oh-my-pi/.github/workflows/ci.yml

name: CI

on:
   push:
      branches: [main]
   pull_request:
      branches: [main]
   workflow_dispatch:
      inputs:
         skip_npm:
            description: "Skip npm publish"
            type: boolean
            default: false

concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
   # scripts/release.ts pushes the version-bump commit and its `v*` tag
   # atomically (`git push --atomic origin refs/heads/main:refs/heads/main
   # <sha>:refs/tags/v<version>`), so a release now arrives as a single `push` to
   # `refs/heads/main` — we no longer trigger on the tag ref at all (see
   # `on.push`). This one branch-push run is therefore authoritative: it runs the
   # full build AND, when HEAD carries a release tag, the release/publish jobs.
   # `release_metadata` resolves that tag once so downstream jobs switch on
   # `is-release` and address the tag by name — `github.ref` is
   # `refs/heads/main` here, not the tag. A `workflow_dispatch` from a `v*` tag
   # ref (or from a tagged main HEAD) is also treated as a release.
   release_metadata:
      name: Resolve release metadata
      runs-on: ubuntu-22.04
      outputs:
         is-release: ${{ steps.detect.outputs.is-release }}
         release-tag: ${{ steps.detect.outputs.release-tag }}
      steps:
         # Only a main-branch run needs tags fetched, so `git tag --points-at
         # HEAD` can see the freshly-pushed `v*`. A tag-ref dispatch reads the
         # tag straight from `github.ref_name`, and fetching `--tags` while
         # checkout uses an explicit tag refspec makes git refuse — so scope
         # fetch-tags to main refs.
         - uses: actions/checkout@v4
           with:
              fetch-tags: ${{ github.ref == 'refs/heads/main' }}
         - name: Detect release tag at HEAD
           id: detect
           shell: bash
           run: |
              is_release=false
              release_tag=""
              case "${{ github.ref }}" in
                refs/tags/v[0-9]*)
                  release_tag="${{ github.ref_name }}"
                  ;;
                refs/heads/main)
                  if [ "${{ github.event_name }}" != "pull_request" ]; then
                    release_tag=$(git tag --points-at HEAD | grep -E '^v[0-9]' | head -n1 || true)
                  fi
                  ;;
              esac
              if [ -n "$release_tag" ]; then
                echo "HEAD carries release tag $release_tag; this run builds and publishes the release."
                is_release=true
              fi
              {
                echo "is-release=$is_release"
                echo "release-tag=$release_tag"
              } >> "$GITHUB_OUTPUT"

   # Compute a stable hash of every input that affects the native cdylib output,
   # then look for any prior successful main run that already uploaded the
   # native artifacts for this hash. Two independent outputs:
   #   * `linux-x64-run-id` — set when the linux x64 canary
   #     (`pi-natives-linux-x64-modern-h<hash>`) is present on a prior main run,
   #     so `test`/`native_linux_x64` can reuse it.
   #   * `cross-platform-run-id` — set when ALL cross-platform native artifacts
   #     also have non-expired artifacts on that same prior run, so
   #     `native_cross_platform` can skip the cold rebuild on main pushes after
   #     dep changes have already warmed sccache there.
   # Non-release native jobs are skipped when their canary hits; the canary
   # retention window (see build-native action) is the effective TTL.
   native_artifact_lookup:
      name: Look up cached native artifacts
      runs-on: ubuntu-22.04
      outputs:
         source-hash: ${{ steps.compute.outputs.source-hash }}
         linux-x64-run-id: ${{ steps.find.outputs.linux-x64-run-id }}
         cross-platform-run-id: ${{ steps.find.outputs.cross-platform-run-id }}
      steps:
         - uses: actions/checkout@v4
         - name: Compute native source hash
           id: compute
           shell: bash
           run: |
              source_hash=$(find crates Cargo.toml Cargo.lock rust-toolchain.toml \
                      packages/natives/scripts packages/natives/package.json \
                      scripts/ci-build-native.ts scripts/host-detect.ts \
                      -type f -print0 \
                    | sort -z \
                    | xargs -0 sha256sum \
                    | sha256sum \
                    | cut -c1-16)
              echo "source-hash=$source_hash" >> "$GITHUB_OUTPUT"
              echo "Native source hash: $source_hash"
         - name: Find prior main build with matching native artifacts
           id: find
           env:
              GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           shell: bash
           run: |
              hash="${{ steps.compute.outputs.source-hash }}"
              # Canary for native_linux_x64: presence of the modern artifact
              # implies the baseline sibling is also there (they upload from the
              # same job).
              linux_canary="pi-natives-linux-x64-modern-h${hash}"
              # Required set for cross-platform reuse — names must match the
              # `actions/upload-artifact` `name:` template in build-native action.
              cross_platform_required=(
                "pi-natives-linux-arm64-h${hash}"
                "pi-natives-darwin-x64-baseline-h${hash}"
                "pi-natives-darwin-arm64-h${hash}"
                "pi-natives-win32-x64-baseline-h${hash}"
              )
              linux_x64_run_id=""
              cross_platform_run_id=""
              for candidate in $(gh run list \
                  --workflow=ci.yml --branch=main --status=success --event=push \
                  --limit=20 --json databaseId --jq='.[].databaseId'); do
                names=$(gh api "/repos/${{ github.repository }}/actions/runs/$candidate/artifacts?per_page=100" \
                    --jq '.artifacts[] | select(.expired == false) | .name')
                if [ -z "$linux_x64_run_id" ] && echo "$names" | grep -qFx "$linux_canary"; then
                  linux_x64_run_id="$candidate"
                fi
                if [ -z "$cross_platform_run_id" ]; then
                  all_found=true
                  # Cross-platform reuse requires the linux canary AND every
                  # cross-platform artifact, since release_binary downloads them
                  # from the same run.
                  if ! echo "$names" | grep -qFx "$linux_canary"; then
                    all_found=false
                  else
                    for req in "${cross_platform_required[@]}"; do
                      if ! echo "$names" | grep -qFx "$req"; then
                        all_found=false
                        break
                      fi
                    done
                  fi
                  if $all_found; then
                    cross_platform_run_id="$candidate"
                  fi
                fi
                if [ -n "$linux_x64_run_id" ] && [ -n "$cross_platform_run_id" ]; then
                  break
                fi
              done
              if [ -n "$linux_x64_run_id" ]; then
                echo "Reusing Linux x64 native artifacts from run $linux_x64_run_id"
              else
                echo "No cached Linux x64 native artifacts for hash $hash; native_linux_x64 will rebuild."
              fi
              if [ -n "$cross_platform_run_id" ]; then
                echo "Reusing cross-platform native artifacts from run $cross_platform_run_id"
              else
                echo "No cached cross-platform native artifacts for hash $hash; native_cross_platform will rebuild on main."
              fi
              {
                echo "linux-x64-run-id=$linux_x64_run_id"
                echo "cross-platform-run-id=$cross_platform_run_id"
              } >> "$GITHUB_OUTPUT"

   # Fast lint, type check, and browser bundle build (no Rust, no native build needed)
   check:
      name: Lint, type check & web build
      runs-on: ubuntu-22.04
      steps:
         - uses: actions/checkout@v4
         - uses: oven-sh/setup-bun@v2
           with:
              bun-version: "1.3"
         - name: Cache bun dependencies
           uses: actions/cache@v4
           with:
              path: ~/.bun/install/cache
              key: bun-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
         - run: bun install --frozen-lockfile
         - name: Type check workspace
           run: bun run ci:check:full
         - name: Build collab web
           run: bun run collab:web:build

   # Linux x64 baseline + modern: required by `test`, so it runs on every PR
   # unless native_artifact_lookup found a cached run. Release runs always
   # rebuild for fresh artifacts.
   native_linux_x64:
      name: "Native: Linux x64 (${{ matrix.variant }})"
      needs: [release_metadata, native_artifact_lookup]
      if: ${{ needs.release_metadata.outputs.is-release == 'true' || needs.native_artifact_lookup.outputs.linux-x64-run-id == '' }}
      runs-on: ubuntu-22.04
      strategy:
         fail-fast: false
         matrix:
            include:
               - { variant: baseline, rust_checks: true }
               - { variant: modern }
      steps:
         - uses: actions/checkout@v4
         - uses: ./.github/actions/build-native
           with:
              hash: ${{ needs.native_artifact_lookup.outputs.source-hash }}
              platform: linux
              arch: x64
              variant: ${{ matrix.variant }}
              rust_checks: ${{ matrix.rust_checks && 'true' || 'false' }}
              save_cache: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

   # Pre-warm the cross-platform native build cache on `main`, in addition to
   # building the artifacts that ship in releases. Skipped on main when
   # native_artifact_lookup already found a recent run with all artifacts intact.
   native_cross_platform:
      name: "Native: ${{ matrix.platform }} ${{ matrix.arch }}"
      needs: [release_metadata, native_artifact_lookup]
      if: ${{ needs.release_metadata.outputs.is-release == 'true' || (github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.native_artifact_lookup.outputs.cross-platform-run-id == '') }}
      strategy:
         fail-fast: false
         matrix:
            include:
               - { os: ubuntu-22.04, platform: linux, arch: arm64, target: aarch64-unknown-linux-gnu }
               - { os: macos-15-intel, platform: darwin, arch: x64, variant: baseline }
               - { os: macos-14, platform: darwin, arch: arm64 }
               - { os: ubuntu-22.04, platform: win32, arch: x64, target: x86_64-pc-windows-msvc, variant: baseline }
      runs-on: ${{ matrix.os }}
      steps:
         - uses: actions/checkout@v4
         - uses: ./.github/actions/build-native
           with:
              hash: ${{ needs.native_artifact_lookup.outputs.source-hash }}
              platform: ${{ matrix.platform }}
              arch: ${{ matrix.arch }}
              variant: ${{ matrix.variant }}
              target: ${{ matrix.target }}
              save_cache: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

   test:
      name: Test & smoke (TS)
      runs-on: ubuntu-22.04
      needs: [native_linux_x64, native_artifact_lookup]
      if: ${{ !cancelled() && needs.native_linux_x64.result != 'failure' }}
      timeout-minutes: 30
      steps:
         - uses: actions/checkout@v4
         - uses: oven-sh/setup-bun@v2
           with:
              bun-version: "1.3"
         - name: Cache bun dependencies
           uses: actions/cache@v4
           with:
              path: ~/.bun/install/cache
              key: bun-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
         - name: Install system deps
           run: |
              sudo apt-get update
              sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev fd-find ripgrep imagemagick
              sudo ln -sf "$(command -v fdfind)" /usr/local/bin/fd
              sudo ln -sf /usr/bin/convert /usr/local/bin/magick
         - run: bun install --frozen-lockfile
         - name: Resolve Linux x64 native artifact run
           id: source
           shell: bash
           run: |
              if [ "${{ needs.native_linux_x64.result }}" = "success" ]; then
                echo "artifact-run-id=${{ github.run_id }}" >> "$GITHUB_OUTPUT"
              else
                echo "artifact-run-id=${{ needs.native_artifact_lookup.outputs.linux-x64-run-id }}" >> "$GITHUB_OUTPUT"
              fi
         - name: Download native addons
           uses: actions/download-artifact@v4
           with:
              pattern: pi-natives-linux-x64-*-h${{ needs.native_artifact_lookup.outputs.source-hash }}
              path: packages/natives/native
              merge-multiple: true
              run-id: ${{ steps.source.outputs.artifact-run-id }}
              github-token: ${{ secrets.GITHUB_TOKEN }}
         - name: Test workspace (TS)
           # `test:ts` sets GITHUB_ACTIONS=0 inline so `bun test` skips its
           # per-file `::group::`/`::endgroup::` annotations. Under `--workspaces`
           # every line is prefixed with `<pkg> test: `, which breaks GHA's
           # column-0 parsing and would leak those markers as literal log spam.
           run: bun run test:ts
         - name: CLI smoke test
           run: bun run ci:test:smoke

   install_methods:
      name: Install method smoke tests
      runs-on: ubuntu-22.04
      steps:
         - uses: actions/checkout@v4
         - uses: oven-sh/setup-bun@v2
           with:
              bun-version: "1.3"
         - uses: dtolnay/rust-toolchain@nightly
           with:
              toolchain: nightly-2026-04-29
         - uses: Swatinem/rust-cache@v2
           with:
              shared-key: install-methods-linux-x64
              cache-on-failure: true
              save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
              cache-workspace-crates: true
         # Layer sccache on top of rust-cache for the same reason as the
         # build-native action: release version bumps bust the target/ cache,
         # but sccache hits at the rustc-unit level survive.
         - name: Setup sccache
           uses: mozilla-actions/sccache-action@v0.0.10
         - name: Enable sccache for cargo
           shell: bash
           run: |
              {
                echo "SCCACHE_GHA_ENABLED=true"
                echo "RUSTC_WRAPPER=sccache"
                echo "CARGO_INCREMENTAL=0"
              } >> "$GITHUB_ENV"
         - name: Cache bun dependencies
           uses: actions/cache@v4
           with:
              path: ~/.bun/install/cache
              key: bun-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
         - name: Install system deps
           run: |
              sudo apt-get update
              sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev fd-find ripgrep imagemagick
              sudo ln -sf "$(command -v fdfind)" /usr/local/bin/fd
              sudo ln -sf /usr/bin/convert /usr/local/bin/magick
         - run: bun install --frozen-lockfile
         - name: Install method smoke tests
           run: bun run ci:test:install-methods

   release_binary:
      name: "Release binary: ${{ matrix.target_id }}"
      if: ${{ needs.release_metadata.outputs.is-release == 'true' && !cancelled() &&
         needs.native_linux_x64.result == 'success' && needs.native_cross_platform.result ==
         'success' && needs.test.result == 'success' && needs.check.result ==
         'success' && needs.install_methods.result == 'success' }}
      needs: [release_metadata, check, native_linux_x64, native_cross_platform, test, install_methods, native_artifact_lookup]
      strategy:
         fail-fast: false
         matrix:
            include:
               - {
                    os: ubuntu-22.04,
                    platform: linux,
                    arch: x64,
                    target_id: linux-x64,
                    binary_path: packages/coding-agent/binaries/omp-linux-x64,
                 }
               - {
                    os: ubuntu-24.04-arm,
                    platform: linux,
                    arch: arm64,
                    target_id: linux-arm64,
                    binary_path: packages/coding-agent/binaries/omp-linux-arm64,
                 }
               - {
                    os: macos-15-intel,
                    platform: darwin,
                    arch: x64,
                    target_id: darwin-x64,
                    binary_path: packages/coding-agent/binaries/omp-darwin-x64,
                 }
               - {
                    os: macos-14,
                    platform: darwin,
                    arch: arm64,
                    target_id: darwin-arm64,
                    binary_path: packages/coding-agent/binaries/omp-darwin-arm64,
                 }
               - {
                    os: ubuntu-22.04,
                    platform: win32,
                    arch: x64,
                    target_id: win32-x64,
                    binary_path: packages/coding-agent/binaries/omp-windows-x64.exe,
                 }
      runs-on: ${{ matrix.os }}
      permissions:
         contents: read
         id-token: write
      env:
         MACOS_SIGNING: ${{ secrets.APPLE_CERTIFICATE_P12 != '' && secrets.APPLE_CERTIFICATE_PASSWORD != '' && secrets.APPLE_API_KEY_ID != '' && secrets.APPLE_API_ISSUER_ID != '' && secrets.APPLE_API_KEY != '' }}
      steps:
         - uses: actions/checkout@v4
         - uses: oven-sh/setup-bun@v2
           with:
              bun-version: "1.3"
         - uses: actions/setup-node@v4
           with:
              node-version: "24"
              registry-url: "https://registry.npmjs.org"
         # Keep npm aligned with trusted publishing setup (>= 11.16.0).
         - name: Ensure npm supports trusted publishing
           if: ${{ !inputs.skip_npm }}
           run: npm install -g npm@latest
         - name: Cache bun dependencies
           uses: actions/cache@v4
           with:
              path: ~/.bun/install/cache
              key: bun-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
         - run: bun install --frozen-lockfile
         - name: Download native addon(s)
           uses: actions/download-artifact@v4
           with:
              pattern: pi-natives-${{ matrix.platform }}-${{ matrix.arch }}*-h${{ needs.native_artifact_lookup.outputs.source-hash }}
              path: packages/natives/native
              merge-multiple: true
         - name: Build release binary
           env:
              RELEASE_TARGETS: ${{ matrix.target_id }}
           run: bun run ci:release:build-binaries
         - name: Sign and notarize macOS binary (Developer ID)
           # Replaces the ad-hoc signature with a Developer ID + hardened-runtime
           # one (+JIT/library-validation entitlements; omp dlopens its
           # runtime-extracted native addon, which has a different Team ID) and
           # notarizes. Auto-skips until the APPLE_* secrets are configured.
           if: matrix.platform == 'darwin' && env.MACOS_SIGNING == 'true'
           env:
              APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
              APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
              APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
              APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
              APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
           run: bash scripts/ci-macos-sign.sh "${{ matrix.binary_path }}"
         # Windows binary is cross-built on Linux, so we have no Windows runner
         # to smoke it on. Cross-build correctness is verified via the napi
         # entry-point exports (see build-native action) and the bun
         # `--compile --target=bun-windows-x64-*` cross-compile.
         - name: Smoke release binary
           if: matrix.platform != 'win32'
           run: |
              runtime_dir="$(mktemp -d)"
              HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" "${{ matrix.binary_path }}" --version
              HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" "${{ matrix.binary_path }}" --smoke-test
         - name: Publish native addon package
           if: ${{ !inputs.skip_npm }}
           env:
              # Fallback auth: setup-node wrote an .npmrc referencing
              # NODE_AUTH_TOKEN; npm uses it only when OIDC has no trusted
              # publisher for the package (or on a first publish).
              NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           run: bun run ci:release:publish-native-leaf ${{ matrix.target_id }}
         - name: Upload release binary artifact
           uses: actions/upload-artifact@v4
           with:
              name: omp-binary-${{ matrix.target_id }}
              path: ${{ matrix.binary_path }}

   release_github:
      name: Publish GitHub release
      if: ${{ needs.release_metadata.outputs.is-release == 'true' && !cancelled() &&
         needs.release_binary.result == 'success' }}
      needs: [release_metadata, release_binary]
      runs-on: ubuntu-22.04
      permissions:
         contents: write
      steps:
         - uses: actions/checkout@v4
         - uses: oven-sh/setup-bun@v2
           with:
              bun-version: "1.3"
         - name: Generate release notes from CHANGELOGs
           run: bun scripts/ci-release-notes.ts ${{ needs.release_metadata.outputs.release-tag }}
         - name: Download release binaries
           uses: actions/download-artifact@v4
           with:
              pattern: omp-binary-*
              path: packages/coding-agent/binaries
              merge-multiple: true
         - name: Create GitHub Release
           uses: softprops/action-gh-release@v2
           with:
              tag_name: ${{ needs.release_metadata.outputs.release-tag }}
              files: |
                 packages/coding-agent/binaries/omp-*
              body_path: release-notes.md
              generate_release_notes: true


   release_github_verify:
      name: Verify published release (macOS)
      if: ${{ needs.release_metadata.outputs.is-release == 'true' && !cancelled() &&
         needs.release_github.result == 'success' }}
      needs: [release_metadata, release_github]
      runs-on: macos-14
      permissions:
         contents: read
      env:
         MACOS_SIGNING: ${{ secrets.APPLE_CERTIFICATE_P12 != '' && secrets.APPLE_CERTIFICATE_PASSWORD != '' && secrets.APPLE_API_KEY_ID != '' && secrets.APPLE_API_ISSUER_ID != '' && secrets.APPLE_API_KEY != '' }}
      steps:
         - name: Download published macOS arm64 binary
           run: |
              curl -fsSL -o omp-darwin-arm64 "https://github.com/${{ github.repository }}/releases/download/${{ needs.release_metadata.outputs.release-tag }}/omp-darwin-arm64"
              chmod +x omp-darwin-arm64
         - name: Verify published macOS arm64 binary
           run: |
              codesign -dvvv ./omp-darwin-arm64
              codesign --verify --strict --verbose=4 ./omp-darwin-arm64
              runtime_dir="$(mktemp -d)"
              HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" ./omp-darwin-arm64 --version
              HOME="$runtime_dir/home" XDG_DATA_HOME="$runtime_dir/xdg" ./omp-darwin-arm64 --smoke-test
         - name: Assert signed release is not ad-hoc
           if: env.MACOS_SIGNING == 'true'
           run: |
              if codesign -dvvv ./omp-darwin-arm64 2>&1 | grep -qE "flags=.*adhoc|Signature=adhoc"; then
                echo "published binary is still ad-hoc signed (Developer ID signing did not run)" >&2
                exit 1
              fi
              # Gatekeeper assessment: a notarized Developer ID binary is accepted.
              # Informational — a bare (unstapled) Mach-O relies on the online ticket
              # lookup, so surface the result without gating the release on it.
              spctl -a -t exec -vv ./omp-darwin-arm64 || echo "spctl non-zero (expected for unstapled bare binary; ticket served online)"

   release_npm:
      name: Publish to npm
      if: ${{ needs.release_metadata.outputs.is-release == 'true' && !cancelled() &&
         needs.release_binary.result == 'success' &&
         needs.release_github_verify.result == 'success' &&
         !inputs.skip_npm }}
      needs: [release_metadata, release_binary, release_github_verify, native_artifact_lookup]
      runs-on: ubuntu-22.04
      # `id-token: write` lets npm mint the GitHub OIDC token it exchanges for a
      # short-lived publish token (trusted publishing + provenance). When a
      # package has no matching trusted publisher configured, npm silently falls
      # back to NODE_AUTH_TOKEN below — which also covers first-ever publishes.
      permissions:
         id-token: write
         contents: read
      steps:
         - uses: actions/checkout@v4
         - uses: oven-sh/setup-bun@v2
           with:
              bun-version: "1.3"
         - uses: actions/setup-node@v4
           with:
              node-version: "24"
              registry-url: "https://registry.npmjs.org"
         # Keep npm aligned with trusted publishing setup (>= 11.16.0).
         - name: Ensure npm supports trusted publishing
           run: npm install -g npm@latest
         - name: Cache bun dependencies
           uses: actions/cache@v4
           with:
              path: ~/.bun/install/cache
              key: bun-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
         - run: bun install --frozen-lockfile
         # The pi-coding-agent prepack executes workspace code (bundle-dist
         # imports the pi-utils barrel, which loads the pi-natives addon), so
         # this job needs the linux x64 native addons just like `test` does.
         # Release runs always rebuild natives in this same run, so the
         # default run-id resolves the artifacts.
         - name: Download native addons
           uses: actions/download-artifact@v4
           with:
              pattern: pi-natives-linux-x64-*-h${{ needs.native_artifact_lookup.outputs.source-hash }}
              path: packages/natives/native
              merge-multiple: true
         - name: Publish to npm
           env:
              # Fallback auth: setup-node wrote an .npmrc referencing
              # NODE_AUTH_TOKEN; npm uses it only when OIDC has no trusted
              # publisher for the package (or on a first publish).
              NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           run: bun run ci:release:publish

   # Regenerate the Homebrew tap formula (can1357/homebrew-tap) from the freshly
   # published release assets and push it. Gated on release_github_verify so the
   # tap only cuts over to a release whose published binary was verified (matches
   # how release_npm is gated). No-ops when HOMEBREW_TAP_DEPLOY_KEY is unset, so a
   # release never blocks on tap access.
   release_brew:
      name: Update Homebrew tap
      if: ${{ needs.release_metadata.outputs.is-release == 'true' && !cancelled() &&
         needs.release_github_verify.result == 'success' }}
      needs: [release_metadata, release_github_verify]
      runs-on: ubuntu-22.04
      env:
         HAS_TAP_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY != '' }}
      steps:
         - uses: actions/checkout@v4
           if: env.HAS_TAP_KEY == 'true'
         - uses: oven-sh/setup-bun@v2
           if: env.HAS_TAP_KEY == 'true'
           with:
              bun-version: "1.3"
         - name: Check out the Homebrew tap
           if: env.HAS_TAP_KEY == 'true'
           uses: actions/checkout@v4
           with:
              repository: can1357/homebrew-tap
              ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
              path: homebrew-tap
         - name: Regenerate and push the formula
           if: env.HAS_TAP_KEY == 'true'
           env:
              GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           run: |
              bun scripts/ci-update-brew-formula.ts "${{ needs.release_metadata.outputs.release-tag }}" --out homebrew-tap/Formula/omp.rb
              cd homebrew-tap
              if git diff --quiet -- Formula/omp.rb; then
                echo "formula already up to date for ${{ needs.release_metadata.outputs.release-tag }}"
                exit 0
              fi
              git -c user.name="github-actions[bot]" \
                  -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
                  commit -m "omp ${{ needs.release_metadata.outputs.release-tag }}" -- Formula/omp.rb
              git push origin HEAD:main