name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  # id-token: write is required for:
  #   1. cosign keyless signing via GitHub's OIDC token
  #   2. SLSA-3 provenance generation (the reusable workflow below also sets it)
  id-token: write

jobs:
  # darwin is built on a NATIVE macOS runner so Apple's ld sets the
  # SG_READ_ONLY flag on the __DATA_CONST segment. The cross-compiled cask
  # shipped without it and aborted under the macOS 15+/Tahoe dyld
  # ("__DATA_CONST segment missing SG_READ_ONLY flag", issue #176). This job
  # links arm64 natively + amd64 via `clang -arch x86_64`, codesigns each
  # Mach-O, smoke-tests the flag (and actually runs the arm64 binary on this
  # Sequoia runner — the exact `gortex --version` repro), packages the tar.gz
  # archives in goreleaser's layout, and uploads them for the `release` job to
  # merge, notarize, sign, and reference from the homebrew cask.
  build-darwin:
    runs-on: macos-15
    # Only reads the repo and hands off an artifact — no release writes here.
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod

      - name: Build darwin binaries (native Apple toolchain)
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF#refs/tags/}"
          # Mirror goreleaser's ldflags so the darwin binaries report the same
          # version/commit as the linux ones. {{ .Version }} is the tag without
          # its leading "v".
          VERSION="${TAG#v}"
          COMMIT="$(git rev-parse --short HEAD)"
          DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          LDFLAGS="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${DATE}"
          mkdir -p dist-darwin

          # arm64: native link on this Apple-Silicon runner.
          CGO_ENABLED=1 GOOS=darwin GOARCH=arm64 \
            go build -ldflags "$LDFLAGS" -o dist-darwin/gortex_darwin_arm64 ./cmd/gortex/

          # amd64: cross within Apple's clang (the macOS SDK is universal), so
          # Apple's ld still sets SG_READ_ONLY. CC + CXX both target x86_64
          # because some tree-sitter scanners are C++.
          CGO_ENABLED=1 GOOS=darwin GOARCH=amd64 \
            CC="clang -arch x86_64" CXX="clang++ -arch x86_64" \
            go build -ldflags "$LDFLAGS" -o dist-darwin/gortex_darwin_amd64 ./cmd/gortex/

      - name: Stage macOS signing material
        env:
          P12_B64:  ${{ secrets.MACOS_CERTIFICATE_P12 }}
          P12_PASS: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail
          SIGNING_DIR=/tmp/macos-signing
          mkdir -p "$SIGNING_DIR"; chmod 700 "$SIGNING_DIR"
          echo "$P12_B64" | base64 -d > "$SIGNING_DIR/cert.p12"
          printf '%s' "$P12_PASS"     > "$SIGNING_DIR/cert.pass"
          chmod 600 "$SIGNING_DIR"/cert.*

          # Reuse the exact signing path (scripts/sign-macos-build-hook.sh)
          # via rcodesign — just the native aarch64-apple-darwin build of the
          # tool instead of the linux-musl one. Pin version + sha256 together;
          # the apple-codesign release page publishes both.
          RCODESIGN_VERSION=0.29.0
          RCODESIGN_SHA256=d1a532150adaf90048260d76359261aa716abafc45c53c5dc18845029184334a
          RCODESIGN_TARBALL="apple-codesign-${RCODESIGN_VERSION}-aarch64-apple-darwin.tar.gz"
          curl -fsSL \
            "https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F${RCODESIGN_VERSION}/${RCODESIGN_TARBALL}" \
            -o "$SIGNING_DIR/$RCODESIGN_TARBALL"
          echo "$RCODESIGN_SHA256  $SIGNING_DIR/$RCODESIGN_TARBALL" | shasum -a 256 -c -
          tar -xzf "$SIGNING_DIR/$RCODESIGN_TARBALL" -C "$SIGNING_DIR" --strip-components=1
          chmod +x "$SIGNING_DIR/rcodesign"
          rm "$SIGNING_DIR/$RCODESIGN_TARBALL"

      - name: Codesign darwin binaries
        run: |
          set -euo pipefail
          sh scripts/sign-macos-build-hook.sh darwin dist-darwin/gortex_darwin_arm64
          sh scripts/sign-macos-build-hook.sh darwin dist-darwin/gortex_darwin_amd64

      - name: Smoke-test __DATA_CONST SG_READ_ONLY flag (issue #176)
        run: |
          set -euo pipefail
          sh scripts/verify-macho-readonly.sh dist-darwin/gortex_darwin_arm64
          sh scripts/verify-macho-readonly.sh dist-darwin/gortex_darwin_amd64
          # End-to-end repro of #176: actually load + run the binary on this
          # Sequoia runner, whose dyld enforces the flag. A missing flag aborts
          # here exactly like `gortex --version` did for users on Tahoe.
          chmod +x dist-darwin/gortex_darwin_arm64
          ./dist-darwin/gortex_darwin_arm64 version
          # amd64 runs under Rosetta when present; otherwise the static otool
          # check above already covers it.
          if arch -x86_64 /usr/bin/true >/dev/null 2>&1; then
            chmod +x dist-darwin/gortex_darwin_amd64
            arch -x86_64 ./dist-darwin/gortex_darwin_amd64 version
          else
            echo "rosetta unavailable; amd64 covered by the otool flag check"
          fi

      - name: Package darwin archives
        run: |
          set -euo pipefail
          # Match goreleaser's tar.gz layout: the binary as `gortex` at the
          # archive root, alongside LICENSE/README (goreleaser's default
          # archive files). install.sh + the cask expect this exact name:
          # gortex_<os>_<arch>.tar.gz.
          mkdir -p dist
          for arch in arm64 amd64; do
            stage="$(mktemp -d)"
            cp "dist-darwin/gortex_darwin_${arch}" "$stage/gortex"
            chmod +x "$stage/gortex"
            cp LICENSE.md README.md "$stage/"
            tar -C "$stage" -czf "dist/gortex_darwin_${arch}.tar.gz" gortex LICENSE.md README.md
            rm -rf "$stage"
          done
          ls -la dist/

      - name: Wipe macOS signing material
        if: always()
        run: rm -rf /tmp/macos-signing

      - name: Upload darwin archives
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: darwin-archives
          path: dist/gortex_darwin_*.tar.gz
          if-no-files-found: error
          retention-days: 1

  release:
    needs: build-darwin
    runs-on: ubuntu-latest
    # Expose sha256 hashes of every release artifact so the provenance job
    # can feed them to the SLSA generator.
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # goreleaser reads the tag list to build the changelog. Without
          # full history the changelog section will be empty or wrong.
          fetch-depth: 0

      # cosign is installed on the host (outside the goreleaser-cross
      # container) so keyless OIDC signing can use the runner's identity
      # token directly — no need to plumb ACTIONS_ID_TOKEN_REQUEST_* vars
      # through `docker run`.
      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: v2.4.1

      # Stage the Apple notary credentials + rcodesign (linux-musl build)
      # under one 0700 directory for the post-archive "Notarize macOS
      # binaries" step. The darwin binaries were already codesigned in the
      # build-darwin job, so the signing cert is NOT needed here — only the
      # notary API key. The dir is wiped unconditionally at the end of the
      # job (see "Wipe macOS signing material").
      - name: Stage macOS notary material
        env:
          NOTARY_B64: ${{ secrets.MACOS_NOTARY_API_KEY }}
          KEY_ID:     ${{ secrets.MACOS_NOTARY_KEY_ID }}
          ISSUER_ID:  ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
        run: |
          set -euo pipefail
          SIGNING_DIR=/tmp/macos-signing
          mkdir -p "$SIGNING_DIR"
          chmod 700 "$SIGNING_DIR"

          echo "$NOTARY_B64" | base64 -d > "$SIGNING_DIR/notary.p8"

          # Pin rcodesign to a known-good release. apple-codesign tags use
          # `apple-codesign/X.Y.Z`; the slash is URL-escaped as %2F. Bump
          # version + sha256 together — the release page publishes both.
          RCODESIGN_VERSION=0.29.0
          RCODESIGN_SHA256=dbe85cedd8ee4217b64e9a0e4c2aef92ab8bcaaa41f20bde99781ff02e600002
          RCODESIGN_TARBALL="apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl.tar.gz"
          curl -fsSL \
            "https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F${RCODESIGN_VERSION}/${RCODESIGN_TARBALL}" \
            -o "$SIGNING_DIR/$RCODESIGN_TARBALL"
          echo "$RCODESIGN_SHA256  $SIGNING_DIR/$RCODESIGN_TARBALL" | sha256sum -c -
          tar -xzf "$SIGNING_DIR/$RCODESIGN_TARBALL" -C "$SIGNING_DIR" --strip-components=1
          chmod +x "$SIGNING_DIR/rcodesign"
          rm "$SIGNING_DIR/$RCODESIGN_TARBALL"

          # rcodesign notary-submit wants a single JSON file with the
          # issuer/key id and the .p8 contents pre-encoded — done once
          # here so the post-archive step is just an upload.
          "$SIGNING_DIR/rcodesign" encode-app-store-connect-api-key \
            -o "$SIGNING_DIR/notary.json" \
            "$ISSUER_ID" "$KEY_ID" "$SIGNING_DIR/notary.p8"

          chmod 600 "$SIGNING_DIR"/notary.*

      # Pull the darwin tar.gz archives the build-darwin job produced (signed,
      # flag-correct, native-linked) into dist-darwin/. They are merged into
      # dist/ AFTER goreleaser runs — goreleaser's `--clean` wipes dist/, so
      # staging them there first would lose them.
      - name: Fetch darwin archives
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: darwin-archives
          path: dist-darwin

      - name: Run GoReleaser (linux build via Docker)
        # goreleaser-cross ships the aarch64/x86_64 linux gcc toolchains so the
        # two linux CGO targets cross-compile from one ubuntu runner. darwin is
        # built separately (build-darwin job) and windows separately
        # (release-windows job); goreleaser here owns the linux archives, the
        # deb/rpm/apk packages, checksums.txt, and the GitHub release. The
        # homebrew cask is assembled in the "Publish homebrew cask" step below,
        # once every platform's tarball hash exists.
        #
        # Image tag is pinned to the Go major.minor; bump together with
        # go.mod and the setup-go step elsewhere in the workflows.
        run: |
          docker run --rm --privileged \
            -v "$PWD":/go/src/gortex \
            -w /go/src/gortex \
            -e GITHUB_TOKEN \
            ghcr.io/goreleaser/goreleaser-cross:v1.26 \
            release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # goreleaser-cross runs as root inside the container, so everything
      # in dist/ is owned by root:root on the host. The subsequent cosign
      # and SLSA steps run as the non-root `runner` user and need to write
      # .sig / .pem files next to the artifacts — reclaim ownership now
      # before any permission-denied errors surface.
      - name: Reclaim ownership of dist/ from Docker
        run: sudo chown -R "$(id -u):$(id -g)" dist

      # Now that goreleaser's --clean has run, fold the darwin tarballs in
      # alongside the linux ones so the notarize / cosign / checksum / upload
      # steps below treat all platforms uniformly.
      - name: Merge darwin archives into dist/
        run: |
          set -euo pipefail
          cp dist-darwin/gortex_darwin_*.tar.gz dist/
          ls -la dist/

      # The build-darwin job already codesigned each darwin Mach-O. Notarization
      # is Apple's blessing on that signature — they don't see the binary
      # again, just hash + signature metadata, so the tarball on disk is
      # left untouched. cosign + the checksums + SLSA provenance below all
      # cover those same untouched bytes.
      #
      # Bare Mach-O can't be stapled (only .app/.pkg/.dmg can), so we
      # don't pass --staple. Online macs fetch the ticket from Apple on
      # first run; offline-first UX would require a signed .pkg.
      - name: Notarize macOS binaries
        run: |
          set -euo pipefail
          SIGNING_DIR=/tmp/macos-signing
          shopt -s nullglob
          for tgz in dist/gortex_darwin_*.tar.gz; do
            workdir="$(mktemp -d)"
            tar -xzf "$tgz" -C "$workdir"
            (cd "$workdir" && zip -q notary.zip gortex)
            "$SIGNING_DIR/rcodesign" notary-submit \
              --api-key-file "$SIGNING_DIR/notary.json" \
              --wait \
              "$workdir/notary.zip"
            rm -rf "$workdir"
          done

      # goreleaser's checksums.txt only hashed its own (linux + nfpm)
      # artifacts. Append the darwin tarballs so install.sh — which verifies
      # every download against checksums.txt — and the cask both resolve. Done
      # before cosign so the signature covers the final checksums.txt. (The
      # release-windows job appends the windows zip the same way.)
      - name: Append darwin checksums
        run: |
          set -euo pipefail
          cd dist
          for f in gortex_darwin_*.tar.gz; do
            grep -q " ${f}$" checksums.txt || sha256sum "$f" >> checksums.txt
          done
          sort -o checksums.txt checksums.txt
          cat checksums.txt

      # Keyless cosign signing: each artifact gets a `.sig` (signature) and
      # `.pem` (certificate chain binding the signature to this workflow's
      # GitHub OIDC identity). Consumers verify with:
      #
      #   cosign verify-blob \
      #     --certificate gortex_linux_amd64.tar.gz.pem \
      #     --signature   gortex_linux_amd64.tar.gz.sig \
      #     --certificate-identity-regexp 'https://github\.com/zzet/gortex/.*' \
      #     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
      #     gortex_linux_amd64.tar.gz
      - name: Sign release artifacts with cosign
        env:
          COSIGN_YES: "true"
        run: |
          cd dist
          shopt -s nullglob
          for f in *.tar.gz *.zip *.deb *.rpm *.apk checksums.txt; do
            echo "Signing $f..."
            cosign sign-blob \
              --output-signature "${f}.sig" \
              --output-certificate "${f}.pem" \
              "$f"
          done
          ls -la *.sig *.pem

      # goreleaser created the release with the linux artifacts + a linux-only
      # checksums.txt. Add the darwin tarballs and overwrite checksums.txt with
      # the darwin-inclusive version (--clobber). The darwin .sig/.pem ride
      # along in the "Upload signatures" step below.
      - name: Upload darwin archives + refreshed checksums to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF#refs/tags/}"
          gh release upload "$TAG" \
            dist/gortex_darwin_*.tar.gz \
            dist/checksums.txt \
            --clobber

      # Goreleaser already created the release and uploaded the primary
      # artifacts. Append .sig + .pem files to the same release so
      # verification instructions in README point at a single URL set.
      - name: Upload signatures to release
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
        with:
          files: |
            dist/*.sig
            dist/*.pem
          # softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 appends to an existing release
          # when the tag already exists (it does — goreleaser made it a
          # moment ago). Never fail_on_unmatched_files here — a failed
          # signing step should surface as a signing error, not as a
          # missing-files upload error.
          fail_on_unmatched_files: false

      - name: Compute artifact hashes for SLSA provenance
        id: hash
        run: |
          cd dist
          shopt -s nullglob
          # SLSA reusable generator wants base64-encoded sha256sum output
          # (one "hash  filename" line per artifact). We hash the primary
          # artifacts only — .sig/.pem are attestations of these files,
          # they don't need their own provenance.
          HASHES=$(sha256sum *.tar.gz *.zip *.deb *.rpm *.apk | base64 -w0)
          echo "hashes=$HASHES" >> "$GITHUB_OUTPUT"

      # Assemble the homebrew cask and push it to zzet/homebrew-tap. goreleaser
      # used to generate this, but the cask references all four os/arch tarballs
      # and darwin is no longer a goreleaser artifact, so we build it here from
      # the now-complete checksums.txt. Completions are still generated on the
      # user's machine at install time (generate_completions_from_executable),
      # so nothing needs to run at release time. HOMEBREW_TAP_TOKEN is a PAT
      # with `repo` scope on the tap; GITHUB_TOKEN can only push to this repo.
      - name: Publish homebrew cask
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF#refs/tags/}"
          VERSION="${TAG#v}"

          # Pull each tarball's sha256 out of the darwin-inclusive checksums.txt.
          sha() { awk -v f="$1" '$2==f || $2=="*"f {print $1; exit}' dist/checksums.txt; }
          DA_AMD64="$(sha gortex_darwin_amd64.tar.gz)"
          DA_ARM64="$(sha gortex_darwin_arm64.tar.gz)"
          LX_AMD64="$(sha gortex_linux_amd64.tar.gz)"
          LX_ARM64="$(sha gortex_linux_arm64.tar.gz)"
          for pair in "darwin_amd64:$DA_AMD64" "darwin_arm64:$DA_ARM64" \
                      "linux_amd64:$LX_AMD64" "linux_arm64:$LX_ARM64"; do
            [ -n "${pair#*:}" ] || { echo "FATAL: no sha256 for gortex_${pair%%:*}.tar.gz in checksums.txt"; exit 1; }
          done

          # Generated cask. #{version} is Ruby interpolation evaluated by brew —
          # it must stay literal, so it is NOT shell-expanded here (no leading $).
          cat > gortex.rb <<EOF
          # This file is generated by release.yml. DO NOT EDIT.
          cask "gortex" do
            version "${VERSION}"

            on_macos do
              on_intel do
                sha256 "${DA_AMD64}"
                url "https://github.com/zzet/gortex/releases/download/v#{version}/gortex_darwin_amd64.tar.gz"
              end
              on_arm do
                sha256 "${DA_ARM64}"
                url "https://github.com/zzet/gortex/releases/download/v#{version}/gortex_darwin_arm64.tar.gz"
              end
            end

            on_linux do
              on_intel do
                sha256 "${LX_AMD64}"
                url "https://github.com/zzet/gortex/releases/download/v#{version}/gortex_linux_amd64.tar.gz"
              end
              on_arm do
                sha256 "${LX_ARM64}"
                url "https://github.com/zzet/gortex/releases/download/v#{version}/gortex_linux_arm64.tar.gz"
              end
            end

            name "gortex"
            desc "Code intelligence engine that indexes repositories into an in-memory knowledge graph."
            homepage "https://github.com/zzet/gortex"

            livecheck do
              skip "Auto-generated on release."
            end

            binary "gortex"

            generate_completions_from_executable "gortex",
              shell_parameter_format: :cobra

            # No zap stanza required
          end
          EOF

          git clone "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/zzet/homebrew-tap.git" tap
          mkdir -p tap/Casks
          cp gortex.rb tap/Casks/gortex.rb
          cd tap
          git add Casks/gortex.rb
          if git diff --cached --quiet; then
            echo "cask already current for ${VERSION}"
          else
            git config user.name  "github-actions[bot]"
            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
            git commit -m "gortex: ${VERSION}"
            git push
            echo "published cask ${VERSION}"
          fi

      # Always wipe signing material — even on failure — so a P12 / .p8
      # never lingers on a runner image cache or in actions/upload-artifact
      # debug bundles. shred clears the inode contents before unlink.
      - name: Wipe macOS signing material
        if: always()
        run: |
          if [ -d /tmp/macos-signing ]; then
            find /tmp/macos-signing -type f -exec shred -uf {} \; 2>/dev/null || true
            rm -rf /tmp/macos-signing
          fi

  # Windows is built on a NATIVE windows runner: the CGo tree-sitter
  # bindings need a real C/C++ toolchain (mingw-w64 ships on PATH there),
  # and goreleaser-cross targets unix only. This job builds a statically
  # linked, self-contained .exe (no runtime DLLs to ship), zips it,
  # cosign-signs, and appends the zip to the release the `release` job
  # already created.
  release-windows:
    needs: release
    runs-on: windows-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod

      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: v2.4.1

      - name: Build gortex.exe (static mingw runtime)
        shell: bash
        env:
          CGO_ENABLED: "1"
        run: |
          set -euo pipefail
          VER="${GITHUB_REF#refs/tags/}"
          # -extldflags=-static folds the mingw C/C++ runtime (libstdc++,
          # libgcc, libwinpthread) into the .exe so it ships as a single
          # self-contained binary — nothing to bundle alongside. The C++
          # stdlib is in the link at all because some tree-sitter grammars
          # carry C++ external scanners (e.g. go-sitter-forest norg); static
          # linking just puts it inside the .exe instead of a DLL.
          go build \
            -ldflags "-s -w -X main.version=${VER} -X main.commit=$(git rev-parse --short HEAD) -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ) -extldflags=-static" \
            -o gortex.exe ./cmd/gortex/

      - name: Verify gortex.exe is self-contained
        shell: bash
        run: |
          set -euo pipefail
          # The static link must leave no dependency on a mingw runtime DLL;
          # a partially static .exe would fail to start where that DLL is
          # absent. If objdump is available, fail the release on any leaked
          # mingw runtime import.
          objdump=""
          for cand in objdump x86_64-w64-mingw32-objdump; do
            command -v "$cand" >/dev/null 2>&1 && { objdump="$cand"; break; }
          done
          if [ -n "$objdump" ]; then
            echo "imported DLLs:"; "$objdump" -p gortex.exe | grep -i 'DLL Name' || true
            if "$objdump" -p gortex.exe | grep -iqE 'libstdc\+\+|libgcc_s|libwinpthread'; then
              echo "FATAL: gortex.exe still imports a mingw runtime DLL — static link incomplete"
              exit 1
            fi
            echo "ok: no mingw runtime DLL imports"
          else
            echo "WARN: objdump not found; skipping self-containment check"
          fi

      - name: Zip (gortex_windows_amd64.zip)
        shell: pwsh
        run: Compress-Archive -Path gortex.exe -DestinationPath gortex_windows_amd64.zip -Force

      - name: Sign + upload to release
        shell: bash
        env:
          COSIGN_YES: "true"
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          cosign sign-blob \
            --output-signature gortex_windows_amd64.zip.sig \
            --output-certificate gortex_windows_amd64.zip.pem \
            gortex_windows_amd64.zip
          TAG="${GITHUB_REF#refs/tags/}"
          gh release upload "$TAG" \
            gortex_windows_amd64.zip \
            gortex_windows_amd64.zip.sig \
            gortex_windows_amd64.zip.pem \
            --clobber

          # Append the windows zip's sha256 to the release checksums.txt so
          # the one-line installer (scripts/install.ps1, which verifies
          # against checksums.txt) covers windows too — the unix goreleaser
          # run only hashed its own artifacts. needs:release guarantees
          # checksums.txt already exists.
          sha="$(sha256sum gortex_windows_amd64.zip | awk '{print $1}')"
          gh release download "$TAG" --pattern checksums.txt --clobber 2>/dev/null || : > checksums.txt
          if ! grep -q "gortex_windows_amd64.zip" checksums.txt; then
            printf '%s  gortex_windows_amd64.zip\n' "$sha" >> checksums.txt
            gh release upload "$TAG" checksums.txt --clobber
          fi

      - name: Publish Scoop manifest
        # Push a refreshed `gortex` manifest to gortexhq/scoop-bucket so
        # `scoop install gortex` resolves this release. SCOOP_BUCKET_TOKEN is
        # a PAT with `repo` scope on that bucket (GITHUB_TOKEN can only push
        # to the source repo). Non-blocking + self-skipping: a bucket hiccup
        # must not fail a release whose binary already shipped, and a
        # token-less fork just skips it.
        continue-on-error: true
        shell: bash
        env:
          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${SCOOP_BUCKET_TOKEN:-}" ]; then
            echo "SCOOP_BUCKET_TOKEN not set; skipping scoop manifest publish"
            exit 0
          fi
          TAG="${GITHUB_REF#refs/tags/}"
          VER="${TAG#v}"
          URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/gortex_windows_amd64.zip"
          SHA="$(sha256sum gortex_windows_amd64.zip | awk '{print $1}')"

          # Build the manifest with jq so escaping + validity are guaranteed.
          # `bin` shims gortex.exe; checkver/autoupdate let scoop's tooling
          # track future releases (the $version token is literal on purpose).
          jq -n \
            --arg version "$VER" \
            --arg url "$URL" \
            --arg hash "$SHA" \
            --arg homepage "https://github.com/${GITHUB_REPOSITORY}" \
            --arg autourl "https://github.com/${GITHUB_REPOSITORY}/releases/download/v\$version/gortex_windows_amd64.zip" \
            '{
               version: $version,
               description: "Code intelligence engine that indexes repositories into an in-memory knowledge graph.",
               homepage: $homepage,
               license: "Apache-2.0",
               architecture: { "64bit": { url: $url, hash: $hash } },
               bin: "gortex.exe",
               checkver: "github",
               autoupdate: { architecture: { "64bit": { url: $autourl } } }
             }' > gortex.json

          # Token in the clone URL — GitHub Actions masks the secret in logs.
          git clone "https://x-access-token:${SCOOP_BUCKET_TOKEN}@github.com/gortexhq/scoop-bucket.git" scoop-bucket
          cd scoop-bucket
          # Honour the bucket's layout: scoop reads manifests from the repo
          # root or a bucket/ subdir. Update in place if one exists, else use
          # the conventional bucket/ subdir.
          if [ -f gortex.json ]; then dest="gortex.json"; else mkdir -p bucket; dest="bucket/gortex.json"; fi
          cp ../gortex.json "$dest"
          git add "$dest"
          if git diff --cached --quiet; then
            echo "scoop manifest already current for ${VER}"
          else
            git config user.name  "github-actions[bot]"
            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
            git commit -m "gortex: ${VER}"
            git push
            echo "published scoop manifest ${VER} -> $dest"
          fi

  # SLSA-3 provenance via the OpenSSF reusable workflow. This runs in a
  # separate, isolated job that the `release` job can't tamper with —
  # that isolation is what elevates us from SLSA-2 to SLSA-3. Output is
  # a `multiple.intoto.jsonl` file attached to the release that
  # consumers verify with https://github.com/slsa-framework/slsa-verifier.
  provenance:
    needs: release
    permissions:
      actions: read
      id-token: write
      contents: write
    # Pinned by tag, not SHA: the SLSA generator verifies its builder
    # binary against the tag name in its workflow ref, so SHA pinning
    # breaks the integrity check (exits 27 with SUCCESS=false). Scorecard
    # exempts slsa-framework reusable workflows from the SHA-pin rule.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ needs.release.outputs.hashes }}
      upload-assets: true

  # VirusTotal scan each primary artifact against ~72 AV engines and
  # append a results badge to the release notes. Needs a VT_API_KEY
  # repo secret (free tier, 500 requests/day). Non-blocking — VT
  # outages shouldn't fail a release.
  virustotal:
    needs: release
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Download release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p dist
          gh release download "${GITHUB_REF#refs/tags/}" --dir dist \
            --pattern '*.tar.gz' \
            --pattern '*.zip' \
            --pattern '*.deb' \
            --pattern '*.rpm' \
            --pattern '*.apk'

      - name: VirusTotal scan + update release body
        uses: crazy-max/ghaction-virustotal@936d8c5c00afe97d3d9a1af26d017cfdf26800a2 # v5
        with:
          vt_api_key: ${{ secrets.VT_API_KEY }}
          files: |
            ./dist/*.tar.gz
            ./dist/*.zip
            ./dist/*.deb
            ./dist/*.rpm
            ./dist/*.apk
          update_release_body: true