deepseek-harness/.github/workflows/landlock-run-release.yml

# Build and publish the @deepseek-ai/node-addon-landlock-run package family from the
# harness source of record. Rehearsal and publication consume the same packed
# tarballs; each native binary is built on its matching architecture.
name: Landlock Run Release

on:
  workflow_dispatch:
    inputs:
      publish:
        description: Publish packed tarballs to npm. Must run from a landlock-run-v* tag.
        required: true
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  # Stable/prerelease dist-tags are shared registry state; serialize release
  # runs so two versions cannot race the final tag assignment.
  group: ${{ github.workflow }}
  cancel-in-progress: false

defaults:
  run:
    working-directory: native/landlock-run

jobs:
  matrix:
    name: Matrix
    runs-on: ubuntu-24.04
    outputs:
      prebuilds: ${{ steps.matrix.outputs.prebuilds }}
    steps:
      - uses: actions/checkout@v4

      - id: matrix
        run: echo "prebuilds=$(node ./scripts/github-matrix.mjs release-prebuild)" >> "$GITHUB_OUTPUT"

  build-prebuilds:
    name: ${{ matrix.package }}
    needs: matrix
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.matrix.outputs.prebuilds) }}
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          package_json_file: package.json

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --filter @deepseek-ai/node-addon-landlock-run-workspace... --frozen-lockfile

      - name: Install musl toolchain
        run: |
          sudo apt-get update -q
          sudo apt-get install -yq musl-tools

      - name: Build native binaries
        run: pnpm build:native

      - name: Verify binary metadata
        run: node ./scripts/verify-launcher-binary.mjs ${{ matrix.dir }}

      - name: Upload prebuild artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: native/landlock-run/${{ matrix.dir }}/bin/*
          if-no-files-found: error
          retention-days: 7

  pack:
    name: Pack npm tarballs
    needs: build-prebuilds
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          package_json_file: package.json

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --filter @deepseek-ai/node-addon-landlock-run-workspace... --frozen-lockfile

      - name: Build TypeScript
        run: pnpm build:ts

      - name: Verify release version
        run: node ./scripts/verify-release.mjs
        env:
          RELEASE_PUBLISH: ${{ inputs.publish }}

      - name: Download prebuild artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: prebuild-*
          path: native/landlock-run/.release/prebuild-artifacts

      - name: Assemble and verify prebuilds
        run: node ./scripts/assemble-prebuilds.mjs .release/prebuild-artifacts

      - name: Verify release payload
        run: node ./scripts/verify-release.mjs --prebuilds
        env:
          RELEASE_PUBLISH: ${{ inputs.publish }}

      - name: Pack release tarballs
        run: node ./scripts/pack-release.mjs dist/npm

      - name: Verify packed install
        run: node ./scripts/verify-packed-install.mjs dist/npm
        env:
          NALR_REQUIRE_LANDLOCK: 1

      - name: Upload npm tarballs
        uses: actions/upload-artifact@v4
        with:
          name: npm-tarballs
          path: native/landlock-run/dist/npm/*
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish to npm
    if: inputs.publish
    needs: pack
    runs-on: ubuntu-24.04
    environment: npm-publish
    permissions:
      contents: read
      id-token: write
    steps:
      # The publish script is the only repository file this job needs, and it
      # imports nothing outside Node's builtins, so there is no install step.
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Download npm tarballs
        uses: actions/download-artifact@v4
        with:
          name: npm-tarballs
          path: native/landlock-run/dist/npm

      - name: Configure npm token fallback
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [[ -n "$NPM_TOKEN" ]]; then
            echo "NODE_AUTH_TOKEN=$NPM_TOKEN" >> "$GITHUB_ENV"
          fi

      - name: Publish tarballs
        # Publication is decided per package against the registry, so re-running
        # this job over the same artifact skips what already landed instead of
        # failing on it. A bare `npm publish` loop could not be retried: the
        # registry answers a repeat of an existing version permanently.
        run: node ./scripts/publish-release.mjs dist/npm