release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  LLAMA_CPP_COMMIT: 7798007a29a90e3053e799394da48cf53a2f8e0f

jobs:
  windows-release:
    name: Windows signed release
    runs-on: windows-latest
    steps:
      - name: Checkout release commit
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Require tag on current main
        shell: pwsh
        run: |
          git fetch origin main:refs/remotes/origin/main --no-tags
          $tagCommit = (git rev-parse HEAD).Trim()
          $mainCommit = (git rev-parse origin/main).Trim()
          if ($tagCommit -ne $mainCommit) {
            throw "Release tag must point at the current main commit. tag=$tagCommit main=$mainCommit"
          }

      - name: Checkout pinned llama.cpp
        uses: actions/checkout@v7
        with:
          repository: ggml-org/llama.cpp
          ref: ${{ env.LLAMA_CPP_COMMIT }}
          path: vendor/llama.cpp
          fetch-depth: 1

      - name: Cache pinned llama.cpp Windows CPU build
        id: llama-cache
        uses: actions/cache@v4
        with:
          path: vendor/llama.cpp/build
          key: llama-${{ runner.os }}-${{ env.LLAMA_CPP_COMMIT }}-cpu-shared-v2

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install frontend dependencies
        run: npm ci

      - name: Validate synchronized release version
        shell: pwsh
        run: npm run check:version -- --tag $env:GITHUB_REF_NAME

      - name: Validate release and updater configuration
        run: npm run check:release

      - name: Frontend lint
        run: npm run lint

      - name: Frontend production build
        run: npm run build

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache Rust build
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target

      - name: Build pinned llama.cpp Windows shared CPU runtime
        if: steps.llama-cache.outputs.cache-hit != 'true'
        shell: pwsh
        run: |
          cmake -S vendor/llama.cpp -B vendor/llama.cpp/build `
            -DGGML_CUDA=OFF `
            -DGGML_NATIVE=OFF `
            -DBUILD_SHARED_LIBS=ON `
            -DLLAMA_BUILD_TESTS=OFF `
            -DLLAMA_BUILD_EXAMPLES=OFF `
            -DLLAMA_BUILD_TOOLS=OFF
          cmake --build vendor/llama.cpp/build --config Release --target llama -j 2

      - name: Stage ABI-locked native runtime
        shell: pwsh
        run: |
          $llamaDll = Get-ChildItem -LiteralPath "vendor/llama.cpp/build" -Filter "llama.dll" -File -Recurse |
            Sort-Object FullName |
            Select-Object -First 1
          if ($null -eq $llamaDll) {
            throw "Unable to locate llama.dll in pinned llama.cpp build"
          }
          $runtimeDir = $llamaDll.Directory.FullName
          $llamaLibs = @(Get-ChildItem -LiteralPath 'vendor/llama.cpp/build' -Filter 'llama.lib' -File -Recurse |
            Where-Object { $_.Directory.Name -eq 'Release' })
          if ($llamaLibs.Count -ne 1) {
            throw "Expected one Release llama.lib import library, found $($llamaLibs.Count)"
          }
          $libDir = $llamaLibs[0].Directory.FullName
          $llamaDir = (Resolve-Path -LiteralPath "vendor/llama.cpp").Path
          & ./scripts/prepare-native-runtime.ps1 `
            -LlamaBuildDir "vendor/llama.cpp/build" `
            -OutputDir "src-tauri/native-runtime/windows-x86_64" `
            -Commit $env:LLAMA_CPP_COMMIT
          "LLAMA_CPP_DIR=$llamaDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "LLAMA_CPP_LIB_DIR=$libDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "OPENMINDAI_NATIVE_STRICT_ABI=1" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "OPENMINDAI_PORTABLE_BUILD=1" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          $runtimeDir | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Rust format check
        run: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check

      - name: Clippy
        run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets --all-features -- -D warnings

      - name: Rust tests
        run: cargo test --locked --manifest-path src-tauri/Cargo.toml --all-features

      - name: Validate signing secrets
        shell: pwsh
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:TAURI_SIGNING_PRIVATE_KEY)) {
            throw "TAURI_SIGNING_PRIVATE_KEY is required for production updater artifacts."
          }
          if ([string]::IsNullOrWhiteSpace($env:TAURI_SIGNING_PRIVATE_KEY_PASSWORD)) {
            throw "TAURI_SIGNING_PRIVATE_KEY_PASSWORD is required for the production updater key."
          }
          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE)) {
            throw "WINDOWS_CERTIFICATE must contain the base64-encoded Authenticode PFX."
          }
          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_PASSWORD)) {
            throw "WINDOWS_CERTIFICATE_PASSWORD is required."
          }

      - name: Import Authenticode certificate
        shell: pwsh
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        run: |
          $pfxPath = Join-Path $env:RUNNER_TEMP "openmindai-code-signing.pfx"
          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE))
          $password = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
          $certificate = Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $password
          if ($null -eq $certificate) {
            throw "The Authenticode certificate could not be imported."
          }
          $config = @{
            bundle = @{
              windows = @{
                certificateThumbprint = $certificate.Thumbprint
                digestAlgorithm = "sha256"
                timestampUrl = "http://timestamp.digicert.com"
              }
            }
          } | ConvertTo-Json -Depth 10
          Set-Content -Path "src-tauri/tauri.windows-ci.conf.json" -Value $config -Encoding utf8
          Remove-Item -LiteralPath $pfxPath -Force

      - name: Build and upload signed Tauri draft release
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: v__VERSION__
          releaseName: OpenMindAI v__VERSION__
          releaseBody: |
            OpenMindAI production release candidate generated by the signed release pipeline.

            The draft remains private until the Authenticode signature, updater metadata/signature, checksums, clean-install test, native runtime ABI contract, and v3.0.0-to-current upgrade test are verified.
          releaseDraft: true
          prerelease: false
          uploadUpdaterJson: true
          uploadUpdaterSignatures: true
          updaterJsonPreferNsis: true
          retryAttempts: 2
          tauriScript: npm run tauri
          args: --features native-cxx-llama --config src-tauri/tauri.windows-ci.conf.json --config src-tauri/tauri.native-windows.conf.json

      - name: Verify signed release asset contract
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $tag = $env:GITHUB_REF_NAME
          $expectedVersion = $tag.TrimStart('v')
          $release = gh release view $tag --json isDraft,tagName | ConvertFrom-Json
          if ($release.tagName -ne $tag) {
            throw "Draft release tag mismatch."
          }
          if (-not $release.isDraft) {
            throw "Release must remain a draft until trust gates pass."
          }

          $assetDir = Join-Path $env:RUNNER_TEMP "openmindai-release-assets"
          if (Test-Path $assetDir) { Remove-Item $assetDir -Recurse -Force }
          New-Item -ItemType Directory -Path $assetDir | Out-Null
          $releaseNotesPath = ".github/releases/$tag.txt"
          if (-not (Test-Path -LiteralPath $releaseNotesPath)) {
            throw "Release notes are missing: $releaseNotesPath"
          }
          gh release edit $tag --notes-file $releaseNotesPath
          foreach ($bootstrapAsset in @("OpenMindAI-Setup.bat", "OpenMindAI-Setup.command", "openmindai-setup.sh", "openmindai.marker")) {
            if (-not (Test-Path -LiteralPath $bootstrapAsset)) {
              throw "Required bootstrap release asset is missing from the source tree: $bootstrapAsset"
            }
            gh release upload $tag $bootstrapAsset --clobber
          }
          gh release download $tag --dir $assetDir --clobber

          $installers = @(Get-ChildItem -Path $assetDir -File | Where-Object { $_.Name -like "*-setup.exe" })
          if ($installers.Count -ne 1) {
            throw "Expected exactly one NSIS setup.exe asset, found $($installers.Count)."
          }
          $installer = $installers[0]
          $signaturePath = "$($installer.FullName).sig"
          $latestPath = Join-Path $assetDir "latest.json"
          if (-not (Test-Path -LiteralPath $signaturePath)) {
            throw "Updater signature asset is missing for $($installer.Name)."
          }
          if (-not (Test-Path -LiteralPath $latestPath)) {
            throw "latest.json updater metadata is missing."
          }

          $authenticode = Get-AuthenticodeSignature -FilePath $installer.FullName
          if ($authenticode.Status -ne 'Valid') {
            throw "Authenticode verification failed for $($installer.Name): $($authenticode.Status) $($authenticode.StatusMessage)"
          }

          $latest = Get-Content -LiteralPath $latestPath -Raw | ConvertFrom-Json
          if ($latest.version -ne $expectedVersion) {
            throw "latest.json version $($latest.version) does not match tag version $expectedVersion."
          }
          $windows = $latest.platforms.'windows-x86_64'
          if ($null -eq $windows) {
            throw "latest.json is missing platforms.windows-x86_64."
          }
          if ([string]::IsNullOrWhiteSpace($windows.signature)) {
            throw "latest.json contains an empty Windows updater signature."
          }
          $signature = (Get-Content -LiteralPath $signaturePath -Raw).Trim()
          if ($windows.signature.Trim() -ne $signature) {
            throw "latest.json signature does not match the uploaded .sig asset."
          }
          try {
            $updateUri = [Uri]$windows.url
          } catch {
            throw "latest.json Windows updater URL is invalid."
          }
          if ($updateUri.Scheme -ne 'https') {
            throw "latest.json Windows updater URL must use HTTPS."
          }
          if ($updateUri.Host -ne 'github.com') {
            throw "latest.json Windows updater URL must point to github.com."
          }
          if (-not $updateUri.AbsolutePath.Contains("/releases/download/$tag/")) {
            throw "latest.json Windows updater URL does not point to the tagged release."
          }
          $urlAssetName = [Uri]::UnescapeDataString([IO.Path]::GetFileName($updateUri.AbsolutePath))
          if ($urlAssetName -ne $installer.Name) {
            throw "latest.json points to $urlAssetName but the signed installer is $($installer.Name)."
          }

          function Invoke-SilentInstaller {
            param([string]$InstallerPath, [string]$Destination)
            if (Test-Path -LiteralPath $Destination) { Remove-Item -LiteralPath $Destination -Recurse -Force }
            New-Item -ItemType Directory -Path $Destination -Force | Out-Null
            $process = Start-Process -FilePath $InstallerPath -ArgumentList @('/S', "/D=$Destination") -Wait -PassThru
            if ($process.ExitCode -ne 0) {
              throw "Installer failed with exit code $($process.ExitCode): $InstallerPath"
            }
          }

          function Resolve-InstalledApp {
            param([string]$Destination)
            $candidate = Get-ChildItem -LiteralPath $Destination -Filter '*.exe' -File -Recurse |
              Where-Object { $_.Name -notmatch '(?i)uninstall' } |
              Sort-Object Length -Descending |
              Select-Object -First 1
            if ($null -eq $candidate) {
              throw "No installed application executable found under $Destination"
            }
            return $candidate
          }

          function Assert-InstalledVersion {
            param([string]$Destination, [string]$ExpectedVersion)
            $appExe = Resolve-InstalledApp -Destination $Destination
            $productVersion = $appExe.VersionInfo.ProductVersion
            $fileVersion = $appExe.VersionInfo.FileVersion
            if (($productVersion -notlike "$ExpectedVersion*") -and ($fileVersion -notlike "$ExpectedVersion*")) {
              throw "Installed executable version mismatch. Expected $ExpectedVersion; product=$productVersion file=$fileVersion path=$($appExe.FullName)"
            }
          }

          function Assert-NativeRuntime {
            param([string]$Destination)
            $appExe = Resolve-InstalledApp -Destination $Destination
            $appDir = $appExe.Directory.FullName
            foreach ($dll in @('llama.dll', 'ggml.dll', 'ggml-base.dll', 'ggml-cpu.dll')) {
              $path = Join-Path $appDir $dll
              if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
                throw "Installed native runtime DLL missing beside app: $path"
              }
            }
            $manifestPath = Join-Path $appDir 'resources/native-runtime/windows-x86_64/native-runtime-manifest.json'
            if (-not (Test-Path -LiteralPath $manifestPath -PathType Leaf)) {
              throw "Installed native runtime manifest missing: $manifestPath"
            }
            $manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
            if ($manifest.llamaCppCommit -ne $env:LLAMA_CPP_COMMIT) {
              throw "Native runtime ABI mismatch in installer: $($manifest.llamaCppCommit)"
            }
          }

          function Remove-SmokeInstall {
            param([string]$Destination)
            $uninstaller = Get-ChildItem -LiteralPath $Destination -Filter '*.exe' -File -Recurse |
              Where-Object { $_.Name -match '(?i)uninstall' } |
              Select-Object -First 1
            if ($null -ne $uninstaller) {
              $process = Start-Process -FilePath $uninstaller.FullName -ArgumentList '/S' -Wait -PassThru
              if ($process.ExitCode -ne 0) {
                throw "Uninstaller failed with exit code $($process.ExitCode): $($uninstaller.FullName)"
              }
            }
            if (Test-Path -LiteralPath $Destination) { Remove-Item -LiteralPath $Destination -Recurse -Force }
          }

          $previousInstallerPath = Join-Path $env:RUNNER_TEMP 'OpenMindAI_3.0.0_x64-setup.exe'
          Invoke-WebRequest -UseBasicParsing -Uri 'https://github.com/smshagor-dev/OpenMindAI/releases/download/v3.0.0/OpenMindAI_3.0.0_x64-setup.exe' -OutFile $previousInstallerPath
          if ((Get-Item -LiteralPath $previousInstallerPath).Length -le 0) {
            throw 'Downloaded v3.0.0 installer is empty.'
          }

          $upgradeRoot = Join-Path $env:RUNNER_TEMP 'OpenMindAI-v3.0.0-to-current-signed-upgrade-smoke'
          Invoke-SilentInstaller -InstallerPath $previousInstallerPath -Destination $upgradeRoot
          $upgradeProcess = Start-Process -FilePath $installer.FullName -ArgumentList @('/S', "/D=$upgradeRoot") -Wait -PassThru
          if ($upgradeProcess.ExitCode -ne 0) {
            throw "v3.0.0 to $expectedVersion upgrade installer failed with exit code $($upgradeProcess.ExitCode)."
          }
          Assert-InstalledVersion -Destination $upgradeRoot -ExpectedVersion $expectedVersion
          Assert-NativeRuntime -Destination $upgradeRoot
          Remove-SmokeInstall -Destination $upgradeRoot

          $cleanRoot = Join-Path $env:RUNNER_TEMP 'OpenMindAI-current-clean-smoke'
          Invoke-SilentInstaller -InstallerPath $installer.FullName -Destination $cleanRoot
          Assert-InstalledVersion -Destination $cleanRoot -ExpectedVersion $expectedVersion
          Assert-NativeRuntime -Destination $cleanRoot
          Remove-SmokeInstall -Destination $cleanRoot
          Write-Host "Signed Windows native installer clean-install and v3.0.0 -> $expectedVersion upgrade smoke tests passed."

          $checksumPath = Join-Path $env:RUNNER_TEMP "SHA256SUMS.txt"
          $lines = Get-ChildItem -Path $assetDir -File |
            Where-Object { $_.Name -ne "SHA256SUMS.txt" } |
            Sort-Object Name |
            ForEach-Object {
              $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
              "$hash  $($_.Name)"
            }
          if ($lines.Count -lt 7) {
            throw "Release asset set is incomplete; expected installer, signature, latest.json, and four bootstrap assets."
          }
          Set-Content -Path $checksumPath -Value $lines -Encoding ascii
          gh release upload $tag $checksumPath --clobber

          $assetNames = @((gh release view $tag --json assets | ConvertFrom-Json).assets | ForEach-Object { $_.name })
          foreach ($required in @($installer.Name, "$($installer.Name).sig", "latest.json", "SHA256SUMS.txt", "OpenMindAI-Setup.bat", "OpenMindAI-Setup.command", "openmindai-setup.sh", "openmindai.marker")) {
            if ($required -notin $assetNames) {
              throw "Verified release asset missing after upload: $required"
            }
          }

      - name: Remove imported certificate
        if: always()
        shell: pwsh
        run: |
          if (Test-Path "src-tauri/tauri.windows-ci.conf.json") {
            $config = Get-Content "src-tauri/tauri.windows-ci.conf.json" -Raw | ConvertFrom-Json
            $thumbprint = $config.bundle.windows.certificateThumbprint
            if (-not [string]::IsNullOrWhiteSpace($thumbprint)) {
              Get-ChildItem Cert:\CurrentUser\My\$thumbprint -ErrorAction SilentlyContinue | Remove-Item -Force
            }
            Remove-Item "src-tauri/tauri.windows-ci.conf.json" -Force
          }
          Remove-Item "src-tauri/native-runtime" -Recurse -Force -ErrorAction SilentlyContinue