release.yml

# This workflow is used to release master releases and also by the snapshot workflow
# to release snapshots.
name: Wheels Release

on:
  push:
    branches:
      - main
  # Manual re-trigger for a stuck or failed release without needing a fresh
  # push to main. Version + channel are derived from the dispatched ref's
  # wheels.json (main -> stable, develop -> snapshot), identical to the
  # push / workflow_call paths since channel selection keys on GITHUB_REF.
  # See #2819.
  workflow_dispatch:
  workflow_call:
    secrets:
      SLACK_WEBHOOK_URL:
        required: true
      FORGEBOX_API_TOKEN:
        required: true
      FORGEBOX_PASS:
        required: true
      # Optional — when present, the build job's "Dispatch downstream package
      # managers" step fires repository_dispatch on homebrew-wheels and
      # scoop-wheels so their auto-update workflows pick up the new release
      # in ~5min instead of waiting for the daily cron. When absent, the step
      # warns and exits 0. The chocolatey path was retired in favor of Scoop
      # for the v4.x Windows install — see scoop-wheels#4.
      DOWNSTREAM_DISPATCH_TOKEN:
        required: false
      # Optional — when present, the build job's "Dispatch Linux repo buckets"
      # step fires repository_dispatch on apt-wheels / yum-wheels so
      # their metadata regen workflows pick up the new .deb/.rpm and republish
      # apt.wheels.dev / yum.wheels.dev within minutes. When absent, the step
      # skips silently — the bucket repos can be populated manually via each
      # repo's workflow_dispatch backfill in the meantime. See issue #2605.
      LINUX_REPO_DISPATCH_TOKEN:
        required: false
      # Required when this workflow is invoked from develop (snapshot context) so
      # the snapshot release can be published to wheels-dev/wheels-snapshots
      # instead of wheels-dev/wheels. Stable (main) builds don't use this and
      # rely on the default GITHUB_TOKEN. See .github/RELEASE_PLAYBOOK.md for
      # the channel architecture.
      WHEELS_SNAPSHOTS_TOKEN:
        required: false

env:
  WHEELS_PRERELEASE: false
  # Route JS actions through Node 24 instead of the deprecated Node 20 runtime.
  # The lone Node 20 action here — Wandalen/wretry.action@v3, which wraps
  # softprops/action-gh-release — began failing its pre/post hooks with
  # "Argument list too long" once GitHub's forced Node 20 -> 24 migration
  # reached the runners (forced default 2026-06-02). Node 24 is backward
  # compatible for JS actions. See #2819.
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  #############################################
  # Build Snapshot or Final Release
  #############################################
  build:
    name: Build & Publish Release
    runs-on: ubuntu-24.04
    # Stable runs queue instead of overlapping, so two quick pushes to main
    # can't both pass the republish check before either uploads (#4221).
    # Snapshot runs get a unique group and never wait.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && 'release-stable' || format('release-{0}', github.run_id) }}
      cancel-in-progress: false
    steps:
      - name: Checkout Repository
        id: Checkout-Repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Setup Environment Variables For Build Process
        id: Calculate-Version-And-Branch
        env:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          cat wheels.json
          BASE_VERSION=$(jq -r '.version' wheels.json)
          echo "Base version from wheels.json: ${BASE_VERSION}"
          # Develop builds carry a -snapshot.N pre-release identifier; main builds
          # are stable releases. The snapshot identifier uses '.' (not '+') so it
          # is a SemVer pre-release identifier, not build metadata. Per SemVer §10,
          # build metadata (after '+') MUST be ignored in precedence comparisons —
          # which would make snapshot N and N+1 sort equal in brew/choco. The '.'
          # form sorts numerically, so 4.0.1-snapshot.1657 > 4.0.1-snapshot.1656.
          if [ "$GITHUB_REF" == "refs/heads/develop" ]; then
            echo "WHEELS_VERSION=${BASE_VERSION}-snapshot.${RUN_NUMBER}" >> $GITHUB_ENV
            echo "BRANCH=develop" >> $GITHUB_ENV
          else
            # Stable release: BASE_VERSION is the GA version, no build qualifier.
            # The run number is captured in the GitHub Actions history; embedding
            # it in the artifact version is SemVer-meaningless for a GA tag.
            echo "WHEELS_VERSION=${BASE_VERSION}" >> $GITHUB_ENV
            echo "BRANCH=main" >> $GITHUB_ENV
          fi

      # A published version's assets never change (#4221). Without this check a
      # push to main whose wheels.json still names a released version rebuilt
      # and replaced that release's assets in place (v4.1.0, 2026-09-17), and
      # republished it to ForgeBox. It runs before any build or publish step
      # and fails closed. The decision (and its fixtures) lives in
      # tools/ci/release_republish_guard.py.
      - name: Refuse to republish an existing release
        if: github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 tools/ci/release_republish_guard.py --repo "$GITHUB_REPOSITORY" --tag "v${WHEELS_VERSION}" --sha "$GITHUB_SHA"

      - name: Make build scripts executable
        run: |
          chmod +x tools/build/scripts/*.sh
          # List scripts for verification
          ls -la tools/build/scripts/

      #############################################
      # Pre-Release Validation (main branch only)
      #############################################

      - name: Validate Release Checklist
        if: github.ref == 'refs/heads/main'
        run: |
          echo "=========================================="
          echo "Validating Release Checklist"
          echo "=========================================="

          # Check that CHANGELOG doesn't contain TBD for this version
          if grep -q "# \[${WHEELS_VERSION%+*}\].*=> TBD" CHANGELOG.md; then
            echo "ERROR: CHANGELOG still contains 'TBD' for version ${WHEELS_VERSION%+*}"
            echo "Please update CHANGELOG.md with the actual release date before releasing."
            exit 1
          fi

          # Check that the CHANGELOG separator below this version is exactly
          # '---' (3 dashes). The release-notes extraction step below uses the
          # awk range /^# \[VERSION\]/,/^---$/, which terminates ONLY on a line
          # of exactly three dashes; a '----' (4-dash) separator silently
          # extends the range into the PREVIOUS version's notes. We mirror that
          # exact awk here and fail if the extracted range pulls in another
          # version heading. (Recurring footgun — see #2606, #2768.)
          VERSION_PATTERN=$(echo "${WHEELS_VERSION%+*}" | sed 's/\./\\./g')
          BLED=$(awk '/^# \['"${VERSION_PATTERN}"'\]/,/^---$/ {print}' CHANGELOG.md \
            | tail -n +2 | grep -cE '^# \[' || true)
          if [ "${BLED}" -ne 0 ]; then
            echo "ERROR: CHANGELOG release-notes range for [${WHEELS_VERSION%+*}] bleeds into a later version section."
            echo "The separator directly below the [${WHEELS_VERSION%+*}] block must be exactly '---' (3 dashes), not '----'."
            echo "This check mirrors the awk extraction used to build the GitHub Release notes."
            exit 1
          fi

          # Check that source version in wheels.json is clean (no -snapshot suffix).
          # The workflow injects -snapshot.N for develop builds automatically.
          BASE_VERSION=$(jq -r '.version' wheels.json)
          if echo "$BASE_VERSION" | grep -qi "snapshot"; then
            echo "ERROR: Version in wheels.json contains snapshot suffix ($BASE_VERSION)"
            echo "Source files should have clean versions (e.g., 3.1.0)."
            echo "The workflow adds -snapshot.N automatically for develop builds."
            exit 1
          fi

          echo "✓ Release checklist validation passed"

      # `wheels lookup` (and its MCP tool) reads an offline docs index shipped
      # inside the module, cli/lucli/data/docs-index.json. It is built here,
      # before anything is published, so a failure can't leave a version on
      # ForgeBox with no GitHub release or module behind it (#4314).
      #
      # It has to describe this build's framework version:
      #   - a release (main) reads the committed docs/api/v<version>.json, with
      #     --strict, so a missing file fails the build with the reason;
      #   - a snapshot build reads the API JSON the snapshot workflow's fast-test
      #     job generated from the running framework (artifact api-docs-snapshot),
      #     also with --strict;
      #   - a manual run on develop has no fast-test artifact, so it builds from
      #     the newest API JSON committed and says so in a warning, rather than
      #     failing the recovery path.
      - name: Setup Node for Docs Index
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Download API docs snapshot
        id: api-docs-snapshot
        if: env.BRANCH == 'develop'
        continue-on-error: true
        uses: actions/download-artifact@v6
        with:
          name: api-docs-snapshot
          path: docs/api

      - name: Build Docs Index For wheels lookup
        env:
          SNAPSHOT_API_JSON: ${{ steps.api-docs-snapshot.outcome }}
        run: |
          if [ "$BRANCH" = "main" ] || [ "$SNAPSHOT_API_JSON" = "success" ]; then
            node tools/build/scripts/build-docs-index.mjs --strict --version "$WHEELS_VERSION"
          else
            echo "::warning title=Docs index::No api-docs-snapshot artifact (a manual run on develop?), so the wheels lookup index uses the newest committed API JSON instead of this build's."
            node tools/build/scripts/build-docs-index.mjs --version "$WHEELS_VERSION"
          fi

      #############################################
      # Prepare and Publish to ForgeBox
      #############################################

      - name: Prepare Wheels Base Template for ForgeBox
        run: |
          ./tools/build/scripts/prepare-base.sh "${{ env.WHEELS_VERSION }}" "${{ env.BRANCH }}" "${{ github.run_number }}" "${{ env.WHEELS_PRERELEASE }}"

      - name: Prepare Wheels Core for ForgeBox
        run: |
          ./tools/build/scripts/prepare-core.sh "${{ env.WHEELS_VERSION }}" "${{ env.BRANCH }}" "${{ github.run_number }}" "${{ env.WHEELS_PRERELEASE }}"

      # The legacy CommandBox `wheels-cli` module (built from cli/src/) is FROZEN
      # as of #3184 — it drifts from the canonical LuCLI-era `wheels` CLI and
      # mis-advertises itself as the official CLI on ForgeBox. The release
      # pipeline no longer re-prepares, re-validates, re-builds, or re-publishes
      # it. The already-published 4.0.3 stays in place; cli/src/ ships a
      # deprecation README pointing at the supported brew/scoop/apt/yum + `wheels
      # new` install path. Refs #3180.

      - name: Prepare Wheels Starter App for ForgeBox
        run: |
         ./tools/build/scripts/prepare-starterApp.sh "${{ env.WHEELS_VERSION }}"

      # CommandBox is only needed for the ForgeBox publish below; it has no
      # other consumer in this workflow. Develop snapshots no longer publish
      # to ForgeBox (they go to wheels-dev/wheels-snapshots via Create Snapshot
      # Pre-Release further down), so we save ~30s of CommandBox install on
      # every snapshot run by gating this to stable releases only.
      - name: Install CommandBox
        if: github.ref == 'refs/heads/main'
        run: |
          # Download to a file first: a retry after partial output would corrupt
          # what gpg reads if curl piped straight into it.
          curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors -o "${RUNNER_TEMP}/ortussolutions.gpg.asc" https://downloads.ortussolutions.com/debs/gpg
          sudo gpg --dearmor -o /usr/share/keyrings/ortussolutions.gpg "${RUNNER_TEMP}/ortussolutions.gpg.asc"
          echo "deb [signed-by=/usr/share/keyrings/ortussolutions.gpg] https://downloads.ortussolutions.com/debs/noarch /" | sudo tee /etc/apt/sources.list.d/ortussolutions.list
          sudo apt-get update && sudo apt-get install -y commandbox

      #############################################
      # Validate Packages Before Publishing
      #############################################

      - name: Validate Package Structure and Versions
        run: |
          echo "=========================================="
          echo "Validating Packages Before ForgeBox Publish"
          echo "=========================================="

          # Function to validate a package
          validate_package() {
            local PACKAGE_DIR=$1
            local PACKAGE_NAME=$2

            echo ""
            echo "Validating $PACKAGE_NAME..."

            # Check if directory exists
            if [ ! -d "$PACKAGE_DIR" ]; then
              echo "ERROR: Directory $PACKAGE_DIR does not exist!"
              exit 1
            fi

            # Locate the package manifest. Prefer wheels.json (post-rename in 4.0)
            # over box.json (legacy CommandBox/ForgeBox format). The ForgeBox-bound
            # artifacts (wheels-base-template, wheels-starter-app) carry box.json;
            # wheels-core ships both manifests during the transition window. The
            # legacy wheels-cli module is frozen (#3184) and no longer published.
            # This validator prefers wheels.json when present.
            local MANIFEST=""
            if [ -f "$PACKAGE_DIR/wheels.json" ]; then
              MANIFEST="$PACKAGE_DIR/wheels.json"
            elif [ -f "$PACKAGE_DIR/box.json" ]; then
              MANIFEST="$PACKAGE_DIR/box.json"
            else
              echo "ERROR: neither wheels.json nor box.json found in $PACKAGE_DIR!"
              exit 1
            fi
            echo "  Manifest: $(basename $MANIFEST)"

            # Validate manifest syntax
            if ! jq empty "$MANIFEST" 2>/dev/null; then
              echo "ERROR: Invalid JSON in $MANIFEST"
              exit 1
            fi

            # Extract and display version
            local VERSION=$(jq -r '.version' "$MANIFEST")
            echo "  Version: $VERSION"

            # Check that version matches expected version
            # Fatal: a mismatched manifest still publishes, under the wrong
            # version (the starter app shipped as 1.0.0 on every release, #3908).
            if [[ "$VERSION" != "${{ env.WHEELS_VERSION }}" ]]; then
              echo "  ERROR: Version mismatch! Expected ${{ env.WHEELS_VERSION }}, got $VERSION"
              exit 1
            fi

            # Count files
            local FILE_COUNT=$(find "$PACKAGE_DIR" -type f | wc -l)
            echo "  Files: $FILE_COUNT"

            if [ "$FILE_COUNT" -eq 0 ]; then
              echo "ERROR: No files found in package directory!"
              exit 1
            fi

            echo "  ✓ Package validated successfully"
          }

          # Validate all packages. The legacy CommandBox wheels-cli module is
          # frozen (#3184) and no longer prepared/published, so it is not validated.
          validate_package "build-wheels-base" "Wheels Base Template"
          validate_package "build-wheels-core/wheels" "Wheels Core"
          validate_package "build-wheels-starterApp" "Wheels Starter App"

          # Two-tier AI docs assertions:
          #   1. source-tree check — consumer tier exists and the root
          #      CLAUDE.md still points at it;
          #   2. artifact check — every distributed package carries the
          #      CONSUMER docs (CLAUDE.md + AGENTS.md) and must NOT leak
          #      maintainer-only paths (.ai deep reference set beyond the
          #      consumer README, .claude/, .github/).
          echo ""
          echo "=========================================="
          echo "Validating two-tier AI docs"
          echo "=========================================="
          ./tools/build/scripts/ship-consumer-docs.sh check

          for pkg in build-wheels-base build-wheels-core/wheels build-wheels-starterApp; do
            ./tools/build/scripts/ship-consumer-docs.sh verify "$pkg"
          done
          echo "  ✓ Two-tier AI docs validated"

          echo ""
          echo "=========================================="
          echo "All packages validated successfully!"
          echo "=========================================="

      # ForgeBox publishing is stable-only (main branch). Snapshots publish to
      # wheels-dev/wheels-snapshots via the Create Snapshot Pre-Release step
      # downstream — that's the canonical bleeding-edge channel post-4.0.
      # Once ForgeBox is fully deprecated, this entire step (and all the
      # ForgeBox-shaped Prepare* / Install CommandBox / Validate steps above)
      # can be deleted as cleanup.
      - name: Publish All Packages to ForgeBox
        if: github.ref == 'refs/heads/main'
        run: |
          # Publish stable release and mark as current/stable version
          ./tools/build/scripts/publish-to-forgebox.sh "wheels-dev" "${{ secrets.FORGEBOX_PASS }}" "true" "true"

      #############################################
      # Build Artifacts for GitHub
      #############################################

      # build-cli.sh (the legacy CommandBox wheels-cli zip from cli/src/) is no
      # longer invoked — the module is frozen (#3184). The canonical CLI ships as
      # the LuCLI module tarball built in "Build Wheels Module Tarball" below.
      - name: Build All Wheels Artifacts
        run: |
          ./tools/build/scripts/build-base.sh "${{ env.WHEELS_VERSION }}" "${{ env.BRANCH }}" "${{ github.run_number }}" "${{ env.WHEELS_PRERELEASE }}"
          ./tools/build/scripts/build-core.sh "${{ env.WHEELS_VERSION }}" "${{ env.BRANCH }}" "${{ github.run_number }}" "${{ env.WHEELS_PRERELEASE }}"
          ./tools/build/scripts/build-starterApp.sh "${{ env.WHEELS_VERSION }}"

      # The offline docs bundle: the prebuilt Astro/Starlight guides and API
      # reference that `wheels docs fetch` downloads and the Homebrew formula
      # stages. Built here so it lands on the SAME release tag as the core and
      # module zips — that is what both consumers resolve against.
      - name: Setup Node for Docs Bundle
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Build Docs Bundle
        run: |
          cd web && pnpm install --frozen-lockfile && cd ..
          ./tools/build/scripts/build-docs.sh "${{ env.WHEELS_VERSION }}"
          cd "artifacts/wheels/${{ env.WHEELS_VERSION }}"
          md5sum wheels-docs-${{ env.WHEELS_VERSION }}.zip > wheels-docs-${{ env.WHEELS_VERSION }}.zip.md5 || md5 -r wheels-docs-${{ env.WHEELS_VERSION }}.zip > wheels-docs-${{ env.WHEELS_VERSION }}.zip.md5
          sha512sum wheels-docs-${{ env.WHEELS_VERSION }}.zip > wheels-docs-${{ env.WHEELS_VERSION }}.zip.sha512 || shasum -a 512 wheels-docs-${{ env.WHEELS_VERSION }}.zip > wheels-docs-${{ env.WHEELS_VERSION }}.zip.sha512

      - name: Build Wheels Module Tarball
        env:
          MODULE_VERSION: ${{ env.WHEELS_VERSION }}
        run: |
          mkdir -p "artifacts/wheels/${MODULE_VERSION}"
          # Codegen/crud templates are committed at cli/lucli/templates/codegen/
          # (single source of truth), so no build-time copy from cli/src/ is needed.
          # Substitute @build.version@ placeholders in the LuCLI module before
          # tarring. Without this, module.json ships with the literal placeholder
          # (or a stale hardcoded version), causing BaseModule.version() to return
          # the wrong value at runtime and the dev toolbar / `wheels --help` to
          # report a stale version. (Historically mirrored the same substitution
          # the now-frozen prepare-cli.sh did for the legacy wheels-cli ForgeBox
          # artifact; that leg was removed in #3184.) See #2326.
          # data/ (the docs index) is skipped: the guides it holds quote the
          # placeholder literally.
          find cli/lucli -type f \( -name "*.json" -o -name "*.md" -o -name "*.cfm" -o -name "*.cfc" \) -not -path "cli/lucli/data/*" -exec sed -i.bak "s/@build\.version@/${MODULE_VERSION}/g" {} \;
          find cli/lucli -name "*.bak" -delete
          # Generate .module-version at build time with the canonical version.
          # This file is read at runtime by the brew/scoop/.deb/.rpm wrappers
          # for two purposes:
          #   (1) `wheels --version` displays its contents verbatim
          #   (2) The wrappers compare staged-module-version vs installed-version
          #       to decide whether to re-sync the module on first run
          # The substitution above only matches *.json *.md *.cfm *.cfc, so
          # `.module-version` (no extension) was previously sourced from a stale
          # source-tracked file and embedded into every artifact (snapshot AND
          # GA). That made every release look like the same snapshot tag and
          # broke channel-switch sync detection. Generating it here ensures
          # both behaviors stay correct. See #2758 follow-up.
          echo "${MODULE_VERSION}" > cli/lucli/.module-version
          tar czf "artifacts/wheels/${MODULE_VERSION}/wheels-module-${MODULE_VERSION}.tar.gz" -C cli/lucli .
          cd cli/lucli && zip -r "../../artifacts/wheels/${MODULE_VERSION}/wheels-module-${MODULE_VERSION}.zip" . && cd ../..
          cd artifacts/wheels/${{ env.WHEELS_VERSION }}
          md5sum wheels-module-${{ env.WHEELS_VERSION }}.tar.gz > wheels-module-${{ env.WHEELS_VERSION }}.tar.gz.md5 || md5 -r wheels-module-${{ env.WHEELS_VERSION }}.tar.gz > wheels-module-${{ env.WHEELS_VERSION }}.tar.gz.md5
          sha512sum wheels-module-${{ env.WHEELS_VERSION }}.tar.gz > wheels-module-${{ env.WHEELS_VERSION }}.tar.gz.sha512 || shasum -a 512 wheels-module-${{ env.WHEELS_VERSION }}.tar.gz > wheels-module-${{ env.WHEELS_VERSION }}.tar.gz.sha512
          md5sum wheels-module-${{ env.WHEELS_VERSION }}.zip > wheels-module-${{ env.WHEELS_VERSION }}.zip.md5 || md5 -r wheels-module-${{ env.WHEELS_VERSION }}.zip > wheels-module-${{ env.WHEELS_VERSION }}.zip.md5
          sha512sum wheels-module-${{ env.WHEELS_VERSION }}.zip > wheels-module-${{ env.WHEELS_VERSION }}.zip.sha512 || shasum -a 512 wheels-module-${{ env.WHEELS_VERSION }}.zip > wheels-module-${{ env.WHEELS_VERSION }}.zip.sha512

      # Build .deb / .rpm Linux packages alongside the zip artifacts. nfpm
      # needs no Linux-specific build host (it's a single Go binary), so this
      # runs on the same ubuntu-24.04 runner as the rest of the pipeline.
      # Generates arch-independent wheels_<v>_all.deb and wheels-<v>.noarch.rpm.
      # See tools/distribution-drafts/linux-packages/ for the nfpm configs.
      - name: Install nfpm
        run: |
          NFPM_VERSION="2.40.0"
          # From the release's checksums.txt; bump together with NFPM_VERSION.
          NFPM_SHA256="535962c4771db671352884b5591254481f851822557ad8476605c1e77a12504c"
          NFPM_TGZ="${RUNNER_TEMP}/nfpm.tar.gz"
          curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors -o "${NFPM_TGZ}" \
            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz"
          echo "${NFPM_SHA256}  ${NFPM_TGZ}" | sha256sum -c -
          sudo tar -xzf "${NFPM_TGZ}" -C /usr/local/bin nfpm
          nfpm --version

      # Container-free (fake JDK stubs): guards the wrapper's Java 21 resolution,
      # e.g. that a pre-set JAVA_HOME at Java 17 — which this very runner
      # exports — is ignored rather than crashing LuCLI (#3728 smoke).
      - name: Test the Linux launcher's Java resolution
        run: bash tools/test-linux-launcher-java.sh

      - name: Test the Linux launcher's offline-docs mirror
        run: bash tools/test-linux-launcher-docs-mirror.sh

      - name: Build Linux packages (.deb / .rpm)
        # CHANNEL derives from the version so develop snapshots produce the
        # `wheels-be` package (which the Phase 2 bleeding-edge receiver
        # downloads) instead of `wheels`. Without this, the snapshot release
        # ships `wheels_<v>_amd64.deb` and the apt-wheels / yum-wheels
        # receiver workflow 404s on its `wheels-be_<v>_amd64.deb` fetch.
        # RC builds keep CHANNEL=stable — RCs aren't fanned out to apt/yum
        # (see release.yml § "Dispatch Linux repo buckets").
        env:
          WHEELS_VERSION: ${{ env.WHEELS_VERSION }}
          CHANNEL: ${{ contains(env.WHEELS_VERSION, '-snapshot') && 'bleeding-edge' || 'stable' }}
          OUT_DIR: artifacts/wheels/${{ env.WHEELS_VERSION }}
        run: bash tools/distribution-drafts/linux-packages/build-linux-packages.sh

      - name: Upload Wheels Base Template Artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-artifacts-base-template
          path: |
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512
            artifacts/wheels/wheels-base-template-be.zip

      - name: Upload Wheels Core Artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-artifacts-core
          path: |
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512
            artifacts/wheels/wheels-core-be.zip

      # The legacy CommandBox wheels-cli zip is no longer built (#3184), so there
      # is no "Upload Wheels CLI Artifact" step. The canonical CLI is published as
      # the wheels-module-*.tar.gz / .zip in "Upload Wheels Module Artifact".

      - name: Upload Wheels Starter App Artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-artifacts-starter-app
          path: |
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512
            artifacts/wheels/wheels-starter-app-be.zip

      - name: Upload Wheels Module Artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-artifacts-module
          path: |
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.zip
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.md5
            artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.sha512

      - name: Upload All Wheels Artifacts (Combined)
        uses: actions/upload-artifact@v7
        with:
          name: build-artifacts-all
          path: |
            artifacts/**/*

      - name: Upload Workflow Logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: logs-release
          path: |
            ${{ runner.temp }}/_runner_diag/
            ${{ runner.temp }}/_github_workflow/

      #############################################
      # Create GitHub Release (main branch only)
      #############################################

      - name: Extract Release Notes from CHANGELOG
        if: github.ref == 'refs/heads/main'
        id: extract-release-notes
        run: |
          # Extract the release notes for the current version from CHANGELOG.md
          VERSION_PATTERN=$(echo "${WHEELS_VERSION%+*}" | sed 's/\./\\./g')
          awk '/^# \['"${VERSION_PATTERN}"'\]/,/^---$/ {print}' CHANGELOG.md | sed '1d;$d' > release-notes.md
          echo "Release notes extracted to release-notes.md"
          cat release-notes.md

      # Wrapped in Wandalen/wretry.action@v3 to recover from transient
      # GitHub Actions artifact-upload flakes — observed pattern is
      # `##[error]other side closed` mid-stream after most assets upload
      # successfully (e.g. SNAPSHOT+1655 lost wheels-core-*.zip while 17/18
      # other assets uploaded fine). softprops/action-gh-release is safe
      # to retry because `overwrite_files: true` makes it idempotent: on
      # retry it attaches to the existing release and only re-uploads
      # missing or stale assets. attempt_delay is in milliseconds.
      #
      # Pinned to v2.6.2: softprops/action-gh-release@v3.0.0 (released
      # 2026-04-12) introduced a regression where `.zip.sha512` asset
      # uploads fail deterministically with `##[error]The "chunk"
      # argument must be of type string or an instance of Buffer,
      # TypedArray, or DataView. Received an instance of ArrayBuffer`.
      # Because the error is deterministic, the Wandalen retry-wrap
      # above runs all 3 attempts with the same result and exits 1.
      # First seen on SNAPSHOT+1656; same error on +1657. Re-pin to @v3
      # once upstream ships a fix. v2.6.2 was cut on the same day as
      # v3.0.0 and is the last known-good release for this repo's
      # upload pattern.
      - name: Create GitHub Release
        if: github.ref == 'refs/heads/main'
        id: gh-release-final
        uses: Wandalen/wretry.action@v3
        with:
          action: softprops/action-gh-release@v2.6.2
          attempt_limit: 3
          attempt_delay: 30000
          # target_commitish pins the tag to the exact release commit. softprops
          # otherwise defaults it to the repo default branch (develop), so a
          # stable tag lands off-main whenever main has diverged from develop at
          # release time (what happened to v4.0.2). See #2819.
          with: |
            tag_name: v${{ env.WHEELS_VERSION }}
            target_commitish: ${{ github.sha }}
            name: Wheels ${{ env.WHEELS_VERSION }}
            body_path: release-notes.md
            draft: false
            prerelease: ${{ env.WHEELS_PRERELEASE }}
            overwrite_files: true
            files: |
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-docs-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-docs-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-docs-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels*_all.deb
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels*.noarch.rpm

      # Announce the stable release in Slack (v4.2.1 shipped with no notification).
      # release.yml is also reused by snapshot.yml for develop snapshots, so this
      # posts only for a stable main-branch release, and only after the GitHub
      # Release publish step succeeded. A missing webhook is a no-op and a
      # delivery failure is a warning: notification never fails or blocks a release.
      - name: Notify Slack of stable release
        if: github.ref == 'refs/heads/main' && steps.gh-release-final.outcome == 'success'
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          RELEASE_VERSION: ${{ env.WHEELS_VERSION }}
          RELEASE_URL: https://github.com/${{ github.repository }}/releases/tag/v${{ env.WHEELS_VERSION }}
        run: |
          set -euo pipefail

          if [ -z "${SLACK_WEBHOOK_URL:-}" ]; then
            echo "no SLACK_WEBHOOK_URL — skipping release notification"
            exit 0
          fi

          # jq -n --arg keeps the version and URL out of the JSON string itself, so
          # no value is interpolated into untrusted JSON. Slack renders *bold* and
          # <url|text> as mrkdwn in an incoming webhook's text field. The message is
          # bump-type agnostic: this step runs for every stable GA, not only patches.
          if ! payload=$(jq -n \
            --arg version "${RELEASE_VERSION}" \
            --arg url "${RELEASE_URL}" \
            '{text: ("*Wheels " + $version + "* is released.\n<" + $url + "|Release notes on GitHub>")}'); then
            echo "::warning::Could not build the Slack release payload; skipping notification."
            exit 0
          fi

          # Bounded timeouts: a stalled webhook must not delay the downstream
          # homebrew/scoop and apt/yum dispatch steps further down this job.
          if ! curl -fsS --connect-timeout 10 --max-time 20 -X POST \
            -H 'Content-type: application/json' \
            --data "${payload}" \
            "${SLACK_WEBHOOK_URL}"; then
            echo "::warning::Slack release notification failed; the release itself is unaffected."
            exit 0
          fi

          echo "Posted Slack release notification for ${RELEASE_VERSION}"

      #############################################
      # Create Snapshot Pre-Release (develop only)
      #############################################

      # Same retry-wrap rationale as the stable Create-GitHub-Release step
      # above. Both branches need the wrap because the same flake fires on
      # any release upload regardless of branch.
      #
      # Snapshots publish to a separate repo (wheels-dev/wheels-snapshots) so
      # the main repo's Releases page stays curated for GA tags only. Without
      # the redirect, ~200-500 snapshot releases per year would drown the
      # ~6-12 GA releases. Requires WHEELS_SNAPSHOTS_TOKEN — a fine-grained PAT
      # with Contents:write on wheels-dev/wheels-snapshots, passed through via
      # workflow_call from snapshot.yml.
      - name: Create Snapshot Pre-Release
        if: github.ref != 'refs/heads/main'
        id: gh-release-snapshot
        uses: Wandalen/wretry.action@v3
        with:
          action: softprops/action-gh-release@v2.6.2
          attempt_limit: 3
          attempt_delay: 30000
          with: |
            tag_name: v${{ env.WHEELS_VERSION }}
            name: Wheels ${{ env.WHEELS_VERSION }} (snapshot)
            body: |
              Automated snapshot from `wheels-dev/wheels` develop branch.

              Install:
              ```
              brew upgrade wheels-be
              ```
            draft: false
            prerelease: true
            overwrite_files: true
            repository: wheels-dev/wheels-snapshots
            token: ${{ secrets.WHEELS_SNAPSHOTS_TOKEN }}
            files: |
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-docs-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-docs-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-docs-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.zip
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.zip.md5
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.zip.sha512
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels*_all.deb
              artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels*.noarch.rpm

      #############################################
      # Dispatch downstream package managers
      #
      # Fires repository_dispatch on wheels-dev/homebrew-wheels and
      # wheels-dev/scoop-wheels so their auto-update workflows pick up
      # the new release within minutes instead of waiting up to 24h for
      # their daily cron. Both repos have:
      #   on:
      #     repository_dispatch:
      #       types: [wheels-released]
      #
      # Chocolatey was dropped — the v1.x chocolatey-wheels package is
      # CommandBox-based and can't drive v4. Windows installs go through
      # Scoop now. See scoop-wheels#4 for the bucket's autoupdate workflow.
      #
      # Requires DOWNSTREAM_DISPATCH_TOKEN — a fine-grained PAT (or app
      # token) with `metadata: read` + `contents: write` on the two
      # downstream repos. If the secret is unset, this step warns and
      # exits 0 so the release itself isn't blocked; cron will catch up.
      #############################################
      - name: Dispatch downstream package managers
        if: steps.gh-release-final.outcome == 'success' || steps.gh-release-snapshot.outcome == 'success'
        env:
          GH_DISPATCH_TOKEN: ${{ secrets.DOWNSTREAM_DISPATCH_TOKEN }}
          WHEELS_RELEASE_VERSION: ${{ env.WHEELS_VERSION }}
        run: |
          set -euo pipefail

          if [ -z "${GH_DISPATCH_TOKEN:-}" ]; then
            echo "::warning::DOWNSTREAM_DISPATCH_TOKEN is not set on the repository — homebrew-wheels and scoop-wheels auto-update will fall back to the daily cron tick."
            exit 0
          fi

          # Derive the channel from the version string. The tap's auto-update.yml
          # uses this to decide which formula to bump:
          #   stable        → Formula/wheels.rb     (sources from wheels-dev/wheels)
          #   bleeding-edge → Formula/wheels-be.rb  (sources from wheels-dev/wheels-snapshots)
          # The version string already encodes this — `*-snapshot.*` is BE,
          # `*-rc.*` is RC, anything else SemVer-clean is stable. Sniffing here
          # rather than using a separate event type keeps backwards-compat with
          # taps still on the older single-channel handler.
          if echo "${WHEELS_RELEASE_VERSION}" | grep -qiE '\-snapshot[\.\+]'; then
            CHANNEL="bleeding-edge"
          elif echo "${WHEELS_RELEASE_VERSION}" | grep -qE '\-rc\.'; then
            CHANNEL="release-candidate"
          else
            CHANNEL="stable"
          fi
          echo "Channel: ${CHANNEL}"

          # Static event type, fixed repo list — no untrusted input flows
          # into the curl arguments. WHEELS_RELEASE_VERSION is generated
          # earlier in the same workflow from wheels.json + run number.
          for repo in homebrew-wheels scoop-wheels; do
            echo "Dispatching wheels-released to wheels-dev/${repo}..."
            http_status=$(curl -sS -o /tmp/dispatch-resp.txt -w "%{http_code}" \
              -X POST \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer ${GH_DISPATCH_TOKEN}" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              "https://api.github.com/repos/wheels-dev/${repo}/dispatches" \
              -d "{\"event_type\":\"wheels-released\",\"client_payload\":{\"version\":\"${WHEELS_RELEASE_VERSION}\",\"channel\":\"${CHANNEL}\"}}" )

            # GitHub returns 204 No Content on success.
            if [ "${http_status}" != "204" ]; then
              echo "::warning::Dispatch to wheels-dev/${repo} returned HTTP ${http_status}: $(cat /tmp/dispatch-resp.txt)"
            else
              echo "  ✓ ${repo} dispatched (channel=${CHANNEL})"
            fi
          done

          echo "Downstream package manager workflows dispatched (homebrew + scoop)."

      #############################################
      # Dispatch Linux repo buckets (apt.wheels.dev / yum.wheels.dev)
      #
      # Fires repository_dispatch on wheels-dev/apt-wheels and
      # wheels-dev/yum-wheels so their metadata-regen workflows pick up
      # the new .deb / .rpm asset and republish apt.wheels.dev /
      # yum.wheels.dev within minutes. See issue #2605.
      #
      # Requires LINUX_REPO_DISPATCH_TOKEN — a fine-grained PAT with
      # `contents: write` on the two bucket repos. If the secret is unset,
      # this step skips silently — releases continue to land on the GitHub
      # Release artifact stream regardless.
      #
      # The bucket repos (wheels-dev/apt-wheels and wheels-dev/yum-wheels)
      # are live and authoritative; their receiver workflows regenerate and
      # republish the apt/yum metadata from the R2 pools.
      #############################################
      - name: Dispatch Linux repo buckets
        if: steps.gh-release-final.outcome == 'success' || steps.gh-release-snapshot.outcome == 'success'
        env:
          GH_DISPATCH_TOKEN: ${{ secrets.LINUX_REPO_DISPATCH_TOKEN }}
          WHEELS_RELEASE_VERSION: ${{ env.WHEELS_VERSION }}
        run: |
          set -euo pipefail

          if [ -z "${GH_DISPATCH_TOKEN:-}" ]; then
            echo "LINUX_REPO_DISPATCH_TOKEN is not set — skipping apt/yum bucket dispatch (Phase 2 prerequisites not in place yet)."
            exit 0
          fi

          # Same channel derivation as the homebrew/scoop dispatch.
          # apt-wheels / yum-wheels route on `channel` in the payload
          # to slot the .deb/.rpm into the right pool (stable vs bleeding-edge).
          # RC releases aren't currently published to apt/yum, so we skip them.
          if echo "${WHEELS_RELEASE_VERSION}" | grep -qiE '\-snapshot[\.\+]'; then
            CHANNEL="bleeding-edge"
          elif echo "${WHEELS_RELEASE_VERSION}" | grep -qE '\-rc\.'; then
            echo "Skipping apt/yum dispatch for release candidate (RCs aren't pushed to apt/yum)."
            exit 0
          else
            CHANNEL="stable"
          fi
          echo "Channel: ${CHANNEL}"

          # Static event type, fixed repo list — no untrusted input flows into
          # the curl arguments. WHEELS_RELEASE_VERSION is generated earlier in
          # the same workflow from wheels.json + run number.
          for repo in apt-wheels yum-wheels; do
            echo "Dispatching wheels-released to wheels-dev/${repo}..."
            http_status=$(curl -sS -o /tmp/linux-dispatch-resp.txt -w "%{http_code}" \
              -X POST \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer ${GH_DISPATCH_TOKEN}" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              "https://api.github.com/repos/wheels-dev/${repo}/dispatches" \
              -d "{\"event_type\":\"wheels-released\",\"client_payload\":{\"version\":\"${WHEELS_RELEASE_VERSION}\",\"channel\":\"${CHANNEL}\"}}" )

            if [ "${http_status}" != "204" ]; then
              echo "::warning::Dispatch to wheels-dev/${repo} returned HTTP ${http_status}: $(cat /tmp/linux-dispatch-resp.txt)"
            else
              echo "  ✓ ${repo} dispatched (channel=${CHANNEL})"
            fi
          done

          echo "Linux repo bucket dispatch complete (apt + yum)."

      - name: Bump develop after stable release
        if: steps.gh-release-final.outcome == 'success' || steps.gh-release-snapshot.outcome == 'success'
        env:
          GH_DISPATCH_TOKEN: ${{ secrets.DOWNSTREAM_DISPATCH_TOKEN }}
          WHEELS_RELEASE_VERSION: ${{ env.WHEELS_VERSION }}
        run: |
          set -euo pipefail

          if [ -z "${GH_DISPATCH_TOKEN:-}" ]; then
            echo "DOWNSTREAM_DISPATCH_TOKEN is not set — skipping bump-develop dispatch."
            exit 0
          fi

          # Reuse the same channel-derivation rule as the homebrew/scoop
          # step so this stays in sync. Only stable GA releases bump develop.
          if echo "${WHEELS_RELEASE_VERSION}" | grep -qiE '\-snapshot[\.\+]'; then
            CHANNEL="bleeding-edge"
          elif echo "${WHEELS_RELEASE_VERSION}" | grep -qE '\-rc\.'; then
            CHANNEL="release-candidate"
          else
            CHANNEL="stable"
          fi

          # Fire bump-develop at this repo to open the develop-bump PR.
          # Only stable GA releases bump develop; snapshots and RCs don't.
          # Same workaround as the homebrew/scoop dispatches above:
          # the release-publish step runs under the default workflow token,
          # which cannot trigger downstream workflows. We dispatch from
          # this step (which runs under DOWNSTREAM_DISPATCH_TOKEN, a PAT)
          # instead. The bump-develop-version.yml workflow listens for
          # repository_dispatch types=[bump-develop]. See issue #2609.
          if [ "${CHANNEL}" = "stable" ]; then
            echo "Dispatching bump-develop to wheels-dev/wheels..."
            http_status=$(curl -sS -o /tmp/dispatch-resp.txt -w "%{http_code}" \
              -X POST \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer ${GH_DISPATCH_TOKEN}" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              "https://api.github.com/repos/wheels-dev/wheels/dispatches" \
              -d "{\"event_type\":\"bump-develop\",\"client_payload\":{\"version\":\"${WHEELS_RELEASE_VERSION}\"}}" )

            if [ "${http_status}" != "204" ]; then
              echo "::warning::bump-develop dispatch returned HTTP ${http_status}: $(cat /tmp/dispatch-resp.txt)"
            else
              echo "  ✓ bump-develop dispatched to wheels-dev/wheels (version=${WHEELS_RELEASE_VERSION})"
            fi
          else
            echo "Skipping bump-develop dispatch (channel=${CHANNEL}, not stable)."
          fi

  #############################################
  # Smoke-test the built module against a clean install.
  #
  # Installs the just-built wheels-module-*.tar.gz into an isolated LUCLI_HOME,
  # extracts wheels-core-*.zip for WHEELS_FRAMEWORK_PATH, then runs every
  # template-driven generator against a scratch project. Catches packaging
  # regressions like #1944 (codegen templates unbundled) that the monorepo
  # test suite can't surface because it exercises source paths, not the
  # built distribution. See #2208.
  #############################################
  smoke-test-distribution:
    name: Smoke Test Installed Distribution
    needs: build
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Install LuCLI
        uses: ./.github/actions/setup-lucli

      - name: Download built module artifact
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts-module
          path: smoke-artifacts/module/

      - name: Download built core artifact
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts-core
          path: smoke-artifacts/core/

      - name: Locate artifacts
        id: artifacts
        run: |
          MODULE_TAR=$(find smoke-artifacts/module -name 'wheels-module-*.tar.gz' | head -1)
          CORE_ZIP=$(find smoke-artifacts/core -name 'wheels-core-*.zip' ! -name '*-be.zip' | head -1)
          if [[ -z "$MODULE_TAR" || -z "$CORE_ZIP" ]]; then
            echo "::error::Artifacts not found. module=$MODULE_TAR core=$CORE_ZIP"
            find smoke-artifacts -type f
            exit 1
          fi
          echo "module_tar=$MODULE_TAR" >> "$GITHUB_OUTPUT"
          echo "core_zip=$CORE_ZIP"     >> "$GITHUB_OUTPUT"

      - name: Run smoke test
        env:
          MODULE_TAR: ${{ steps.artifacts.outputs.module_tar }}
          CORE_ZIP: ${{ steps.artifacts.outputs.core_zip }}
        run: |
          bash tools/ci/smoke-test-module.sh "$MODULE_TAR" "$CORE_ZIP"

      - name: Upload smoke-test logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: smoke-test-logs
          path: |
            smoke-artifacts/
          retention-days: 7