.github/workflows/release-cli-finalize.yml

name: Finalize CLI npm channel

on:
  workflow_dispatch:
    inputs:
      stage_run_id:
        description: Successful Stage CLI npm release workflow run ID
        required: true
        type: string
      stage_run_attempt:
        description: Successful Stage CLI npm release workflow run attempt
        required: true
        type: string
      version:
        description: Exact staged maka-agent product version
        required: true
        type: string

permissions:
  actions: read
  contents: read

concurrency:
  group: cli-npm-finalize
  cancel-in-progress: false

jobs:
  inspect:
    name: Verify the public npm channel
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Require main
        env:
          RELEASE_REF: ${{ github.ref }}
        run: |
          if [[ "$RELEASE_REF" != "refs/heads/main" ]]; then
            echo "CLI npm finalization must be dispatched from main; found $RELEASE_REF" >&2
            exit 1
          fi

      - name: Load the exact stage workflow run
        env:
          GH_TOKEN: ${{ github.token }}
          STAGE_RUN_ID: ${{ inputs.stage_run_id }}
          STAGE_RUN_ATTEMPT: ${{ inputs.stage_run_attempt }}
        run: |
          if [[ ! "$STAGE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
            echo "Stage workflow run ID must be a positive integer" >&2
            exit 1
          fi
          if [[ ! "$STAGE_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]; then
            echo "Stage workflow run attempt must be a positive integer" >&2
            exit 1
          fi
          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$STAGE_RUN_ID/attempts/$STAGE_RUN_ATTEMPT" > "$RUNNER_TEMP/stage-run.json"

      - name: Check out the current release verifier
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          package-manager-cache: false

      - name: Select the release npm toolchain
        run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"

      - name: Download the exact staged candidate
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: cli-staged-release-${{ inputs.stage_run_attempt }}
          path: packages/cli/release
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ inputs.stage_run_id }}

      - name: Verify the stage run and release record
        id: release
        env:
          EXPECTED_VERSION: ${{ inputs.version }}
        run: |
          node scripts/release-cli-publication.mjs validate-stage-run \
            packages/cli/release \
            "$RUNNER_TEMP/stage-run.json" \
            "$EXPECTED_VERSION" \
            "$GITHUB_OUTPUT"

      - name: Revalidate the product release authority
        env:
          GH_TOKEN: ${{ github.token }}
          PRODUCT_SOURCE_COMMIT: ${{ steps.release.outputs.source_commit }}
          PRODUCT_TAG: ${{ steps.release.outputs.product_tag }}
        run: |
          node scripts/product-release-authority.mjs verify-draft \
            "$PRODUCT_TAG" "$PRODUCT_SOURCE_COMMIT" "$GITHUB_REPOSITORY"

      - name: Fetch and verify the public registry bytes
        run: |
          node scripts/release-cli-publication.mjs fetch-registry \
            packages/cli/release \
            "$RUNNER_TEMP/registry-release"

      - name: Verify npm signatures and provenance
        run: |
          node scripts/release-cli-publication.mjs prepare-audit \
            packages/cli/release \
            "$RUNNER_TEMP/signature-audit"
          cd "$RUNNER_TEMP/signature-audit"
          npm audit signatures --json --include-attestations > audit.json
          node "$GITHUB_WORKSPACE/scripts/release-cli-publication.mjs" validate-audit \
            "$GITHUB_WORKSPACE/packages/cli/release" \
            "$RUNNER_TEMP/signature-audit/audit.json"

      - name: Preserve the verified public npm package
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cli-public-package-${{ github.run_attempt }}
          path: ${{ runner.temp }}/registry-release
          if-no-files-found: error
          compression-level: 0
          retention-days: 30