release.yml

name: Release

# Manual release of `strands-shell` (PyPI) + `@strands-agents/shell` (npm).
#
# Shape: scan → ci + build (wheels/sdist/node addons) → inspect → notes →
#        approve → tag + release → publish.
#
# Publish is the last step. Everything before it — the full CI matrix, the
# multi-platform builds, and the artifact inspection — runs on a fork too;
# only the OIDC upload to PyPI/npm fails there, because the fork is not the
# registered trusted publisher.
#
# The reviewer approves against green checks AND a downloadable, version-
# verified artifact bundle. `dry_run` skips only approval + tag + publish;
# ci/build/inspect/notes still run so the artifact can be reviewed on the run
# page without shipping anything.
#
# This workflow is dispatch-only. It deliberately has no `push: tags` trigger:
# a pushed tag must not be able to reach publish while skipping version
# validation, CI, and the approval gate.

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Explicit version, e.g. 0.3.0 (no leading v, no prefix).'
        required: true
        type: string
      sha:
        description: 'Optional commit SHA to release (must be an ancestor of origin/main). Defaults to current origin/main.'
        required: false
        default: ''
        type: string
      dry_run:
        description: 'Skip approval + tag + publish. CI/build/inspect/notes still run so you can review the artifact on the run page.'
        required: true
        default: true
        type: boolean

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  # ── Resolve SHA and validate version (single gatekeeper) ─────────────────
  # Validates the typed version, resolves a PINNED SHA (default origin/main,
  # or a typed SHA that must be an ancestor of main), finds the previous tag,
  # and rejects duplicate / non-monotonic / pre-existing tags. Every
  # downstream job checks out this exact SHA — the release is pinned to a
  # reviewed commit, not a moving branch.
  scan-commits:
    name: Resolve SHA and validate version
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      release_sha: ${{ steps.scan.outputs.release_sha }}
      prev_tag: ${{ steps.scan.outputs.prev_tag }}
      new_tag: ${{ steps.scan.outputs.new_tag }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: Resolve SHA, find previous tag, validate version
        id: scan
        env:
          NEW_VERSION: ${{ inputs.version }}
          SHA_INPUT: ${{ inputs.sha }}
        run: |
          set -euo pipefail

          # 1. Validate the typed version (bare semver, no prefix).
          if ! [[ "$NEW_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::version '$NEW_VERSION' is not bare semver (expected MAJOR.MINOR.PATCH, no 'v')."
            exit 1
          fi

          # 2. Resolve the SHA. Default to origin/main; if a sha was typed,
          #    accept it only if it's an ancestor of origin/main.
          if [ -n "$SHA_INPUT" ]; then
            RELEASE_SHA=$(git rev-parse --verify "$SHA_INPUT^{commit}" 2>/dev/null) || {
              echo "::error::sha '$SHA_INPUT' is not a valid commit."
              exit 1
            }
            if ! git merge-base --is-ancestor "$RELEASE_SHA" origin/main; then
              echo "::error::sha $RELEASE_SHA is not an ancestor of origin/main — release only from main history."
              exit 1
            fi
          else
            RELEASE_SHA=$(git rev-parse origin/main)
          fi

          # 3. Resolve the previous tag. Tags are bare `v<semver>`.
          TAG_PREFIX="v"
          PREV_TAG=$(git tag --list "${TAG_PREFIX}*" --sort=-v:refname | head -n1)
          if [ -z "$PREV_TAG" ]; then
            echo "::error::No prior tag matching ${TAG_PREFIX}* — refusing to release without a baseline."
            exit 1
          fi
          PREV_VERSION="${PREV_TAG#"${TAG_PREFIX}"}"
          NEW_TAG="${TAG_PREFIX}${NEW_VERSION}"

          # 4. Reject duplicate / non-monotonic / pre-existing tags.
          if [ "$NEW_VERSION" = "$PREV_VERSION" ]; then
            echo "::error::version $NEW_VERSION matches existing tag $PREV_TAG."
            exit 1
          fi
          HIGHER=$(printf '%s\n%s\n' "$PREV_VERSION" "$NEW_VERSION" | sort -V | tail -n1)
          if [ "$HIGHER" != "$NEW_VERSION" ]; then
            echo "::error::version $NEW_VERSION is not greater than previous $PREV_VERSION."
            exit 1
          fi
          if git rev-parse --verify "refs/tags/$NEW_TAG" >/dev/null 2>&1; then
            echo "::error::tag $NEW_TAG already exists."
            exit 1
          fi

          # 5. Sanity-check: at least one commit since prev tag.
          COUNT=$(git rev-list --count "$PREV_TAG..$RELEASE_SHA")
          if [ "$COUNT" = "0" ]; then
            echo "::error::no commits between $PREV_TAG and $RELEASE_SHA — nothing to release."
            exit 1
          fi

          {
            echo "release_sha=$RELEASE_SHA"
            echo "prev_tag=$PREV_TAG"
            echo "new_tag=$NEW_TAG"
          } >> "$GITHUB_OUTPUT"

          {
            echo "### Release scan"
            echo ""
            echo "| | |"
            echo "|---|---|"
            echo "| Previous tag | \`$PREV_TAG\` |"
            echo "| Proposed tag | \`$NEW_TAG\` |"
            echo "| Pinned SHA | \`$RELEASE_SHA\` |"
            echo "| Commits since prev tag | **$COUNT** |"
          } >> "$GITHUB_STEP_SUMMARY"

  # ── Full CI matrix at the pinned SHA ─────────────────────────────────────
  # Runs the same Rust/Python/Node/audit matrix the merge gate runs, but
  # against the exact commit being released rather than the branch tip.
  ci:
    name: CI
    needs: scan-commits
    uses: ./.github/workflows/ci.yml
    permissions:
      contents: read
    with:
      ref: ${{ needs.scan-commits.outputs.release_sha }}

  # ── Build native wheels for PyPI (one job per target) ────────────────────
  # Manifests carry a 0.0.0 placeholder; stamp-version writes inputs.version
  # into them at build time (the version is validated by scan-commits).
  python-wheels:
    needs: scan-commits
    name: Python wheel (${{ matrix.target }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: macos-15-intel
            target: x86_64-apple-darwin
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            manylinux: "2_28"
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            manylinux: "2_28"
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.scan-commits.outputs.release_sha }}

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Stamp version
        uses: ./.github/actions/stamp-version
        with:
          version: ${{ inputs.version }}

      - name: Build wheel
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          # --find-interpreter is required for cross-compiled targets: inside the
          # manylinux cross container maturin can't auto-detect an interpreter for
          # the non-host arch, so it must enumerate the ones the image ships.
          args: --release --out dist --strip --find-interpreter
          manylinux: ${{ matrix.manylinux || 'auto' }}
          sccache: "true"

      - name: Upload wheel artifact
        uses: actions/upload-artifact@v7
        with:
          name: python-wheel-${{ matrix.target }}
          path: dist/*.whl

  python-sdist:
    needs: scan-commits
    name: Python sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.scan-commits.outputs.release_sha }}

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Stamp version
        uses: ./.github/actions/stamp-version
        with:
          version: ${{ inputs.version }}

      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist

      - uses: actions/upload-artifact@v7
        with:
          name: python-sdist
          path: dist/*.tar.gz

  # ── Inspect Python dists: verify coverage + version, re-upload bundle ────
  # Downloads every wheel + sdist, asserts each is stamped with the typed
  # version, checks target coverage + metadata, then re-uploads the verified
  # set as pypi-dist-bundle. python-publish pulls from the same bundle, so the
  # bytes on the run page are the bytes uploaded to PyPI.
  python-inspect:
    name: Inspect Python dists
    needs: [scan-commits, python-wheels, python-sdist]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      # Only the Python dists — without the pattern, merge-multiple would also
      # pull the node-addon-*.node artifacts and break `twine check dist/*`.
      - uses: actions/download-artifact@v8
        with:
          path: dist
          pattern: python-*
          merge-multiple: true

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: List contents of every wheel and sdist
        run: |
          set -euo pipefail
          for f in dist/*.whl; do
            echo "::group::$f"; python -m zipfile -l "$f"; echo "::endgroup::"
          done
          for f in dist/*.tar.gz; do
            echo "::group::$f"; tar tzf "$f"; echo "::endgroup::"
          done

      - name: Assert artifacts are stamped with the typed version
        # Wheel + sdist filenames encode the version (PEP 427 / PEP 625) and
        # publish cannot change them. Catch a version mismatch here, before
        # anything is tagged or shipped.
        env:
          EXPECTED: ${{ inputs.version }}
        run: |
          python - <<'PYEOF'
          import os
          import re
          import sys
          from pathlib import Path

          expected = os.environ["EXPECTED"]
          errors = []
          checked = 0
          for f in sorted(Path("dist").iterdir()):
              name = f.name
              if name.endswith(".whl"):
                  m = re.match(r"^[^-]+-([^-]+)-", name)
              elif name.endswith(".tar.gz"):
                  m = re.match(r"^[^-]+-(.+)\.tar\.gz$", name)
              else:
                  continue
              checked += 1
              version = m.group(1) if m else None
              if version != expected:
                  errors.append(f"{name}: version is {version!r}, expected {expected!r}")
          if not checked:
              print("::error::No wheel or sdist found in dist/", file=sys.stderr)
              sys.exit(1)
          if errors:
              for e in errors:
                  print(f"::error::{e}")
              sys.exit(1)
          print(f"All {checked} artifact(s) stamped with version {expected}")
          PYEOF

      - name: Verify the dist set covers all platform targets
        # Maturin's --find-interpreter builds a wheel per discovered Python
        # version, so the exact count varies as runners update. Instead of an
        # exact count, verify that every matrix target produced at least one
        # wheel and that the sdist exists.
        run: |
          set -euo pipefail
          echo "Dists:"; ls -1 dist/
          missing=()
          for target in aarch64-apple-darwin x86_64-apple-darwin x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-msvc; do
            # Maturin encodes the target in the wheel filename's platform tag:
            #   aarch64-apple-darwin   → macosx_*_arm64
            #   x86_64-apple-darwin    → macosx_*_x86_64
            #   x86_64-unknown-linux-gnu → manylinux_*_x86_64
            #   aarch64-unknown-linux-gnu → manylinux_*_aarch64
            case "$target" in
              aarch64-apple-darwin)       pattern="macosx_*_arm64" ;;
              x86_64-apple-darwin)        pattern="macosx_*_x86_64" ;;
              x86_64-unknown-linux-gnu)   pattern="manylinux_*_x86_64" ;;
              aarch64-unknown-linux-gnu)  pattern="manylinux_*_aarch64" ;;
              x86_64-pc-windows-msvc)     pattern="win_amd64" ;;
            esac
            # shellcheck disable=SC2086  # $pattern is a glob; splitting is intended.
            if ! ls dist/*${pattern}*.whl >/dev/null 2>&1; then
              missing+=("$target")
            fi
          done
          # `[ -f dist/*.tar.gz ]` would break on zero or multiple matches
          # (SC2144); glob into an array and test that at least one exists.
          shopt -s nullglob
          sdists=(dist/*.tar.gz)
          if [ ${#sdists[@]} -eq 0 ]; then
            missing+=("sdist")
          fi
          if [ ${#missing[@]} -gt 0 ]; then
            echo "::error::Missing dists for: ${missing[*]}"
            exit 1
          fi
          echo "All platform targets covered + sdist present."

      - name: twine check (metadata + README rendering)
        run: |
          pip install twine
          twine check dist/*

      - name: Upload verified bundle for publish
        uses: actions/upload-artifact@v7
        with:
          name: pypi-dist-bundle
          path: dist/*
          if-no-files-found: error
          retention-days: 30

  # ── Build native node addons for npm (one job per target) ────────────────
  node-builds:
    needs: scan-commits
    name: Node addon (${{ matrix.target }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: macos-15-intel
            target: x86_64-apple-darwin
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.scan-commits.outputs.release_sha }}

      - uses: actions/setup-node@v6
        with:
          node-version: "20"

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Stamp version
        uses: ./.github/actions/stamp-version
        with:
          version: ${{ inputs.version }}

      - name: Install cross-compile deps (linux aarch64)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: npm install
        run: npm install

      - name: napi build
        # --js/--dts must match package.json's build script: write the generated
        # loader to native.* and leave the hand-authored index.* wrapper intact.
        # When cross-compiling to aarch64-linux, Cargo must link with the
        # aarch64 cross GCC; otherwise it falls back to the host x86-64 `cc` and
        # rust-lld rejects the object files as "incompatible with elf64-x86-64".
        # The var is harmless on native targets (empty -> ignored).
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.target == 'aarch64-unknown-linux-gnu' && 'aarch64-linux-gnu-gcc' || '' }}
        # napi-rs v3: cargo flags go after `--` (v2's --cargo-flags was removed).
        # `--lib` keeps cargo from also building the [[bin]] targets (one needs
        # the wasm feature) when only the cdylib addon is wanted.
        run: npx napi build --platform --release --features node --js native.js --dts native.d.ts --target ${{ matrix.target }} -- --lib

      - name: Upload native artifact
        uses: actions/upload-artifact@v7
        with:
          name: node-addon-${{ matrix.target }}
          # Ship the generated loader (native.js/.d.ts) alongside the binary.
          # These are gitignored build outputs, so the pack/publish jobs (which
          # don't run napi build) have no other way to get them — the main
          # package's index.js does `require('./native.js')`. The loader is
          # platform-independent and identical across targets, so downloading
          # with merge-multiple just overwrites it with the same content.
          path: |
            *.node
            native.js
            native.d.ts

  # ── Pack + inspect all 6 npm packages (fan-in from per-platform builds) ──
  # Assembles the exact publishable set — the main @strands-agents/shell package
  # plus the 5 per-platform packages — using the napi-rs v3 release flow, packs
  # each to a .tgz, verifies the packed set, then uploads npm-packages. The
  # publish jobs pull from this same bundle, so the tarballs on the run page are
  # the tarballs shipped to npm.
  node-pack:
    name: Pack npm packages
    needs: [scan-commits, node-builds]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.scan-commits.outputs.release_sha }}
          persist-credentials: false

      - uses: actions/setup-node@v6
        with:
          node-version: "20"

      - name: Stamp version
        uses: ./.github/actions/stamp-version
        with:
          version: ${{ inputs.version }}

      - name: npm install
        run: npm install

      - name: Download all native artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts
          pattern: node-addon-*
          merge-multiple: true

      - name: Restore generated loader into the main package
        # native.js/.d.ts are gitignored build outputs uploaded by node-builds;
        # the main package's index.js requires('./native.js'), so put them at the
        # repo root before packing. (This job doesn't run napi build.)
        run: cp artifacts/native.js artifacts/native.d.ts ./

      - name: Assemble npm packages (napi-rs v3, no publish)
        # The same napi flow node-publish uses, minus the registry push:
        #  - create-npm-dirs scaffolds npm/<target>/ with os/cpu/libc package.json
        #  - artifacts copies each *.node from ./artifacts into its npm/<target>/
        #    (--output-dir is the INPUT location of the .node files; --npm-dir the OUTPUT)
        #  - pre-publish --skip-optional-publish wires the main package's
        #    optionalDependencies to the platform packages WITHOUT publishing,
        #    so the packed set matches exactly what the publish jobs would ship.
        run: |
          npx napi create-npm-dirs
          npx napi artifacts --output-dir ./artifacts --npm-dir ./npm
          npx napi pre-publish -t npm --no-gh-release --skip-optional-publish

      - name: Pack all packages
        run: |
          set -euo pipefail
          mkdir -p dist-npm
          npm pack --pack-destination dist-npm
          for d in npm/*/; do (cd "$d" && npm pack --pack-destination "$GITHUB_WORKSPACE/dist-npm"); done

      - name: Verify the packaged set matches the publish matrix
        # Guard against drift: the publish stage uses a static matrix of the 5
        # platform packages (+ the main package = 6 total). If package.json's
        # napi.targets gains/loses a target, the packed count changes here and
        # this fails the run BEFORE anything is published — prompting whoever
        # changed the targets to update node-publish-platform's matrix to match.
        run: |
          set -euo pipefail
          expected=6
          # shellcheck disable=SC2012  # controlled .tgz names; ls|wc is fine here.
          actual=$(ls dist-npm/*.tgz | wc -l | tr -d ' ')
          echo "Packed tarballs ($actual):"; ls -1 dist-npm/*.tgz
          if [ "$actual" -ne "$expected" ]; then
            echo "::error::Expected $expected npm packages (1 main + 5 platform) but packed $actual. If napi.targets changed, update node-publish-platform's matrix to match."
            exit 1
          fi

      - name: Assert every tarball is stamped with the typed version
        # package.json's version is the source of the published version and,
        # unlike wheels, isn't encoded in the tarball name — read it out of each
        # packed tarball and confirm it matches the typed release version.
        env:
          EXPECTED: ${{ inputs.version }}
        run: |
          set -euo pipefail
          errors=0
          for tgz in dist-npm/*.tgz; do
            actual=$(tar -xOzf "$tgz" package/package.json | jq -r .version)
            if [ "$actual" != "$EXPECTED" ]; then
              echo "::error::$tgz: version is '$actual', expected '$EXPECTED'."
              errors=$((errors + 1))
            fi
          done
          if [ "$errors" -gt 0 ]; then
            exit 1
          fi
          echo "All tarballs stamped with version $EXPECTED"

      - name: List every tarball's contents
        run: |
          set -euo pipefail
          for tgz in dist-npm/*.tgz; do
            echo "::group::$tgz"; tar tzf "$tgz"; echo "::endgroup::"
          done

      - name: Upload all npm packages for inspect/publish
        uses: actions/upload-artifact@v7
        with:
          name: npm-packages
          path: dist-npm/*.tgz
          if-no-files-found: error
          retention-days: 30

  # ── Draft notes grouped by commit type ───────────────────────────────────
  # Gated on CI + both build/inspect legs succeeding, so notes (and the
  # approval that follows) only render once the release is known-buildable and
  # the artifact is verified.
  draft-notes:
    name: Draft release notes (grouped by commit type)
    needs:
      - scan-commits
      - ci
      - python-inspect
      - node-pack
    if: |
      always() &&
      needs.scan-commits.result == 'success' &&
      needs.ci.result == 'success' &&
      needs.python-inspect.result == 'success' &&
      needs.node-pack.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.scan-commits.outputs.release_sha }}
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Render notes
        env:
          PREV_TAG: ${{ needs.scan-commits.outputs.prev_tag }}
          NEW_REF: ${{ needs.scan-commits.outputs.release_sha }}
          NEW_TAG: ${{ needs.scan-commits.outputs.new_tag }}
        run: |
          set -euo pipefail
          # Feed commits to the grouper as `hash<TAB>subject` lines and let
          # it bucket them by conventional-commit type (feat, fix, ...).
          git log --no-merges --pretty=format:'%h%x09%s' "$PREV_TAG..$NEW_REF" \
            | NEW_TAG="$NEW_TAG" PREV_TAG="$PREV_TAG" \
              python .github/scripts/group-release-notes.py > release-notes.md

      - name: Render release summary
        env:
          NEW_TAG: ${{ needs.scan-commits.outputs.new_tag }}
          RELEASE_SHA: ${{ needs.scan-commits.outputs.release_sha }}
          DRY_RUN: ${{ inputs.dry_run }}
          IS_FORK: ${{ github.event.repository.fork }}
        run: |
          set -euo pipefail
          {
            echo "## Release proposal"
            echo ""
            echo "| | |"
            echo "|---|---|"
            echo "| Package | \`strands-shell\` (PyPI) + \`@strands-agents/shell\` (npm) |"
            echo "| Proposed tag | \`$NEW_TAG\` |"
            echo "| Pinned SHA | \`$RELEASE_SHA\` |"
            echo "| Dry run | \`$DRY_RUN\` |"
            echo "| Running on fork | \`$IS_FORK\` |"
            echo ""
            echo "> Reviewers: the verified artifacts are uploaded as \`pypi-dist-bundle\` and \`npm-packages\` on this run's page. Download and install in a fresh venv / tmpdir to sanity-check before approving."
            echo ""
            echo "### Drafted notes"
            echo ""
            cat release-notes.md
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload release notes artifact
        uses: actions/upload-artifact@v7
        with:
          name: release-notes
          path: release-notes.md
          retention-days: 30

  # ── Reviewer approval (skipped on dry runs) ──────────────────────────────
  approve-release:
    name: Wait for reviewer approvals
    needs: [scan-commits, draft-notes]
    if: inputs.dry_run != true
    runs-on: ubuntu-latest
    environment:
      # Configure reviewers + main-only deployment branches in repo settings.
      # On forks the environment has no reviewer config, so this just passes —
      # the publish steps are the ones that fail there.
      name: release-gate
    permissions: {}
    steps:
      - name: Acknowledge approval
        env:
          NEW_TAG: ${{ needs.scan-commits.outputs.new_tag }}
          RELEASE_SHA: ${{ needs.scan-commits.outputs.release_sha }}
        run: |
          echo "Approved to release $NEW_TAG at $RELEASE_SHA."

  # ── Tag + GitHub release ──────────────────────────────────────────────────
  # Runs before publish so the tag is the source of truth. If publish fails,
  # the tag stays — just re-run the publish jobs. Tags the PINNED SHA (the
  # reviewed commit), not the branch tip.
  create-gh-release:
    name: Create GitHub release
    needs: [scan-commits, draft-notes, approve-release]
    if: inputs.dry_run != true
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.scan-commits.outputs.release_sha }}
          # This job creates the tag, so keep the GITHUB_TOKEN in git config
          # for the push below. Other jobs use persist-credentials: false.
          persist-credentials: true

      - name: Download release notes artifact
        uses: actions/download-artifact@v8
        with:
          name: release-notes

      - name: Tag the pinned SHA and create the release
        env:
          GH_TOKEN: ${{ github.token }}
          NEW_TAG: ${{ needs.scan-commits.outputs.new_tag }}
          RELEASE_SHA: ${{ needs.scan-commits.outputs.release_sha }}
        run: |
          set -euo pipefail
          # Push the tag over git rather than letting `gh release create
          # --target <sha>` create it through the releases API. The API path
          # returns "403 Resource not accessible by integration" for the
          # GITHUB_TOKEN (see cli/cli#9514); a plain ref push with the same
          # token succeeds.
          #
          # Both steps are guarded so re-running the job after a partial
          # failure is safe: if a prior run pushed the tag but errored before
          # the release was made, git push would otherwise refuse the existing
          # tag. This keeps the "tag is source of truth, just re-run" contract.
          if ! git ls-remote --exit-code --tags origin "refs/tags/$NEW_TAG" >/dev/null 2>&1; then
            git tag "$NEW_TAG" "$RELEASE_SHA"
            git push origin "refs/tags/$NEW_TAG"
          fi

          # Tag now exists on the remote, so this only attaches notes to it.
          if ! gh release view "$NEW_TAG" >/dev/null 2>&1; then
            gh release create "$NEW_TAG" \
              --title "$NEW_TAG" \
              --notes-file release-notes.md
          fi

  # ── Publish to PyPI ───────────────────────────────────────────────────────
  # Publishes exactly the bundle python-inspect verified. On a fork this fails
  # at the OIDC step — by design.
  python-publish:
    name: Publish to PyPI
    needs: [python-inspect, approve-release, create-gh-release]
    if: inputs.dry_run != true
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/strands-shell
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: pypi-dist-bundle
          path: dist

      - uses: pypa/gh-action-pypi-publish@release/v1

  # ── Publish the 5 per-platform npm packages (one retriable job each) ──────
  # Each leg publishes exactly one tarball that node-pack packed + uploaded, so
  # a flaky single platform can be re-run on its own via "Re-run failed jobs"
  # without touching the others. The matrix is static — its entries must match
  # package.json's napi.targets; node-pack's count check fails the run before
  # this stage if they drift. fail-fast: false so one platform failing doesn't
  # cancel the rest.
  node-publish-platform:
    name: Publish ${{ matrix.pkg }}
    needs: [node-pack, approve-release, create-gh-release]
    if: inputs.dry_run != true
    runs-on: ubuntu-latest
    # OIDC trusted publishing (no NPM_TOKEN) — matches the strands-agents golden
    # path (see harness-sdk). Requires id-token: write and a registered trusted
    # publisher on npmjs.com for every package published.
    environment:
      name: npm
    permissions:
      id-token: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        pkg:
          - strands-agents-shell-darwin-x64
          - strands-agents-shell-darwin-arm64
          - strands-agents-shell-linux-x64-gnu
          - strands-agents-shell-linux-arm64-gnu
          - strands-agents-shell-win32-x64-msvc
    env:
      V: ${{ inputs.version }}
    steps:
      # No checkout/build — publish the exact tarball node-pack uploaded.
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Update npm to latest
        # Trusted publishing needs a recent npm (>= 11.5.1).
        run: npm install -g npm@latest

      - name: Download the inspected npm packages
        uses: actions/download-artifact@v8
        with:
          name: npm-packages
          path: dist-npm

      - name: Publish ${{ matrix.pkg }}
        # ./ prefix: npm treats a bare "dir/file.tgz" as a git spec.
        run: npm publish "./dist-npm/${{ matrix.pkg }}-${V}.tgz" --access public

  # ── Publish the main package last ─────────────────────────────────────────
  # Gated on all platform packages succeeding, since the main package's
  # optionalDependencies reference them.
  node-publish-main:
    name: Publish @strands-agents/shell
    needs: [node-publish-platform]
    if: inputs.dry_run != true
    runs-on: ubuntu-latest
    environment:
      name: npm
      url: https://www.npmjs.com/package/@strands-agents/shell
    permissions:
      id-token: write
      contents: read
    env:
      V: ${{ inputs.version }}
    steps:
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Update npm to latest
        run: npm install -g npm@latest

      - name: Download the inspected npm packages
        uses: actions/download-artifact@v8
        with:
          name: npm-packages
          path: dist-npm

      - name: Publish @strands-agents/shell
        run: npm publish "./dist-npm/strands-agents-shell-${V}.tgz" --access public