release-workflows.test.sh - DeepSeek-Reasonix

release-workflows.test.sh

1	#!/usr/bin/env bash
2	set -euo pipefail
3
4	repo_root="$(git rev-parse --show-toplevel)"
5	node --test "$repo_root/scripts/verify-manual-desktop-producer.test.mjs"
6	node --test "$repo_root/scripts/release-publication-ledger.test.mjs"
7	bash "$repo_root/scripts/manual-desktop-exception.test.sh"
8	test_root="$(mktemp -d "${TMPDIR:-/tmp}/reasonix-release-workflow-test.XXXXXX")"
9	cleanup() {
10	case "$test_root" in
11	/reasonix-release-workflow-test.) rm -rf -- "$test_root" ;;
12	*) echo "refusing to clean unexpected test directory: $test_root" >&2 ;;
13	esac
14	}
15	trap cleanup EXIT
16
17	# Stable tags have one entrypoint and one protected environment. Reusable
18	# publishers must verify that only that entrypoint can claim prior approval.
19	# The manual exception is immutable-candidate scoped and cannot advance any
20	# Desktop update entry point. Keep normal signing as the default.
21	python3 - "$repo_root" <<'PY'
22	import pathlib, sys
23	root = pathlib.Path(sys.argv[1])
24	stable = (root / '.github/workflows/release-stable.yml').read_text()
25	desktop = (root / '.github/workflows/release-desktop.yml').read_text()
26	publisher = (root / 'scripts/publish-desktop-github-release.sh').read_text()
27	exception = (root / 'scripts/manual-desktop-exception.sh').read_text()
28	for workflow in (stable, desktop):
29	block = workflow.split(' desktop_manual_only:', 1)[1].split('\n\n', 1)[0]
30	assert 'default: false' in block
31	# One owner decides which tags may skip Authenticode, so an exception
32	# cannot drift between the orchestrator, the publisher, and the release.
33	assert 'scripts/manual-desktop-exception.sh validate' in workflow
34	assert '7278072720a2dc7a31cce0eec18c1eacc149c0e0' in exception
35	verifier = (root / 'scripts/verify-stable-release-artifacts.sh').read_text()
36	# Postflight reads the same allowlist and asserts the update pointers never
37	# serve the manual release, instead of naming one release's prior version.
38	assert 'manual-desktop-exception.sh" validate "$desktop_tag"' in verifier
39	assert '1.38.8' not in verifier and 'v1.38.7' not in verifier
40	assert 'inputs.allow_recovery' in stable.split('name: Restrict manual Desktop distribution', 1)[1].split('- name:', 1)[0]
41	assert stable.count('desktop_manual_only: ${{ inputs.desktop_manual_only \|\| false }}') == 2
42	assert "HAS_CERTUM: ${{ secrets.CERTUM_USERNAME != '' && secrets.CERTUM_OTP_URI != '' && secrets.CERTUM_KEY_ID != '' && !inputs.desktop_manual_only }}" in desktop
43	assert desktop.index('name: Validate signing mode') < desktop.index('name: Build and package')
44	assert "inputs.orchestrated }}\" != \"true\"" in desktop
45	assert 'manual-download only' in desktop
46	manual_exit = desktop.index('if [ "$DESKTOP_MANUAL_ONLY" = "true" ]; then', desktop.index('name: Mirror immutable assets'))
47	assert manual_exit < desktop.index('validate_current_pointer()', manual_exit)
48	assert 'pointer_moved=false' in desktop[manual_exit:manual_exit + 350]
49	attach = desktop.split('name: Attach desktop manifest to matching CLI release', 1)[1].split('env:', 1)[0]
50	assert '!inputs.desktop_manual_only' in attach
51	manual_publish = publisher.split('if [ "${DESKTOP_MANUAL_ONLY:-false}" = "true" ]; then', 1)[1].split('elif', 1)[0]
52	assert 'manual-desktop-exception.sh" validate "$tag"' in manual_publish
53	assert 'args+=(--latest=false)' in manual_publish
54	assert 'name: Sign artifacts (minisign)' in desktop
55	PY
56	[ "$(grep -Ec '^ environment: release$' "$repo_root/.github/workflows/release-stable.yml")" = "1" ]
57	test ! -e "$repo_root/.github/workflows/release-stable-trigger.yml"
58	candidate="$repo_root/.github/workflows/release-candidate.yml"
59	python3 - "$repo_root" <<'PY'
60	import pathlib, re, sys
61	root = pathlib.Path(sys.argv[1]) / '.github/workflows'
62	levels = {'none': 0, 'read': 1, 'write': 2}
63
64	def permissions(text, indent):
65	match = re.search(r'(?m)^' + ' ' * indent + r'permissions:\n((?:' + ' ' * (indent + 2) + r'[^\n]*\n)+)', text)
66	if not match:
67	return None
68	return {key: levels[value] for key, value in re.findall(r'([\w-]+): (none\|read\|write)', match[1])}
69
70	desktop = (root / 'release-desktop.yml').read_text()
71	required = permissions(desktop, 0)
72	for block in re.split(r'(?m)^ [\w-]+:\n', desktop.split('\njobs:\n', 1)[1])[1:]:
73	for key, value in (permissions(block, 4) or {}).items():
74	required[key] = max(required.get(key, 0), value)
75	# Conditions cannot hide a nested permission escalation at workflow parsing.
76	# Cover both preparation and the current/legacy publishing entrypoints.
77	for name in ('release-candidate.yml', 'release-promote.yml', 'release-stable.yml'):
78	workflow = (root / name).read_text()
79	default = permissions(workflow, 0)
80	calls = 0
81	for block in re.split(r'(?m)^ [\w-]+:\n', workflow.split('\njobs:\n', 1)[1])[1:]:
82	if 'uses: ./.github/workflows/release-desktop.yml' not in block:
83	continue
84	calls += 1
85	explicit = permissions(block, 4)
86	effective = default if explicit is None else explicit
87	for key, value in required.items():
88	assert effective.get(key, 0) >= value, f'{name}: Desktop call cannot grant {key} at required level {value}'
89	assert calls, f'{name}: expected a Desktop call'
90	PY
91	promote="$repo_root/.github/workflows/release-promote.yml"
92	verify="$repo_root/.github/workflows/release-verify.yml"
93	rehearsal_verify="$repo_root/.github/workflows/release-candidate-verify.yml"
94	for workflow in "$candidate" "$promote" "$verify" "$rehearsal_verify"; do test -s "$workflow"; done
95	candidate_dispatch="$(sed -n '/workflow_dispatch:/,/^ push:/p' "$candidate")"
96	[ "$(grep -Ec '^ [a-z_]+:$' <<<"$candidate_dispatch")" = "2" ]
97	grep -Fq 'required: true' <<<"$(sed -n '/^ version:/,/^ rehearsal:/p' <<<"$candidate_dispatch")"
98	grep -Fq 'required: false' <<<"$(sed -n '/^ rehearsal:/,$p' <<<"$candidate_dispatch")"
99	! grep -Fq 'inputs.source_sha' "$candidate"
100	! grep -Fq 'pull_request_target' "$candidate"
101	grep -Fq 'branches: [main-v2]' "$candidate"
102	grep -Fq -- '- release-notes/releases.json' "$candidate"
103	grep -Fq 'actions/attest-build-provenance@v3' "$candidate"
104	grep -Fq 'bash scripts/validate-release-control-plane.sh' "$candidate"
105	preflight_line="$(grep -n -m1 'bash scripts/validate-release-control-plane.sh' "$candidate" \| cut -d: -f1)"
106	source_ci_line="$(grep -n -m1 'run: bash scripts/verify-release-push-ci.sh' "$candidate" \| cut -d: -f1)"
107	[ "$preflight_line" -lt "$source_ci_line" ]
108	! grep -Fq 'source_sha="$(git rev-parse origin/main-v2)"' "$candidate"
109	grep -Fq 'retention-days: 30' "$candidate"
110	grep -Fq 'retention-days: 90' "$candidate"
111	grep -Fq 'name: ${{ needs.resolve.outputs.artifact_namespace }}-evidence-${{ needs.resolve.outputs.candidate_id }}' "$candidate"
112	grep -Fq 'RELEASE_EVIDENCE_ARTIFACT_ID: ${{ steps.evidence.outputs.artifact-id }}' "$candidate"
113	grep -Fq 'node scripts/resolve-release-candidate.mjs resolve-rehearsal' "$rehearsal_verify"
114	grep -Fq 'node scripts/release-candidate.mjs verify-rehearsal' "$rehearsal_verify"
115	grep -Fq 'node scripts/verify-release-artifact-archive.mjs' "$rehearsal_verify"
116	! grep -Eq 'environment: release\|release-candidate-tags\.sh activate\|publish-(desktop\|homebrew)\|npm publish' "$rehearsal_verify"
117	grep -Fq 'gh attestation verify' "$promote"
118	grep -Fq 'bash scripts/release-candidate-tags.sh check' "$promote"
119	grep -Fq 'bash scripts/release-candidate-tags.sh activate' "$promote"
120	grep -Fq 'git push --atomic "$remote"' "$repo_root/scripts/release-candidate-tags.sh"
121	[ "$(grep -Ec '^ environment: release$' "$promote")" = "1" ]
122	grep -Fq 'group: stable-release-publication' "$promote"
123	grep -Fq 'VERIFY_PUBLIC_SITE_ONLY: "true"' "$promote"
124	grep -Fq 'release-publication-ledger-' "$promote"
125	grep -Fq 'release-publication-timing-' "$promote"
126	grep -Fq 'release-candidate-timing-' "$candidate"
127	grep -Fq 'immutable-complete-newer-pointer-preserved' "$promote"
128	grep -Fq 'RELEASE_REVOKED_CANDIDATES' "$candidate"
129	grep -Fq 'PUSH_SHA: ${{ github.sha }}' "$candidate"
130	grep -Fq 'node scripts/resolve-release-candidate.mjs active "$candidate_id"' "$candidate"
131	grep -Fq 'The sealed record exists but its payload expired; preparing fresh files.' "$candidate"
132	grep -Fq 'RELEASE_REVOKED_CANDIDATES' "$promote"
133	grep -Fq 'run: bash scripts/verify-stable-release-artifacts.sh' "$verify"
134	grep -Fq 'RELEASE_OPERATION: recover' "$verify"
135	grep -Fq -- '--dump-dom' "$repo_root/scripts/verify-stable-release-artifacts.sh"
136	grep -Eq 'ALLOW_STABLE_RECOVERY:.*inputs\.allow_recovery' \
137	"$repo_root/.github/workflows/release-stable.yml"
138	grep -Fq 'bash scripts/validate-stable-candidate.sh "$RELEASE_VERSION" "$RELEASE_SHA"' \
139	"$repo_root/.github/workflows/release-stable.yml"
140	grep -Fq 'bash scripts/verify-release-push-ci.sh "$RELEASE_SHA"' \
141	"$repo_root/.github/workflows/release-stable.yml"
142	grep -Fq 'if: ${{ !inputs.allow_recovery }}' \
143	"$repo_root/.github/workflows/release-stable.yml"
144	test -x "$repo_root/scripts/validate-stable-candidate.sh"
145	test -x "$repo_root/scripts/verify-release-push-ci.sh"
146	test -x "$repo_root/scripts/validate-release-control-plane.sh"
147	test -x "$repo_root/scripts/finalize-windows-signed-candidate.sh"
148	for retired in release-preview.yml release-cli-trigger.yml release-desktop-trigger.yml; do
149	test ! -e "$repo_root/.github/workflows/$retired"
150	done
151	npm_events="$(sed -n '/^on:/,/^permissions:/p' "$repo_root/.github/workflows/release-npm.yml")"
152	! grep -Eq 'push:\|npm-v\-\' <<<"$npm_events"
153	grep -Eq '^name: Prepare release$' "$repo_root/.github/workflows/prepare-release-notes.yml"
154	[ "$(grep -Fc 'git merge --no-edit origin/main-v2' "$repo_root/.github/workflows/prepare-release-notes.yml")" = "0" ]
155	grep -Fq 'RELEASE_NOTES_SOURCE_SHA=$source_sha' "$repo_root/.github/workflows/prepare-release-notes.yml"
156	grep -Fq -- '--to "$RELEASE_NOTES_SOURCE_SHA"' "$repo_root/.github/workflows/prepare-release-notes.yml"
157	notes_dispatch="$(sed -n '/workflow_dispatch:/,/permissions:/p' "$repo_root/.github/workflows/prepare-release-notes.yml")"
158	[ "$(grep -Ec '^ [a-z_]+:$' <<<"$notes_dispatch")" = "1" ]
159	grep -Fq 'GitHub Actions could not open the PR; the reviewed branch is preserved.' \
160	"$repo_root/.github/workflows/prepare-release-notes.yml"
161	if grep -Eq '^ push:$' "$repo_root/.github/workflows/release-stable.yml" \|\|
162	grep -Eq '^ push:$' "$repo_root/.github/workflows/release.yml" \|\|
163	grep -Eq '^ push:$' "$repo_root/.github/workflows/release-desktop.yml"; then
164	echo "production workflow must be dispatched on protected main-v2, not run on a tag origin" >&2
165	exit 1
166	fi
167	for workflow in release.yml release-npm.yml release-desktop.yml; do
168	grep -Eq 'github\.workflow_ref' "$repo_root/.github/workflows/$workflow"
169	grep -Eq 'github\.ref_protected' "$repo_root/.github/workflows/$workflow"
170	grep -Eq 'inputs\.approved_sha' "$repo_root/.github/workflows/$workflow"
171	grep -Eq 'verify-release-tag\.sh' "$repo_root/.github/workflows/$workflow"
172	grep -Eq 'release-\{1\}\.yml' "$repo_root/.github/workflows/$workflow"
173	done
174	for workflow in release.yml release-npm.yml; do
175	grep -Eq "needs\.cache-guard\.result == 'success'" "$repo_root/.github/workflows/$workflow"
176	done
177	if grep -Eq '^ cache-guard:\|needs\.cache-guard' "$repo_root/.github/workflows/release-desktop.yml"; then
178	echo "Desktop must reuse the orchestrator cache/docs evidence instead of executing candidate guard scripts twice" >&2
179	exit 1
180	fi
181	grep -Eq 'options: \[stable\]' "$repo_root/.github/workflows/release.yml"
182	cli_channel="$(grep -A6 -E '^ channel:' "$repo_root/.github/workflows/release.yml")"
183	grep -Eq 'default: stable' <<<"$cli_channel"
184	grep -Eq '^ environment: release$' "$repo_root/.github/workflows/release.yml"
185	grep -Eq 'GORELEASER_CURRENT_TAG:.*needs\.resolve\.outputs\.tag' \
186	"$repo_root/.github/workflows/release.yml"
187	grep -Eq 'bash scripts/resolve-cli-release\.sh' "$repo_root/.github/workflows/release.yml"
188	grep -Eq 'git merge-base --is-ancestor.*origin/main-v2' "$repo_root/.github/workflows/release.yml"
189	grep -Eq 'CLI Preview must tag current main-v2' "$repo_root/.github/workflows/release.yml"
190	grep -Fq 'ALLOW_PREVIEW_RECOVERY: ${{ inputs.allow_preview_recovery }}' "$repo_root/.github/workflows/release.yml"
191	grep -Eq 'Preview recovery requires the approved Preview orchestrator' "$repo_root/.github/workflows/release.yml"
192	grep -Eq "channel == 'stable'.*HOMEBREW_TAP_TOKEN" "$repo_root/.github/workflows/release.yml"
193	grep -Fq 'name: Isolate release-control checkout from product git state' \
194	"$repo_root/.github/workflows/release.yml"
195	grep -Fq "grep -qxF '/release-control/'" "$repo_root/.github/workflows/release.yml"
196	grep -Fq 'git check-ignore -q release-control/' "$repo_root/.github/workflows/release.yml"
197	release_control_isolation_line="$(
198	grep -n -m1 'name: Isolate release-control checkout from product git state' \
199	"$repo_root/.github/workflows/release.yml" \| cut -d: -f1
200	)"
201	goreleaser_action_line="$(
202	grep -n -m1 'uses: goreleaser/goreleaser-action@' \
203	"$repo_root/.github/workflows/release.yml" \| cut -d: -f1
204	)"
205	[ "$release_control_isolation_line" -lt "$goreleaser_action_line" ]
206
207	# A protected control-plane checkout must remain available to the workflow
208	# without making the immutable product checkout dirty for GoReleaser.
209	mkdir -p "$test_root/product-checkout/release-control"
210	git init -q "$test_root/product-checkout"
211	printf 'control plane\n' >"$test_root/product-checkout/release-control/marker"
212	[ "$(git -C "$test_root/product-checkout" status --porcelain --untracked-files=all)" = \
213	'?? release-control/marker' ]
214	product_git_common_dir="$(
215	git -C "$test_root/product-checkout" rev-parse --path-format=absolute --git-common-dir
216	)"
217	product_exclude="$product_git_common_dir/info/exclude"
218	printf '%s\n' '/release-control/' >>"$product_exclude"
219	git -C "$test_root/product-checkout" check-ignore -q release-control/
220	[ -z "$(git -C "$test_root/product-checkout" status --porcelain --untracked-files=all)" ]
221	grep -Eq "needs\.build\.result == 'success'" "$repo_root/.github/workflows/release-desktop.yml"
222	grep -Eq "needs\.publish\.result == 'success'" "$repo_root/.github/workflows/release-desktop.yml"
223	grep -Eq 'options: \[stable\]' "$repo_root/.github/workflows/release-desktop.yml"
224	desktop_dispatch="$(sed -n '/^ workflow_dispatch:/,/^ workflow_call:/p' "$repo_root/.github/workflows/release-desktop.yml")"
225	if grep -Eqi 'preview\|canary' <<<"$desktop_dispatch"; then
226	echo "Standalone Desktop dispatch must not expose a Preview or Canary choice" >&2
227	exit 1
228	fi
229	grep -Eq '^ resolve:$' "$repo_root/.github/workflows/release-desktop.yml"
230	grep -Eq 'sha:.*steps\.candidate\.outputs\.sha' "$repo_root/.github/workflows/release-desktop.yml"
231	grep -Fq 'bash scripts/resolve-desktop-candidate.sh' "$repo_root/.github/workflows/release-desktop.yml"
232	grep -Fq 'name: Smoke-test packaged Electron startup' "$repo_root/.github/workflows/release-desktop.yml"
233	grep -Eq '^ windows-build:$' "$repo_root/.github/workflows/release-desktop.yml"
234	grep -Eq '^ windows-sign:$' "$repo_root/.github/workflows/release-desktop.yml"
235	windows_sign="$(sed -n '/^ windows-sign:/,/^ windows-runtime-acceptance:/p' "$repo_root/.github/workflows/release-desktop.yml")"
236	grep -Fq 'needs: [resolve, windows-build, signing-contract]' <<<"$windows_sign"
237	grep -Fq 'desktop/build/electron/${{ matrix.name }}/app' "$repo_root/.github/workflows/release-desktop.yml"
238	grep -Fq 'node desktop/packaging/smoke.mjs' "$repo_root/.github/workflows/release-desktop.yml"
239	grep -Fq -- '--service desktop/build/bin/reasonix-desktop.exe' "$repo_root/.github/workflows/release-desktop.yml"
240	grep -Fq 'node desktop/packaging/smoke.mjs "$RUNNER_TEMP/desktop-startup/Reasonix.app"' "$repo_root/.github/workflows/release-desktop.yml"
241	grep -Fq 'xvfb-run -a node desktop/packaging/smoke.mjs' "$repo_root/.github/workflows/release-desktop.yml"
242	test ! -e "$repo_root/scripts/test-webview2-approval-smoke.ps1"
243	# The Wails-era WebView2/WebKitGTK native smoke harnesses are retired with the
244	# old shell; the packaged Electron startup smoke replaces them.
245	test ! -e "$repo_root/scripts/test-webview2-native-smoke.ps1"
246	test ! -e "$repo_root/scripts/test-transcript-selection-webview2.ps1"
247	test ! -e "$repo_root/.github/workflows/transcript-native-smoke.yml"
248	grep -Fq 'name: Package Electron shell for native startup smoke' "$repo_root/.github/workflows/ci.yml"
249	grep -Fq 'name: Smoke-test Electron native startup' "$repo_root/.github/workflows/ci.yml"
250	grep -Fq 'node packaging/package.mjs windows/amd64 v0.0.0-ci canary' \
251	"$repo_root/.github/workflows/ci.yml"
252	grep -Fq -- '-X main.version=v0.0.0-ci -X main.channel=canary' "$repo_root/.github/workflows/ci.yml"
253	grep -Fq 'node packaging/smoke.mjs build/electron/windows-amd64/app --service build/bin/reasonix-desktop.exe' \
254	"$repo_root/.github/workflows/ci.yml"
255	grep -Fq 'node packaging/verify.mjs ../dist/Reasonix-darwin-arm64.zip' \
256	"$repo_root/.github/workflows/ci.yml"
257	grep -Fq 'node packaging/verify.mjs ../dist/Reasonix-windows-amd64.zip' \
258	"$repo_root/.github/workflows/ci.yml"
259	grep -Fq 'node packaging/signing-files.mjs build/windows/signing-payload --check' \
260	"$repo_root/.github/workflows/ci.yml"
261	if grep -Fq 'wails build' "$repo_root/.github/workflows/ci.yml"; then
262	echo "CI must package the Electron shell, not wails build" >&2
263	exit 1
264	fi
265	for retired_review_gate in \
266	"$repo_root/.github/workflows/cross-boundary-review.yml" \
267	"$repo_root/.github/workflows/cross-boundary-review-signal.yml" \
268	"$repo_root/.github/scripts/cross-boundary-review.cjs" \
269	"$repo_root/.github/scripts/cross-boundary-review.test.cjs"; do
270	if [ -e "$retired_review_gate" ]; then
271	echo "Retired cross-boundary review gate still exists: $retired_review_gate" >&2
272	exit 1
273	fi
274	done
275	! grep -Fq 'cross-boundary-review' "$repo_root/.github/workflows/ci.yml"
276	! grep -Fq 'independent cross-boundary review' "$repo_root/.github/pull_request_template.md"
277	desktop_build_line="$(grep -n -m1 'name: Build and package' "$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1)"
278	electron_smoke_line="$(grep -n -m1 'name: Smoke-test packaged Electron startup' "$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1)"
279	signing_upload_line="$(grep -n -m1 'name: Upload Windows signing inputs' "$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1)"
280	[ "$desktop_build_line" -lt "$electron_smoke_line" ]
281	[ "$electron_smoke_line" -lt "$signing_upload_line" ]
282	[ "$(grep -Fc 'IN_ORCHESTRATOR: ${{ inputs.orchestrator }}' "$repo_root/.github/workflows/release-desktop.yml")" = "3" ]
283	[ "$(grep -Fc 'name: Revalidate immutable Desktop candidate' "$repo_root/.github/workflows/release-desktop.yml")" = "2" ]
284	[ "$(grep -Fc 'ref: ${{ needs.resolve.outputs.sha }}' "$repo_root/.github/workflows/release-desktop.yml")" -ge 4 ]
285	[ "$(grep -Ec '^ path: release-control$' "$repo_root/.github/workflows/release-desktop.yml")" -ge "5" ]
286	grep -Fq 'name: Checkout protected release verifier' "$repo_root/.github/workflows/release-desktop.yml"
287	grep -Fq 'scripts/desktop-release-artifacts.mjs' "$repo_root/.github/workflows/release-desktop.yml"
288	if grep -Fq 'test-webview2-native-smoke.ps1' "$repo_root/.github/workflows/release-desktop.yml"; then
289	echo "Desktop release must smoke the packaged Electron shell, not the Wails/WebView2 harness" >&2
290	exit 1
291	fi
292	grep -Fq 'finalize-windows-signed-candidate.sh' "$repo_root/.github/workflows/release-desktop.yml"
293	grep -Fq 'verify-windows-authenticode.ps1' "$repo_root/scripts/finalize-windows-signed-candidate.sh"
294	[ "$(grep -Fc 'ref: ${{ github.workflow_sha }}' "$repo_root/.github/workflows/release-desktop.yml")" -ge 2 ]
295	[ "$(grep -Fc 'bash release-control/scripts/resolve-desktop-candidate.sh' "$repo_root/.github/workflows/release-desktop.yml")" = "2" ]
296	[ "$(grep -Fc 'RELEASE_TAG: ${{ inputs.approved_cli_tag }}' "$repo_root/.github/workflows/release-desktop.yml")" = "3" ]
297	desktop_mirror="$(sed -n '/^ mirror:/,$p' "$repo_root/.github/workflows/release-desktop.yml")"
298	if grep -Fq 'RELEASE_TAG: ${{ inputs.tag }}' <<<"$desktop_mirror"; then
299	echo "Desktop mirror must revalidate the orchestrator-approved CLI tag" >&2
300	exit 1
301	fi
302	desktop_publish="$(sed -n '/name: publish release/,/name: mirror to R2/p' "$repo_root/.github/workflows/release-desktop.yml")"
303	if grep -Eq 'bash scripts/(resolve-desktop-candidate\|validate-desktop-release-manifest\|publish-desktop-github-release)\.sh' <<<"$desktop_publish"; then
304	echo "Desktop publish job uses candidate-controlled release scripts" >&2
305	exit 1
306	fi
307	if grep -Eq 'bash scripts/(resolve-desktop-candidate\|validate-desktop-release-manifest\|verify-desktop-release-directory\|decide-desktop-pointer-update)\.sh' <<<"$desktop_mirror"; then
308	echo "Desktop mirror job uses candidate-controlled release scripts" >&2
309	exit 1
310	fi
311	if grep -Fq 'ref: ${{ inputs.approved_sha \|\| inputs.tag \|\| github.ref }}' \
312	"$repo_root/.github/workflows/release-desktop.yml"; then
313	echo "Desktop jobs must checkout the resolved immutable candidate SHA" >&2
314	exit 1
315	fi
316	grep -Fq "group: release-desktop-\${{ (inputs.channel == 'preview' \|\| inputs.channel == 'canary') && 'preview' \|\| 'stable' }}" \
317	"$repo_root/.github/workflows/release-desktop.yml"
318	grep -Eq 'IN_PRODUCTION_SIGNING_SMOKE:.*inputs\.production_signing_smoke' \
319	"$repo_root/.github/workflows/release-desktop.yml"
320	grep -Eq 'IN_SIGNING_PREFLIGHT:.*inputs\.signing_preflight' \
321	"$repo_root/.github/workflows/release-desktop.yml"
322	grep -Fq "group: release-npm-\${{ inputs.channel \|\| 'next' }}" \
323	"$repo_root/.github/workflows/release-npm.yml"
324	npm_dispatch="$(sed -n '/^ workflow_dispatch:/,/^ workflow_call:/p' "$repo_root/.github/workflows/release-npm.yml")"
325	grep -Eq 'default: stable' <<<"$npm_dispatch"
326	if grep -Eq '^ - canary$' <<<"$npm_dispatch"; then
327	echo "Standalone npm dispatch must not expose public Canary publication" >&2
328	exit 1
329	fi
330	grep -Fq 'if: ${{ !inputs.orchestrated }}' "$repo_root/.github/workflows/release-npm.yml"
331	grep -Fq 'Publish or recover immutable npm packages' "$repo_root/.github/workflows/release-npm.yml"
332	npm_cache_guard="$(sed -n '/^ cache-guard:/,/^ npm:/p' "$repo_root/.github/workflows/release-npm.yml")"
333	if grep -Fq 'RECOVERY_CONTROL_SHA' <<<"$npm_cache_guard"; then
334	echo "npm recovery control plane must load in the publisher job after candidate checkout" >&2
335	exit 1
336	fi
337	npm_job="$(sed -n '/^ npm:/,$p' "$repo_root/.github/workflows/release-npm.yml")"
338	grep -Fq 'RECOVERY_CONTROL_SHA: ${{ github.workflow_sha }}' <<<"$npm_job"
339	grep -Fq 'git restore --source="$RECOVERY_CONTROL_SHA"' <<<"$npm_job"
340	for recovery_script in npm/publish.mjs scripts/finalize-npm-official-release.mjs; do
341	grep -Fq "$recovery_script" <<<"$npm_job"
342	done
343	# Orchestrated Stable recovery needs the same protected publisher repair as a
344	# standalone run; the immutable product checkout must not select the old helper.
345	npm_control_step="$(sed -n '/ - name: Load approved npm publication control plane/,/ - uses: actions\/setup-go@v7/p' "$repo_root/.github/workflows/release-npm.yml")"
346	[ -n "$npm_control_step" ]
347	if grep -q 'if:' <<<"$npm_control_step"; then
348	echo "npm publication control plane must load for orchestrated recovery too" >&2
349	exit 1
350	fi
351	grep -Fq 'publishPackages' "$repo_root/npm/build.mjs"
352	grep -Fq 'thumbprint: ${{ secrets.CERTUM_KEY_ID }}' "$repo_root/.github/workflows/release-desktop.yml"
353	grep -Eq 'SIGNPATH_RELEASE_SIGNING_ATTESTATION does not match' "$repo_root/.github/workflows/release-desktop.yml"
354	grep -Eq '^ signing_preflight:$' "$repo_root/.github/workflows/release-desktop.yml"
355	grep -Eq '^ signing_preflight_verified:$' "$repo_root/.github/workflows/release-desktop.yml"
356	grep -Eq '^ signing-contract:$' "$repo_root/.github/workflows/release-desktop.yml"
357	grep -Eq '^ attest-signing-contract:$' "$repo_root/.github/workflows/release-desktop.yml"
358	grep -Eq '^ production_signing_smoke:$' "$repo_root/.github/workflows/release-desktop.yml"
359	grep -Eq "needs\.build\.result == 'success'.!inputs\.production_signing_smoke.!inputs\.signing_preflight" \
360	"$repo_root/.github/workflows/release-desktop.yml"
361	! grep -Eq 'signpath/github-action-submit-signing-request\|secrets.SIGNPATH_API_TOKEN\|complete-signpath-request\.ps1' "$repo_root/.github/workflows/release-desktop.yml"
362	grep -Fq 'uses: ./release-control/.github/actions/setup-certum' "$repo_root/.github/workflows/release-desktop.yml"
363	grep -Fq 'sign-certum.ps1" -PayloadDirectory' "$repo_root/scripts/finalize-windows-signed-candidate.sh"
364	grep -Fq 'sign-certum.ps1" -FilePath' "$repo_root/scripts/finalize-windows-signed-candidate.sh"
365	grep -Fq -- '-ExpectedThumbprint "$CERTUM_KEY_ID"' "$repo_root/scripts/finalize-windows-signed-candidate.sh"
366	grep -Eq '^ signpath-preflight:$' "$repo_root/.github/workflows/release-stable.yml"
367	grep -Eq 'signing_preflight: true' "$repo_root/.github/workflows/release-stable.yml"
368	grep -Eq 'signing_preflight_verified: true' "$repo_root/.github/workflows/release-stable.yml"
369	grep -Eq 'needs: \[authorize, signpath-preflight\]' "$repo_root/.github/workflows/release-stable.yml"
370	grep -Eq 'name: Require R2 for Preview' "$repo_root/.github/workflows/release-desktop.yml"
371	grep -Eq "channel == 'preview'.*HAS_R2 != 'true'" "$repo_root/.github/workflows/release-desktop.yml"
372	grep -Eq 'name: Validate generated manifest before publication' "$repo_root/.github/workflows/release-desktop.yml"
373	grep -Eq 'name: Validate R2 manifest before upload' "$repo_root/.github/workflows/release-desktop.yml"
374	grep -Fq 'scripts/publish-desktop-github-release.sh' "$repo_root/.github/workflows/release-desktop.yml"
375	if grep -Eq 'gh release create .*dist/' "$repo_root/.github/workflows/release-desktop.yml"; then
376	echo "Desktop release publication must recover an existing GitHub release" >&2
377	exit 1
378	fi
379	grep -Fq 'scripts/decide-desktop-pointer-update.sh' "$repo_root/.github/workflows/release-desktop.yml"
380	grep -Fq 'scripts/verify-desktop-release-directory.sh' "$repo_root/.github/workflows/release-desktop.yml"
381	grep -Fq 'scripts/compare-desktop-release-manifests.sh' "$repo_root/.github/workflows/release-desktop.yml"
382	grep -Fq 'go -C release-control/desktop build -o "$signature_verifier" ./cmd/sign' \
383	"$repo_root/.github/workflows/release-desktop.yml"
384	grep -Fq 'verify_signature_directory assets' "$repo_root/.github/workflows/release-desktop.yml"
385	grep -Fq 'verify_signature_directory "$existing_directory"' \
386	"$repo_root/.github/workflows/release-desktop.yml"
387	grep -Fq -- '--allow-authenticated-payload-differences' \
388	"$repo_root/.github/workflows/release-desktop.yml"
389	grep -Fq 'cp "$payload" "assets/$payload_relative"' "$repo_root/.github/workflows/release-desktop.yml"
390	grep -Fq 'cp "$signature" "assets/$relative"' "$repo_root/.github/workflows/release-desktop.yml"
391	grep -Fq 'verify-desktop-release-manifest-assets.sh' "$repo_root/.github/workflows/release-desktop.yml"
392	grep -Fq 'verify_signature_directory "$published_directory"' \
393	"$repo_root/.github/workflows/release-desktop.yml"
394	manifest_adoption_line="$(grep -nF 'cp "$existing_directory/latest.json" assets/latest.json' \
395	"$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1)"
396	authenticated_compare_line="$(grep -nF -- '--allow-authenticated-payload-differences assets "$existing_directory"' \
397	"$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1)"
398	if [ -z "$manifest_adoption_line" ] \|\| [ -z "$authenticated_compare_line" ] \|\|
399	[ "$manifest_adoption_line" -ge "$authenticated_compare_line" ]; then
400	echo "Desktop recovery must adopt a validated existing manifest before directory comparison" >&2
401	exit 1
402	fi
403	grep -Fq 'download_optional "preview/latest.json"' "$repo_root/.github/workflows/release-desktop.yml"
404	grep -Fq 'download_optional "canary/latest.json"' "$repo_root/.github/workflows/release-desktop.yml"
405	grep -Fq '"legacy-${current_channel}" "$current_version" "$current_base"' \
406	"$repo_root/.github/workflows/release-desktop.yml"
407	grep -Fq 'legacy-preview "$current_version" "$legacy_preview_base"' \
408	"$repo_root/.github/workflows/release-desktop.yml"
409	grep -Fq 'publish_pointer canary' "$repo_root/.github/workflows/release-desktop.yml"
410	grep -Fq 'publish_pointer preview' "$repo_root/.github/workflows/release-desktop.yml"
411	grep -Fq 'cmp -s /tmp/reasonix-desktop-canary-latest.json /tmp/reasonix-desktop-preview-latest.json' \
412	"$repo_root/.github/workflows/release-desktop.yml"
413	grep -Fq 'steps.mirror_r2.outputs.pointer_moved' "$repo_root/.github/workflows/release-desktop.yml"
414	if grep -Fq 'aws s3 cp assets/ "s3://${R2_BUCKET}/preview/"' "$repo_root/.github/workflows/release-desktop.yml" \|\|
415	grep -Fq 'aws s3 cp assets/ "s3://${R2_BUCKET}/canary/"' "$repo_root/.github/workflows/release-desktop.yml"; then
416	echo "Desktop public pointers must contain only latest.json, not mutable asset copies" >&2
417	exit 1
418	fi
419
420	desktop_generated_validation_line="$(
421	grep -n -m1 'name: Validate generated manifest before publication' \
422	"$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1
423	)"
424	desktop_github_publish_line="$(
425	grep -n -m1 'name: Publish GitHub release' \
426	"$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1
427	)"
428	desktop_r2_validation_line="$(
429	grep -n -m1 'name: Validate R2 manifest before upload' \
430	"$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1
431	)"
432	desktop_r2_upload_line="$(
433	grep -n -m1 'name: Mirror immutable assets and advance R2 pointer' \
434	"$repo_root/.github/workflows/release-desktop.yml" \| cut -d: -f1
435	)"
436	[ "$desktop_generated_validation_line" -lt "$desktop_github_publish_line" ]
437	[ "$desktop_r2_validation_line" -lt "$desktop_r2_upload_line" ]
438	grep -Eq '^ postflight:$' "$repo_root/.github/workflows/release-stable.yml"
439	grep -Eq 'verify-stable-release-artifacts\.sh' "$repo_root/.github/workflows/release-stable.yml"
440	grep -Eq 'name: Upload reviewed release notes' "$repo_root/.github/workflows/release-stable.yml"
441	grep -Eq 'name: orchestrator-reviewed-release-notes' "$repo_root/.github/workflows/release-stable.yml"
442	for channel in cli npm desktop; do
443	grep -Eq '^ publish_'"$channel"':' "$repo_root/.github/workflows/release-stable.yml"
444	grep -Eq "inputs\.publish_$channel" "$repo_root/.github/workflows/release-stable.yml"
445	done
446
447	# The checked-in SignPath policy contract is the single source of truth for the
448	# provider allowlist and every top-level workflow that can reach signing.
449	go run ./cmd/signpath-contract validate
450	contract_fingerprint="$(go run ./cmd/signpath-contract fingerprint)"
451	grep -Eq '^v1:[0-9a-f]{64}$' <<<"$contract_fingerprint"
452	grep -Eq 'public postflight will still verify it' "$repo_root/.github/workflows/release-stable.yml"
453	for workflow in release.yml release-desktop.yml; do
454	grep -Eq 'name: Download orchestrator-reviewed release notes' "$repo_root/.github/workflows/$workflow"
455	grep -Eq 'name: orchestrator-reviewed-release-notes' "$repo_root/.github/workflows/$workflow"
456	grep -Eq 'if: \$\{\{ !inputs\.orchestrated' "$repo_root/.github/workflows/$workflow"
457	done
458
459	# CLI clients and the website consume separate Stable and Preview pointers. The
460	# publisher must validate every public archive before moving a pointer, retain an
461	# immutable per-tag record, and leave both public pointers untouched for RCs.
462	cli_release_workflow="$repo_root/.github/workflows/release.yml"
463	grep -Eq 'name: Publish CLI release metadata to R2' "$cli_release_workflow"
464	grep -Fq 'cli/releases/${TAG}/latest.json' "$cli_release_workflow"
465	grep -Fq 'cli/${channel}/latest.json' "$cli_release_workflow"
466	grep -Fq "group: release-cli-\${{ inputs.channel \|\| 'stable' }}" "$cli_release_workflow"
467	grep -Fq 'scripts/decide-cli-pointer-update.sh' "$cli_release_workflow"
468	grep -Fq 'scripts/validate-cli-release-manifest.sh' "$cli_release_workflow"
469	grep -Fq 'scripts/compare-cli-release-manifests.sh' "$cli_release_workflow"
470	grep -Eq 'name: Decide whether CLI artifacts need publication' "$cli_release_workflow"
471	grep -Fq 'path: release-control' "$cli_release_workflow"
472	grep -Fq 'ref: ${{ github.workflow_sha }}' "$cli_release_workflow"
473	grep -Fq 'release-control/scripts/decide-cli-release-publication.sh' "$cli_release_workflow"
474	cli_goreleaser="$(sed -n '/^ goreleaser:/,$p' "$cli_release_workflow")"
475	if grep -Fq 'bash scripts/decide-cli-release-publication.sh' <<<"$cli_goreleaser"; then
476	echo "CLI recovery uses candidate-controlled publication policy" >&2
477	exit 1
478	fi
479	grep -Fq "steps.publication.outputs.decision == 'publish' && inputs.candidate_artifact_name == ''" "$cli_release_workflow"
480	grep -Fq "steps.publication.outputs.decision == 'publish' && inputs.candidate_artifact_name != ''" "$cli_release_workflow"
481	grep -Fq 'immutable CLI release metadata for $TAG already exists with different content' "$cli_release_workflow"
482	grep -Fq 'cmp -s /tmp/cli-release.json /tmp/cli-release.pointer.json' "$cli_release_workflow"
483	grep -Eq 'internal CLI release .*Stable and Preview pointers remain unchanged' "$cli_release_workflow"
484	cli_public_validation_line="$(
485	grep -n -m1 'if \[ -n "\$channel" \]' "$cli_release_workflow" \| cut -d: -f1
486	)"
487	cli_immutable_upload_line="$(
488	grep -n -m1 'cli/releases/${TAG}/latest.json' "$cli_release_workflow" \| cut -d: -f1
489	)"
490	[ "$cli_public_validation_line" -lt "$cli_immutable_upload_line" ]
491	pointer_compare="$repo_root/scripts/compare-cli-release-tags.sh"
492	test -x "$pointer_compare"
493	[ "$(bash "$pointer_compare" stable v1.2.4 v1.2.3)" = "update" ]
494	[ "$(bash "$pointer_compare" stable v1.2.3 v1.2.3)" = "skip" ]
495	[ "$(bash "$pointer_compare" stable v1.2.2 v1.2.3)" = "skip" ]
496	[ "$(bash "$pointer_compare" stable v100000000000000000000.0.0 v99999999999999999999.999.999)" = "update" ]
497	[ "$(bash "$pointer_compare" preview v1.2.3-preview.11 v1.2.3-preview.9)" = "update" ]
498	[ "$(bash "$pointer_compare" preview v1.2.3-preview.9 v1.2.3-preview.9)" = "skip" ]
499	[ "$(bash "$pointer_compare" preview v1.2.3-preview.8 v1.2.3-preview.9)" = "skip" ]
500	[ "$(bash "$pointer_compare" stable v1.2.3 "")" = "update" ]
501	if bash "$pointer_compare" stable v1.2.3 v1.2.3-preview.1 >/dev/null 2>&1; then
502	echo "stable comparator accepted a preview pointer" >&2
503	exit 1
504	fi
505	if bash "$pointer_compare" preview v1.2.3-preview.1 v1.2.3 >/dev/null 2>&1; then
506	echo "preview comparator accepted a stable pointer" >&2
507	exit 1
508	fi
509	if bash "$pointer_compare" stable v01.2.3 v1.2.2 >/dev/null 2>&1; then
510	echo "stable comparator accepted a non-canonical tag" >&2
511	exit 1
512	fi
513	cli_pointer_decider="$repo_root/scripts/decide-cli-pointer-update.sh"
514	test -x "$cli_pointer_decider"
515	cli_pointer_candidate="$test_root/cli-pointer-candidate.json"
516	cli_pointer_older="$test_root/cli-pointer-older.json"
517	cli_pointer_equal="$test_root/cli-pointer-equal.json"
518	cli_pointer_equal_different="$test_root/cli-pointer-equal-different.json"
519	cli_pointer_newer="$test_root/cli-pointer-newer.json"
520	printf '{"tag_name":"v1.3.0","marker":"candidate"}\n' >"$cli_pointer_candidate"
521	printf '{"tag_name":"v1.2.9","marker":"older"}\n' >"$cli_pointer_older"
522	cp "$cli_pointer_candidate" "$cli_pointer_equal"
523	printf '{"tag_name":"v1.3.0","marker":"different"}\n' >"$cli_pointer_equal_different"
524	printf '{"tag_name":"v1.3.1","marker":"newer"}\n' >"$cli_pointer_newer"
525	[ "$(bash "$cli_pointer_decider" stable "$cli_pointer_candidate" -)" = "update" ]
526	[ "$(bash "$cli_pointer_decider" stable "$cli_pointer_candidate" "$cli_pointer_older")" = "update" ]
527	[ "$(bash "$cli_pointer_decider" stable "$cli_pointer_candidate" "$cli_pointer_equal")" = "skip" ]
528	[ "$(bash "$cli_pointer_decider" stable "$cli_pointer_candidate" "$cli_pointer_equal_different")" = "update" ]
529	[ "$(bash "$cli_pointer_decider" stable "$cli_pointer_candidate" "$cli_pointer_newer")" = "skip" ]
530	if bash "$cli_pointer_decider" stable "$cli_pointer_candidate" "$test_root/missing-cli-pointer.json" >/dev/null 2>&1; then
531	echo "CLI pointer decider accepted an unreadable manifest path" >&2
532	exit 1
533	fi
534	for asset in \
535	reasonix-darwin-amd64.tar.gz \
536	reasonix-darwin-arm64.tar.gz \
537	reasonix-linux-amd64.tar.gz \
538	reasonix-linux-arm64.tar.gz \
539	reasonix-windows-amd64.zip \
540	reasonix-windows-arm64.zip \
541	SHA256SUMS; do
542	grep -Fq "\"$asset\"" "$cli_release_workflow"
543	done
544	publication_decider="$repo_root/scripts/decide-cli-release-publication.sh"
545	test -x "$publication_decider"
546	[ "$(bash "$publication_decider" stable v1.2.3 esengine/DeepSeek-Reasonix - -)" = "publish" ]
547	publication_checksums="$test_root/cli-publication-SHA256SUMS"
548	publication_release="$test_root/cli-publication-release.json"
549	publication_hash="0000000000000000000000000000000000000000000000000000000000000000"
550	publication_assets='[
551	"reasonix-darwin-amd64.tar.gz",
552	"reasonix-darwin-arm64.tar.gz",
553	"reasonix-linux-amd64.tar.gz",
554	"reasonix-linux-arm64.tar.gz",
555	"reasonix-windows-amd64.zip",
556	"reasonix-windows-arm64.zip",
557	"SHA256SUMS"
558	]'
559	for asset in \
560	reasonix-darwin-amd64.tar.gz \
561	reasonix-darwin-arm64.tar.gz \
562	reasonix-linux-amd64.tar.gz \
563	reasonix-linux-arm64.tar.gz \
564	reasonix-windows-amd64.zip \
565	reasonix-windows-arm64.zip; do
566	printf '%s %s\n' "$publication_hash" "$asset"
567	done >"$publication_checksums"
568	publication_checksum_hash="$(shasum -a 256 "$publication_checksums" \| awk '{print $1}')"
569	jq -n \
570	--arg repo "esengine/DeepSeek-Reasonix" \
571	--arg tag "v1.2.3" \
572	--arg archive_hash "$publication_hash" \
573	--arg checksum_hash "$publication_checksum_hash" \
574	--argjson names "$publication_assets" '
575	{
576	tag_name: $tag,
577	draft: false,
578	prerelease: false,
579	html_url: ("https://github.com/" + $repo + "/releases/tag/" + $tag),
580	assets: [
581	$names[] as $name \|
582	{
583	name: $name,
584	state: "uploaded",
585	size: 1,
586	browser_download_url:
587	("https://github.com/" + $repo + "/releases/download/" + $tag + "/" + $name),
588	digest: ("sha256:" + (if $name == "SHA256SUMS" then $checksum_hash else $archive_hash end))
589	}
590	]
591	}
592	' >"$publication_release"
593	[ "$(bash "$publication_decider" stable v1.2.3 esengine/DeepSeek-Reasonix \
594	"$publication_release" "$publication_checksums")" = "reuse" ]
595	publication_preview="$test_root/cli-publication-preview-release.json"
596	jq '.tag_name = "v1.2.3-preview.4" \| .prerelease = true \|
597	.html_url = "https://github.com/esengine/DeepSeek-Reasonix/releases/tag/v1.2.3-preview.4" \|
598	.assets \|= map(.browser_download_url \|= sub("/v1.2.3/"; "/v1.2.3-preview.4/"))' \
599	"$publication_release" >"$publication_preview"
600	[ "$(bash "$publication_decider" preview v1.2.3-preview.4 esengine/DeepSeek-Reasonix \
601	"$publication_preview" "$publication_checksums")" = "reuse" ]
602	publication_rc="$test_root/cli-publication-rc-release.json"
603	jq '.tag_name = "v1.2.3-rc.1" \| .prerelease = true \|
604	.html_url = "https://github.com/esengine/DeepSeek-Reasonix/releases/tag/v1.2.3-rc.1" \|
605	.assets \|= map(.browser_download_url \|= sub("/v1.2.3/"; "/v1.2.3-rc.1/"))' \
606	"$publication_release" >"$publication_rc"
607	[ "$(bash "$publication_decider" any v1.2.3-rc.1 esengine/DeepSeek-Reasonix \
608	"$publication_rc" "$publication_checksums")" = "reuse" ]
609	publication_partial="$test_root/cli-publication-partial-release.json"
610	jq '.assets \|= map(select(.name != "reasonix-linux-arm64.tar.gz"))' \
611	"$publication_release" >"$publication_partial"
612	if bash "$publication_decider" stable v1.2.3 esengine/DeepSeek-Reasonix \
613	"$publication_partial" "$publication_checksums" >/dev/null 2>&1; then
614	echo "CLI publication decider accepted a partial existing release" >&2
615	exit 1
616	fi
617	publication_bad_checksums="$test_root/cli-publication-bad-SHA256SUMS"
618	sed '1s/^0/1/' "$publication_checksums" >"$publication_bad_checksums"
619	if bash "$publication_decider" stable v1.2.3 esengine/DeepSeek-Reasonix \
620	"$publication_release" "$publication_bad_checksums" >/dev/null 2>&1; then
621	echo "CLI publication decider accepted mismatched checksums" >&2
622	exit 1
623	fi
624	manifest_validator="$repo_root/scripts/validate-cli-release-manifest.sh"
625	manifest_comparator="$repo_root/scripts/compare-cli-release-manifests.sh"
626	test -x "$manifest_validator"
627	test -x "$manifest_comparator"
628	manifest_assets='[
629	"reasonix-darwin-amd64.tar.gz",
630	"reasonix-darwin-arm64.tar.gz",
631	"reasonix-linux-amd64.tar.gz",
632	"reasonix-linux-arm64.tar.gz",
633	"reasonix-windows-amd64.zip",
634	"reasonix-windows-arm64.zip",
635	"SHA256SUMS"
636	]'
637	manifest_repo="esengine/DeepSeek-Reasonix"
638	manifest_tag="v1.2.3"
639	manifest_file="$test_root/cli-release-manifest.json"
640	jq -n \
641	--arg repo "$manifest_repo" \
642	--arg tag "$manifest_tag" \
643	--argjson names "$manifest_assets" '
644	{
645	tag_name: $tag,
646	prerelease: false,
647	html_url: ("https://github.com/" + $repo + "/releases/tag/" + $tag),
648	release_notes_url: ("https://reasonix.io/changelog/" + $tag + "/"),
649	assets: [
650	$names[] as $name \|
651	{
652	name: $name,
653	browser_download_url:
654	("https://github.com/" + $repo + "/releases/download/" + $tag + "/" + $name),
655	size: 1
656	}
657	]
658	}
659	' >"$manifest_file"
660	bash "$manifest_validator" stable "$manifest_tag" "$manifest_repo" "$manifest_file"
661	bash "$manifest_validator" any "$manifest_tag" "$manifest_repo" "$manifest_file"
662
663	legacy_manifest="$test_root/cli-release-manifest-legacy.json"
664	jq 'del(.release_notes_url)' "$manifest_file" >"$legacy_manifest"
665	bash "$manifest_validator" legacy-stable "$manifest_tag" "$manifest_repo" "$legacy_manifest"
666	bash "$manifest_comparator" "$manifest_file" "$legacy_manifest"
667	if bash "$manifest_validator" stable "$manifest_tag" "$manifest_repo" "$legacy_manifest" >/dev/null 2>&1; then
668	echo "strict CLI manifest validator accepted a legacy manifest" >&2
669	exit 1
670	fi
671	wrong_legacy_notes="$test_root/cli-release-manifest-wrong-legacy-notes.json"
672	jq '.release_notes_url = "https://reasonix.io/changelog/v9.9.9/"' \
673	"$manifest_file" >"$wrong_legacy_notes"
674	if bash "$manifest_validator" legacy-stable "$manifest_tag" "$manifest_repo" \
675	"$wrong_legacy_notes" >/dev/null 2>&1; then
676	echo "legacy CLI manifest validator accepted a mismatched release-notes URL" >&2
677	exit 1
678	fi
679	if bash "$manifest_comparator" "$manifest_file" "$wrong_legacy_notes" >/dev/null 2>&1; then
680	echo "CLI manifest comparator ignored a non-legacy difference" >&2
681	exit 1
682	fi
683
684	rc_manifest_tag="v1.2.4-rc.1"
685	rc_notes_tag="v1.2.4"
686	rc_manifest="$test_root/cli-release-manifest-rc.json"
687	jq \
688	--arg repo "$manifest_repo" \
689	--arg tag "$rc_manifest_tag" \
690	--arg notes_tag "$rc_notes_tag" '
691	.tag_name = $tag \|
692	.prerelease = true \|
693	.html_url = ("https://github.com/" + $repo + "/releases/tag/" + $tag) \|
694	.release_notes_url = ("https://reasonix.io/changelog/" + $notes_tag + "/") \|
695	.assets \|= map(
696	.browser_download_url =
697	("https://github.com/" + $repo + "/releases/download/" + $tag + "/" + .name)
698	)
699	' "$manifest_file" >"$rc_manifest"
700	bash "$manifest_validator" any "$rc_manifest_tag" "$manifest_repo" "$rc_manifest" "$rc_notes_tag"
701
702	expect_invalid_cli_manifest() {
703	local description="$1"
704	local file="$2"
705	if bash "$manifest_validator" stable "$manifest_tag" "$manifest_repo" "$file" >/dev/null 2>&1; then
706	echo "CLI manifest validator accepted $description" >&2
707	exit 1
708	fi
709	}
710
711	jq '.assets[0].browser_download_url = "https://github.com/attacker/project/releases/download/v1.2.3/reasonix-darwin-amd64.tar.gz"' \
712	"$manifest_file" >"$test_root/wrong-repository.json"
713	expect_invalid_cli_manifest "an asset from another repository" "$test_root/wrong-repository.json"
714	jq '.assets[0].browser_download_url = "https://github.com/esengine/DeepSeek-Reasonix/releases/download/v9.9.9/reasonix-darwin-amd64.tar.gz"' \
715	"$manifest_file" >"$test_root/wrong-tag.json"
716	expect_invalid_cli_manifest "an asset from another tag" "$test_root/wrong-tag.json"
717	jq '.assets = .assets[:-1]' "$manifest_file" >"$test_root/missing-asset.json"
718	expect_invalid_cli_manifest "a missing required asset" "$test_root/missing-asset.json"
719	jq '.assets[0].size = 0' "$manifest_file" >"$test_root/empty-asset.json"
720	expect_invalid_cli_manifest "a zero-byte asset" "$test_root/empty-asset.json"
721	jq '.assets[0].size = 1073741825' "$manifest_file" >"$test_root/oversized-asset.json"
722	expect_invalid_cli_manifest "an asset above the release size limit" "$test_root/oversized-asset.json"
723	jq '.assets[0].size = 9007199254740992' "$manifest_file" >"$test_root/unsafe-integer-asset.json"
724	expect_invalid_cli_manifest "an asset size above the JavaScript safe-integer range" \
725	"$test_root/unsafe-integer-asset.json"
726	if bash "$manifest_validator" preview "$manifest_tag" "$manifest_repo" "$manifest_file" >/dev/null 2>&1; then
727	echo "CLI manifest validator accepted a Stable manifest as Preview" >&2
728	exit 1
729	fi
730
731	# Desktop public pointers use the same strict channel grammar, but their assets
732	# must also share one exact immutable directory and complete integrity metadata.
733	desktop_compare="$repo_root/scripts/compare-desktop-release-versions.sh"
734	test -x "$desktop_compare"
735	[ "$(bash "$desktop_compare" stable v1.2.4 v1.2.3)" = "update" ]
736	[ "$(bash "$desktop_compare" stable v1.2.3 v1.2.3)" = "skip" ]
737	[ "$(bash "$desktop_compare" stable v1.2.2 v1.2.3)" = "skip" ]
738	[ "$(bash "$desktop_compare" stable v100000000000000000000.0.0 v99999999999999999999.999.999)" = "update" ]
739	[ "$(bash "$desktop_compare" preview v1.2.3-preview.11 v1.2.3-preview.9)" = "update" ]
740	[ "$(bash "$desktop_compare" preview v1.2.3-preview.9 v1.2.3-preview.9)" = "skip" ]
741	[ "$(bash "$desktop_compare" preview v1.2.3-preview.8 v1.2.3-preview.9)" = "skip" ]
742	[ "$(bash "$desktop_compare" preview v1.2.3-preview.1 "")" = "update" ]
743	if bash "$desktop_compare" stable v1.2.3 v1.2.3-preview.1 >/dev/null 2>&1; then
744	echo "Desktop Stable comparator accepted a Preview pointer" >&2
745	exit 1
746	fi
747	if bash "$desktop_compare" preview v1.2.3-preview.1 v1.2.3 >/dev/null 2>&1; then
748	echo "Desktop Preview comparator accepted a Stable pointer" >&2
749	exit 1
750	fi
751	if bash "$desktop_compare" preview v1.2.3-preview.01 v1.2.3-preview.1 >/dev/null 2>&1; then
752	echo "Desktop comparator accepted a non-canonical Preview version" >&2
753	exit 1
754	fi
755
756	desktop_pointer_decider="$repo_root/scripts/decide-desktop-pointer-update.sh"
757	test -x "$desktop_pointer_decider"
758	preview_candidate="$test_root/preview-candidate.json"
759	preview_older="$test_root/preview-older.json"
760	preview_equal="$test_root/preview-equal.json"
761	preview_equal_different="$test_root/preview-equal-different.json"
762	preview_newer="$test_root/preview-newer.json"
763	printf '{"version":"v1.3.0-preview.42","marker":"candidate"}\n' >"$preview_candidate"
764	printf '{"version":"v1.3.0-preview.41","marker":"older"}\n' >"$preview_older"
765	cp "$preview_candidate" "$preview_equal"
766	printf '{"version":"v1.3.0-preview.42","marker":"different"}\n' >"$preview_equal_different"
767	printf '{"version":"v1.3.0-preview.43","marker":"newer"}\n' >"$preview_newer"
768	preview_newer_equal="$test_root/preview-newer-equal.json"
769	preview_newer_conflict="$test_root/preview-newer-conflict.json"
770	cp "$preview_newer" "$preview_newer_equal"
771	printf '{"version":"v1.3.0-preview.43","marker":"conflict"}\n' >"$preview_newer_conflict"
772	expect_pointer_source() {
773	local expected="$1"
774	shift
775	local decision
776	local action
777	local source
778	decision="$(bash "$desktop_pointer_decider" "$@")"
779	IFS=$'\t' read -r action source <<<"$decision"
780	[ "$action" = "update" ]
781	[ "$source" = "$expected" ]
782	}
783	expect_pointer_source "$preview_candidate" preview "$preview_candidate" - -
784	expect_pointer_source "$preview_candidate" preview "$preview_candidate" "$preview_older" "$preview_older"
785	expect_pointer_source "$preview_candidate" preview "$preview_candidate" "$preview_equal" "$preview_older"
786	expect_pointer_source "$preview_candidate" preview "$preview_candidate" "$preview_older" "$preview_equal"
787	[ "$(bash "$desktop_pointer_decider" preview "$preview_candidate" "$preview_equal" "$preview_equal")" = "skip" ]
788	expect_pointer_source "$preview_candidate" preview "$preview_candidate" "$preview_equal" "$preview_equal_different"
789	expect_pointer_source "$preview_newer" preview "$preview_candidate" "$preview_newer" "$preview_older"
790	[ "$(bash "$desktop_pointer_decider" preview "$preview_candidate" "$preview_newer" "$preview_newer_equal")" = "skip" ]
791	if bash "$desktop_pointer_decider" preview "$preview_candidate" "$preview_newer" \
792	"$preview_newer_conflict" >/dev/null 2>&1; then
793	echo "Desktop Preview pointer decider accepted conflicting equal newer aliases" >&2
794	exit 1
795	fi
796	if bash "$desktop_pointer_decider" preview "$preview_candidate" "$test_root/missing.json" - >/dev/null 2>&1; then
797	echo "Desktop Preview pointer decider accepted an unreadable manifest path" >&2
798	exit 1
799	fi
800
801	stable_candidate="$test_root/stable-candidate.json"
802	stable_older="$test_root/stable-older.json"
803	stable_equal="$test_root/stable-equal.json"
804	stable_equal_different="$test_root/stable-equal-different.json"
805	stable_newer="$test_root/stable-newer.json"
806	printf '{"version":"v1.3.0","marker":"candidate"}\n' >"$stable_candidate"
807	printf '{"version":"v1.2.9","marker":"older"}\n' >"$stable_older"
808	cp "$stable_candidate" "$stable_equal"
809	printf '{"version":"v1.3.0","marker":"different"}\n' >"$stable_equal_different"
810	printf '{"version":"v1.3.1","marker":"newer"}\n' >"$stable_newer"
811	expect_pointer_source "$stable_candidate" stable "$stable_candidate" -
812	expect_pointer_source "$stable_candidate" stable "$stable_candidate" "$stable_older"
813	[ "$(bash "$desktop_pointer_decider" stable "$stable_candidate" "$stable_equal")" = "skip" ]
814	expect_pointer_source "$stable_candidate" stable "$stable_candidate" "$stable_equal_different"
815	[ "$(bash "$desktop_pointer_decider" stable "$stable_candidate" "$stable_newer")" = "skip" ]
816
817	desktop_directory_verifier="$repo_root/scripts/verify-desktop-release-directory.sh"
818	test -x "$desktop_directory_verifier"
819	candidate_directory="$test_root/desktop-directory-candidate"
820	existing_directory="$test_root/desktop-directory-existing"
821	mkdir -p "$candidate_directory" "$existing_directory"
822	printf 'asset-a\n' >"$candidate_directory/a"
823	printf 'asset-b\n' >"$candidate_directory/b"
824	cp "$candidate_directory/a" "$existing_directory/a"
825	bash "$desktop_directory_verifier" --allow-missing "$candidate_directory" "$existing_directory"
826	if bash "$desktop_directory_verifier" "$candidate_directory" "$existing_directory" >/dev/null 2>&1; then
827	echo "Desktop release directory verifier accepted a missing object in exact mode" >&2
828	exit 1
829	fi
830	cp "$candidate_directory/b" "$existing_directory/b"
831	bash "$desktop_directory_verifier" "$candidate_directory" "$existing_directory"
832	printf 'candidate-signature\n' >"$candidate_directory/a.minisig"
833	printf 'existing-signature\n' >"$existing_directory/a.minisig"
834	if bash "$desktop_directory_verifier" "$candidate_directory" "$existing_directory" >/dev/null 2>&1; then
835	echo "Desktop release directory verifier accepted a byte-distinct signature without opt-in" >&2
836	exit 1
837	fi
838	bash "$desktop_directory_verifier" --allow-signature-differences \
839	"$candidate_directory" "$existing_directory"
840	printf 'candidate-payload\n' >"$candidate_directory/signed"
841	printf 'existing-payload\n' >"$existing_directory/signed"
842	printf 'candidate-signature\n' >"$candidate_directory/signed.minisig"
843	printf 'existing-signature\n' >"$existing_directory/signed.minisig"
844	if bash "$desktop_directory_verifier" --allow-signature-differences \
845	"$candidate_directory" "$existing_directory" >/dev/null 2>&1; then
846	echo "Desktop release directory verifier accepted a byte-distinct payload without authenticated-payload opt-in" >&2
847	exit 1
848	fi
849	bash "$desktop_directory_verifier" --allow-authenticated-payload-differences \
850	"$candidate_directory" "$existing_directory"
851	printf '' >"$existing_directory/signed.minisig"
852	if bash "$desktop_directory_verifier" --allow-authenticated-payload-differences \
853	"$candidate_directory" "$existing_directory" >/dev/null 2>&1; then
854	echo "Desktop release directory verifier accepted a byte-distinct payload with an empty signature" >&2
855	exit 1
856	fi
857	cp "$candidate_directory/signed" "$existing_directory/signed"
858	cp "$candidate_directory/signed.minisig" "$existing_directory/signed.minisig"
859	printf '' >"$existing_directory/a.minisig"
860	if bash "$desktop_directory_verifier" --allow-signature-differences \
861	"$candidate_directory" "$existing_directory" >/dev/null 2>&1; then
862	echo "Desktop release directory verifier accepted an empty recovered signature" >&2
863	exit 1
864	fi
865	cp "$candidate_directory/a.minisig" "$existing_directory/a.minisig"
866	printf 'conflict\n' >"$existing_directory/a"
867	if bash "$desktop_directory_verifier" --allow-missing "$candidate_directory" "$existing_directory" >/dev/null 2>&1; then
868	echo "Desktop release directory verifier accepted conflicting immutable content" >&2
869	exit 1
870	fi
871	cp "$candidate_directory/a" "$existing_directory/a"
872	printf 'unexpected\n' >"$existing_directory/unexpected"
873	if bash "$desktop_directory_verifier" --allow-missing "$candidate_directory" "$existing_directory" >/dev/null 2>&1; then
874	echo "Desktop release directory verifier accepted an unexpected immutable object" >&2
875	exit 1
876	fi
877
878	recovery_candidate_directory="$test_root/desktop-directory-recovery-candidate"
879	recovery_existing_directory="$test_root/desktop-directory-recovery-existing"
880	mkdir -p "$recovery_candidate_directory" "$recovery_existing_directory"
881	printf 'candidate-payload\n' >"$recovery_candidate_directory/artifact"
882	printf 'candidate-signature\n' >"$recovery_candidate_directory/artifact.minisig"
883	printf 'existing-payload\n' >"$recovery_existing_directory/artifact"
884	printf 'existing-signature\n' >"$recovery_existing_directory/artifact.minisig"
885	printf '{"version":"v1.2.3","release_notes_url":"https://reasonix.io/changelog/v1.2.3/","marker":"candidate"}\n' \
886	>"$recovery_candidate_directory/latest.json"
887	printf '{"version":"v1.2.3","release_notes_url":"https://reasonix.io/changelog/v1.2.3/","marker":"existing"}\n' \
888	>"$recovery_existing_directory/latest.json"
889	if bash "$desktop_directory_verifier" --allow-missing --allow-legacy-manifest \
890	--allow-authenticated-payload-differences \
891	"$recovery_candidate_directory" "$recovery_existing_directory" >/dev/null 2>&1; then
892	echo "Desktop recovery accepted a conflicting manifest before validated adoption" >&2
893	exit 1
894	fi
895	cp "$recovery_existing_directory/latest.json" "$recovery_candidate_directory/latest.json"
896	bash "$desktop_directory_verifier" --allow-missing --allow-legacy-manifest \
897	--allow-authenticated-payload-differences \
898	"$recovery_candidate_directory" "$recovery_existing_directory"
899
900	legacy_candidate_directory="$test_root/desktop-directory-legacy-candidate"
901	legacy_existing_directory="$test_root/desktop-directory-legacy-existing"
902	mkdir -p "$legacy_candidate_directory" "$legacy_existing_directory"
903	printf 'asset\n' >"$legacy_candidate_directory/artifact"
904	cp "$legacy_candidate_directory/artifact" "$legacy_existing_directory/artifact"
905	jq -n '{
906	version: "v1.2.3",
907	release_notes_url: "https://reasonix.io/changelog/v1.2.3/",
908	platforms: {"darwin-arm64": {size: 42}}
909	}' >"$legacy_candidate_directory/latest.json"
910	jq 'del(.release_notes_url)' "$legacy_candidate_directory/latest.json" \
911	>"$legacy_existing_directory/latest.json"
912	bash "$desktop_directory_verifier" --allow-legacy-manifest \
913	"$legacy_candidate_directory" "$legacy_existing_directory"
914	if bash "$desktop_directory_verifier" \
915	"$legacy_candidate_directory" "$legacy_existing_directory" >/dev/null 2>&1; then
916	echo "Desktop release directory verifier accepted a legacy manifest without opt-in" >&2
917	exit 1
918	fi
919	jq '.platforms["darwin-arm64"].size = 99' "$legacy_existing_directory/latest.json" \
920	>"$legacy_existing_directory/latest-conflict.json"
921	mv "$legacy_existing_directory/latest-conflict.json" "$legacy_existing_directory/latest.json"
922	if bash "$desktop_directory_verifier" --allow-legacy-manifest \
923	"$legacy_candidate_directory" "$legacy_existing_directory" >/dev/null 2>&1; then
924	echo "Desktop release directory verifier ignored a non-legacy manifest difference" >&2
925	exit 1
926	fi
927
928	desktop_manifest_asset_verifier="$repo_root/scripts/verify-desktop-release-manifest-assets.sh"
929	test -x "$desktop_manifest_asset_verifier"
930	manifest_asset_directory="$test_root/desktop-manifest-assets"
931	mkdir -p "$manifest_asset_directory"
932	printf 'manifest-bound-payload\n' >"$manifest_asset_directory/payload.zip"
933	printf 'manifest-bound-native\n' >"$manifest_asset_directory/payload.deb"
934	manifest_asset_sha="$(shasum -a 256 "$manifest_asset_directory/payload.zip" \| awk '{print $1}')"
935	manifest_asset_size="$(wc -c <"$manifest_asset_directory/payload.zip" \| tr -d '[:space:]')"
936	manifest_native_sha="$(shasum -a 256 "$manifest_asset_directory/payload.deb" \| awk '{print $1}')"
937	manifest_native_size="$(wc -c <"$manifest_asset_directory/payload.deb" \| tr -d '[:space:]')"
938	jq -n \
939	--arg url "https://dl.reasonix.io/desktop-v1.2.3/payload.zip" \
940	--arg sha "$manifest_asset_sha" \
941	--argjson size "$manifest_asset_size" \
942	--arg native_url "https://dl.reasonix.io/desktop-v1.2.3/payload.deb" \
943	--arg native_sha "$manifest_native_sha" \
944	--argjson native_size "$manifest_native_size" \
945	'{
946	platforms: {test: {url: $url, sha256: $sha, size: $size}},
947	native_packages: {test: {url: $native_url, sha256: $native_sha, size: $native_size}},
948	downloads: {}
949	}' \
950	>"$manifest_asset_directory/latest.json"
951	bash "$desktop_manifest_asset_verifier" \
952	"$manifest_asset_directory/latest.json" "$manifest_asset_directory"
953	printf 'corrupted-payload\n' >"$manifest_asset_directory/payload.zip"
954	if bash "$desktop_manifest_asset_verifier" \
955	"$manifest_asset_directory/latest.json" "$manifest_asset_directory" >/dev/null 2>&1; then
956	echo "Desktop release manifest asset verifier accepted a mismatched payload" >&2
957	exit 1
958	fi
959
960	# GitHub release recovery uses the same immutable-subset rule: an interrupted
961	# release may fill missing assets, while conflicting or extra assets fail closed.
962	desktop_github_publisher="$repo_root/scripts/publish-desktop-github-release.sh"
963	test -x "$desktop_github_publisher"
964	fake_gh_bin="$test_root/fake-gh-bin"
965	fake_gh_state="$test_root/fake-gh-state"
966	mkdir -p "$fake_gh_bin" "$fake_gh_state"
967	cat >"$fake_gh_bin/gh" <<'FAKE_GH'
968	#!/usr/bin/env bash
969	set -euo pipefail
970	state="${FAKE_GH_STATE:?FAKE_GH_STATE is required}"
971	command="${1:-}"
972	shift \|\| true
973
974	release_json() {
975	if [ ! -f "$state/release.json" ]; then
976	echo "HTTP 404: Not Found" >&2
977	return 1
978	fi
979	assets='[]'
980	if compgen -G "$state/assets/*" >/dev/null; then
981	for asset in "$state/assets"/*; do
982	assets="$(jq -cn --argjson current "$assets" --arg name "$(basename "$asset")" \
983	'$current + [{name: $name}]')"
984	done
985	fi
986	jq --argjson assets "$assets" '. + {assets: $assets}' "$state/release.json"
987	}
988
989	case "$command" in
990	api)
991	release_json
992	;;
993	release)
994	subcommand="${1:-}"
995	shift \|\| true
996	case "$subcommand" in
997	create)
998	tag="${1:?tag is required}"
999	shift
1000	title=""
1001	notes_file=""
1002	prerelease=false
1003	while [ "$#" -gt 0 ]; do
1004	case "$1" in
1005	-R \| --repo \| --title \| --notes-file)
1006	option="$1"
1007	value="${2:?$option requires a value}"
1008	shift 2
1009	case "$option" in
1010	--title) title="$value" ;;
1011	--notes-file) notes_file="$value" ;;
1012	esac
1013	;;
1014	--prerelease)
1015	prerelease=true
1016	shift
1017	;;
1018	--latest \| --latest=false)
1019	shift
1020	;;
1021	*)
1022	echo "unexpected fake gh release create argument: $1" >&2
1023	exit 2
1024	;;
1025	esac
1026	done
1027	mkdir -p "$state/assets"
1028	jq -n --arg tag "$tag" --arg name "$title" --rawfile body "$notes_file" \
1029	--argjson prerelease "$prerelease" \
1030	'{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: $prerelease}' \
1031	>"$state/release.json"
1032	;;
1033	download)
1034	tag="${1:?tag is required}"
1035	shift
1036	pattern=""
1037	destination=""
1038	while [ "$#" -gt 0 ]; do
1039	case "$1" in
1040	-R \| --repo)
1041	shift 2
1042	;;
1043	-p \| --pattern)
1044	pattern="${2:?pattern is required}"
1045	shift 2
1046	;;
1047	-D \| --dir)
1048	destination="${2:?destination is required}"
1049	shift 2
1050	;;
1051	*)
1052	echo "unexpected fake gh release download argument: $1" >&2
1053	exit 2
1054	;;
1055	esac
1056	done
1057	test -n "$tag"
1058	mkdir -p "$destination"
1059	if [ -n "$pattern" ]; then
1060	cp "$state/assets/$pattern" "$destination/$pattern"
1061	elif compgen -G "$state/assets/*" >/dev/null; then
1062	cp "$state/assets"/* "$destination/"
1063	fi
1064	;;
1065	upload)
1066	tag="${1:?tag is required}"
1067	shift
1068	asset=""
1069	while [ "$#" -gt 0 ]; do
1070	case "$1" in
1071	-R \| --repo)
1072	shift 2
1073	;;
1074	*)
1075	asset="$1"
1076	shift
1077	;;
1078	esac
1079	done
1080	test -n "$tag"
1081	mkdir -p "$state/assets"
1082	cp "$asset" "$state/assets/$(basename "$asset")"
1083	;;
1084	*)
1085	echo "unsupported fake gh command: $command $subcommand" >&2
1086	exit 2
1087	;;
1088	esac
1089	;;
1090	*)
1091	echo "unsupported fake gh command: $command" >&2
1092	exit 2
1093	;;
1094	esac
1095	FAKE_GH
1096	chmod +x "$fake_gh_bin/gh"
1097
1098	github_candidate="$test_root/desktop-github-candidate"
1099	github_notes="$test_root/desktop-github-notes.md"
1100	mkdir -p "$github_candidate"
1101	printf 'asset-a\n' >"$github_candidate/a"
1102	printf 'asset-b\n' >"$github_candidate/b"
1103	printf 'Release notes.\n' >"$github_notes"
1104	PATH="$fake_gh_bin:$PATH" FAKE_GH_STATE="$fake_gh_state" \
1105	GITHUB_REPOSITORY=esengine/DeepSeek-Reasonix \
1106	bash "$desktop_github_publisher" desktop-v1.2.3 v1.2.3 false \
1107	"$github_notes" "$github_candidate"
1108	bash "$desktop_directory_verifier" "$github_candidate" "$fake_gh_state/assets"
1109
1110	rm -f "$fake_gh_state/assets/b"
1111	PATH="$fake_gh_bin:$PATH" FAKE_GH_STATE="$fake_gh_state" \
1112	GITHUB_REPOSITORY=esengine/DeepSeek-Reasonix \
1113	bash "$desktop_github_publisher" desktop-v1.2.3 v1.2.3 false \
1114	"$github_notes" "$github_candidate"
1115	bash "$desktop_directory_verifier" "$github_candidate" "$fake_gh_state/assets"
1116
1117	printf 'conflict\n' >"$fake_gh_state/assets/a"
1118	if PATH="$fake_gh_bin:$PATH" FAKE_GH_STATE="$fake_gh_state" \
1119	GITHUB_REPOSITORY=esengine/DeepSeek-Reasonix \
1120	bash "$desktop_github_publisher" desktop-v1.2.3 v1.2.3 false \
1121	"$github_notes" "$github_candidate" >/dev/null 2>&1; then
1122	echo "Desktop GitHub recovery accepted conflicting immutable content" >&2
1123	exit 1
1124	fi
1125	cp "$github_candidate/a" "$fake_gh_state/assets/a"
1126	printf 'unexpected\n' >"$fake_gh_state/assets/unexpected"
1127	if PATH="$fake_gh_bin:$PATH" FAKE_GH_STATE="$fake_gh_state" \
1128	GITHUB_REPOSITORY=esengine/DeepSeek-Reasonix \
1129	bash "$desktop_github_publisher" desktop-v1.2.3 v1.2.3 false \
1130	"$github_notes" "$github_candidate" >/dev/null 2>&1; then
1131	echo "Desktop GitHub recovery accepted an unexpected immutable asset" >&2
1132	exit 1
1133	fi
1134	rm -f "$fake_gh_state/assets/unexpected"
1135	jq '.name = "Wrong title"' "$fake_gh_state/release.json" >"$fake_gh_state/release.json.new"
1136	mv "$fake_gh_state/release.json.new" "$fake_gh_state/release.json"
1137	if PATH="$fake_gh_bin:$PATH" FAKE_GH_STATE="$fake_gh_state" \
1138	GITHUB_REPOSITORY=esengine/DeepSeek-Reasonix \
1139	bash "$desktop_github_publisher" desktop-v1.2.3 v1.2.3 false \
1140	"$github_notes" "$github_candidate" >/dev/null 2>&1; then
1141	echo "Desktop GitHub recovery accepted conflicting release metadata" >&2
1142	exit 1
1143	fi
1144
1145	desktop_validator="$repo_root/scripts/validate-desktop-release-manifest.sh"
1146	desktop_manifest_comparator="$repo_root/scripts/compare-desktop-release-manifests.sh"
1147	test -x "$desktop_validator"
1148	test -x "$desktop_manifest_comparator"
1149	write_desktop_manifest() {
1150	local version="$1"
1151	local base="$2"
1152	local output="$3"
1153	local notes_version="${4:-$version}"
1154	jq -n --arg version "$version" --arg notes_version "$notes_version" \
1155	--arg base "$base" --arg sha "$(printf 'a%.0s' {1..64})" '
1156	def asset($name): {
1157	url: ($base + $name),
1158	sig: ($base + $name + ".minisig"),
1159	size: 42,
1160	sha256: $sha
1161	};
1162	{
1163	version: $version,
1164	download_page: "https://reasonix.io/?download=desktop#start",
1165	release_notes_url: ("https://reasonix.io/changelog/" + $notes_version + "/"),
1166	platforms: {
1167	"darwin-arm64": asset("Reasonix-darwin-arm64.zip"),
1168	"darwin-amd64": asset("Reasonix-darwin-amd64.zip"),
1169	"windows-amd64": asset("Reasonix-windows-amd64-installer.exe"),
1170	"windows-arm64": asset("Reasonix-windows-arm64-installer.exe"),
1171	"linux-amd64": asset("Reasonix-linux-amd64.tar.gz")
1172	},
1173	native_packages: {
1174	"linux-amd64": asset("Reasonix-linux-amd64.deb")
1175	},
1176	downloads: {
1177	"Reasonix-darwin-arm64.dmg": asset("Reasonix-darwin-arm64.dmg"),
1178	"Reasonix-darwin-amd64.dmg": asset("Reasonix-darwin-amd64.dmg"),
1179	"Reasonix-darwin-universal.dmg": asset("Reasonix-darwin-universal.dmg"),
1180	"Reasonix-windows-amd64.zip": asset("Reasonix-windows-amd64.zip")
1181	}
1182	}
1183	' >"$output"
1184	}
1185
1186	desktop_stable_version="v1.2.3"
1187	desktop_stable_base="https://dl.reasonix.io/desktop-${desktop_stable_version}/"
1188	desktop_stable_manifest="$test_root/desktop-stable.json"
1189	write_desktop_manifest "$desktop_stable_version" "$desktop_stable_base" "$desktop_stable_manifest"
1190	bash "$desktop_validator" stable "$desktop_stable_version" "$desktop_stable_base" "$desktop_stable_manifest"
1191
1192	desktop_github_base="https://github.com/esengine/DeepSeek-Reasonix/releases/download/desktop-${desktop_stable_version}/"
1193	desktop_github_manifest="$test_root/desktop-stable-github.json"
1194	write_desktop_manifest "$desktop_stable_version" "$desktop_github_base" "$desktop_github_manifest"
1195	bash "$desktop_validator" stable "$desktop_stable_version" "$desktop_github_base" "$desktop_github_manifest"
1196
1197	desktop_preview_version="v1.3.0-preview.42"
1198	desktop_preview_base="https://dl.reasonix.io/desktop-${desktop_preview_version}/"
1199	desktop_preview_manifest="$test_root/desktop-preview.json"
1200	write_desktop_manifest "$desktop_preview_version" "$desktop_preview_base" "$desktop_preview_manifest"
1201	bash "$desktop_validator" preview "$desktop_preview_version" "$desktop_preview_base" "$desktop_preview_manifest"
1202
1203	desktop_rc_version="v1.3.0-rc.1"
1204	desktop_rc_notes_version="v1.3.0"
1205	desktop_rc_base="https://dl.reasonix.io/desktop-${desktop_rc_version}/"
1206	desktop_rc_manifest="$test_root/desktop-rc.json"
1207	write_desktop_manifest "$desktop_rc_version" "$desktop_rc_base" "$desktop_rc_manifest" \
1208	"$desktop_rc_notes_version"
1209	bash "$desktop_validator" any "$desktop_rc_version" "$desktop_rc_base" \
1210	"$desktop_rc_manifest" "$desktop_rc_notes_version"
1211
1212	desktop_legacy_notes_manifest="$test_root/desktop-stable-legacy-notes.json"
1213	jq 'del(.release_notes_url)' "$desktop_stable_manifest" >"$desktop_legacy_notes_manifest"
1214	bash "$desktop_validator" legacy-stable "$desktop_stable_version" \
1215	"$desktop_stable_base" "$desktop_legacy_notes_manifest"
1216	bash "$desktop_manifest_comparator" "$desktop_stable_manifest" "$desktop_legacy_notes_manifest"
1217	if bash "$desktop_validator" stable "$desktop_stable_version" "$desktop_stable_base" \
1218	"$desktop_legacy_notes_manifest" >/dev/null 2>&1; then
1219	echo "strict Desktop manifest validator accepted a legacy release-notes manifest" >&2
1220	exit 1
1221	fi
1222	jq '.release_notes_url = "https://reasonix.io/changelog/v9.9.9/"' \
1223	"$desktop_stable_manifest" >"$test_root/desktop-wrong-legacy-notes.json"
1224	if bash "$desktop_manifest_comparator" "$desktop_stable_manifest" \
1225	"$test_root/desktop-wrong-legacy-notes.json" >/dev/null 2>&1; then
1226	echo "Desktop manifest comparator ignored a non-legacy difference" >&2
1227	exit 1
1228	fi
1229
1230	expect_invalid_desktop_manifest() {
1231	local description="$1"
1232	local channel="$2"
1233	local version="$3"
1234	local base="$4"
1235	local file="$5"
1236	if bash "$desktop_validator" "$channel" "$version" "$base" "$file" >/dev/null 2>&1; then
1237	echo "Desktop manifest validator accepted $description" >&2
1238	exit 1
1239	fi
1240	}
1241
1242	jq 'del(.platforms["windows-arm64"])' "$desktop_preview_manifest" >"$test_root/desktop-missing-platform.json"
1243	expect_invalid_desktop_manifest "a missing platform" preview "$desktop_preview_version" \
1244	"$desktop_preview_base" "$test_root/desktop-missing-platform.json"
1245	jq '.platforms["darwin-arm64"].url = "https://evil.invalid/file"' \
1246	"$desktop_preview_manifest" >"$test_root/desktop-hostile-url.json"
1247	expect_invalid_desktop_manifest "a hostile URL" preview "$desktop_preview_version" \
1248	"$desktop_preview_base" "$test_root/desktop-hostile-url.json"
1249	jq '.platforms["darwin-arm64"].sig += "?mirror=1"' \
1250	"$desktop_preview_manifest" >"$test_root/desktop-bad-signature.json"
1251	expect_invalid_desktop_manifest "a mismatched signature URL" preview "$desktop_preview_version" \
1252	"$desktop_preview_base" "$test_root/desktop-bad-signature.json"
1253	jq '.native_packages["linux-amd64"].size = 0' \
1254	"$desktop_preview_manifest" >"$test_root/desktop-zero-size.json"
1255	expect_invalid_desktop_manifest "a zero-byte native package" preview "$desktop_preview_version" \
1256	"$desktop_preview_base" "$test_root/desktop-zero-size.json"
1257	jq '.native_packages["linux-amd64"].size = 1073741825' \
1258	"$desktop_preview_manifest" >"$test_root/desktop-oversized-asset.json"
1259	expect_invalid_desktop_manifest "an asset above the release size limit" preview \
1260	"$desktop_preview_version" "$desktop_preview_base" \
1261	"$test_root/desktop-oversized-asset.json"
1262	jq '.native_packages["linux-amd64"].size = 9007199254740992' \
1263	"$desktop_preview_manifest" >"$test_root/desktop-unsafe-integer-size.json"
1264	expect_invalid_desktop_manifest "an asset size above the JavaScript safe-integer range" preview \
1265	"$desktop_preview_version" "$desktop_preview_base" \
1266	"$test_root/desktop-unsafe-integer-size.json"
1267	jq '.downloads["Reasonix-darwin-universal.dmg"].sha256 = ("A" * 64)' \
1268	"$desktop_preview_manifest" >"$test_root/desktop-bad-sha.json"
1269	expect_invalid_desktop_manifest "an uppercase SHA-256" preview "$desktop_preview_version" \
1270	"$desktop_preview_base" "$test_root/desktop-bad-sha.json"
1271	jq 'del(.downloads["Reasonix-windows-amd64.zip"])' \
1272	"$desktop_preview_manifest" >"$test_root/desktop-missing-download.json"
1273	expect_invalid_desktop_manifest "a missing website download" preview "$desktop_preview_version" \
1274	"$desktop_preview_base" "$test_root/desktop-missing-download.json"
1275	jq '.platforms.extra = .platforms["darwin-arm64"]' \
1276	"$desktop_preview_manifest" >"$test_root/desktop-extra-platform.json"
1277	expect_invalid_desktop_manifest "an unexpected platform" preview "$desktop_preview_version" \
1278	"$desktop_preview_base" "$test_root/desktop-extra-platform.json"
1279	write_desktop_manifest "$desktop_preview_version" "https://dl.reasonix.io/desktop-preview/" \
1280	"$test_root/desktop-rolling-preview.json"
1281	expect_invalid_desktop_manifest "the legacy mutable Preview directory" preview "$desktop_preview_version" \
1282	"$desktop_preview_base" "$test_root/desktop-rolling-preview.json"
1283	jq 'del(.downloads)' "$test_root/desktop-rolling-preview.json" \
1284	>"$test_root/desktop-legacy-preview.json"
1285	bash "$desktop_validator" legacy-preview "$desktop_preview_version" \
1286	"https://dl.reasonix.io/desktop-preview/" "$test_root/desktop-legacy-preview.json"
1287	jq 'del(.release_notes_url, .downloads)' "$desktop_preview_manifest" \
1288	>"$test_root/desktop-legacy-preview-immutable.json"
1289	bash "$desktop_validator" legacy-preview "$desktop_preview_version" \
1290	"$desktop_preview_base" "$test_root/desktop-legacy-preview-immutable.json"
1291	jq '.release_notes_url = null' "$desktop_preview_manifest" \
1292	>"$test_root/desktop-null-legacy-preview-immutable.json"
1293	bash "$desktop_validator" legacy-preview "$desktop_preview_version" \
1294	"$desktop_preview_base" "$test_root/desktop-null-legacy-preview-immutable.json"
1295	jq 'del(.downloads)' "$desktop_stable_manifest" >"$test_root/desktop-legacy-stable.json"
1296	bash "$desktop_validator" legacy-stable "$desktop_stable_version" \
1297	"$desktop_stable_base" "$test_root/desktop-legacy-stable.json"
1298	jq '.downloads = null' "$desktop_stable_manifest" >"$test_root/desktop-null-legacy-stable.json"
1299	bash "$desktop_validator" legacy-stable "$desktop_stable_version" \
1300	"$desktop_stable_base" "$test_root/desktop-null-legacy-stable.json"
1301	jq '.downloads = {}' "$desktop_stable_manifest" >"$test_root/desktop-empty-downloads.json"
1302	expect_invalid_desktop_manifest "empty downloads in a legacy Stable manifest" legacy-stable \
1303	"$desktop_stable_version" "$desktop_stable_base" "$test_root/desktop-empty-downloads.json"
1304	expect_invalid_desktop_manifest "a legacy Stable manifest as a new publication" stable \
1305	"$desktop_stable_version" "$desktop_stable_base" "$test_root/desktop-legacy-stable.json"
1306	jq 'del(.downloads["Reasonix-windows-amd64.zip"])' \
1307	"$test_root/desktop-rolling-preview.json" >"$test_root/desktop-partial-legacy-downloads.json"
1308	expect_invalid_desktop_manifest "partial downloads in a legacy Preview manifest" legacy-preview \
1309	"$desktop_preview_version" "https://dl.reasonix.io/desktop-preview/" \
1310	"$test_root/desktop-partial-legacy-downloads.json"
1311	expect_invalid_desktop_manifest "a Preview manifest as Stable" stable "$desktop_preview_version" \
1312	"$desktop_preview_base" "$desktop_preview_manifest"
1313	expect_invalid_desktop_manifest "a non-official asset base" preview "$desktop_preview_version" \
1314	"https://cdn.invalid/desktop-${desktop_preview_version}/" "$desktop_preview_manifest"
1315
1316	# Release notes use one deterministic branch per official version. Failure to
1317	# open the PR must preserve that branch and print an exact manual handoff.
1318	prepare_notes="$repo_root/.github/workflows/prepare-release-notes.yml"
1319	generate_notes="$repo_root/scripts/generate-release-notes.mjs"
1320	if grep -Eq '^ (target_pr\|from_tag):$' "$prepare_notes"; then
1321	echo "Prepare release must expose only the official version input" >&2
1322	exit 1
1323	fi
1324	grep -Fq 'branch="release-notes/v${VERSION}"' "$prepare_notes"
1325	grep -Fq 'GitHub Actions could not open the PR; the reviewed branch is preserved.' "$prepare_notes"
1326	grep -Fq 'gh pr create --repo ${{ github.repository }} --base main-v2 --head $RELEASE_NOTES_BRANCH --fill' "$prepare_notes"
1327	grep -Eq 'GITHUB_STEP_SUMMARY' "$prepare_notes"
1328	grep -Fq 'node scripts/generate-release-notes.mjs --version "$VERSION" --to "$RELEASE_NOTES_SOURCE_SHA"' "$prepare_notes"
1329	grep -Fq 'thinking: { type: "disabled" }' "$generate_notes"
1330
1331	desktop_candidate_resolver="$repo_root/scripts/resolve-desktop-candidate.sh"
1332	test -x "$desktop_candidate_resolver"
1333
1334	git init --bare -q "$test_root/remote.git"
1335	git clone -q "$test_root/remote.git" "$test_root/repo"
1336	(
1337	cd "$test_root/repo"
1338	git config user.name "Release Workflow Test"
1339	git config user.email "release-workflow-test@example.invalid"
1340	git commit --allow-empty -q -m "candidate"
1341	git branch -M main-v2
1342	git push -q -u origin main-v2
1343
1344	git tag v1.2.3
1345	git tag npm-v1.2.3
1346	git tag -a desktop-v1.2.3 -m "desktop release"
1347	git tag v1.3.0-preview.42
1348	git push -q origin v1.2.3 npm-v1.2.3 desktop-v1.2.3 v1.3.0-preview.42
1349	GITHUB_OUTPUT="$test_root/stable.out" RELEASE_TAG=v1.2.3 "$repo_root/scripts/resolve-stable-release.sh"
1350	grep -Eq '^version=1\.2\.3$' "$test_root/stable.out"
1351	grep -Eq '^desktop_tag=desktop-v1\.2\.3$' "$test_root/stable.out"
1352	GITHUB_OUTPUT="$test_root/preview.out" RELEASE_TAG=v1.3.0-preview.42 \
1353	"$repo_root/scripts/resolve-preview-release.sh"
1354	grep -Eq '^version=1\.3\.0-preview\.42$' "$test_root/preview.out"
1355	grep -Eq '^desktop_tag=desktop-v1\.3\.0-preview\.42$' "$test_root/preview.out"
1356	grep -Eq '^npm_version=1\.3\.0-canary\.42$' "$test_root/preview.out"
1357	approved_sha="$(git rev-parse HEAD)"
1358	GITHUB_OUTPUT="$test_root/desktop-rehearsal.out" \
1359	RELEASE_CHANNEL=stable RELEASE_TAG=desktop-v1.2.3 \
1360	IN_ORCHESTRATED=true IN_ORCHESTRATOR=candidate APPROVED_SHA="$approved_sha" \
1361	CANDIDATE_PREPARATION=true CANDIDATE_REHEARSAL=true \
1362	"$desktop_candidate_resolver"
1363	grep -Eq '^sha='"$approved_sha"'$' "$test_root/desktop-rehearsal.out"
1364	if GITHUB_OUTPUT="$test_root/desktop-unsafe-rehearsal.out" \
1365	RELEASE_CHANNEL=stable RELEASE_TAG=desktop-v1.2.3 \
1366	IN_ORCHESTRATED=true IN_ORCHESTRATOR=promote APPROVED_SHA="$approved_sha" \
1367	CANDIDATE_REHEARSAL=true \
1368	"$desktop_candidate_resolver" >"$test_root/desktop-unsafe-rehearsal.log" 2>&1; then
1369	echo "rehearsal without candidate preparation unexpectedly passed" >&2
1370	exit 1
1371	fi
1372	grep -Fq 'rehearsal requires non-publishing candidate preparation' "$test_root/desktop-unsafe-rehearsal.log"
1373	GITHUB_OUTPUT="$test_root/desktop-stable-candidate.out" \
1374	RELEASE_CHANNEL=stable RELEASE_TAG=desktop-v1.2.3 \
1375	IN_ORCHESTRATED=false CALLER_EVENT_NAME=workflow_dispatch \
1376	CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1377	CALLER_SHA="$approved_sha" CALLER_WORKFLOW_SHA="$approved_sha" \
1378	"$desktop_candidate_resolver"
1379	grep -Eq '^sha='"$approved_sha"'$' "$test_root/desktop-stable-candidate.out"
1380	GITHUB_OUTPUT="$test_root/desktop-preview-candidate.out" \
1381	RELEASE_CHANNEL=preview RELEASE_TAG=desktop-v1.3.0-preview.42 \
1382	IN_ORCHESTRATED=false CALLER_EVENT_NAME=workflow_dispatch \
1383	CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1384	CALLER_SHA="$approved_sha" CALLER_WORKFLOW_SHA="$approved_sha" \
1385	"$desktop_candidate_resolver"
1386	grep -Eq '^sha='"$approved_sha"'$' "$test_root/desktop-preview-candidate.out"
1387	GITHUB_OUTPUT="$test_root/desktop-orchestrated-preview-candidate.out" \
1388	RELEASE_CHANNEL=preview RELEASE_TAG=desktop-v1.3.0-preview.42 \
1389	IN_ORCHESTRATED=true IN_ORCHESTRATOR=preview APPROVED_SHA="$approved_sha" \
1390	"$desktop_candidate_resolver"
1391	grep -Eq '^sha='"$approved_sha"'$' "$test_root/desktop-orchestrated-preview-candidate.out"
1392	if GITHUB_OUTPUT="$test_root/desktop-wrong-orchestrator-candidate.out" \
1393	RELEASE_CHANNEL=preview RELEASE_TAG=desktop-v1.3.0-preview.42 \
1394	IN_ORCHESTRATED=true IN_ORCHESTRATOR=stable APPROVED_SHA="$approved_sha" \
1395	"$desktop_candidate_resolver" >"$test_root/desktop-wrong-orchestrator-candidate.log" 2>&1; then
1396	echo "stable orchestrator unexpectedly authorized a Desktop Preview candidate" >&2
1397	exit 1
1398	fi
1399	grep -Eq 'stable orchestrator cannot authorize a Desktop preview candidate' \
1400	"$test_root/desktop-wrong-orchestrator-candidate.log"
1401	if GITHUB_OUTPUT="$test_root/desktop-unprotected-candidate.out" \
1402	RELEASE_CHANNEL=preview RELEASE_TAG=desktop-v1.3.0-preview.42 \
1403	IN_ORCHESTRATED=false CALLER_EVENT_NAME=workflow_dispatch \
1404	CALLER_REF=refs/heads/topic CALLER_REF_PROTECTED=false \
1405	CALLER_SHA="$approved_sha" CALLER_WORKFLOW_SHA="$approved_sha" \
1406	"$desktop_candidate_resolver" >"$test_root/desktop-unprotected-candidate.log" 2>&1; then
1407	echo "unprotected Desktop candidate unexpectedly passed" >&2
1408	exit 1
1409	fi
1410	grep -Eq 'standalone Desktop releases must run from protected main-v2' \
1411	"$test_root/desktop-unprotected-candidate.log"
1412	git tag desktop-v1.3.0-preview.42
1413	if GITHUB_OUTPUT="$test_root/desktop-tagged-preview-candidate.out" \
1414	RELEASE_CHANNEL=preview RELEASE_TAG=desktop-v1.3.0-preview.42 \
1415	IN_ORCHESTRATED=false CALLER_EVENT_NAME=workflow_dispatch \
1416	CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1417	CALLER_SHA="$approved_sha" CALLER_WORKFLOW_SHA="$approved_sha" \
1418	"$desktop_candidate_resolver" >"$test_root/desktop-tagged-preview-candidate.log" 2>&1; then
1419	echo "Git-tagged Desktop Preview candidate unexpectedly passed" >&2
1420	exit 1
1421	fi
1422	grep -Eq 'Desktop Preview uses an immutable asset directory, not a Git tag' \
1423	"$test_root/desktop-tagged-preview-candidate.log"
1424	git tag -d desktop-v1.3.0-preview.42 >/dev/null
1425
1426	ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/tags/v1.2.3' \
1427	EXPECTED_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/tags/v1.2.3' \
1428	CALLER_EVENT_NAME=push CALLER_REF=refs/tags/v1.2.3 CALLER_REF_PROTECTED=true \
1429	CALLER_WORKFLOW_SHA="$approved_sha" CALLER_SHA="$approved_sha" \
1430	APPROVED_CLI_TAG=v1.2.3 APPROVED_SHA="$approved_sha" \
1431	"$repo_root/scripts/verify-release-authorization.sh"
1432	ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-preview.yml@refs/heads/main-v2' \
1433	EXPECTED_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-preview.yml@refs/heads/main-v2' \
1434	CALLER_EVENT_NAME=workflow_dispatch CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1435	CALLER_WORKFLOW_SHA="$approved_sha" CALLER_SHA="$approved_sha" \
1436	APPROVED_CHANNEL=preview APPROVED_CLI_TAG=v1.3.0-preview.42 APPROVED_SHA="$approved_sha" \
1437	"$repo_root/scripts/verify-release-authorization.sh"
1438	RELEASE_TAG=desktop-v1.2.3 APPROVED_SHA="$approved_sha" \
1439	"$repo_root/scripts/verify-release-tag.sh"
1440
1441	git commit --allow-empty -q -m "release workflow fix"
1442	git push -q origin main-v2
1443	recovery_workflow_sha="$(git rev-parse HEAD)"
1444	if RELEASE_TAG=v1.3.0-preview.42 \
1445	"$repo_root/scripts/resolve-preview-release.sh" >"$test_root/stale-preview.log" 2>&1; then
1446	echo "stale Preview tag unexpectedly passed normal release resolution" >&2
1447	exit 1
1448	fi
1449	grep -Eq 'must point to current .*main-v2' "$test_root/stale-preview.log"
1450	GITHUB_OUTPUT="$test_root/preview-recovery.out" ALLOW_PREVIEW_RECOVERY=true \
1451	RELEASE_TAG=v1.3.0-preview.42 "$repo_root/scripts/resolve-preview-release.sh"
1452	grep -Eq '^sha='"$approved_sha"'$' "$test_root/preview-recovery.out"
1453	if ALLOW_PREVIEW_RECOVERY=invalid RELEASE_TAG=v1.3.0-preview.42 \
1454	"$repo_root/scripts/resolve-preview-release.sh" >"$test_root/invalid-preview-recovery.log" 2>&1; then
1455	echo "invalid Preview recovery mode unexpectedly passed" >&2
1456	exit 1
1457	fi
1458	grep -Eq 'ALLOW_PREVIEW_RECOVERY must be true or false' \
1459	"$test_root/invalid-preview-recovery.log"
1460	if GITHUB_OUTPUT="$test_root/desktop-stale-preview-candidate.out" \
1461	RELEASE_CHANNEL=preview RELEASE_TAG=desktop-v1.3.0-preview.42 \
1462	IN_ORCHESTRATED=false CALLER_EVENT_NAME=workflow_dispatch \
1463	CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1464	CALLER_SHA="$approved_sha" CALLER_WORKFLOW_SHA="$approved_sha" \
1465	"$desktop_candidate_resolver" >"$test_root/desktop-stale-preview-candidate.log" 2>&1; then
1466	echo "stale Desktop Preview candidate unexpectedly passed" >&2
1467	exit 1
1468	fi
1469	grep -Eq 'Desktop Preview must use current main-v2' \
1470	"$test_root/desktop-stale-preview-candidate.log"
1471	GITHUB_OUTPUT="$test_root/desktop-orchestrated-preview-recovery-candidate.out" \
1472	RELEASE_CHANNEL=preview RELEASE_TAG=desktop-v1.3.0-preview.42 \
1473	IN_ORCHESTRATED=true IN_ORCHESTRATOR=preview APPROVED_SHA="$approved_sha" \
1474	"$desktop_candidate_resolver"
1475	grep -Eq '^sha='"$approved_sha"'$' \
1476	"$test_root/desktop-orchestrated-preview-recovery-candidate.out"
1477	GITHUB_OUTPUT="$test_root/desktop-stable-recovery-candidate.out" \
1478	RELEASE_CHANNEL=stable RELEASE_TAG=desktop-v1.2.3 \
1479	IN_ORCHESTRATED=false CALLER_EVENT_NAME=workflow_dispatch \
1480	CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1481	CALLER_SHA="$recovery_workflow_sha" CALLER_WORKFLOW_SHA="$recovery_workflow_sha" \
1482	"$desktop_candidate_resolver"
1483	grep -Eq '^sha='"$approved_sha"'$' "$test_root/desktop-stable-recovery-candidate.out"
1484	GITHUB_OUTPUT="$test_root/stale-main.out" RELEASE_TAG=v1.2.3 \
1485	"$repo_root/scripts/resolve-stable-release.sh"
1486	grep -Eq '^sha='"$approved_sha"'$' "$test_root/stale-main.out"
1487	GITHUB_OUTPUT="$test_root/recovery.out" ALLOW_STABLE_RECOVERY=true RELEASE_TAG=v1.2.3 \
1488	"$repo_root/scripts/resolve-stable-release.sh"
1489	grep -Eq '^sha='"$approved_sha"'$' "$test_root/recovery.out"
1490	ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/heads/main-v2' \
1491	EXPECTED_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/heads/main-v2' \
1492	CALLER_EVENT_NAME=workflow_dispatch CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1493	CALLER_WORKFLOW_SHA="$recovery_workflow_sha" CALLER_SHA="$recovery_workflow_sha" \
1494	APPROVED_CLI_TAG=v1.2.3 APPROVED_SHA="$approved_sha" \
1495	"$repo_root/scripts/verify-release-authorization.sh"
1496	RELEASE_TAG=v1.2.3 APPROVED_SHA="$approved_sha" VERIFY_RELEASE_CHECKOUT=false \
1497	"$repo_root/scripts/verify-release-tag.sh"
1498	if ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/heads/main-v2' \
1499	EXPECTED_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/heads/main-v2' \
1500	CALLER_EVENT_NAME=workflow_dispatch CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true \
1501	CALLER_WORKFLOW_SHA="$approved_sha" CALLER_SHA="$recovery_workflow_sha" \
1502	APPROVED_CLI_TAG=v1.2.3 APPROVED_SHA="$approved_sha" \
1503	"$repo_root/scripts/verify-release-authorization.sh" >"$test_root/stale-workflow.log" 2>&1; then
1504	echo "stale recovery workflow unexpectedly passed release authorization" >&2
1505	exit 1
1506	fi
1507	grep -Eq 'protected caller workflow SHA is' "$test_root/stale-workflow.log"
1508
1509	if ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/heads/topic' \
1510	EXPECTED_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-stable.yml@refs/heads/topic' \
1511	CALLER_EVENT_NAME=workflow_dispatch CALLER_REF=refs/heads/topic CALLER_REF_PROTECTED=false \
1512	CALLER_WORKFLOW_SHA="$recovery_workflow_sha" CALLER_SHA="$recovery_workflow_sha" \
1513	APPROVED_CLI_TAG=v1.2.3 APPROVED_SHA="$approved_sha" \
1514	"$repo_root/scripts/verify-release-authorization.sh" >"$test_root/unprotected.log" 2>&1; then
1515	echo "unprotected caller unexpectedly passed release authorization" >&2
1516	exit 1
1517	fi
1518	grep -Eq 'caller ref is not protected' "$test_root/unprotected.log"
1519
1520	git tag v1.2.4
1521	git tag npm-v1.2.4
1522	git push -q origin v1.2.4 npm-v1.2.4
1523	if RELEASE_TAG=v1.2.4 "$repo_root/scripts/resolve-stable-release.sh" >"$test_root/missing.log" 2>&1; then
1524	echo "missing sibling tag unexpectedly passed" >&2
1525	exit 1
1526	fi
1527	grep -Eq 'required stable release tag is missing: desktop-v1\.2\.4' "$test_root/missing.log"
1528
1529	other_sha="$(git commit-tree HEAD^{tree} -p HEAD -m "other")"
1530	git tag v1.2.6 "$other_sha"
1531	git tag npm-v1.2.6 "$other_sha"
1532	git tag desktop-v1.2.6 "$other_sha"
1533	git push -q origin v1.2.6 npm-v1.2.6 desktop-v1.2.6
1534	if ALLOW_STABLE_RECOVERY=true RELEASE_TAG=v1.2.6 \
1535	"$repo_root/scripts/resolve-stable-release.sh" >"$test_root/non-ancestor.log" 2>&1; then
1536	echo "non-ancestor recovery tags unexpectedly passed release resolution" >&2
1537	exit 1
1538	fi
1539	grep -Eq 'is not an ancestor of' "$test_root/non-ancestor.log"
1540	git tag -f desktop-v1.2.3 "$other_sha" >/dev/null
1541	git push -q -f origin desktop-v1.2.3
1542	git checkout -q --detach "$approved_sha"
1543	if RELEASE_TAG=desktop-v1.2.3 APPROVED_SHA="$approved_sha" \
1544	"$repo_root/scripts/verify-release-tag.sh" >"$test_root/moved-tag.log" 2>&1; then
1545	echo "moved release tag unexpectedly passed approved SHA validation" >&2
1546	exit 1
1547	fi
1548	grep -Eq 'moved to .* after approval' "$test_root/moved-tag.log"
1549	git tag -f desktop-v1.2.3 "$approved_sha" >/dev/null
1550	git push -q -f origin desktop-v1.2.3
1551	git switch -q main-v2
1552
1553	git tag v1.2.5
1554	git tag npm-v1.2.5 "$other_sha"
1555	git tag desktop-v1.2.5
1556	git push -q origin v1.2.5 npm-v1.2.5 desktop-v1.2.5
1557	if RELEASE_TAG=v1.2.5 "$repo_root/scripts/resolve-stable-release.sh" >"$test_root/mismatch.log" 2>&1; then
1558	echo "mismatched sibling tag unexpectedly passed" >&2
1559	exit 1
1560	fi
1561	grep -Eq 'npm-v1\.2\.5 points to .* expected' "$test_root/mismatch.log"
1562
1563	if RELEASE_TAG=v1.2.3-rc.1 "$repo_root/scripts/resolve-stable-release.sh" >"$test_root/prerelease.log" 2>&1; then
1564	echo "prerelease tag unexpectedly passed stable validation" >&2
1565	exit 1
1566	fi
1567	grep -Eq 'stable release tag must be vMAJOR.MINOR.PATCH' "$test_root/prerelease.log"
1568	)
1569
1570	EVENT_NAME=push IN_CHANNEL=stable IN_TAG=desktop-v1.2.3 REF_NAME=v1.2.3 RUN_NUMBER=10 \
1571	GITHUB_OUTPUT="$test_root/desktop-stable.out" bash "$repo_root/scripts/resolve-desktop-release.sh"
1572	grep -Eq '^tag=desktop-v1\.2\.3$' "$test_root/desktop-stable.out"
1573	grep -Eq '^version=v1\.2\.3$' "$test_root/desktop-stable.out"
1574	grep -Eq '^notes_version=v1\.2\.3$' "$test_root/desktop-stable.out"
1575
1576	EVENT_NAME=workflow_call IN_ORCHESTRATED=true IN_CHANNEL=preview IN_BASE_VERSION=1.3.0 \
1577	IN_TAG='' REF_NAME=main-v2 RUN_NUMBER=999 IN_PREVIEW_NUMBER=42 \
1578	GITHUB_OUTPUT="$test_root/desktop-preview.out" bash "$repo_root/scripts/resolve-desktop-release.sh"
1579	grep -Eq '^version=v1\.3\.0-preview\.42$' "$test_root/desktop-preview.out"
1580	grep -Eq '^tag=desktop-v1\.3\.0-preview\.42$' "$test_root/desktop-preview.out"
1581	grep -Eq '^channel=preview$' "$test_root/desktop-preview.out"
1582	grep -Eq '^notes_version=v1\.3\.0-preview\.42$' "$test_root/desktop-preview.out"
1583
1584	if EVENT_NAME=workflow_call IN_ORCHESTRATED=true IN_CHANNEL=preview IN_BASE_VERSION=1.3.0 \
1585	IN_TAG=desktop-v1.3.0-preview.42 REF_NAME=main-v2 RUN_NUMBER=42 \
1586	GITHUB_OUTPUT="$test_root/desktop-preview-tagged.out" \
1587	bash "$repo_root/scripts/resolve-desktop-release.sh" \
1588	>"$test_root/desktop-preview-tagged.log" 2>&1; then
1589	echo "tagged Desktop Preview dispatch unexpectedly passed" >&2
1590	exit 1
1591	fi
1592	grep -Eq 'Desktop Preview versions are synthesized from protected main-v2' \
1593	"$test_root/desktop-preview-tagged.log"
1594
1595	# Legacy signing automation may still dispatch `canary`; normalize it to Preview
1596	# without exposing a third public release path.
1597	EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_SIGNING_PREFLIGHT=true \
1598	IN_CHANNEL=canary IN_BASE_VERSION=1.3.0 IN_TAG='' REF_NAME=main-v2 RUN_NUMBER=43 \
1599	GITHUB_OUTPUT="$test_root/desktop-canary-compat.out" bash "$repo_root/scripts/resolve-desktop-release.sh"
1600	grep -Eq '^version=v1\.3\.0-preview\.43$' "$test_root/desktop-canary-compat.out"
1601	grep -Eq '^tag=desktop-v1\.3\.0-preview\.43$' "$test_root/desktop-canary-compat.out"
1602	grep -Eq '^channel=preview$' "$test_root/desktop-canary-compat.out"
1603
1604	EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_PRODUCTION_SIGNING_SMOKE=true \
1605	IN_CHANNEL=preview IN_BASE_VERSION=1.3.0 IN_TAG='' REF_NAME=main-v2 RUN_NUMBER=44 \
1606	GITHUB_OUTPUT="$test_root/desktop-preview-smoke.out" bash "$repo_root/scripts/resolve-desktop-release.sh"
1607	grep -Eq '^version=v1\.3\.0-preview\.44$' "$test_root/desktop-preview-smoke.out"
1608
1609	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=preview \
1610	IN_BASE_VERSION=1.3.0 IN_TAG='' REF_NAME=main-v2 RUN_NUMBER=45 \
1611	GITHUB_OUTPUT="$test_root/desktop-preview-direct.out" \
1612	bash "$repo_root/scripts/resolve-desktop-release.sh" \
1613	>"$test_root/desktop-preview-direct.log" 2>&1; then
1614	echo "standalone public Desktop Preview unexpectedly passed" >&2
1615	exit 1
1616	fi
1617	grep -Eq 'public Desktop Preview releases must be dispatched by release-preview.yml' \
1618	"$test_root/desktop-preview-direct.log"
1619
1620	EVENT_NAME=push IN_CHANNEL='' IN_TAG='' REF_NAME=desktop-v1.4.0-rc.1 RUN_NUMBER=50 \
1621	GITHUB_OUTPUT="$test_root/desktop-rc.out" bash "$repo_root/scripts/resolve-desktop-release.sh"
1622	grep -Eq '^prerelease=true$' "$test_root/desktop-rc.out"
1623	grep -Eq '^notes_version=v1\.4\.0$' "$test_root/desktop-rc.out"
1624
1625	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=stable \
1626	IN_TAG=desktop-v1.4.0-rc.1 REF_NAME=main-v2 RUN_NUMBER=50 \
1627	GITHUB_OUTPUT="$test_root/desktop-rc-dispatch.out" \
1628	bash "$repo_root/scripts/resolve-desktop-release.sh" \
1629	>"$test_root/desktop-rc-dispatch.log" 2>&1; then
1630	echo "manual Desktop RC recovery unexpectedly passed" >&2
1631	exit 1
1632	fi
1633	grep -Eq 'manual Desktop recovery accepts only desktop-vMAJOR.MINOR.PATCH' \
1634	"$test_root/desktop-rc-dispatch.log"
1635
1636	if EVENT_NAME=workflow_dispatch IN_CHANNEL=stable IN_TAG=desktop-v1.4.0-preview.1 \
1637	REF_NAME=main-v2 RUN_NUMBER=50 GITHUB_OUTPUT="$test_root/desktop-preview-as-stable.out" \
1638	bash "$repo_root/scripts/resolve-desktop-release.sh" \
1639	>"$test_root/desktop-preview-as-stable.log" 2>&1; then
1640	echo "Desktop Preview tag unexpectedly passed as Stable" >&2
1641	exit 1
1642	fi
1643	grep -Eq 'Desktop Preview versions must use channel=preview without a Git tag' \
1644	"$test_root/desktop-preview-as-stable.log"
1645
1646	if EVENT_NAME=workflow_dispatch IN_CHANNEL=stable IN_TAG='' REF_NAME=main-v2 RUN_NUMBER=50 \
1647	GITHUB_OUTPUT="$test_root/desktop-missing-tag.out" bash "$repo_root/scripts/resolve-desktop-release.sh" \
1648	>"$test_root/desktop-missing-tag.log" 2>&1; then
1649	echo "tag-less desktop stable dispatch unexpectedly passed" >&2
1650	exit 1
1651	fi
1652	grep -Eq 'stable dispatch requires tag' "$test_root/desktop-missing-tag.log"
1653
1654	EVENT_NAME=workflow_call IN_ORCHESTRATED=true IN_CHANNEL=preview IN_TAG=v1.3.0-preview.42 \
1655	REF_NAME=main-v2 GITHUB_OUTPUT="$test_root/cli-preview-call.out" \
1656	bash "$repo_root/scripts/resolve-cli-release.sh"
1657	grep -Eq '^tag=v1\.3\.0-preview\.42$' "$test_root/cli-preview-call.out"
1658	grep -Eq '^version=1\.3\.0-preview\.42$' "$test_root/cli-preview-call.out"
1659	grep -Eq '^base_version=1\.3\.0$' "$test_root/cli-preview-call.out"
1660	grep -Eq '^notes_version=v1\.3\.0-preview\.42$' "$test_root/cli-preview-call.out"
1661	grep -Eq '^channel=preview$' "$test_root/cli-preview-call.out"
1662	grep -Eq '^prerelease=true$' "$test_root/cli-preview-call.out"
1663
1664	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=preview \
1665	IN_TAG=v1.3.0-preview.42 REF_NAME=main-v2 CALLER_REF=refs/heads/main-v2 \
1666	CALLER_REF_PROTECTED=true GITHUB_OUTPUT="$test_root/cli-preview-dispatch.out" \
1667	bash "$repo_root/scripts/resolve-cli-release.sh" \
1668	>"$test_root/cli-preview-dispatch.log" 2>&1; then
1669	echo "standalone public CLI Preview unexpectedly passed" >&2
1670	exit 1
1671	fi
1672	grep -Eq 'manual CLI recovery accepts only vMAJOR.MINOR.PATCH' \
1673	"$test_root/cli-preview-dispatch.log"
1674
1675	EVENT_NAME=push IN_CHANNEL='' IN_TAG='' REF_NAME=v1.3.0-rc.1 \
1676	GITHUB_OUTPUT="$test_root/cli-rc.out" bash "$repo_root/scripts/resolve-cli-release.sh"
1677	grep -Eq '^channel=stable$' "$test_root/cli-rc.out"
1678	grep -Eq '^prerelease=true$' "$test_root/cli-rc.out"
1679	grep -Eq '^notes_version=v1\.3\.0$' "$test_root/cli-rc.out"
1680
1681	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=stable \
1682	IN_TAG=v1.3.0-rc.1 REF_NAME=main-v2 CALLER_REF=refs/heads/main-v2 \
1683	CALLER_REF_PROTECTED=true GITHUB_OUTPUT="$test_root/cli-rc-dispatch.out" \
1684	bash "$repo_root/scripts/resolve-cli-release.sh" \
1685	>"$test_root/cli-rc-dispatch.log" 2>&1; then
1686	echo "manual CLI RC recovery unexpectedly passed" >&2
1687	exit 1
1688	fi
1689	grep -Eq 'manual CLI recovery accepts only vMAJOR.MINOR.PATCH' \
1690	"$test_root/cli-rc-dispatch.log"
1691
1692	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=stable \
1693	IN_TAG=v1.3.0-preview.42 REF_NAME=main-v2 CALLER_REF=refs/heads/main-v2 \
1694	CALLER_REF_PROTECTED=true GITHUB_OUTPUT="$test_root/cli-channel-mismatch.out" \
1695	bash "$repo_root/scripts/resolve-cli-release.sh" >"$test_root/cli-channel-mismatch.log" 2>&1; then
1696	echo "CLI Preview tag unexpectedly passed as Stable" >&2
1697	exit 1
1698	fi
1699	grep -Eq 'manual CLI recovery accepts only vMAJOR.MINOR.PATCH' "$test_root/cli-channel-mismatch.log"
1700
1701	if EVENT_NAME=push IN_CHANNEL='' IN_TAG='' REF_NAME=v1.3.0-preview.latest \
1702	GITHUB_OUTPUT="$test_root/cli-invalid-preview.out" bash "$repo_root/scripts/resolve-cli-release.sh" \
1703	>"$test_root/cli-invalid-preview.log" 2>&1; then
1704	echo "malformed CLI Preview tag unexpectedly passed" >&2
1705	exit 1
1706	fi
1707	grep -Eq 'CLI Preview tag must be vMAJOR.MINOR.PATCH-preview.N' "$test_root/cli-invalid-preview.log"
1708
1709	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=preview \
1710	IN_TAG=v1.3.0-preview.42 REF_NAME=topic CALLER_REF=refs/heads/topic \
1711	CALLER_REF_PROTECTED=false GITHUB_OUTPUT="$test_root/cli-unprotected.out" \
1712	bash "$repo_root/scripts/resolve-cli-release.sh" >"$test_root/cli-unprotected.log" 2>&1; then
1713	echo "unprotected CLI Preview dispatch unexpectedly passed" >&2
1714	exit 1
1715	fi
1716	grep -Eq 'manual CLI releases must run from protected main-v2' "$test_root/cli-unprotected.log"
1717
1718	EVENT_NAME=push IN_ORCHESTRATED=false IN_CHANNEL='' IN_BASE_VERSION='' IN_TAG='' \
1719	REF_NAME=npm-v1.4.0-rc.1 RUN_NUMBER=50 GITHUB_OUTPUT="$test_root/npm-rc.out" \
1720	bash "$repo_root/scripts/resolve-npm-release.sh"
1721	grep -Eq '^arg=npm-v1\.4\.0-rc\.1$' "$test_root/npm-rc.out"
1722
1723	EVENT_NAME=push IN_ORCHESTRATED=true IN_CHANNEL=stable IN_BASE_VERSION=1.5.0 \
1724	IN_TAG=npm-v1.5.0 REF_NAME=v1.5.0 RUN_NUMBER=51 GITHUB_OUTPUT="$test_root/npm-stable.out" \
1725	bash "$repo_root/scripts/resolve-npm-release.sh"
1726	grep -Eq '^arg=v1\.5\.0$' "$test_root/npm-stable.out"
1727
1728	EVENT_NAME=workflow_call IN_ORCHESTRATED=true IN_CHANNEL=canary IN_BASE_VERSION=1.5.0 \
1729	IN_TAG='' REF_NAME=main-v2 RUN_NUMBER=999 IN_PREVIEW_NUMBER=42 \
1730	GITHUB_OUTPUT="$test_root/npm-canary.out" bash "$repo_root/scripts/resolve-npm-release.sh"
1731	grep -Eq '^arg=v1\.5\.0-canary\.42$' "$test_root/npm-canary.out"
1732
1733	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=canary IN_BASE_VERSION=1.5.0 \
1734	IN_TAG='' REF_NAME=main-v2 RUN_NUMBER=52 GITHUB_OUTPUT="$test_root/npm-canary-direct.out" \
1735	bash "$repo_root/scripts/resolve-npm-release.sh" \
1736	>"$test_root/npm-canary-direct.log" 2>&1; then
1737	echo "standalone public npm Canary unexpectedly passed" >&2
1738	exit 1
1739	fi
1740	grep -Eq 'public npm Canary releases must be dispatched by release-preview.yml' \
1741	"$test_root/npm-canary-direct.log"
1742
1743	if EVENT_NAME=workflow_dispatch IN_ORCHESTRATED=false IN_CHANNEL=stable IN_BASE_VERSION=1.5.0 \
1744	IN_TAG=npm-v1.5.1 REF_NAME=main-v2 RUN_NUMBER=52 GITHUB_OUTPUT="$test_root/npm-mismatch.out" \
1745	bash "$repo_root/scripts/resolve-npm-release.sh" >"$test_root/npm-mismatch.log" 2>&1; then
1746	echo "mismatched npm stable dispatch unexpectedly passed" >&2
1747	exit 1
1748	fi
1749	grep -Eq 'does not match requested version' "$test_root/npm-mismatch.log"
1750
1751	e2e_workflow="$repo_root/.github/workflows/e2e-bot.yml"
1752	grep -Fq 'REASONIX_HOME: ${{ runner.temp }}/reasonix-e2e-home' "$e2e_workflow"
1753	grep -Fq 'cp /tmp/reasonix-e2e.toml "$REASONIX_HOME/config.toml"' "$e2e_workflow"
1754	grep -Fq "printf 'DEEPSEEK_API_KEY=%s\\n' \"\$DEEPSEEK_API_KEY\" > \"\$REASONIX_HOME/.env\"" "$e2e_workflow"
1755	grep -Fq -- '-task "compaction,fix-add-bug,fizzbuzz,palindrome,subagent-delegation"' "$e2e_workflow"
1756	grep -Fq 'const unsuccessful = results.filter((result) => !result.Passed \|\| result.Skipped);' "$e2e_workflow"
1757	grep -Fq "if: always() && hashFiles('report.md') != ''" "$e2e_workflow"
1758	e2e_missing_key="$(grep -A2 -F 'missing DEEPSEEK_API_KEY secret' "$e2e_workflow")"
1759	if grep -Fq 'exit 0' <<<"$e2e_missing_key"; then
1760	echo "e2e bot still treats a missing provider secret as success" >&2
1761	exit 1
1762	fi
1763
1764	node --test "$repo_root/npm/publish.test.mjs"
1765	node --test "$repo_root/scripts/finalize-npm-official-release.test.mjs"
1766	node "$repo_root/scripts/check-desktop-build-contract.mjs"
1767	bash "$repo_root/scripts/release-stable.test.sh"
1768	bash "$repo_root/scripts/check-cache-impact.test.sh"
1769	bash "$repo_root/scripts/check-docs-impact.test.sh"
1770
1771	# Each build orchestrator must gate on the compiled docs identity once. The
1772	# Desktop child consumes the candidate evidence instead of rerunning the guard.
1773	for workflow in release.yml release-npm.yml release-candidate.yml; do
1774	grep -Fq 'bash scripts/verify-embedded-docs.sh "$DOCS_BUILD_VERSION"' \
1775	"$repo_root/.github/workflows/$workflow"
1776	done
1777	grep -Fq 'reasonix/internal/productdocs.linkedVersion={{ .Tag }}' "$repo_root/.goreleaser.yaml"
1778	grep -Fq 'reasonix/internal/productdocs.linkedRevision={{ .Commit }}' "$repo_root/.goreleaser.yaml"
1779	# The Homebrew cask must keep stripping quarantine from the unsigned CLI, but
1780	# through Homebrew's current postflight_steps stanza, never the deprecated
1781	# `postflight do` that GoReleaser's hooks field renders.
1782	homebrew_config="$(sed -n '/^homebrew_casks:/,/^release:/p' "$repo_root/.goreleaser.yaml")"
1783	grep -Fq 'postflight_steps do' <<<"$homebrew_config"
1784	grep -Fq 'com.apple.quarantine' <<<"$homebrew_config"
1785	! grep -Eq '^\s+hooks:\|^\s+post:' <<<"$homebrew_config"
1786	grep -Fq 'reasonix/internal/productdocs.linkedVersion=${binaryVersion}' "$repo_root/npm/build.mjs"
1787	grep -Fq 'product_docs_ldflags="-X reasonix/internal/productdocs.linkedVersion=$VERSION' \
1788	"$repo_root/scripts/desktop-build.sh"
1789
1790	echo "release workflow contract tests: PASS"
1791

1791 lines BASH