release.yml

name: Release ChatMux Server

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  release-policy:
    name: Validate protected release ref
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    steps:
      - name: Require main branch
        env:
          RELEASE_REF: ${{ github.ref }}
        run: |
          if [ "$RELEASE_REF" != "refs/heads/main" ]; then
            echo "Releases may only be dispatched from refs/heads/main." >&2
            exit 1
          fi

  build:
    name: Build Node 22 Linux x64 server artifact
    needs: release-policy
    timeout-minutes: 30
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    outputs:
      artifact_name: ${{ steps.metadata.outputs.artifact_name }}
      release_tag: ${{ steps.metadata.outputs.release_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Install tmux
        run: |
          sudo apt-get update
          sudo apt-get install --yes tmux
          tmux -V

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          architecture: x64
          cache: npm

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14

      - name: Define canonical release asset
        id: metadata
        run: |
          set -euo pipefail
          case "$(node --version)" in
            v22.*) ;;
            *) echo "Node 22 is required." >&2; exit 1 ;;
          esac
          case "$(getconf GNU_LIBC_VERSION)" in
            "glibc 2.35") ;;
            *) echo "The release artifact must be built on glibc 2.35." >&2; exit 1 ;;
          esac
          VERSION="$(node -p "require('./package.json').version")"
          ASSET_NAME="chatmux-server-${VERSION}-linux-x64-node22.tar.gz"
          {
            echo "artifact_name=$ASSET_NAME"
            echo "release_tag=v$VERSION"
          } >> "$GITHUB_OUTPUT"

      - name: Install dependencies
        run: npm ci
      - name: Verify source
        run: npm run verify


      - name: Build server artifact
        run: npm run server:bundle
      - name: Require updater worker and exact release metadata
        run: |
          set -euo pipefail
          test -f dist-server/server/release-update-worker.js
          test -f packaging/release/update-compatibility.json
          node --input-type=module <<'EOF'
          import fs from 'node:fs/promises';
          const version = JSON.parse(await fs.readFile('package.json', 'utf8')).version;
          const declaration = JSON.parse(await fs.readFile('packaging/release/update-compatibility.json', 'utf8'));
          const values = declaration?.schema === 1 && declaration?.releases?.[version]?.database?.rollbackCompatibleFrom;
          if (!Array.isArray(values) || values.some((value) => !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u.test(value)) || new Set(values).size !== values.length) {
            throw new Error(`No exact compatibility declaration exists for ${version}.`);
          }
          EOF
          test ! -e release/server/image.png

      - name: Stage and verify canonical release assets
        env:
          ASSET_NAME: ${{ steps.metadata.outputs.artifact_name }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          archives=(release/server/*.tar.gz)
          if [ "${#archives[@]}" -ne 1 ]; then
            echo "Expected exactly one generated server archive." >&2
            exit 1
          fi
          source_archive="${archives[0]}"
          if [ "$(basename "$source_archive")" != "$ASSET_NAME" ]; then
            echo "Generated archive name does not match canonical release asset: $source_archive" >&2
            exit 1
          fi
          source_checksum="${source_archive}.sha256"
          test -f "$source_checksum"
          (
            cd "$(dirname "$source_archive")"
            sha256sum --check "$(basename "$source_checksum")"
          )

          mkdir release-assets
          cp "$source_archive" "release-assets/$ASSET_NAME"
          (
            cd release-assets
            sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256"
            sha256sum --check "$ASSET_NAME.sha256"
          )

          assets=(release-assets/*)
          if [ "${#assets[@]}" -ne 2 ] ||
             [ ! -f "release-assets/$ASSET_NAME" ] ||
             [ ! -f "release-assets/$ASSET_NAME.sha256" ] ||
             [ -e release-assets/image.png ]; then
            echo "Release staging must contain only the canonical archive and checksum, never image.png." >&2
            exit 1
          fi
          tar -tzf "release-assets/$ASSET_NAME" | node --input-type=module -e "
            import fs from 'node:fs';
            const entries = fs.readFileSync(0, 'utf8').trim().split('\n').filter(Boolean);
            const required = ['./dist-server/server/release-update-worker.js', './release-update-metadata.json'];
            if (entries.some((entry) => entry.includes('image.png') || entry.startsWith('/') || entry.split('/').includes('..') || !entry.startsWith('./')) || required.some((entry) => !entries.includes(entry))) {
              throw new Error('Archive updater layout is unsafe or incomplete.');
            }
          "

      - name: Smoke extracted server artifact
        env:
          ASSET_NAME: ${{ steps.metadata.outputs.artifact_name }}
        run: |
          set -euo pipefail
          mkdir extracted
          tar -xzf "release-assets/$ASSET_NAME" -C extracted
          test -f extracted/package.json
          expected_version="${ASSET_NAME#chatmux-server-}"
          expected_version="${expected_version%-linux-x64-node22.tar.gz}"
          actual_version="$(node -p "require('./extracted/package.json').version")"
          test "$actual_version" = "$expected_version"
          node extracted/scripts/chatmux-runtime.mjs --help

      - name: Upload canonical server release assets
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: chatmux-server-release
          path: release-assets/*
          if-no-files-found: error

  ubuntu-24-compatibility:
    name: Smoke server artifact on Ubuntu 24.04
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          architecture: x64

      - name: Download canonical server release assets
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
        with:
          name: chatmux-server-release
          path: release-assets

      - name: Verify checksum and smoke extracted artifact
        env:
          ASSET_NAME: ${{ needs.build.outputs.artifact_name }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          assets=(release-assets/*)
          if [ "${#assets[@]}" -ne 2 ] ||
             [ ! -f "release-assets/$ASSET_NAME" ] ||
             [ ! -f "release-assets/$ASSET_NAME.sha256" ] ||
             [ -e release-assets/image.png ]; then
            echo "Compatibility job received non-canonical release assets." >&2
            exit 1
          fi
          (
            cd release-assets
            sha256sum --check "$ASSET_NAME.sha256"
          )
          mkdir extracted
          tar -xzf "release-assets/$ASSET_NAME" -C extracted
          test -f extracted/package.json
          expected_version="${ASSET_NAME#chatmux-server-}"
          expected_version="${expected_version%-linux-x64-node22.tar.gz}"
          actual_version="$(node -p "require('./extracted/package.json').version")"
          test "$actual_version" = "$expected_version"
          node extracted/scripts/chatmux-runtime.mjs --help
          (
            cd extracted
            node -e "const Database=require('better-sqlite3'); const bcrypt=require('bcrypt'); const pty=require('node-pty'); const db=new Database(':memory:'); db.exec('select 1'); db.close(); const hash=bcrypt.hashSync('smoke',4); if(!bcrypt.compareSync('smoke',hash)) process.exit(1); const child=pty.spawn(process.execPath,['-e','process.exit(0)']); child.onExit(() => process.exit(0)); setTimeout(() => process.exit(1),5000)"
            node -e "const {spawnSync}=require('node:child_process'); const rg=require('@vscode/ripgrep').rgPath; const result=spawnSync(rg,['--version'],{stdio:'inherit'}); process.exit(result.status ?? 1)"
          )
          export HOME="$RUNNER_TEMP/chatmux-home"
          mkdir -p "$HOME"
          SERVER_PORT=39001 HOST=127.0.0.1 node extracted/scripts/chatmux-runtime.mjs start >"$RUNNER_TEMP/chatmux-server.log" 2>&1 &
          server_pid=$!
          trap 'kill "$server_pid" 2>/dev/null || true' EXIT
          for _ in {1..30}; do
            if curl --fail --silent http://127.0.0.1:39001/health >/dev/null; then
              break
            fi
            sleep 1
          done
          curl --fail --silent http://127.0.0.1:39001/health
          kill "$server_pid"
          wait "$server_pid" || true
          trap - EXIT

  rollback-compatibility:
    name: Prove declared database rollback compatibility
    needs: build
    runs-on: ubuntu-22.04
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          architecture: x64
      - name: Download just-built canonical server release assets
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
        with:
          name: chatmux-server-release
          path: target-assets
      - name: Prove target migration and exact old-runtime rollback
        env:
          ASSET_NAME: ${{ needs.build.outputs.artifact_name }}
          GH_TOKEN: ${{ github.token }}
          CHATMUX_UPDATE_COMPATIBILITY_DECLARATION: packaging/release/update-compatibility.json
          CHATMUX_RELEASE_REPOSITORY: ${{ github.repository }}
          CHATMUX_COMPATIBILITY_EVIDENCE_DIR: rollback-compatibility-evidence
        run: |
          set -euo pipefail
          target_version="${ASSET_NAME#chatmux-server-}"
          target_version="${target_version%-linux-x64-node22.tar.gz}"
          CHATMUX_TARGET_VERSION="$target_version" \
          CHATMUX_TARGET_ARCHIVE="target-assets/$ASSET_NAME" \
          CHATMUX_TARGET_CHECKSUM="target-assets/$ASSET_NAME.sha256" \
          node scripts/release/verify-db-rollback-compatibility.mjs
      - name: Upload rollback compatibility evidence
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: rollback-compatibility-evidence
          path: rollback-compatibility-evidence
          if-no-files-found: warn

  publish:
    name: Publish GitHub Release
    needs:
      - build
      - ubuntu-24-compatibility
      - rollback-compatibility
    runs-on: ubuntu-22.04
    environment: release
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Download canonical server release assets
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
        with:
          name: chatmux-server-release
          path: release-assets

      - name: Verify publish inputs
        env:
          ASSET_NAME: ${{ needs.build.outputs.artifact_name }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          assets=(release-assets/*)
          if [ "${#assets[@]}" -ne 2 ] ||
             [ ! -f "release-assets/$ASSET_NAME" ] ||
             [ ! -f "release-assets/$ASSET_NAME.sha256" ] ||
             [ -e release-assets/image.png ]; then
            echo "Refusing to publish non-canonical release assets or image.png." >&2
            exit 1
          fi
          if [ ! -f install.sh ]; then
            echo "Refusing to publish without the one-line bootstrap install.sh." >&2
            exit 1
          fi
          (
            cd release-assets
            sha256sum --check "$ASSET_NAME.sha256"
          )
          tar -tzf "release-assets/$ASSET_NAME" | node --input-type=module -e "
            import fs from 'node:fs';
            const entries = fs.readFileSync(0, 'utf8').trim().split('\n').filter(Boolean);
            if (entries.some((entry) => entry.includes('image.png'))) throw new Error('image.png is forbidden from release publication.');
          "

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          ASSET_NAME: ${{ needs.build.outputs.artifact_name }}
          RELEASE_TAG: ${{ needs.build.outputs.release_tag }}
        run: |
          set -euo pipefail
          gh release create "$RELEASE_TAG" \
            "release-assets/$ASSET_NAME" \
            "release-assets/$ASSET_NAME.sha256" \
            install.sh \
            --repo "$GITHUB_REPOSITORY" \
            --target "$GITHUB_SHA" \
            --title "ChatMux $RELEASE_TAG" \
            --generate-notes