" \
            --draft \
            "${kind[@]}" \
            --target "$GITHUB_SHA" \
            --title "Rootform $ROOTFORM_VERSION" \
            --notes-file build/release-notes.md
          release_id="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" |
            jq -rs --arg tag "$tag" '[.[][] | select(.tag_name == $tag and .draft == true)] | if length == 1 then .[0].id else empty end')"
          test -n "$release_id"
          find build/release -maxdepth 1 -type f -printf '%f\n' | LC_ALL=C sort > build/expected-assets.txt
          gh api "repos/$GITHUB_REPOSITORY/releases/$release_id" --jq '.assets[].name' \
            | LC_ALL=C sort > build/uploaded-assets.txt
          diff --unified build/expected-assets.txt build/uploaded-assets.txt
          release_url="$(gh api "repos/$GITHUB_REPOSITORY/releases/$release_id" --jq '.html_url')"
          [[ "$release_url" == https://github.com/* ]]
          printf 'url=%s\n' "$release_url" >> "$GITHUB_OUTPUT"
          printf 'release_id=%s\n' "$release_id" >> "$GITHUB_OUTPUT"

      - name: Upload exact draft candidate for native jobs
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-candidate-${{ inputs.version }}-${{ github.sha }}
          path: build/release
          if-no-files-found: error
          compression-level: 0
          retention-days: 90

      - name: Upload generated installation metadata for review
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-installation-metadata-${{ inputs.version }}-${{ github.sha }}
          path: build/installers
          if-no-files-found: error
          compression-level: 9
          retention-days: 90

      - name: Render candidate evidence
        id: candidate-evidence
        env:
          RELEASE_URL: ${{ steps.final-release.outputs.url }}
          ROOTFORM_VERSION: ${{ inputs.version }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail
          bun scripts/render-candidate-report.ts \
            --version "$ROOTFORM_VERSION" \
            --release build/release \
            --release-url "$RELEASE_URL" \
            --run-url "$RUN_URL" \
            --output build/candidate-evidence.md
          cat build/candidate-evidence.md >> "$GITHUB_STEP_SUMMARY"
          printf 'body=%s\n' "$(base64 -w 0 build/candidate-evidence.md)" >> "$GITHUB_OUTPUT"

  platforms:
    name: runtime ${{ matrix.target }}
    needs: qualify
    permissions:
      contents: read
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        include:
          - { archive_target: linux-amd64, executable: rootform, runner: ubuntu-24.04, target: linux-amd64 }
          - { archive_target: linux-arm64, executable: rootform, runner: ubuntu-24.04-arm, target: linux-arm64 }
          - { archive_target: darwin-amd64, executable: rootform, runner: macos-15-intel, target: macos-amd64 }
          - { archive_target: darwin-arm64, executable: rootform, runner: macos-15, target: macos-arm64 }
          - { archive_target: windows-amd64, executable: rootform.exe, runner: windows-2025, target: windows-amd64 }

    steps:
      - name: Check out distribution
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install exact Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.0

      - name: Download exact draft candidate
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rootform-candidate-${{ inputs.version }}-${{ github.sha }}
          path: build/release

      - name: Extract verified native binary
        run: >-
          bun scripts/extract-release-binary.ts
          --version "${{ inputs.version }}"
          --release build/release
          --target "${{ matrix.archive_target }}"
          --output "build/bin/${{ matrix.executable }}"

      - name: Exercise native runtime
        run: >-
          bun scripts/verify-platform-runtime.ts
          --version "${{ inputs.version }}"
          --binary "build/bin/${{ matrix.executable }}"
          --target "${{ matrix.target }}"
          --evidence "build/platform-evidence/${{ matrix.target }}.json"

      - name: Upload native runtime evidence
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-runtime-${{ inputs.version }}-${{ matrix.target }}
          path: build/platform-evidence/${{ matrix.target }}.json
          if-no-files-found: error
          compression-level: 9
          retention-days: 90

  installation:
    name: native installation qualification
    needs: qualify
    permissions:
      contents: write
    uses: ./.github/workflows/installation-qualification.yml
    with:
      version: ${{ inputs.version }}
      release_id: ${{ needs.qualify.outputs.release_id }}

  registry:
    name: verify exact registry evidence
    needs: qualify
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.0
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rootform-candidate-${{ inputs.version }}-${{ github.sha }}
          path: build/release
      - name: Verify the proof draft and exact binary binding
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ inputs.version }}
          RELEASE_ID: ${{ needs.qualify.outputs.release_id }}
          HANDOFF_RELEASE_ID: ${{ needs.qualify.outputs.handoff_release_id }}
        run: |
          set -euo pipefail
          tag="registry-qualification-v$VERSION-$RELEASE_ID"
          proofs="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" | jq -cs --arg tag "$tag" '[.[][]|select(.tag_name==$tag)]')"
          if [[ "$(jq length <<<"$proofs")" != 1 ]]; then
            echo '::error::Registry qualification evidence is unavailable for this draft.'
            exit 1
          fi
          proof="$(jq -ec --arg commit "$GITHUB_SHA" '.[0]|select(.draft and .target_commitish==$commit and (.assets|length)==1)' <<<"$proofs")"
          asset="$(jq -ec '.assets[0]|select(.name=="registry-bound.json" and .state=="uploaded" and .size>0 and .size<=65536 and (.digest|test("^sha256:[0-9a-f]{64}$")))' <<<"$proof")"
          handoff="$(gh api "repos/$GITHUB_REPOSITORY/releases/$HANDOFF_RELEASE_ID" | jq -ec --arg tag "engine-handoff-v$VERSION" --arg commit "$GITHUB_SHA" 'select(.draft and .tag_name==$tag and .target_commitish==$commit and .author.type=="Bot")')"
          candidate="$(gh api "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID" | jq -ec --arg tag "v$VERSION" --arg commit "$GITHUB_SHA" 'select(.draft and .tag_name==$tag and .target_commitish==$commit)')"
          [[ "$(jq -r .author.id <<<"$proof")" == "$(jq -r .author.id <<<"$handoff")" ]]
          [[ "$(jq -r .uploader.id <<<"$asset")" == "$(jq -r .author.id <<<"$handoff")" ]]
          [[ "$(jq -r .created_at <<<"$proof")" > "$(jq -r .created_at <<<"$candidate")" || "$(jq -r .created_at <<<"$proof")" == "$(jq -r .created_at <<<"$candidate")" ]]
          mkdir -p build/registry-evidence build/bin
          gh api -H 'Accept: application/octet-stream' "repos/$GITHUB_REPOSITORY/releases/assets/$(jq -r .id <<<"$asset")" >build/registry-proof.json
          [[ "sha256:$(sha256sum build/registry-proof.json | cut -d ' ' -f1)" == "$(jq -r .digest <<<"$asset")" ]]
          bun scripts/extract-release-binary.ts --version "$VERSION" --release build/release --target linux-amd64 --output build/bin/rootform
          bun scripts/registry-qualification.ts --proof build/registry-proof.json --version "$VERSION" \
            --rootform-commit "$GITHUB_SHA" --binary build/bin/rootform --candidate-release-id "$RELEASE_ID" \
            --engine-commit "$(jq -r .source_commit public-export.json)" --evidence build/registry-evidence/qualification.json
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-registry-${{ inputs.version }}-${{ github.sha }}
          path: build/registry-evidence/qualification.json
          if-no-files-found: error
          retention-days: 90

  record:
    name: record qualified candidate
    needs:
      - qualify
      - platforms
      - installation
      - registry
    permissions:
      # Draft releases are visible only with write access.
      contents: write
    runs-on: ubuntu-24.04
    timeout-minutes: 5

    steps:
      - name: Record exact qualified draft
        env:
          GH_TOKEN: ${{ github.token }}
          HANDOFF_RELEASE_ID: ${{ needs.qualify.outputs.handoff_release_id }}
          RELEASE_ID: ${{ needs.qualify.outputs.release_id }}
          ROOTFORM_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          # Publication requires this record: it binds the qualified draft and its
          # asset digests to the run whose every job passed.
          mkdir -p build/qualification
          gh api "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID" | jq -e \
            --arg tag "v$ROOTFORM_VERSION" \
            --argjson handoff "$HANDOFF_RELEASE_ID" \
            --argjson run "$GITHUB_RUN_ID" \
            --argjson attempt "$GITHUB_RUN_ATTEMPT" '
            select(.draft and .tag_name == $tag and .target_commitish == env.GITHUB_SHA) |
            {format_version: "1", version: env.ROOTFORM_VERSION, tag: $tag, commit: .target_commitish,
             release_id: .id, handoff_release_id: $handoff, run_id: $run, run_attempt: $attempt,
             assets: ([.assets[] | {name, size, digest}] | sort_by(.name))}' \
            > build/qualification/qualification.json
          echo "Qualified draft $RELEASE_ID of v$ROOTFORM_VERSION at \`$GITHUB_SHA\` is ready for publish." >> "$GITHUB_STEP_SUMMARY"

      - name: Upload qualification record
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: rootform-qualification-${{ inputs.version }}-${{ github.sha }}
          path: build/qualification/qualification.json
          if-no-files-found: error
          retention-days: 90

  evidence:
    name: PR evidence
    if: always() && needs.qualify.outputs.pull-request != ''
    needs:
      - qualify
      - platforms
      - installation
      - record
      - registry
    permissions:
      contents: read
      pull-requests: write
    runs-on: ubuntu-24.04
    timeout-minutes: 5

    steps:
      - name: Publish one current evidence comment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          PR_NUMBER: ${{ needs.qualify.outputs.pull-request }}
          QUALIFY_RESULT: ${{ needs.qualify.result == 'success' && needs.platforms.result == 'success' && needs.installation.result == 'success' && needs.registry.result == 'success' && needs.record.result == 'success' && 'success' || 'failure' }}
          REPORT_BASE64: ${{ needs.qualify.outputs.evidence }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        with:
          script: |
            const marker = '<!-- rootform:distribution-evidence -->';
            const runUrl = process.env.RUN_URL;
            const qualified = process.env.QUALIFY_RESULT === 'success';
            const report = qualified && process.env.REPORT_BASE64
              ? Buffer.from(process.env.REPORT_BASE64, 'base64').toString('utf8')
              : `${marker}\n## Distribution candidate evidence\n\n> **Blocked**, [Open workflow run](${runUrl})\n`;
            if (!report.startsWith(marker) || Buffer.byteLength(report) > 60000) {
              core.setFailed('Distribution evidence report is invalid');
              return;
            }
            await core.summary.addRaw(report).write();
            const issue_number = Number(process.env.PR_NUMBER);
            if (!Number.isSafeInteger(issue_number) || issue_number < 1) {
              core.setFailed('Pull request number is invalid');
              return;
            }
            const comments = await github.paginate(github.rest.issues.listComments, {
              ...context.repo,
              issue_number,
              per_page: 100,
            });
            const existing = comments.find((comment) =>
              comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker)
            );
            if (existing) {
              await github.rest.issues.updateComment({
                ...context.repo,
                comment_id: existing.id,
                body: report,
              });
            } else {
              await github.rest.issues.createComment({
                ...context.repo,
                issue_number,
                body: report,
              });
            }
            if (!qualified) core.setFailed('Candidate qualification did not pass');