release.yml

# Сборка Windows / Linux / macOS zip + GitHub Release.
#
# Автоматически: push тега X.Y.Z или vX.Y.Z.
# Имена zip берутся из semver в pubspec на закоммиченном ref (после merge в main он может
# быть новее номера тега из‑за version-bump — это не блокирует сборку, см. job version-hint).
# Вручную: Actions → Release → Run workflow (создаёт тег из pubspec, если его ещё нет).

name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - '*.*.*'
      - 'v*'

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  version-hint:
    name: Version vs tag (hint only)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Warn when git tag and pubspec semver differ
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          VER=$(grep '^version:' pubspec.yaml | sed 's/^version: //' | sed 's/+.*//')
          RAW="${{ github.ref_name }}"
          TAG="${RAW#v}"
          if [ "$VER" != "$TAG" ]; then
            echo "::warning::Git tag is $RAW but pubspec semver is $VER (часто так бывает после auto version-bump на main). Артефакты будут с именем **$VER** из pubspec; GitHub Release останется на теге **$RAW**. Чтобы всё совпадало, поставьте тег на semver из pubspec (например $VER)."
          else
            echo "Tag $RAW matches pubspec semver $VER."
          fi

  # End-to-end scenarios (test/e2e) must pass before a release is published.
  e2e:
    name: E2E tests
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.47.1'
          channel: 'stable'
          cache: true

      - name: Install Linux dependencies
        timeout-minutes: 8
        run: |
          APT="-o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20"
          sudo apt-get $APT update
          # bubblewrap runs the extension sandbox scenario; without it it skips.
          sudo apt-get $APT install -y libsecret-1-dev bubblewrap
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Get dependencies
        run: flutter pub get

      - name: Run E2E tests
        run: flutter test test/e2e

  build-windows:
    name: Build Windows
    runs-on: windows-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      full_version: ${{ steps.version.outputs.full_version }}
      build_number: ${{ steps.version.outputs.build_number }}
    steps:
      - uses: actions/checkout@v4

      - name: Get version from pubspec.yaml
        id: version
        shell: bash
        run: |
          FULL_VERSION=$(grep "^version:" pubspec.yaml | sed 's/version: //')
          VERSION=$(echo "$FULL_VERSION" | sed 's/+.*//')
          BUILD_NUMBER=$(echo "$FULL_VERSION" | sed 's/.*+//')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "full_version=$FULL_VERSION" >> "$GITHUB_OUTPUT"
          echo "build_number=$BUILD_NUMBER" >> "$GITHUB_OUTPUT"

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.47.1'
          channel: 'stable'
          cache: true

      - name: Get dependencies
        run: flutter pub get

      - name: Build Windows (release)
        run: flutter build windows --release

      - name: Bundle querya-mcp (MCP stdio bridge)
        run: |
          cd packages\querya_mcp_bridge
          dart pub get
          dart compile exe bin\querya_mcp.dart -o ..\..\build\windows\x64\runner\Release\querya-mcp.exe

      - name: Zip Windows artifact (portable)
        run: |
          $v = "${{ steps.version.outputs.version }}"
          $dir = "build\windows\x64\runner\Release"
          New-Item -ItemType File -Path "$dir\.portable" -Force | Out-Null
          New-Item -ItemType File -Path "$dir\portable.txt" -Force | Out-Null
          Compress-Archive -Path "$dir\*" -DestinationPath "Querya-Desktop-$v-windows.zip"
          Remove-Item -Path "$dir\.portable", "$dir\portable.txt" -Force

      - name: Install Inno Setup
        run: choco install innosetup --no-progress -y

      - name: Build Windows setup.exe (installable)
        shell: pwsh
        run: |
          $v = "${{ steps.version.outputs.version }}"
          $iscc = "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe"
          if (!(Test-Path $iscc)) { throw "ISCC not found at $iscc" }
          & $iscc "/DMyAppVersion=$v" "packaging\windows\querya.iss"
          $setup = "dist-windows\Querya-Desktop-$v-windows-setup.exe"
          if (!(Test-Path $setup)) { throw "Setup not produced: $setup" }
          Copy-Item $setup "Querya-Desktop-$v-windows-setup.exe"

      - uses: actions/upload-artifact@v4
        with:
          name: bundle-windows
          path: |
            Querya-Desktop-${{ steps.version.outputs.version }}-windows.zip
            Querya-Desktop-${{ steps.version.outputs.version }}-windows-setup.exe
          if-no-files-found: error

  build-linux:
    name: Build Linux
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Get version from pubspec.yaml
        id: version
        run: |
          FULL_VERSION=$(grep "^version:" pubspec.yaml | sed 's/version: //')
          VERSION=$(echo "$FULL_VERSION" | sed 's/+.*//')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y clang cmake ninja-build pkg-config libgtk-3-dev libsecret-1-dev

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.47.1'
          channel: 'stable'
          cache: true

      - name: Get dependencies
        run: flutter pub get

      - name: Build Linux (release)
        run: flutter build linux --release

      - name: Splice in vsync-patched Linux engine (querya-desktop#980)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./scripts/linux/apply_patched_engine.sh

      - name: Bundle querya-mcp (MCP stdio bridge)
        run: |
          cd packages/querya_mcp_bridge
          dart pub get
          dart compile exe bin/querya_mcp.dart -o ../../build/linux/x64/release/bundle/querya-mcp

      - name: Zip Linux artifact (portable)
        run: |
          cd build/linux/x64/release/bundle
          touch .portable portable.txt
          zip -r "${GITHUB_WORKSPACE}/Querya-Desktop-${{ steps.version.outputs.version }}-linux.zip" .
          rm -f .portable portable.txt

      - name: Build Linux AppImage (installable)
        run: ./scripts/linux/build_appimage.sh

      - name: Build Linux .deb (Debian/Ubuntu)
        run: ./scripts/linux/build_deb.sh

      - name: Build Linux .rpm (Fedora/RHEL)
        run: |
          sudo apt-get install -y rpm
          ./scripts/linux/build_rpm.sh

      - name: Install Flatpak toolchain
        run: |
          sudo apt-get install -y flatpak flatpak-builder
          # GitHub runners are not root for Flatpak system ops; use --user.
          flatpak remote-add --if-not-exists --user flathub \
            https://flathub.org/repo/flathub.flatpakrepo
          flatpak install -y --user flathub org.gnome.Platform//48 org.gnome.Sdk//48

      - name: Build Linux Flatpak (installable)
        run: ./scripts/linux/build_flatpak.sh

      - uses: actions/upload-artifact@v4
        with:
          name: bundle-linux
          path: |
            Querya-Desktop-${{ steps.version.outputs.version }}-linux.zip
            Querya-Desktop-${{ steps.version.outputs.version }}-linux.AppImage
            Querya-Desktop-${{ steps.version.outputs.version }}-linux.deb
            Querya-Desktop-${{ steps.version.outputs.version }}-linux.rpm
            Querya-Desktop-${{ steps.version.outputs.version }}-linux.flatpak
          if-no-files-found: error

  build-macos:
    name: Build macOS
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - name: Get version from pubspec.yaml
        id: version
        run: |
          FULL_VERSION=$(grep "^version:" pubspec.yaml | sed 's/version: //')
          VERSION=$(echo "$FULL_VERSION" | sed 's/+.*//')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.47.1'
          channel: 'stable'
          cache: true

      - name: Get dependencies
        run: flutter pub get

      - name: Build macOS (release)
        run: flutter build macos --release

      - name: Sign and notarize macOS app
        env:
          MACOS_CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE_P12 }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          MACOS_KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
        run: |
          set -euo pipefail
          if [ -z "${MACOS_SIGN_IDENTITY:-}" ] || [ -z "${MACOS_NOTARY_KEY:-}" ]; then
            echo "Skipping macOS signing/notarization — secrets not configured."
            exit 0
          fi
          APP="build/macos/Build/Products/Release/querya_desktop.app"
          test -d "$APP"

          KEYCHAIN="$RUNNER_TEMP/build.keychain"
          security create-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$KEYCHAIN"
          security set-keychain-settings -lut 1200 "$KEYCHAIN"
          security default-keychain -s "$KEYCHAIN"
          security unlock-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$KEYCHAIN"

          echo "$MACOS_CERTIFICATE_P12" | base64 --decode -o "$RUNNER_TEMP/certificate.p12"
          security import "$RUNNER_TEMP/certificate.p12" -k "$KEYCHAIN" -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_KEYCHAIN_PASSWORD" "$KEYCHAIN"

          # Sign nested code from the inside out (avoids --deep pitfalls).
          find "$APP/Contents/Frameworks" -type f \( -name "*.dylib" -o -name "*.so" \) -exec \
            codesign --force --timestamp --options runtime --sign "$MACOS_SIGN_IDENTITY" {} +
          find "$APP/Contents/Frameworks" -type d -name "*.framework" -exec \
            codesign --force --timestamp --options runtime --sign "$MACOS_SIGN_IDENTITY" {} +
          find "$APP/Contents/MacOS" -maxdepth 1 -type f -exec \
            codesign --force --timestamp --options runtime --sign "$MACOS_SIGN_IDENTITY" {} +

          # Sign the main app bundle with hardened runtime and signed entitlements.
          codesign --force --timestamp --options runtime \
            --entitlements macos/Runner/ReleaseSigned.entitlements \
            --sign "$MACOS_SIGN_IDENTITY" "$APP"

          codesign --verify --deep --strict --verbose=2 "$APP"

          NOTARY_KEY="$RUNNER_TEMP/notary_key.p8"
          echo -n "$MACOS_NOTARY_KEY" | base64 --decode -o "$NOTARY_KEY"
          ditto -c -k --keepParent "$APP" "$RUNNER_TEMP/notarize.zip"
          xcrun notarytool submit "$RUNNER_TEMP/notarize.zip" \
            --key "$NOTARY_KEY" \
            --key-id "$MACOS_NOTARY_KEY_ID" \
            --issuer "$MACOS_NOTARY_ISSUER_ID" \
            --wait
          xcrun stapler staple "$APP"
          rm "$NOTARY_KEY"

      - name: Zip macOS .app
        run: |
          APP="build/macos/Build/Products/Release/querya_desktop.app"
          test -d "$APP"
          ditto -c -k --keepParent "$APP" "Querya-Desktop-${{ steps.version.outputs.version }}-macos.zip"

      - name: Build macOS .dmg
        env:
          MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
        run: |
          set -euo pipefail
          APP="build/macos/Build/Products/Release/querya_desktop.app"
          DMG="Querya-Desktop-${{ steps.version.outputs.version }}-macos.dmg"
          test -d "$APP"

          # Drag-to-Applications layout: the app next to an /Applications link.
          STAGE="$RUNNER_TEMP/dmg-stage"
          rm -rf "$STAGE" && mkdir -p "$STAGE"
          ditto "$APP" "$STAGE/Querya Desktop.app"
          ln -s /Applications "$STAGE/Applications"
          hdiutil create -volname "Querya Desktop" -srcfolder "$STAGE" \
            -fs HFS+ -format UDZO -ov "$DMG"

          if [ -z "${MACOS_SIGN_IDENTITY:-}" ] || [ -z "${MACOS_NOTARY_KEY:-}" ]; then
            echo "Skipping .dmg signing/notarization — secrets not configured."
            exit 0
          fi

          # The signing keychain was created by the previous signing step.
          codesign --force --timestamp --sign "$MACOS_SIGN_IDENTITY" "$DMG"
          NOTARY_KEY="$RUNNER_TEMP/notary_key_dmg.p8"
          echo -n "$MACOS_NOTARY_KEY" | base64 --decode -o "$NOTARY_KEY"
          xcrun notarytool submit "$DMG" \
            --key "$NOTARY_KEY" \
            --key-id "$MACOS_NOTARY_KEY_ID" \
            --issuer "$MACOS_NOTARY_ISSUER_ID" \
            --wait
          xcrun stapler staple "$DMG"
          xcrun stapler validate "$DMG"
          rm "$NOTARY_KEY"

      - uses: actions/upload-artifact@v4
        with:
          name: bundle-macos
          path: |
            Querya-Desktop-${{ steps.version.outputs.version }}-macos.zip
            Querya-Desktop-${{ steps.version.outputs.version }}-macos.dmg
          if-no-files-found: error

  build-ext-tester:
    name: Build querya-ext-tester (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: linux-x64
            archive: tar.gz
          - os: macos-latest
            target: macos-arm64
            archive: tar.gz
          - os: macos-15-intel
            target: macos-x64
            archive: tar.gz
          - os: windows-latest
            target: windows-x64
            archive: zip
    steps:
      - uses: actions/checkout@v4

      - name: Get version from pubspec.yaml
        id: version
        shell: bash
        run: |
          FULL_VERSION=$(grep "^version:" pubspec.yaml | sed 's/version: //')
          VERSION=$(echo "$FULL_VERSION" | sed 's/+.*//')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.47.1'
          channel: stable
          cache: true

      - name: Get dependencies
        run: flutter pub get

      - name: Compile standalone executable (AOT)
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p build/ext-tester
          EXE=querya-ext-tester
          if [ "${{ runner.os }}" = "Windows" ]; then EXE=querya-ext-tester.exe; fi
          # Pure Dart in a throwaway package: `dart compile exe` rejects the
          # app's graph (build hooks in sqlite3 and objective_c).
          scripts/ci/build_ext_tester.sh "build/ext-tester/$EXE"
          MCP=querya-mcp
          if [ "${{ runner.os }}" = "Windows" ]; then MCP=querya-mcp.exe; fi
          mkdir -p build/mcp
          # Own dependency-free package: one static binary, no build hooks.
          (cd packages/querya_mcp_bridge && dart pub get && \
            dart compile exe bin/querya_mcp.dart -o "../../build/mcp/$MCP")

      - name: Smoke test
        shell: bash
        run: |
          set -euo pipefail
          EXE=build/ext-tester/querya-ext-tester
          if [ "${{ runner.os }}" = "Windows" ]; then EXE=build/ext-tester/querya-ext-tester.exe; fi
          "$EXE" --help | grep -q "Usage: querya-ext-tester"
          # An empty directory has no manifest.json: the run must fail with exit code 1.
          mkdir -p build/ext-tester-empty
          set +e
          "$EXE" build/ext-tester-empty --no-color > smoke.log
          code=$?
          set -e
          cat smoke.log
          test "$code" -eq 1
          grep -q "manifest.json not found" smoke.log
          MCP=build/mcp/querya-mcp
          if [ "${{ runner.os }}" = "Windows" ]; then MCP=build/mcp/querya-mcp.exe; fi
          "$MCP" --help | grep -q "Usage: querya-mcp"
          # No endpoint file: initialize must be answered with a clear error.
          set +e
          echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' \
            | QUERYA_MCP_ENDPOINT="$PWD/build/no-such-endpoint.json" "$MCP" > mcp-smoke.log
          code=$?
          set -e
          cat mcp-smoke.log
          test "$code" -eq 1
          grep -q "Querya Desktop is not running" mcp-smoke.log

      - name: Package
        shell: bash
        run: |
          set -euo pipefail
          NAME="querya-ext-tester-v${{ steps.version.outputs.version }}-${{ matrix.target }}"
          MCP_NAME="querya-mcp-v${{ steps.version.outputs.version }}-${{ matrix.target }}"
          cd build/ext-tester
          if [ "${{ matrix.archive }}" = "zip" ]; then
            7z a -tzip "../../$NAME.zip" querya-ext-tester.exe
            cd ../mcp && 7z a -tzip "../../$MCP_NAME.zip" querya-mcp.exe
          else
            tar -czf "../../$NAME.tar.gz" querya-ext-tester
            cd ../mcp && tar -czf "../../$MCP_NAME.tar.gz" querya-mcp
          fi

      - uses: actions/upload-artifact@v4
        with:
          name: tester-${{ matrix.target }}
          path: |
            querya-ext-tester-v${{ steps.version.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }}
            querya-mcp-v${{ steps.version.outputs.version }}-${{ matrix.target }}.${{ matrix.archive }}
          if-no-files-found: error

  publish:
    name: Publish GitHub Release
    needs: [e2e, build-windows, build-linux, build-macos, build-ext-tester]
    runs-on: ubuntu-latest
    outputs:
      version: ${{ needs.build-windows.outputs.version }}
      release_tag: ${{ steps.rel.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: bundle-*
          merge-multiple: true

      - uses: actions/download-artifact@v4
        with:
          path: tester-artifacts
          pattern: tester-*
          merge-multiple: true

      - name: Layout distribution files
        run: |
          set -euo pipefail
          mkdir -p dist
          find artifacts \( -name '*.zip' -o -name '*.dmg' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.rpm' -o -name '*.flatpak' -o -name '*-windows-setup.exe' \) \
            -exec mv -t dist/ {} +
          test "$(find dist -name '*.zip' | wc -l)" -eq 3
          test "$(find dist -name '*.dmg' | wc -l)" -eq 1
          test "$(find dist -name '*.AppImage' | wc -l)" -eq 1
          test "$(find dist -name '*.deb' | wc -l)" -eq 1
          test "$(find dist -name '*.rpm' | wc -l)" -eq 1
          test "$(find dist -name '*.flatpak' | wc -l)" -eq 1
          test "$(find dist -name '*-windows-setup.exe' | wc -l)" -eq 1
          find tester-artifacts -type f \( -name 'querya-ext-tester-*.tar.gz' -o -name 'querya-ext-tester-*.zip' \) \
            -exec mv -t dist/ {} +
          test "$(find dist -name 'querya-ext-tester-*' | wc -l)" -eq 4
          find tester-artifacts -type f \( -name 'querya-mcp-*.tar.gz' -o -name 'querya-mcp-*.zip' \) \
            -exec mv -t dist/ {} +
          test "$(find dist -name 'querya-mcp-*' | wc -l)" -eq 4
          cd dist
          sha256sum *.* | tee SHA256SUMS.txt

      - name: Build release notes from CHANGELOG.md
        run: |
          set -euo pipefail
          VERSION="${{ needs.build-windows.outputs.version }}"
          ./scripts/extract-changelog-section.sh "$VERSION" > release-notes.md
          {
            echo ""
            echo "---"
            echo ""
            echo "### Downloads"
            echo ""
            echo "#### Portable (zip — run from folder, no installer)"
            echo "- **Linux**: \`Querya-Desktop-${VERSION}-linux.zip\`"
            echo "- **Windows**: \`Querya-Desktop-${VERSION}-windows.zip\`"
            echo "- **macOS**: \`Querya-Desktop-${VERSION}-macos.zip\` (signed, notarized and stapled \`.app\` when Apple Developer secrets are configured; otherwise unsigned)"
            echo "- **macOS disk image**: \`Querya-Desktop-${VERSION}-macos.dmg\` (drag to Applications; notarized and stapled when Apple Developer secrets are configured)"
            echo ""
            echo "Optional USB-style profile: set \`QUERYA_PORTABLE=1\` or create a \`QueryaData/\` folder next to the binary (see docs/packaging.md)."
            echo ""
            echo "#### Installable"
            echo "- **Linux AppImage**: \`Querya-Desktop-${VERSION}-linux.AppImage\` (\`chmod +x\` then run)"
            echo "- **Linux .deb** (Debian/Ubuntu): \`Querya-Desktop-${VERSION}-linux.deb\` — \`sudo apt install ./Querya-Desktop-${VERSION}-linux.deb\`"
            echo "- **Linux .rpm** (Fedora/RHEL): \`Querya-Desktop-${VERSION}-linux.rpm\` — \`sudo dnf install ./Querya-Desktop-${VERSION}-linux.rpm\`"
            echo "- **Linux Flatpak**: \`Querya-Desktop-${VERSION}-linux.flatpak\` — \`flatpak install --user ./Querya-Desktop-${VERSION}-linux.flatpak\`"
            echo "- **Windows setup**: \`Querya-Desktop-${VERSION}-windows-setup.exe\` (Inno Setup)"
            echo ""
            echo "**Arch (AUR):** \`querya-desktop\` — \`yay -S querya-desktop\` (auto-published when \`AUR_SSH_PRIVATE_KEY\` is configured)."
            echo ""
            echo "#### Extension developers"
            echo "- **querya-ext-tester** (headless extension test runner, no Flutter needed): \`querya-ext-tester-v${VERSION}-linux-x64.tar.gz\`, \`-macos-arm64.tar.gz\`, \`-macos-x64.tar.gz\`, \`-windows-x64.zip\` — see docs/extension-testing.md"
            echo ""
            echo "#### MCP (AI clients)"
            echo "- **querya-mcp** (stdio bridge for Claude Desktop, Cursor, VS Code and other MCP clients; also bundled with the Linux and Windows builds): \`querya-mcp-v${VERSION}-linux-x64.tar.gz\`, \`-macos-arm64.tar.gz\`, \`-macos-x64.tar.gz\`, \`-windows-x64.zip\`"
            echo ""
            echo "Verify checksums: \`SHA256SUMS.txt\`"
            echo ""
            echo "### Build info"
            echo "- **pubspec**: ${{ needs.build-windows.outputs.full_version }}"
            echo "- **Commit**: ${{ github.sha }}"
          } >> release-notes.md

      - name: Release tag name
        id: rel
        run: |
          if [ "${{ github.ref_type }}" = "tag" ]; then
            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${{ needs.build-windows.outputs.version }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.rel.outputs.tag }}
          name: Querya Desktop ${{ needs.build-windows.outputs.version }}
          body_path: release-notes.md
          fail_on_unmatched_files: false
          files: |
            dist/Querya-Desktop-*.zip
            dist/*.dmg
            dist/querya-ext-tester-*
            dist/querya-mcp-*
            dist/*.deb
            dist/*.rpm
            dist/*.flatpak
            dist/*.AppImage
            dist/*-windows-setup.exe
            dist/SHA256SUMS.txt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-aur:
    name: Publish AUR (querya-desktop)
    needs: [publish]
    runs-on: ubuntu-latest
    steps:
      - name: Check AUR secret
        id: aur
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          if [ -n "${AUR_SSH_PRIVATE_KEY}" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Wait for release assets
        if: steps.aur.outputs.enabled == 'true'
        run: sleep 15

      - uses: actions/checkout@v4
        if: steps.aur.outputs.enabled == 'true'

      - name: SSH agent
        if: steps.aur.outputs.enabled == 'true'
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}

      - name: Publish to AUR
        if: steps.aur.outputs.enabled == 'true'
        run: |
          set -euo pipefail
          VER="${{ needs.publish.outputs.version }}"
          TAG="${{ needs.publish.outputs.release_tag }}"
          chmod +x ./scripts/linux/aur_publish.sh
          ./scripts/linux/aur_publish.sh "$VER" "$TAG"

  publish-linux-repo:
    name: Publish APT + DNF repository
    needs: [publish]
    runs-on: ubuntu-latest
    steps:
      - name: Check repository secrets
        id: repo
        env:
          GPG_KEY: ${{ secrets.PACKAGE_REPO_GPG_PRIVATE_KEY }}
          TOKEN: ${{ secrets.PACKAGE_REPO_TOKEN }}
        run: |
          if [ -n "${GPG_KEY}" ] && [ -n "${TOKEN}" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            echo "PACKAGE_REPO_GPG_PRIVATE_KEY / PACKAGE_REPO_TOKEN not set; skipping."
          fi

      - uses: actions/checkout@v4
        if: steps.repo.outputs.enabled == 'true'

      - uses: actions/download-artifact@v4
        if: steps.repo.outputs.enabled == 'true'
        with:
          name: bundle-linux
          path: artifacts/linux

      - name: Install repository tooling
        if: steps.repo.outputs.enabled == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y apt-utils createrepo-c rpm

      - name: Import signing key
        if: steps.repo.outputs.enabled == 'true'
        id: gpg
        env:
          GPG_KEY: ${{ secrets.PACKAGE_REPO_GPG_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          echo "$GPG_KEY" | gpg --batch --import
          fpr="$(gpg --batch --list-secret-keys --with-colons | awk -F: '/^fpr:/ {print $10; exit}')"
          echo "fpr=$fpr" >> "$GITHUB_OUTPUT"

      - name: Publish
        if: steps.repo.outputs.enabled == 'true'
        env:
          PACKAGE_REPO_URL: https://x-access-token:${{ secrets.PACKAGE_REPO_TOKEN }}@github.com/QueryaHub/repo.git
          GPG_KEY_ID: ${{ steps.gpg.outputs.fpr }}
        run: |
          set -euo pipefail
          deb="$(find artifacts/linux -name '*.deb' | head -n1)"
          rpm="$(find artifacts/linux -name '*.rpm' | head -n1)"
          ./scripts/linux/publish_package_repo.sh "$deb" "$rpm"