keychain-cli.yml

name: Keychain CLI

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (plain X.Y.Z, chosen by the maintainer)'
        type: string
        required: true
      dry-run:
        description: 'Dry run (build and verify only)'
        type: boolean
        default: true

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: socket-keychain / ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - { runner: macos-15, target: darwin-arm64 }
          - { runner: macos-15-intel, target: darwin-x64 }
          - { runner: ubuntu-24.04-arm, target: linux-arm64 }
          - { runner: ubuntu-24.04, target: linux-x64 }
          - { runner: windows-2022, target: win32-x64 }
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          persist-credentials: false
      - uses: ./.github/actions/fleet/setup-and-install
      - name: Validate release version
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: node --input-type=module -e 'import("./packages/keychain-cli-builder/scripts/stage-release.mts").then(({ validateVersion }) => validateVersion(process.env.RELEASE_VERSION))'
      - name: Install Linux Keychain toolchain
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libsecret-1-dev pkg-config
      - name: Install Windows toolchain
        if: runner.os == 'Windows'
        run: choco install mingw -y
      - name: Build native executable
        env:
          BUILD_MODE: prod
          RELEASE_VERSION: ${{ inputs.version }}
        run: pnpm --filter keychain-cli-builder build
      - name: Smoke-test native executable
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
          TARGET: ${{ matrix.target }}
        run: |
          ext=""
          [ "${TARGET%%-*}" = "win32" ] && ext=".exe"
          bin="packages/keychain-cli-builder/build/prod/$TARGET/out/Final/socket-keychain${ext}"
          test "$("$bin" --version)" = "socket-keychain ${RELEASE_VERSION}"
          "$bin" --help
          set +e
          "$bin" get socket-keychain-release-probe missing
          status=$?
          set -e
          test "$status" -eq 3
          "$bin" delete socket-keychain-release-probe missing
      - name: Stage verified release asset
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
          TARGET: ${{ matrix.target }}
        run: |
          ext=""
          [ "${TARGET%%-*}" = "win32" ] && ext=".exe"
          node packages/keychain-cli-builder/scripts/stage-release.mts \
            "$RELEASE_VERSION" \
            "$TARGET" \
            "packages/keychain-cli-builder/build/prod/$TARGET/out/Final/socket-keychain${ext}" \
            dist
      - name: Upload verified asset
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 (2026-05-15)
        with:
          name: socket-keychain-${{ matrix.target }}
          path: dist/
          if-no-files-found: error
          retention-days: 14
          compression-level: 0

  release:
    name: Release socket-keychain
    needs: build
    if: github.event_name == 'workflow_dispatch' && !inputs.dry-run
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    environment: release
    permissions:
      contents: write
    steps:
      - name: Download verified assets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 (2026-05-15)
        with:
          path: release
          pattern: socket-keychain-*
          merge-multiple: true
      - name: Verify complete release set
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          cd release
          expected=(darwin-arm64 darwin-x64 linux-arm64 linux-x64)
          for target in "${expected[@]}"; do
            test -f "socket-keychain-${RELEASE_VERSION}-${target}"
            test -f "socket-keychain-${RELEASE_VERSION}-${target}.sha256"
          done
          test -f "socket-keychain-${RELEASE_VERSION}-win32-x64.exe"
          test -f "socket-keychain-${RELEASE_VERSION}-win32-x64.exe.sha256"
          cat ./*.sha256 > checksums.txt
          sha256sum --check checksums.txt
          test "$(find . -maxdepth 1 -type f -name 'socket-keychain-*' ! -name '*.sha256' | wc -l)" -eq 5
      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          gh release create "socket-keychain-v${RELEASE_VERSION}" \
            --draft \
            --target "${GITHUB_SHA}" \
            --title "socket-keychain v${RELEASE_VERSION}" \
            --notes "Local OS credential bridge for AI tools, hooks, Agent-CI, and developer automation."
      - name: Upload release assets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          gh release upload "socket-keychain-v${RELEASE_VERSION}" \
            release/socket-keychain-* \
            release/checksums.txt
      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
        run: gh release edit "socket-keychain-v${RELEASE_VERSION}" --draft=false