release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  security:
    name: Security scan
    uses: $/.github/workflows/security.yml
    permissions:
      contents: read
      security-events: write
      pull-requests: read

  # Invoked here rather than merely run beforehand: scripts/release.sh commits
  # and pushes a release-prep commit to main *before* tagging, so anything run
  # ahead of time covers the wrong SHA. As a called workflow this runs against
  # the exact tag SHA.
  #
  # contents: read is required and cannot be inherited — this workflow sets
  # permissions: {} above, and a called workflow can only maintain or reduce
  # the caller's token permissions, never elevate them. Without it,
  # actions/checkout inside the reusable workflow has no repository access.
  headless-probe:
    name: Headless keyring probe
    uses: $/.github/workflows/headless-probe-composition.yml
    permissions:
      contents: read

  test:
    name: Test before release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      BASECAMP_NO_KEYRING: "1"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to the cache used by tag-push workflows
        with:
          go-version-file: 'go.mod'

      - name: Install golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.11.1  # keep in lockstep with test.yml Lint
          install-only: true

      - name: Cache BATS
        id: cache-bats
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to the cache used by tag-push workflows
        with:
          path: ~/.local
          key: bats-1.11.0-home

      - name: Install BATS
        if: steps.cache-bats.outputs.cache-hit != 'true'
        run: |
          git clone --depth 1 --branch v1.11.0 https://github.com/bats-core/bats-core.git /tmp/bats-core
          /tmp/bats-core/install.sh ~/.local

      - name: Add BATS to PATH
        run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Run release quality gate
        run: |
          make check-lint-lockstep fmt-check vet lint test test-e2e provenance-check check-naming check-surface
          go test -tags dev -race -count=1 ./...

      - name: Run govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          GOFLAGS=-tags=dev govulncheck ./...

      - name: Check CLI surface compatibility
        run: |
          # Generate current snapshot
          make build
          scripts/check-cli-surface.sh ./bin/basecamp /tmp/current-surface.txt
          # Generate baseline from previous tag in isolated worktree
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          if [ -n "$PREV_TAG" ]; then
            SCRIPT_DIR="$(pwd)/scripts"
            WORKTREE_DIR=/tmp/baseline-tree
            trap 'git worktree remove "$WORKTREE_DIR" --force 2>/dev/null || true' EXIT
            git worktree add "$WORKTREE_DIR" "$PREV_TAG"
            cd "$WORKTREE_DIR"
            make build
            if "$SCRIPT_DIR/check-cli-surface.sh" ./bin/basecamp /tmp/baseline-surface.txt 2>/dev/null; then
              cd -
              git worktree remove "$WORKTREE_DIR" --force
              trap - EXIT
              scripts/check-cli-surface-diff.sh /tmp/baseline-surface.txt /tmp/current-surface.txt
            else
              echo "Baseline ($PREV_TAG) does not support --help --agent — skipping surface diff"
              cd -
              git worktree remove "$WORKTREE_DIR" --force
              trap - EXIT
            fi
          else
            echo "First release — no baseline to compare against"
          fi

  release:
    name: Release
    needs: [test, security, headless-probe]
    runs-on: ubuntu-latest
    timeout-minutes: 45
    environment: release
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Generate token for Homebrew tap
        id: sdk-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.RELEASE_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: basecamp
          repositories: homebrew-tap
          permission-contents: write

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to the cache used by tag-push workflows
        with:
          go-version-file: 'go.mod'

      - name: Verify tag is on main
        run: |
          git fetch origin main
          git merge-base --is-ancestor "$GITHUB_SHA" origin/main

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2

      - name: Verify macOS signing secrets
        if: github.repository == 'basecamp/basecamp-cli'
        run: |
          missing=()
          for var in MACOS_SIGN_P12 MACOS_SIGN_PASSWORD MACOS_NOTARY_KEY MACOS_NOTARY_KEY_ID MACOS_NOTARY_ISSUER_ID; do
            if [ -z "${!var}" ]; then
              missing+=("$var")
            fi
          done
          if [ ${#missing[@]} -gt 0 ]; then
            echo "::error::Missing macOS signing secrets: ${missing[*]}"
            exit 1
          fi
          echo "All macOS signing secrets present"
        env:
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}

      - name: Verify Windows signing secrets
        if: github.repository == 'basecamp/basecamp-cli'
        run: |
          missing=()
          for var in SM_API_KEY SM_CLIENT_CERT_FILE_B64 SM_CLIENT_CERT_PASSWORD; do
            if [ -z "${!var}" ]; then
              missing+=("$var")
            fi
          done
          if [ ${#missing[@]} -gt 0 ]; then
            echo "::error::Missing Windows signing secrets: ${missing[*]}"
            exit 1
          fi
          echo "All Windows signing secrets present"
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}

      - name: Set up Java for jsign
        if: github.repository == 'basecamp/basecamp-cli'
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin
          java-version: '21'

      # Guarded like the preflight above: on forks this must not run at all —
      # decoding an empty secret would export a nonempty SM_CLIENT_CERT_FILE,
      # which the wrapper correctly treats as partial configuration and fails.
      # With no SM_* env exported, forks take the wrapper's skip path instead
      # and release unsigned.
      - name: Prepare Windows signing
        if: github.repository == 'basecamp/basecamp-cli'
        env:
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
        run: |
          # jsign >= 7.5 is mandatory: 7.1-7.3 are broken against DigiCert
          # ONE's current API (bc3-desktop commit 59d6453).
          JSIGN_VERSION=7.5
          JSIGN_SHA256=602a51c3545a6dc4fb99bd2ea7152b26d1345916d0c93ddfbd5936cb735af91c
          umask 077
          curl -fsSL --retry 3 -o "$RUNNER_TEMP/jsign-$JSIGN_VERSION.jar" \
            "https://github.com/ebourg/jsign/releases/download/$JSIGN_VERSION/jsign-$JSIGN_VERSION.jar"
          echo "$JSIGN_SHA256  $RUNNER_TEMP/jsign-$JSIGN_VERSION.jar" | sha256sum -c -
          printf '%s' "$SM_CLIENT_CERT_FILE_B64" | base64 -d > "$RUNNER_TEMP/digicert-client-cert.p12"
          {
            echo "JSIGN_JAR=$RUNNER_TEMP/jsign-$JSIGN_VERSION.jar"
            echo "SM_CLIENT_CERT_FILE=$RUNNER_TEMP/digicert-client-cert.p12"
          } >> "$GITHUB_ENV"

      - name: Install GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          # Keep in sync with .mise.toml goreleaser version pin.
          version: 'v2.15.4'
          install-only: true

      - name: Resolve the previous stable tag for release notes
        run: |
          # Stable releases must diff against the last STABLE tag, not the last
          # rc, or the notes come out empty. Mirrors update-nix-flake.sh:32.
          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
            echo "prerelease — leaving previous-tag detection to goreleaser"
            exit 0
          fi
          PREV=$(git tag --merged "$GITHUB_SHA" --sort=-version:refname \
                   --list 'v[0-9]*.[0-9]*.[0-9]*' \
                 | awk -v cur="$GITHUB_REF_NAME" '!/-/ && $0 != cur { print; exit }')
          [ -n "$PREV" ] || { echo "::error::no previous stable tag resolved"; exit 1; }
          echo "Release notes will diff against $PREV"
          echo "GORELEASER_PREVIOUS_TAG=$PREV" >> "$GITHUB_ENV"

      - name: Run GoReleaser
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_TOKEN: ${{ steps.sdk-token.outputs.token }}
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          # Windows Authenticode signing via DigiCert KeyLocker (jsign).
          # JSIGN_JAR and SM_CLIENT_CERT_FILE arrive via GITHUB_ENV from the
          # "Prepare Windows signing" step above.
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
          # DigiCert ONE certificate ID (not the keypair alias) for the OV cert
          # CN=37signals LLC, expires 2027-04-30. Keep in sync with bc3-desktop.
          SIGN_ALIAS: 1346fa41-d9f0-4580-b7b9-a95cf5674354
        run: goreleaser release --clean

      - name: Clean up Windows signing material
        if: always()
        run: rm -f "$RUNNER_TEMP/digicert-client-cert.p12" "$RUNNER_TEMP"/jsign-*.jar

      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-checksums: ./dist/checksums.txt

  # AUR publishing runs as its own job, not a step in `release`. As a step it
  # sat *after* GoReleaser and attestation, so an AUR-side outage turned the
  # whole job red with the release already published — and that took the four
  # `needs: [release]` verification jobs down with it as skipped. Isolated and
  # continue-on-error, an AUR outage can no longer mask signing verification.
  # Recover a missed publish with the aur-publish workflow (workflow_dispatch).
  aur-publish:
    name: Publish to AUR
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    continue-on-error: true
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Shared with the aur-publish workflow's recovery runs. Without this, a
    # recovery that already passed its version check could clone after a newer
    # automatic publish landed and push the older PKGBUILD as a fast-forward.
    concurrency:
      group: aur-publish
      cancel-in-progress: false
    environment: release
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check AUR publishing configuration
        id: aur-config
        env:
          AUR_KEY: ${{ secrets.AUR_KEY }}
        run: |
          if [ -n "$AUR_KEY" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish to AUR
        if: steps.aur-config.outputs.enabled == 'true'
        env:
          AUR_KEY: ${{ secrets.AUR_KEY }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          mkdir -p ~/.ssh
          echo "$AUR_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          echo -e "Host aur.archlinux.org\n  IdentityFile ~/.ssh/aur\n  User aur\n  StrictHostKeyChecking accept-new" >> ~/.ssh/config
          git config --global user.name "37signals"
          git config --global user.email "dev@37signals.com"
          # publish-aur.sh derives everything from the published release assets
          # and no-ops when the PKGBUILD is already current, so retrying is safe.
          for attempt in 1 2 3; do
            if scripts/publish-aur.sh "$VERSION"; then
              exit 0
            fi
            if [ "$attempt" -lt 3 ]; then
              echo "AUR publish attempt ${attempt} failed; retrying in $((attempt * 60))s"
              sleep $((attempt * 60))
            fi
          done
          echo "AUR publish failed after 3 attempts"
          exit 1

      - name: Notify on AUR publish failure
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
          REPO_SLUG: ${{ github.repository }}
          REF_NAME: ${{ github.ref_name }}
          RUN_ID: ${{ github.run_id }}
        run: |
          RUN_URL="https://github.com/${REPO_SLUG}/actions/runs/${RUN_ID}"
          BODY="Publishing [${REF_NAME}](${RUN_URL}) to the AUR failed. The GitHub release is unaffected — only the Arch package is stale. Re-run the \`Publish to AUR\` workflow with version \`${REF_NAME#v}\` once the AUR is reachable."

          # Dedup lives in notify-issue.sh, shared with aur-publish.yml. Both
          # files used to carry their own title-based lookup; when the canonical
          # issue was retitled, the release path opened a duplicate and fixing
          # only the recovery path would have left this one broken.
          notify_status=0
          scripts/notify-issue.sh \
            --repo "$REPO_SLUG" \
            --label aur-publish \
            --title "AUR publish failure" \
            --body "$BODY" || notify_status=$?

          # Always emit the annotation, whatever the notifier did. It now fails
          # closed rather than filing a duplicate, so on a lookup failure this
          # is the only signal left.
          echo "::error::AUR publish failed for ${REF_NAME}. See ${RUN_URL}"
          exit "$notify_status"

  macos-verify:
    name: Verify macOS signing
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: macos-latest
    timeout-minutes: 10
    permissions:
      contents: read
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - name: Download release binary
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p /tmp/verify
          gh release download "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern "basecamp_*_darwin_${{ matrix.arch }}.tar.gz" \
            --dir /tmp/verify
          tar -xzf /tmp/verify/basecamp_*_darwin_${{ matrix.arch }}.tar.gz -C /tmp/verify

      - name: Verify TeamIdentifier
        run: |
          TEAM_ID=$(codesign -dv --verbose=4 /tmp/verify/basecamp 2>&1 | grep TeamIdentifier= | cut -d= -f2)
          echo "TeamIdentifier (${{ matrix.arch }}): $TEAM_ID"
          if [ "$TEAM_ID" != "2WNYUYRS7G" ]; then
            echo "::error::TeamIdentifier mismatch (${{ matrix.arch }}): expected 2WNYUYRS7G, got $TEAM_ID"
            exit 1
          fi

      - name: Verify hardened runtime
        run: |
          FLAGS=$(codesign -dv --verbose=4 /tmp/verify/basecamp 2>&1 | grep 'flags=' | head -1)
          echo "Flags (${{ matrix.arch }}): $FLAGS"
          if ! echo "$FLAGS" | grep -q 'runtime'; then
            echo "::error::Hardened runtime flag not set (${{ matrix.arch }}): $FLAGS"
            exit 1
          fi

      - name: Check notarization status
        run: |
          # Best-effort: notarization ticket propagation can lag, so this is
          # telemetry, not a gate. TeamIdentifier and hardened runtime above
          # are the hard assertions.
          spctl -a -vvv -t install /tmp/verify/basecamp 2>&1 | tee /tmp/verify/spctl.out
          if grep -q 'accepted\|Notarized Developer ID' /tmp/verify/spctl.out; then
            echo "Notarization accepted for ${{ matrix.arch }}"
          else
            echo "::warning::Notarization not yet accepted for ${{ matrix.arch }} (ticket propagation may lag)"
          fi

  windows-verify:
    name: Verify Windows signing
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: windows-latest
    timeout-minutes: 10
    permissions:
      contents: read
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - name: Download release binary
        env:
          GH_TOKEN: ${{ github.token }}
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path "$env:RUNNER_TEMP\verify" | Out-Null
          gh release download $env:GITHUB_REF_NAME `
            --repo $env:GITHUB_REPOSITORY `
            --pattern "basecamp_*_windows_${{ matrix.arch }}.zip" `
            --dir "$env:RUNNER_TEMP\verify"
          if ($LASTEXITCODE -ne 0) { throw 'gh release download failed' }
          $zip = Get-ChildItem "$env:RUNNER_TEMP\verify\basecamp_*_windows_${{ matrix.arch }}.zip"
          Expand-Archive -Path $zip.FullName -DestinationPath "$env:RUNNER_TEMP\verify\extract" -Force

      - name: Verify Authenticode signature
        shell: pwsh
        run: |
          # Signature validation of an arm64 PE needs no execution, so both
          # arches verify on the x64 runner.
          $sig = Get-AuthenticodeSignature "$env:RUNNER_TEMP\verify\extract\basecamp.exe"
          Write-Host "Status (${{ matrix.arch }}): $($sig.Status) - $($sig.StatusMessage)"
          Write-Host "Signer: $($sig.SignerCertificate.Subject)"
          if ($sig.Status -ne 'Valid') {
            Write-Host "::error::Authenticode status (${{ matrix.arch }}): $($sig.Status) - $($sig.StatusMessage)"
            exit 1
          }
          if ($sig.SignerCertificate.Subject -notmatch 'CN=37signals LLC') {
            Write-Host "::error::Unexpected signer (${{ matrix.arch }}): $($sig.SignerCertificate.Subject)"
            exit 1
          }
          if (-not $sig.TimeStamperCertificate) {
            Write-Host "::error::No timestamp countersignature (${{ matrix.arch }}) - signature would expire with the cert on 2027-04-30"
            exit 1
          }
          Write-Host "Signature valid, signer and timestamp verified (${{ matrix.arch }})"

      - name: Download installer asset
        if: matrix.arch == 'amd64'
        env:
          GH_TOKEN: ${{ github.token }}
        shell: pwsh
        run: |
          gh release download $env:GITHUB_REF_NAME `
            --repo $env:GITHUB_REPOSITORY `
            --pattern 'basecamp_installer.ps1' `
            --dir "$env:RUNNER_TEMP\verify"
          if ($LASTEXITCODE -ne 0) { throw 'gh release download failed' }

      # Both engines: confirms jsign's ps1 content-hash encoding matches what
      # PowerShell computes, on Core and on Windows PowerShell 5.1.
      - name: Verify installer signature (pwsh)
        if: matrix.arch == 'amd64'
        shell: pwsh
        run: |
          $sig = Get-AuthenticodeSignature "$env:RUNNER_TEMP\verify\basecamp_installer.ps1"
          Write-Host "Installer status (pwsh): $($sig.Status) - $($sig.StatusMessage)"
          if ($sig.Status -ne 'Valid') { exit 1 }

      - name: Verify installer signature (Windows PowerShell 5.1)
        if: matrix.arch == 'amd64'
        shell: powershell
        run: |
          $sig = Get-AuthenticodeSignature "$env:RUNNER_TEMP\verify\basecamp_installer.ps1"
          Write-Host "Installer status (powershell): $($sig.Status) - $($sig.StatusMessage)"
          if ($sig.Status -ne 'Valid') { exit 1 }

  # Not continue-on-error. It was, and that is half of why v0.8.0 published a
  # flake that could not build: the job could not fail the run, and the AUR
  # outage skipped it outright. A broken flake is a broken release artifact, so
  # it should colour the run even though it lands after publication.
  nix-verify:
    name: Verify Nix flake
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Nix
        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Build and verify
        run: |
          STORE_PATH=$(nix build --no-link --print-out-paths)
          "$STORE_PATH/bin/basecamp" --version

  sync-skills:
    name: Sync skills
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    continue-on-error: true
    concurrency:
      group: sync-skills
      cancel-in-progress: false
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: release
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # An older stable release can reach this job after a newer one has
      # published — its run stalled, or its failed sync was rerun later — and
      # the script mirrors the skills wholesale, so it would roll basecamp/skills
      # back. The concurrency group serialises the jobs but does not order them,
      # so this is the check the manual Sync skills workflow makes: only the
      # latest stable release publishes. A failed lookup fails the job, which
      # files the issue below rather than skipping in silence.
      - name: Confirm this is the latest stable release
        id: latest
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          latest=$(gh release view --repo "${GITHUB_REPOSITORY}" --json tagName --jq .tagName)
          if [ "$TAG" = "$latest" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::Skipping the skills sync for ${TAG}: the latest stable release is ${latest}, and syncing an older tag would roll basecamp/skills back."
            echo "publish=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Generate token for skills repo
        if: steps.latest.outputs.publish == 'true'
        id: skills-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.RELEASE_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: basecamp
          repositories: skills
          permission-contents: write

      - name: Sync skills to distribution repo
        if: steps.latest.outputs.publish == 'true'
        id: sync
        env:
          SKILLS_TOKEN: ${{ steps.skills-token.outputs.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          SOURCE_SHA: ${{ github.sha }}
        run: scripts/sync-skills.sh

      - name: Notify on sync failure
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
          REF_NAME: ${{ github.ref_name }}
          RUN_ID: ${{ github.run_id }}
        run: |
          TITLE="Skills sync failure"
          BODY="The automatic skills sync for [${REF_NAME}](https://github.com/${{ github.repository }}/actions/runs/${RUN_ID}) failed. Check the workflow run for details."

          # Check for existing open issue before creating a new one
          existing=$(gh issue list --repo ${{ github.repository }} --state open --search "in:title $TITLE" --json number,title --jq '[.[] | select(.title == "'"$TITLE"'")][0].number // empty' 2>/dev/null || true)
          if [ -n "$existing" ]; then
            gh issue comment --repo ${{ github.repository }} "$existing" --body "$BODY" || true
          else
            gh issue create --repo ${{ github.repository }} --title "$TITLE" --body "$BODY" || true
          fi

          # Always emit annotation so the failure is visible in the workflow summary
          echo "::error::Skills sync to basecamp/skills failed for ${REF_NAME}. See https://github.com/${{ github.repository }}/actions/runs/${RUN_ID}"