release-cli-direct.yml

name: Release CLI Direct Installer

on:
  workflow_call:
    inputs:
      tag:
        description: "Git tag to build and publish CLI assets for (e.g. v0.17.2)"
        required: true
        type: string
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Git tag to build and publish CLI assets for (e.g. v0.17.2)"
        required: true
        type: string
      verify_only:
        description: "Skip build/publish and only verify metadata on main for the provided tag"
        required: false
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: release-cli-${{ inputs.tag || github.event.release.tag_name || github.event.inputs.tag }}
  cancel-in-progress: true

jobs:
  build-and-publish-cli:
    runs-on: macos-14
    permissions:
      contents: write
      pull-requests: write
    env:
      TAG_NAME: ${{ inputs.tag || github.event.release.tag_name || github.event.inputs.tag }}
      EVENT_NAME: ${{ github.event_name }}
      EVENT_RELEASE_PRERELEASE: ${{ github.event_name == 'release' && (github.event.release.prerelease && 'true' || 'false') || '' }}
      VERIFY_ONLY: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.verify_only == 'true' && 'true' || 'false') || 'false' }}
      WORKFLOW_SHA: ${{ github.workflow_sha }}
      LANG: en_US.UTF-8
      LC_ALL: en_US.UTF-8

    steps:
      - name: Resolve release channel and publish target
        run: |
          set -euo pipefail

          if [ -z "${TAG_NAME}" ]; then
            echo "::error::TAG_NAME is empty."
            exit 1
          fi

          if [[ "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            CHANNEL="stable"
            TARGET_PATH="web/public/updates/cli/latest.json"
          elif [[ "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
            CHANNEL="rc"
            TARGET_PATH="web/public/updates/cli/latest-rc.json"
          else
            echo "::error::Unsupported tag format '${TAG_NAME}'. Expected vX.Y.Z or vX.Y.Z-rc.N"
            exit 1
          fi

          if [ "$EVENT_NAME" = "release" ]; then
            if [ "$CHANNEL" = "stable" ] && [ "${EVENT_RELEASE_PRERELEASE}" = "true" ]; then
              echo "::error::Release event is marked prerelease, but tag '${TAG_NAME}' resolved to stable."
              exit 1
            fi
            if [ "$CHANNEL" = "rc" ] && [ "${EVENT_RELEASE_PRERELEASE}" != "true" ]; then
              echo "::error::RC tag '${TAG_NAME}' must be published from a prerelease GitHub release."
              exit 1
            fi
          fi

          echo "CLI_RELEASE_CHANNEL=${CHANNEL}" >> "$GITHUB_ENV"
          echo "CLI_UPDATE_TARGET_PATH=${TARGET_PATH}" >> "$GITHUB_ENV"
          echo "[preflight] Resolved channel=${CHANNEL} target=${TARGET_PATH}"

      - name: Initialize release publication state
        run: |
          set -euo pipefail
          {
            echo "RELEASE_ARTIFACTS_UPLOADED=no"
            echo "PUBLISH_PR_OPENED=no"
            echo "PUBLISH_PR_NUMBER="
            echo "PUBLISH_PR_URL="
            echo "PUBLISH_FOLLOWUP_REQUIRED=no"
            echo "MAIN_METADATA_SYNCED=unknown"
            echo "PUBLISH_AUTH_MODE=unknown"
            echo "SOURCE_TAG_SHA=unknown"
          } >> "$GITHUB_ENV"

      - name: Resolve release publish auth mode
        if: ${{ github.event_name == 'release' || github.event_name == 'workflow_dispatch' }}
        env:
          PUBLISH_WITH_PAT: ${{ secrets.RELEASE_PUBLISH_PAT != '' && 'true' || 'false' }}
        run: |
          set -euo pipefail
          if [ "$PUBLISH_WITH_PAT" = "true" ]; then
            echo "PUBLISH_AUTH_MODE=release_publish_pat" >> "$GITHUB_ENV"
            echo "[preflight] release metadata publish auth: RELEASE_PUBLISH_PAT"
          else
            echo "PUBLISH_AUTH_MODE=github_token" >> "$GITHUB_ENV"
            echo "::warning::RELEASE_PUBLISH_PAT is not configured; PR checks for publish branches may not run when using github.token."
          fi

      - name: Checkout tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.TAG_NAME }}

      - name: Validate published GitHub release state
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          args=(--tag "$TAG_NAME")
          if [ "$EVENT_NAME" = "release" ]; then
            args+=(--event-prerelease "$EVENT_RELEASE_PRERELEASE")
          fi
          scripts/release/validate_github_release_state.sh "${args[@]}"

      - name: Record source tag revision
        if: ${{ env.VERIFY_ONLY != 'true' }}
        run: |
          set -euo pipefail
          SOURCE_TAG_SHA="$(git rev-parse HEAD)"
          echo "SOURCE_TAG_SHA=${SOURCE_TAG_SHA}" >> "$GITHUB_ENV"
          echo "[preflight] source_tag_sha=${SOURCE_TAG_SHA} workflow_sha=${WORKFLOW_SHA}"

      - name: Install Rust toolchain (macOS targets)
        if: ${{ env.VERIFY_ONLY != 'true' }}
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: 1.97.1
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Run SQLite migration compatibility gate
        if: ${{ env.VERIFY_ONLY != 'true' }}
        run: scripts/ci/check_sqlite_migration_compatibility.sh

      - name: Build CLI binaries (arm64, x86_64, universal)
        if: ${{ env.VERIFY_ONLY != 'true' }}
        env:
          ASSET_DIR: ${{ github.workspace }}/build/cli-release
        run: |
          set -euo pipefail
          echo "[build] Building CLI binaries for ${TAG_NAME}"

          cd core/rust
          cargo build -p helm-cli --release --target aarch64-apple-darwin
          cargo build -p helm-cli --release --target x86_64-apple-darwin

          mkdir -p "$ASSET_DIR"

          ARM64_ASSET="$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-arm64"
          X64_ASSET="$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-x86_64"
          UNIVERSAL_ASSET="$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-universal"

          cp target/aarch64-apple-darwin/release/helm "$ARM64_ASSET"
          cp target/x86_64-apple-darwin/release/helm "$X64_ASSET"
          lipo -create "$ARM64_ASSET" "$X64_ASSET" -output "$UNIVERSAL_ASSET"
          chmod +x "$ARM64_ASSET" "$X64_ASSET" "$UNIVERSAL_ASSET"

          ARM64_SHA="$(shasum -a 256 "$ARM64_ASSET" | awk '{print $1}')"
          X64_SHA="$(shasum -a 256 "$X64_ASSET" | awk '{print $1}')"
          UNIVERSAL_SHA="$(shasum -a 256 "$UNIVERSAL_ASSET" | awk '{print $1}')"

          {
            echo "${ARM64_SHA}  $(basename "$ARM64_ASSET")"
            echo "${X64_SHA}  $(basename "$X64_ASSET")"
            echo "${UNIVERSAL_SHA}  $(basename "$UNIVERSAL_ASSET")"
          } > "$ASSET_DIR/helm-cli-${TAG_NAME}-checksums.txt"

          export ARM64_SHA X64_SHA UNIVERSAL_SHA
          ARM64_NAME="$(basename "$ARM64_ASSET")"
          X64_NAME="$(basename "$X64_ASSET")"
          UNIVERSAL_NAME="$(basename "$UNIVERSAL_ASSET")"
          export ARM64_NAME X64_NAME UNIVERSAL_NAME

          python3 - <<'PY'
          import datetime
          import json
          import os

          repo = os.environ["GITHUB_REPOSITORY"]
          tag = os.environ["TAG_NAME"]
          version = tag[1:] if tag.startswith("v") else tag
          asset_dir = os.environ["ASSET_DIR"]

          def entry(name_env: str, sha_env: str):
              name = os.environ[name_env]
              sha = os.environ[sha_env]
              return {
                  "url": f"https://github.com/{repo}/releases/download/{tag}/{name}",
                  "sha256": sha,
              }

          payload = {
              "version": version,
              "channel": os.environ["CLI_RELEASE_CHANNEL"],
              "published_at": datetime.datetime.utcnow().replace(microsecond=0).isoformat() + "Z",
              "downloads": {
                  "universal": entry("UNIVERSAL_NAME", "UNIVERSAL_SHA"),
                  "arm64": entry("ARM64_NAME", "ARM64_SHA"),
                  "x86_64": entry("X64_NAME", "X64_SHA"),
              },
          }

          with open(os.path.join(asset_dir, "latest.json"), "w", encoding="utf-8") as f:
              json.dump(payload, f, indent=2)
              f.write("\n")
          PY

      - name: Verify CLI binary version matches tag
        if: ${{ env.VERIFY_ONLY != 'true' }}
        env:
          ASSET_DIR: ${{ github.workspace }}/build/cli-release
        run: |
          set -euo pipefail
          EXPECTED_VERSION="${TAG_NAME#v}"
          ACTUAL_VERSION="$("$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-universal" --json --version | python3 -c 'import json,sys; payload=json.load(sys.stdin); print((payload.get("data") or {}).get("version",""))')"
          if [ -z "$ACTUAL_VERSION" ]; then
            echo "::error::Unable to determine CLI version from built artifact."
            exit 1
          fi
          if [ "$ACTUAL_VERSION" != "$EXPECTED_VERSION" ]; then
            echo "::error::CLI version mismatch: expected ${EXPECTED_VERSION}, got ${ACTUAL_VERSION}"
            exit 1
          fi
          echo "[verify] CLI version matches tag: ${ACTUAL_VERSION}"

      - name: Generate CLI release provenance manifest
        if: ${{ env.VERIFY_ONLY != 'true' }}
        env:
          ASSET_DIR: ${{ github.workspace }}/build/cli-release
        run: |
          set -euo pipefail
          PROVENANCE_PATH="$ASSET_DIR/provenance-${TAG_NAME}.json"
          scripts/release/generate_provenance_manifest.sh \
            --output "$PROVENANCE_PATH" \
            --subject "$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-arm64" \
            --subject "$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-x86_64" \
            --subject "$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-universal" \
            --subject "$ASSET_DIR/helm-cli-${TAG_NAME}-checksums.txt" \
            --subject "$ASSET_DIR/latest.json" \
            --tag "$TAG_NAME"

      - name: Upload CLI artifacts to workflow run
        if: ${{ env.VERIFY_ONLY != 'true' }}
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: helm-cli-${{ env.TAG_NAME }}
          path: |
            build/cli-release/helm-cli-${{ env.TAG_NAME }}-darwin-arm64
            build/cli-release/helm-cli-${{ env.TAG_NAME }}-darwin-x86_64
            build/cli-release/helm-cli-${{ env.TAG_NAME }}-darwin-universal
            build/cli-release/helm-cli-${{ env.TAG_NAME }}-checksums.txt
            build/cli-release/latest.json
            build/cli-release/provenance-${{ env.TAG_NAME }}.json

      - name: Upload CLI binaries to GitHub release
        if: ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && env.VERIFY_ONLY != 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
          ASSET_DIR: ${{ github.workspace }}/build/cli-release
        run: |
          set -euo pipefail
          gh release upload "$TAG_NAME" \
            "$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-arm64#helm-cli-${TAG_NAME}-darwin-arm64" \
            "$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-x86_64#helm-cli-${TAG_NAME}-darwin-x86_64" \
            "$ASSET_DIR/helm-cli-${TAG_NAME}-darwin-universal#helm-cli-${TAG_NAME}-darwin-universal" \
            "$ASSET_DIR/helm-cli-${TAG_NAME}-checksums.txt#helm-cli-${TAG_NAME}-checksums.txt" \
            "$ASSET_DIR/provenance-${TAG_NAME}.json#provenance-${TAG_NAME}.json" \
            --clobber
          echo "RELEASE_ARTIFACTS_UPLOADED=yes" >> "$GITHUB_ENV"

      - name: Publish website CLI latest metadata via PR
        if: ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && env.VERIFY_ONLY != 'true' }}
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PUBLISH_PAT != '' && secrets.RELEASE_PUBLISH_PAT || github.token }}
          FALLBACK_GH_TOKEN: ${{ github.token }}
          PUBLISH_WITH_PAT: ${{ secrets.RELEASE_PUBLISH_PAT != '' && 'true' || 'false' }}
          ASSET_DIR: ${{ github.workspace }}/build/cli-release
        run: |
          set -euo pipefail

          SOURCE_JSON="$ASSET_DIR/latest.json"
          TARGET_PATH="${CLI_UPDATE_TARGET_PATH}"
          PUBLISH_DIR="$RUNNER_TEMP/cli-updates-publish"
          PUBLISH_BRANCH="chore/publish-cli-updates-${TAG_NAME}-${CLI_RELEASE_CHANNEL}"
          TARGET_ENDPOINT="https://helmapp.dev/updates/cli/$(basename "$TARGET_PATH")"

          clone_publish_repo() {
            git clone --depth 1 --branch main "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$PUBLISH_DIR"
          }

          if ! clone_publish_repo; then
            if [ "$PUBLISH_WITH_PAT" != "true" ]; then
              echo "::error::Unable to clone main with github.token for metadata publication."
              exit 1
            fi

            echo "::warning::RELEASE_PUBLISH_PAT could not clone the repository; retrying with github.token."
            PUBLISH_DIR="${RUNNER_TEMP}/cli-updates-publish-fallback"
            GH_TOKEN="$FALLBACK_GH_TOKEN"
            PUBLISH_WITH_PAT="false"
            echo "PUBLISH_AUTH_MODE=github_token_fallback" >> "$GITHUB_ENV"
            clone_publish_repo
          fi
          mkdir -p "$PUBLISH_DIR/$(dirname "$TARGET_PATH")"
          cp "$SOURCE_JSON" "$PUBLISH_DIR/$TARGET_PATH"

          cd "$PUBLISH_DIR"
          if [ -z "$(git status --porcelain -- "$TARGET_PATH")" ]; then
            echo "[publish] CLI latest metadata is already current on main."
            echo "MAIN_METADATA_SYNCED=yes" >> "$GITHUB_ENV"
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add "$TARGET_PATH"
          git commit -m "chore(release): publish CLI latest metadata for ${TAG_NAME}"

          git checkout -B "$PUBLISH_BRANCH"
          if ! git push -u origin "$PUBLISH_BRANCH" --force-with-lease; then
            if [ "$PUBLISH_WITH_PAT" != "true" ]; then
              echo "::error::Unable to push metadata publish branch with github.token."
              exit 1
            fi

            echo "::warning::RELEASE_PUBLISH_PAT could not push the publish branch; retrying with github.token."
            GH_TOKEN="$FALLBACK_GH_TOKEN"
            PUBLISH_WITH_PAT="false"
            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
            echo "PUBLISH_AUTH_MODE=github_token_fallback" >> "$GITHUB_ENV"
            git push -u origin "$PUBLISH_BRANCH" --force-with-lease
          fi

          EXISTING_PR="$(gh pr list --repo "$GITHUB_REPOSITORY" --base main --head "$PUBLISH_BRANCH" --state open --json number --jq '.[0].number // empty' || true)"
          if [ -n "$EXISTING_PR" ]; then
            PR_NUMBER="$EXISTING_PR"
            echo "[publish] PR already exists for $PUBLISH_BRANCH (#$PR_NUMBER)."
          else
            PR_BODY_FILE="$RUNNER_TEMP/release-cli-publish-pr-body.md"
            cat > "$PR_BODY_FILE" <<EOF
          This PR was auto-generated by \`release-cli-direct.yml\`.

          It publishes CLI direct-update metadata for \`${TAG_NAME}\`:
          - \`${TARGET_PATH}\`
          - channel: \`${CLI_RELEASE_CHANNEL}\`

          Merge this PR to update:
          - \`${TARGET_ENDPOINT}\`
          EOF
            PR_URL="$(gh pr create \
              --repo "$GITHUB_REPOSITORY" \
              --base main \
              --head "$PUBLISH_BRANCH" \
              --title "chore(release): publish CLI latest metadata for ${TAG_NAME}" \
              --body-file "$PR_BODY_FILE" 2>&1)" || {
              if [ "$PUBLISH_WITH_PAT" = "true" ]; then
                echo "::warning::RELEASE_PUBLISH_PAT could not create the publish PR; retrying with github.token."
                GH_TOKEN="$FALLBACK_GH_TOKEN"
                PUBLISH_WITH_PAT="false"
                echo "PUBLISH_AUTH_MODE=github_token_fallback" >> "$GITHUB_ENV"
                PR_URL="$(gh pr create \
                  --repo "$GITHUB_REPOSITORY" \
                  --base main \
                  --head "$PUBLISH_BRANCH" \
                  --title "chore(release): publish CLI latest metadata for ${TAG_NAME}" \
                  --body-file "$PR_BODY_FILE" 2>&1)" && true
              fi
            }
            if [ -z "${PR_URL:-}" ] || ! PR_NUMBER="$(gh pr list --repo "$GITHUB_REPOSITORY" --base main --head "$PUBLISH_BRANCH" --state open --json number --jq '.[0].number // empty' || true)"; then
              echo "::error::Unable to create CLI publish PR via GitHub Actions token."
              echo "::error::Fallback branch was pushed: ${PUBLISH_BRANCH}"
              echo "::error::Open manual PR: https://github.com/${GITHUB_REPOSITORY}/compare/main...${PUBLISH_BRANCH}?expand=1"
              echo "::error::gh output: ${PR_URL}"
              exit 1
            fi
            if [ -z "$PR_NUMBER" ]; then
              echo "::error::CLI publish PR was created but could not be resolved to an open PR number."
              echo "::error::Open manual PR: https://github.com/${GITHUB_REPOSITORY}/compare/main...${PUBLISH_BRANCH}?expand=1"
              exit 1
            fi

            echo "[publish] Created CLI publish PR #${PR_NUMBER}: ${PR_URL}"
          fi

          PR_URL="$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json url --jq '.url')"
          {
            echo "PUBLISH_PR_OPENED=yes"
            echo "PUBLISH_PR_NUMBER=${PR_NUMBER}"
            echo "PUBLISH_PR_URL=${PR_URL}"
          } >> "$GITHUB_ENV"

          if [ "$PUBLISH_WITH_PAT" != "true" ]; then
            echo "::notice::Follow-up required: merge publish PR #${PR_NUMBER} (${PR_URL}). Configure RELEASE_PUBLISH_PAT to allow required checks + auto-merge on publish branches."
            echo "PUBLISH_FOLLOWUP_REQUIRED=yes" >> "$GITHUB_ENV"
            exit 0
          fi

          if gh pr merge --repo "$GITHUB_REPOSITORY" --squash --auto "$PR_NUMBER"; then
            echo "[publish] Auto-merge enabled for CLI publish PR #${PR_NUMBER}."
          else
            echo "::warning::Unable to enable auto-merge for CLI publish PR #${PR_NUMBER}."
            echo "::warning::Manual merge may be required."
            echo "PUBLISH_FOLLOWUP_REQUIRED=yes" >> "$GITHUB_ENV"
            exit 0
          fi

          MERGED_AT=""
          PR_URL=""
          for i in {1..24}; do
            PR_HANDOFF_STATE="$(
              scripts/release/publish_pr_handoff_state.py "$(
                gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json state,mergedAt,url
              )"
            )"
            PR_STATE="$(printf '%s\n' "$PR_HANDOFF_STATE" | awk -F= '$1=="PR_STATE" {print substr($0, index($0, "=") + 1)}')"
            MERGED_AT="$(printf '%s\n' "$PR_HANDOFF_STATE" | awk -F= '$1=="MERGED_AT" {print substr($0, index($0, "=") + 1)}')"
            PR_URL="$(printf '%s\n' "$PR_HANDOFF_STATE" | awk -F= '$1=="PR_URL" {print substr($0, index($0, "=") + 1)}')"
            HANDOFF_STATUS="$(printf '%s\n' "$PR_HANDOFF_STATE" | awk -F= '$1=="HANDOFF_STATUS" {print substr($0, index($0, "=") + 1)}')"

            if [ "$HANDOFF_STATUS" = "merged" ]; then
              echo "[publish] CLI publish PR #${PR_NUMBER} merged at ${MERGED_AT}."
              break
            fi

            if [ "$HANDOFF_STATUS" = "closed_unmerged" ]; then
              echo "::warning::CLI publish PR #${PR_NUMBER} is no longer open but not merged."
              echo "::warning::PR URL: ${PR_URL}"
              echo "PUBLISH_FOLLOWUP_REQUIRED=yes" >> "$GITHUB_ENV"
              exit 0
            fi

            if [ "$HANDOFF_STATUS" != "open" ]; then
              echo "::error::Unexpected CLI publish PR handoff state: ${HANDOFF_STATUS:-<empty>} (state=${PR_STATE:-<empty>})"
              exit 1
            fi

            echo "[publish] Waiting for CLI publish PR #${PR_NUMBER} to merge (attempt ${i}/24)..."
            sleep 15
          done

          if [ -z "$MERGED_AT" ]; then
            echo "::warning::CLI publish PR #${PR_NUMBER} was not merged within the workflow wait window."
            echo "::warning::PR URL: ${PR_URL}"
            echo "::warning::Merge the PR and run workflow_dispatch for release-cli-direct.yml with verify_only=true."
            echo "::notice::Follow-up required: merge CLI publish PR #${PR_NUMBER} (${PR_URL}), then run verify_only dispatch to confirm metadata sync."
            echo "PUBLISH_FOLLOWUP_REQUIRED=yes" >> "$GITHUB_ENV"
          fi

      - name: Verify CLI latest metadata on main matches release tag
        if: ${{ github.event_name == 'release' || github.event_name == 'workflow_dispatch' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          TARGET_PATH="${CLI_UPDATE_TARGET_PATH}"
          VERIFY_DIR="$RUNNER_TEMP/cli-updates-verify-main"
          EXPECTED_VERSION="${TAG_NAME#v}"

          git clone --depth 1 --branch main "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$VERIFY_DIR"
          MAIN_JSON="$VERIFY_DIR/$TARGET_PATH"

          if [ ! -f "$MAIN_JSON" ]; then
            if [ "${PUBLISH_FOLLOWUP_REQUIRED}" = "yes" ]; then
              echo "::warning::Expected CLI latest metadata not found on main yet: ${TARGET_PATH}"
              echo "MAIN_METADATA_SYNCED=no" >> "$GITHUB_ENV"
              exit 0
            fi
            echo "::error::Expected CLI latest metadata not found on main: ${TARGET_PATH}"
            exit 1
          fi

          ACTUAL_VERSION="$(
          python3 - "$MAIN_JSON" <<'PY'
          import json
          import sys

          with open(sys.argv[1], "r", encoding="utf-8") as f:
              payload = json.load(f)
          print(str(payload.get("version", "")).strip())
          PY
          )"

          if [ -z "$ACTUAL_VERSION" ]; then
            if [ "${PUBLISH_FOLLOWUP_REQUIRED}" = "yes" ]; then
              echo "::warning::Unable to parse version from ${TARGET_PATH} on main while publish PR follow-up is pending."
              echo "MAIN_METADATA_SYNCED=no" >> "$GITHUB_ENV"
              exit 0
            fi
            echo "::error::Unable to parse version from ${TARGET_PATH} on main."
            exit 1
          fi

          if [ "$ACTUAL_VERSION" != "$EXPECTED_VERSION" ]; then
            if [ "${PUBLISH_FOLLOWUP_REQUIRED}" = "yes" ]; then
              echo "::warning::CLI latest metadata on main does not yet match release tag while publish PR follow-up is pending."
              echo "::warning::expected=${EXPECTED_VERSION} actual=${ACTUAL_VERSION} file=${TARGET_PATH}"
              echo "MAIN_METADATA_SYNCED=no" >> "$GITHUB_ENV"
              exit 0
            fi
            echo "::error::CLI latest metadata on main does not match release tag."
            echo "::error::expected=${EXPECTED_VERSION} actual=${ACTUAL_VERSION} file=${TARGET_PATH}"
            echo "::error::If fallback publishing was required, merge branch chore/publish-cli-updates-${TAG_NAME}-${CLI_RELEASE_CHANNEL} and run workflow_dispatch with verify_only=true."
            exit 1
          fi

          if [ "${PUBLISH_FOLLOWUP_REQUIRED}" = "yes" ]; then
            echo "PUBLISH_FOLLOWUP_REQUIRED=no" >> "$GITHUB_ENV"
          fi
          echo "MAIN_METADATA_SYNCED=yes" >> "$GITHUB_ENV"
          echo "[verify] Verified CLI latest metadata on main matches release tag: ${ACTUAL_VERSION}"

      - name: Release publication summary
        if: ${{ always() }}
        run: |
          set -euo pipefail
          artifacts_uploaded="${RELEASE_ARTIFACTS_UPLOADED:-no}"
          publish_pr_opened="${PUBLISH_PR_OPENED:-no}"
          main_metadata_synced="${MAIN_METADATA_SYNCED:-unknown}"
          publish_auth_mode="${PUBLISH_AUTH_MODE:-unknown}"
          workflow_sha="${WORKFLOW_SHA:-unknown}"
          source_tag_sha="${SOURCE_TAG_SHA:-unknown}"
          publish_pr_number="${PUBLISH_PR_NUMBER:-}"
          publish_pr_url="${PUBLISH_PR_URL:-}"
          publish_followup_required="${PUBLISH_FOLLOWUP_REQUIRED:-no}"

          {
            echo "## Release CLI Publication Summary"
            echo ""
            echo "- Verify only run: ${VERIFY_ONLY}"
            echo "- Artifacts uploaded: ${artifacts_uploaded}"
            echo "- Publish auth mode: ${publish_auth_mode}"
            echo "- Workflow revision: ${workflow_sha}"
            echo "- Source tag revision: ${source_tag_sha}"
            echo "- Publish PR opened: ${publish_pr_opened}"
            echo "- Main metadata synced: ${main_metadata_synced}"
            if [ -n "${publish_pr_number}" ]; then
              echo "- Publish PR: #${publish_pr_number} (${publish_pr_url})"
            fi
            if [ "${publish_followup_required}" = "yes" ]; then
              echo ""
              echo "Follow-up required:"
              echo "1. Merge publish PR #${publish_pr_number}"
              echo "2. Run workflow_dispatch for release-cli-direct.yml with tag=${TAG_NAME} and verify_only=true"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

          if [ "${publish_followup_required}" = "yes" ]; then
            echo "::notice::[verify] Release artifacts published, publish PR is open, and follow-up merge+rerun is required."
          fi