release.yml

name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

env:
  GITHUB_ENVIRONMENT: production

jobs:
  # Generate AI-powered release notes using Claude API
  generate-notes:
    runs-on: ubuntu-latest
    # Stable releases only — RC/prerelease tags (v*-rc.*) are handled by prerelease.yml.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    outputs:
      notes: ${{ steps.generate.outputs.notes }}
      notes_file: ${{ steps.generate.outputs.notes_file }}
      contributors: ${{ steps.contributors.outputs.section }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0  # Full history for git log

      - name: Get previous tag
        id: prev_tag
        run: |
          # Get the previous STABLE tag. This job runs for stable tags only,
          # and after an RC cycle the nearest tag is the last RC, which
          # would summarize only the final RC delta instead of everything
          # since the last release (v0.70.0 shipped notes covering rc.4..rc.5).
          PREV_TAG=$(git describe --tags --abbrev=0 --exclude '*-*' HEAD^ 2>/dev/null || echo "")
          echo "tag=$PREV_TAG" >> $GITHUB_OUTPUT
          if [ -n "$PREV_TAG" ]; then
            echo "Previous tag: $PREV_TAG"
          else
            echo "No previous tag found (first release)"
          fi

      - name: Collect commits
        id: commits
        run: |
          PREV_TAG="${{ steps.prev_tag.outputs.tag }}"
          MAX_COMMITS=200

          if [ -z "$PREV_TAG" ]; then
            # First release - get all commits
            echo "Collecting all commits (first release)"
            COMMITS=$(git log --pretty=format:"- %s" --no-merges | head -n $MAX_COMMITS)
            TOTAL=$(git rev-list --count --no-merges HEAD)
          else
            # Get commits since previous tag
            echo "Collecting commits from $PREV_TAG to HEAD"
            COMMITS=$(git log "${PREV_TAG}..HEAD" --pretty=format:"- %s" --no-merges | head -n $MAX_COMMITS)
            TOTAL=$(git rev-list --count --no-merges "${PREV_TAG}..HEAD")
          fi

          # Filter out noise (merge commits, version bumps)
          COMMITS=$(echo "$COMMITS" | grep -v -E "^- (Merge branch|Merge pull request|Bump version|chore\(deps\)|chore\(release\))" || echo "$COMMITS")

          # Add truncation note if needed
          if [ "$TOTAL" -gt "$MAX_COMMITS" ]; then
            COMMITS="$COMMITS

          (Showing $MAX_COMMITS most recent of $TOTAL commits)"
            echo "::warning::Truncated to $MAX_COMMITS commits (total: $TOTAL)"
          fi

          # Output commits using heredoc for multiline
          echo "commits<<EOF" >> $GITHUB_OUTPUT
          echo "$COMMITS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          echo "Collected $(echo "$COMMITS" | wc -l) commits"

      # Deterministic credit for outside contributors. Kept out of the LLM
      # summary above so a name can never be dropped or invented. Lists the
      # authors of PRs merged since the previous stable tag, excluding
      # maintainers, bots and org members (scripts/contributors.sh).
      - name: Collect contributors
        id: contributors
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
        run: |
          SECTION=$(bash scripts/contributors.sh release "$PREV_TAG" HEAD || true)
          {
            echo "section<<CONTRIBUTORS_EOF"
            echo "$SECTION"
            echo "CONTRIBUTORS_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Generate release notes with Claude
        id: generate
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          # Pass via env to avoid shell injection from commit messages containing
          # quotes, backticks, or other shell metacharacters (see release run 24950486759).
          VERSION: ${{ github.ref_name }}
          COMMITS: ${{ steps.commits.outputs.commits }}
        run: |

          # Check if API key is configured
          if [ -z "$ANTHROPIC_API_KEY" ]; then
            echo "::warning::ANTHROPIC_API_KEY not configured, using fallback message"
            NOTES="Release notes could not be generated automatically (API key not configured). See commit history for changes."
            echo "notes<<EOF" >> $GITHUB_OUTPUT
            echo "$NOTES" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            exit 0
          fi

          # Build the prompt
          PROMPT="Generate concise release notes for version ${VERSION} of MCPProxy (Smart MCP Proxy).

          MCPProxy is a smart proxy for AI agents using the Model Context Protocol (MCP). It provides intelligent tool discovery, token savings, and security quarantine for MCP servers. MCPProxy has two editions: Personal (desktop app) and Teams (multi-user server). Note which changes affect which edition if applicable.

          Commits since last release:
          ${COMMITS}

          Requirements:
          - Maximum 400 words
          - Use markdown format
          - DO NOT include a title or header like 'MCPProxy vX.X.X Release Notes' - GitHub already shows the version
          - Start directly with a brief 1-2 sentence summary of this release
          - Group changes into sections (use only sections that have content):
            - **New Features** - New functionality (feat: commits)
            - **Bug Fixes** - Fixed issues (fix: commits)
            - **Breaking Changes** - Changes requiring user action
            - **Improvements** - Enhancements to existing features
          - Skip internal changes (chore:, docs:, test:, ci: commits) unless significant
          - Use bullet points for each change
          - Be specific but brief
          - If there are no meaningful changes, say 'Minor internal improvements and maintenance updates.'"

          # Call Claude API using jq for proper JSON escaping
          PAYLOAD=$(jq -n \
            --arg model "claude-sonnet-4-5-20250929" \
            --argjson max_tokens 1024 \
            --arg prompt "$PROMPT" \
            '{
              model: $model,
              max_tokens: $max_tokens,
              messages: [{
                role: "user",
                content: $prompt
              }]
            }')

          echo "Calling Claude API..."
          RESPONSE=$(curl -s --max-time 30 \
            https://api.anthropic.com/v1/messages \
            -H "x-api-key: $ANTHROPIC_API_KEY" \
            -H "content-type: application/json" \
            -H "anthropic-version: 2023-06-01" \
            -d "$PAYLOAD" 2>&1) || {
            echo "::warning::Claude API request failed (timeout or network error)"
            NOTES="Release notes could not be generated automatically. See commit history for changes."
            echo "notes<<EOF" >> $GITHUB_OUTPUT
            echo "$NOTES" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            exit 0
          }

          # Check for API errors
          ERROR_MSG=$(echo "$RESPONSE" | jq -r '.error.message // empty' 2>/dev/null || echo "")
          if [ -n "$ERROR_MSG" ]; then
            echo "::warning::Claude API error: $ERROR_MSG"
            NOTES="Release notes could not be generated automatically. See commit history for changes."
            echo "notes<<EOF" >> $GITHUB_OUTPUT
            echo "$NOTES" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            exit 0
          fi

          # Extract the generated notes
          NOTES=$(echo "$RESPONSE" | jq -r '.content[0].text // empty' 2>/dev/null || echo "")

          if [ -z "$NOTES" ]; then
            echo "::warning::Failed to extract release notes from API response"
            NOTES="Release notes could not be generated automatically. See commit history for changes."
          else
            echo "✅ Release notes generated successfully"
          fi

          # Output notes
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          echo "$NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          # Save to file for artifact
          NOTES_FILE="RELEASE_NOTES-${VERSION}.md"
          echo "$NOTES" > "$NOTES_FILE"
          echo "notes_file=$NOTES_FILE" >> $GITHUB_OUTPUT

      - name: Upload release notes artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: release-notes
          path: RELEASE_NOTES-${{ github.ref_name }}.md
          if-no-files-found: ignore

  build:
    environment: production
    # Only run on stable version tags — RC/prerelease tags (v*-rc.*) go through prerelease.yml.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            goos: linux
            goarch: amd64
            cgo: "0"
            name: mcpproxy-linux-amd64
            archive_format: tar.gz
          - os: ubuntu-latest
            goos: linux
            goarch: arm64
            cgo: "0"
            name: mcpproxy-linux-arm64
            archive_format: tar.gz
          - os: windows-latest
            goos: windows
            goarch: amd64
            cgo: "1"
            name: mcpproxy-windows-amd64.exe
            archive_format: zip
          - os: windows-latest
            goos: windows
            goarch: arm64
            cgo: "1"
            name: mcpproxy-windows-arm64.exe
            archive_format: zip
          - os: macos-15
            goos: darwin
            goarch: amd64
            cgo: "1"
            name: mcpproxy-darwin-amd64
            archive_format: tar.gz
          - os: macos-15
            goos: darwin
            goarch: arm64
            cgo: "1"
            name: mcpproxy-darwin-arm64
            archive_format: tar.gz
          # Server edition (Linux only) — uncomment when server MVP is ready
          # - os: ubuntu-latest
          #   goos: linux
          #   goarch: amd64
          #   cgo: "0"
          #   name: mcpproxy-server-linux-amd64
          #   archive_format: tar.gz
          #   edition: server
          # - os: ubuntu-latest
          #   goos: linux
          #   goarch: arm64
          #   cgo: "0"
          #   name: mcpproxy-server-linux-arm64
          #   archive_format: tar.gz
          #   edition: server

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      - name: Download release notes artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          name: release-notes
          path: .
        continue-on-error: true  # Don't fail if notes not yet available

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version: "1.26"

      - name: Cache Go modules and build
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
            ~/AppData/Local/go-build
          key: ${{ runner.os }}-go-1.26-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-1.26-

      - name: Download dependencies
        run: go mod download

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: '22'

      - name: Install frontend dependencies
        run: cd frontend && npm ci

      - name: Build frontend
        run: cd frontend && npm run build

      - name: Copy frontend dist to embed location
        shell: bash
        run: |
          rm -rf web/frontend
          mkdir -p web/frontend/dist
          cp -r frontend/dist/. web/frontend/dist/
          # Recreate the tracked .gitkeep so //go:embed all:frontend/dist
          # always has something to embed (matches the Makefile frontend-build target).
          touch web/frontend/dist/.gitkeep

      - name: Import Code-Signing Certificates (macOS)
        if: matrix.goos == 'darwin'
        run: |
          set -euo pipefail

          echo "📦 Preparing isolated keychain for code signing"
          UNIQUE_ID="${{ matrix.goos }}-${{ matrix.goarch }}-$$-$(date +%s)"
          TEMP_KEYCHAIN="mcpproxy-build-${UNIQUE_ID}.keychain"

          security create-keychain -p "temp123" "$TEMP_KEYCHAIN"
          security list-keychains -s "$TEMP_KEYCHAIN" ~/Library/Keychains/login.keychain-db /Library/Keychains/System.keychain
          security unlock-keychain -p "temp123" "$TEMP_KEYCHAIN"
          security set-keychain-settings -t 3600 -l "$TEMP_KEYCHAIN"

          if [ -z "${{ secrets.APPLE_DEVELOPER_ID_CERT }}" ] || [ -z "${{ secrets.APPLE_DEVELOPER_ID_CERT_PASSWORD }}" ]; then
            echo "❌ APPLE_DEVELOPER_ID_CERT and APPLE_DEVELOPER_ID_CERT_PASSWORD secrets are required"
            exit 1
          fi

          echo "${{ secrets.APPLE_DEVELOPER_ID_CERT }}" | base64 -d > developer-id.p12
          security import developer-id.p12 \
            -k "$TEMP_KEYCHAIN" \
            -P "${{ secrets.APPLE_DEVELOPER_ID_CERT_PASSWORD }}" \
            -T /usr/bin/codesign \
            -T /usr/bin/productbuild \
            -T /usr/bin/productsign \
            -T /usr/bin/security
          rm -f developer-id.p12

          echo "🔍 Checking for separate Developer ID Installer certificate"
          INSTALLER_ID=$(security find-identity -v -p basic "$TEMP_KEYCHAIN" | grep "Developer ID Installer" || true)

          if [ -z "$INSTALLER_ID" ]; then
            if [ -z "${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_CERT }}" ] || [ -z "${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_CERT_PASSWORD }}" ]; then
              echo "❌ Developer ID Installer identity not found in APPLE_DEVELOPER_ID_CERT"
              echo "   Provide APPLE_DEVELOPER_ID_INSTALLER_CERT and password secrets"
              exit 1
            fi

            echo "Importing dedicated Developer ID Installer certificate"
            echo "${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_CERT }}" | base64 -d > developer-id-installer.p12
            security import developer-id-installer.p12 \
              -k "$TEMP_KEYCHAIN" \
              -P "${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_CERT_PASSWORD }}" \
              -T /usr/bin/productsign \
              -T /usr/bin/productbuild \
              -T /usr/bin/codesign \
              -T /usr/bin/security
            rm -f developer-id-installer.p12
          fi

          security set-key-partition-list -S apple-tool:,apple: -s -k "temp123" "$TEMP_KEYCHAIN"

          APP_CERT_IDENTITY=$(security find-identity -v -p codesigning "$TEMP_KEYCHAIN" | grep "Developer ID Application" | head -1 | grep -o '"[^"]*"' | tr -d '"')
          PKG_CERT_IDENTITY=$(security find-identity -v -p basic "$TEMP_KEYCHAIN" | grep "Developer ID Installer" | head -1 | grep -o '"[^"]*"' | tr -d '"')

          if [ -z "$APP_CERT_IDENTITY" ]; then
            echo "❌ Developer ID Application identity not found after import"
            exit 1
          fi

          if [ -z "$PKG_CERT_IDENTITY" ]; then
            echo "❌ Developer ID Installer identity not found after import"
            exit 1
          fi

          echo "✅ Using Developer ID Application: $APP_CERT_IDENTITY"
          echo "✅ Using Developer ID Installer: $PKG_CERT_IDENTITY"

          echo "APP_CERT_IDENTITY=$APP_CERT_IDENTITY" >> "$GITHUB_ENV"
          echo "PKG_CERT_IDENTITY=$PKG_CERT_IDENTITY" >> "$GITHUB_ENV"
          echo "$TEMP_KEYCHAIN" > .keychain_name

          echo "=== Available signing identities in temporary keychain ==="
          security find-identity -v "$TEMP_KEYCHAIN"

          echo "✅ Certificate import completed"

      - name: Build binary and create archives
        shell: bash
        env:
          CGO_ENABLED: ${{ matrix.cgo }}
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          # ✅ Force minimum supported macOS version for compatibility (13.0 for Swift tray app)
          MACOSX_DEPLOYMENT_TARGET: "13.0"
          # Defensive CGO flags to ensure proper deployment target
          CGO_CFLAGS: "-mmacosx-version-min=13.0"
          CGO_LDFLAGS: "-mmacosx-version-min=13.0"
          # Spec 092 FR-011: pin the Sparkle EdDSA PUBLIC key into the shipped
          # Info.plist. scripts/build-swift-app.sh no-ops when this is empty
          # (forks, and every build until the maintainer generates the keypair),
          # leaving SPARKLE_PUBLIC_KEY_PLACEHOLDER in place — which makes the
          # updater refuse to start and the tray fall back to the browser path
          # rather than trusting an unverified update.
          SPARKLE_PUBLIC_ED_KEY: ${{ secrets.SPARKLE_ED_PUBLIC_KEY }}
          # Optional override of the compiled-in feed URL (defaults to the
          # Info.plist value, https://mcpproxy.app/appcast.xml).
          SPARKLE_FEED_URL: ${{ vars.SPARKLE_FEED_URL }}
        run: |
          VERSION=${GITHUB_REF#refs/tags/}
          # NOTE (Spec 079/092): the shared matrix binary stays UNSTAMPED. It feeds
          # the DMG/PKG app bundle and the .deb/.rpm packages, which must keep
          # detecting their own channel via runtime heuristics
          # (internal/updatecheck/channel.go). Single-channel pipelines stamp their
          # own marker: Dockerfile -> docker,
          # scripts/build-windows-installer.ps1 -> windows-installer, and the
          # archive build below -> tarball.
          LDFLAGS="-s -w -X main.version=${VERSION} -X github.com/smart-mcp-proxy/mcpproxy-go/internal/httpapi.buildVersion=${VERSION}"

          # Determine clean binary name and build flags
          EDITION="${{ matrix.edition }}"
          BUILD_TAGS=""
          if [ "$EDITION" = "server" ]; then
            CLEAN_BINARY="mcpproxy-server"
            BUILD_TAGS="-tags server"
          elif [ "${{ matrix.goos }}" = "windows" ]; then
            CLEAN_BINARY="mcpproxy.exe"
          else
            CLEAN_BINARY="mcpproxy"
          fi

          # Create clean core binary (app bundle, .deb/.rpm, installers)
          go build ${BUILD_TAGS} -ldflags "${LDFLAGS}" -o ${CLEAN_BINARY} ./cmd/mcpproxy

          # Spec 092 FR-020: build a SEPARATE core binary for the .tar.gz/.zip
          # archive, stamped with the tarball install-channel marker. Only this
          # copy is stamped — a positively identified tarball install is the one
          # channel `mcpproxy update` is allowed to self-replace, and the DMG /
          # deb / rpm consumers of ${CLEAN_BINARY} must never inherit that.
          #
          # Homebrew is the one consumer that still shares this artifact (the tap
          # formula downloads the very same .tar.gz). That is safe because the
          # tarball marker is deliberately WEAK: detect() runs its positive
          # heuristics first, so a binary living under a Homebrew prefix/Cellar
          # resolves to homebrew regardless of the stamp. See
          # internal/updatecheck/channel.go and its channel_tarball_test.go.
          TARBALL_STAGE="tarball-stage"
          rm -rf "${TARBALL_STAGE}"
          mkdir -p "${TARBALL_STAGE}"
          go build ${BUILD_TAGS} \
            -ldflags "${LDFLAGS} -X github.com/smart-mcp-proxy/mcpproxy-go/internal/updatecheck.buildChannel=tarball" \
            -o "${TARBALL_STAGE}/${CLEAN_BINARY}" ./cmd/mcpproxy

          # Build tray binary for platforms with GUI support (macOS and Windows, personal only)
          if [ "$EDITION" != "server" ] && { [ "${{ matrix.goos }}" = "darwin" ] || [ "${{ matrix.goos }}" = "windows" ]; }; then
            echo "Building mcpproxy-tray for ${{ matrix.goos }}..."

            # Determine tray binary name, and on Windows link it as a GUI
            # (not console) executable. Without -H windowsgui the tray pops a
            # console window on every launch; scripts/build-windows-installer.ps1
            # has always passed it, and the archived copy must match, because a
            # tray self-update extracts THIS binary and installs it over the
            # installer's copy (internal/tray applyArchiveUpdate).
            TRAY_LDFLAGS="${LDFLAGS}"
            if [ "${{ matrix.goos }}" = "windows" ]; then
              TRAY_BINARY="mcpproxy-tray.exe"
              TRAY_LDFLAGS="${LDFLAGS} -H windowsgui"
            else
              TRAY_BINARY="mcpproxy-tray"
            fi

            go build -ldflags "${TRAY_LDFLAGS}" -o ${TRAY_BINARY} ./cmd/mcpproxy-tray
          fi

          # Build Swift tray app (macOS only — replaces Go tray in .app bundle for DMG/PKG)
          if [ "$EDITION" != "server" ] && [ "${{ matrix.goos }}" = "darwin" ]; then
            chmod +x scripts/build-swift-app.sh
            OUTPUT_DIR="$(pwd)/swift-build"
            mkdir -p "$OUTPUT_DIR"
            ./scripts/build-swift-app.sh "${VERSION}" "${{ matrix.goarch }}" "$OUTPUT_DIR"
            SWIFT_APP="$OUTPUT_DIR/MCPProxy.app"
            if [ -d "$SWIFT_APP" ]; then
              echo "SWIFT_APP_PATH=$SWIFT_APP" >> $GITHUB_ENV
            else
              echo "❌ Swift app build failed"
              exit 1
            fi
          fi

          # Code sign macOS binaries
          if [ "${{ matrix.goos }}" = "darwin" ]; then
            echo "Code signing macOS binary..."

            # Debug: List all available certificates
            echo "Available certificates:"
            security find-identity -v -p codesigning

            # Find the Developer ID certificate identity
            CERT_IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | grep -o '"[^"]*"' | tr -d '"')

            # Verify we found a valid certificate
            if [ -n "${CERT_IDENTITY}" ]; then
              echo "✅ Found Developer ID certificate: ${CERT_IDENTITY}"
            else
              echo "❌ No Developer ID certificate found, using team ID as fallback"
              CERT_IDENTITY="${{ secrets.APPLE_TEAM_ID }}"
              echo "⚠️  Using fallback identity: ${CERT_IDENTITY}"
            fi

            # Validate entitlements file formatting (Apple's recommendation)
            echo "=== Validating entitlements file ==="
            if [ -f "scripts/entitlements.plist" ]; then
              echo "Validating entitlements formatting with plutil..."
              if plutil -lint scripts/entitlements.plist; then
                echo "✅ Entitlements file is properly formatted"
              else
                echo "❌ Entitlements file has formatting issues"
                exit 1
              fi

              # Convert to XML format if needed (Apple's recommendation)
              plutil -convert xml1 scripts/entitlements.plist
              echo "✅ Entitlements converted to XML format"
            else
              echo "⚠️  No entitlements file found"
            fi

            # Sign both binaries with proper Developer ID certificate, hardened runtime, and timestamp
            echo "=== Signing binaries with hardened runtime ==="

            # Install GNU coreutils for timeout command (macOS compatibility)
            if ! command -v timeout &> /dev/null; then
              echo "Installing GNU coreutils for timeout command..."
              brew install coreutils
              # Use gtimeout from coreutils
              TIMEOUT_CMD="gtimeout"
            else
              TIMEOUT_CMD="timeout"
            fi

            # Sign core binary
            echo "Signing core binary: ${CLEAN_BINARY}"
            SIGN_SUCCESS=false
            for attempt in 1 2 3; do
              echo "Core binary signing attempt $attempt/3..."

              # Use timeout command to prevent hanging (max 5 minutes per attempt)
              if $TIMEOUT_CMD 300 codesign --force \
                --options runtime \
                --entitlements scripts/entitlements.plist \
                --sign "${CERT_IDENTITY}" \
                --timestamp \
                ${CLEAN_BINARY}; then

                SIGN_SUCCESS=true
                echo "✅ Core binary signing succeeded on attempt $attempt"
                break
              else
                echo "❌ Core binary signing attempt $attempt failed or timed out"
                if [ $attempt -lt 3 ]; then
                  echo "Retrying in 10 seconds..."
                  sleep 10
                fi
              fi
            done

            if [ "$SIGN_SUCCESS" != "true" ]; then
              echo "❌ All core binary signing attempts failed"
              exit 1
            fi

            # Sign the tarball-stamped core binary (Spec 092 FR-020). It is a
            # separate build product from ${CLEAN_BINARY}, so it needs its own
            # signature — an unsigned binary in the .tar.gz would be a Gatekeeper
            # regression for tarball users.
            echo "Signing tarball-stamped core binary: ${TARBALL_STAGE}/${CLEAN_BINARY}"
            TARBALL_SIGN_SUCCESS=false
            for attempt in 1 2 3; do
              echo "Tarball core signing attempt $attempt/3..."
              if $TIMEOUT_CMD 300 codesign --force \
                --options runtime \
                --entitlements scripts/entitlements.plist \
                --sign "${CERT_IDENTITY}" \
                --timestamp \
                "${TARBALL_STAGE}/${CLEAN_BINARY}"; then

                TARBALL_SIGN_SUCCESS=true
                echo "✅ Tarball core signing succeeded on attempt $attempt"
                break
              else
                echo "❌ Tarball core signing attempt $attempt failed or timed out"
                if [ $attempt -lt 3 ]; then
                  echo "Retrying in 10 seconds..."
                  sleep 10
                fi
              fi
            done

            if [ "$TARBALL_SIGN_SUCCESS" != "true" ]; then
              echo "❌ All tarball core signing attempts failed"
              exit 1
            fi

            if codesign -vvv --deep --strict "${TARBALL_STAGE}/${CLEAN_BINARY}"; then
              echo "✅ Tarball core strict verification PASSED"
            else
              echo "❌ Tarball core strict verification FAILED"
              exit 1
            fi

            # Sign tray binary
            echo "Signing tray binary: mcpproxy-tray"
            TRAY_SIGN_SUCCESS=false
            for attempt in 1 2 3; do
              echo "Tray binary signing attempt $attempt/3..."

              # Use timeout command to prevent hanging (max 5 minutes per attempt)
              if $TIMEOUT_CMD 300 codesign --force \
                --options runtime \
                --entitlements scripts/entitlements.plist \
                --sign "${CERT_IDENTITY}" \
                --timestamp \
                mcpproxy-tray; then

                TRAY_SIGN_SUCCESS=true
                echo "✅ Tray binary signing succeeded on attempt $attempt"
                break
              else
                echo "❌ Tray binary signing attempt $attempt failed or timed out"
                if [ $attempt -lt 3 ]; then
                  echo "Retrying in 10 seconds..."
                  sleep 10
                fi
              fi
            done

            if [ "$TRAY_SIGN_SUCCESS" != "true" ]; then
              echo "❌ All tray binary signing attempts failed"
              exit 1
            fi

            # Verify signing, hardened runtime, and timestamp using Apple's recommended methods
            echo "=== Verifying binary signatures (Apple's recommended verification) ==="

            # Verify core binary
            echo "=== Core binary verification ==="
            codesign --verify --verbose ${CLEAN_BINARY}
            echo "Core binary basic verification: $?"

            # Apple's recommended strict verification for notarization
            echo "=== Core binary strict verification (matches notarization requirements) ==="
            if codesign -vvv --deep --strict ${CLEAN_BINARY}; then
              echo "✅ Core binary strict verification PASSED - ready for notarization"
            else
              echo "❌ Core binary strict verification FAILED - will not pass notarization"
              exit 1
            fi

            # Verify tray binary
            echo "=== Tray binary verification ==="
            codesign --verify --verbose mcpproxy-tray
            echo "Tray binary basic verification: $?"

            # Apple's recommended strict verification for notarization
            echo "=== Tray binary strict verification (matches notarization requirements) ==="
            if codesign -vvv --deep --strict mcpproxy-tray; then
              echo "✅ Tray binary strict verification PASSED - ready for notarization"
            else
              echo "❌ Strict verification FAILED - will not pass notarization"
              exit 1
            fi

            # Check for secure timestamp (Apple's recommended check)
            echo "=== Checking for secure timestamp ==="
            TIMESTAMP_CHECK=$(codesign -dvv ${CLEAN_BINARY} 2>&1)
            if echo "$TIMESTAMP_CHECK" | grep -q "Timestamp="; then
              echo "✅ Secure timestamp present:"
              echo "$TIMESTAMP_CHECK" | grep "Timestamp="
            else
              echo "❌ No secure timestamp found"
              echo "Full output:"
              echo "$TIMESTAMP_CHECK"
            fi

            # Display detailed signature info
            codesign --display --verbose=4 ${CLEAN_BINARY}

            # Check entitlements formatting (Apple's recommendation)
            echo "=== Checking entitlements formatting ==="
            codesign --display --entitlements - ${CLEAN_BINARY} | head -10

            # Verify with spctl (Gatekeeper assessment) - expected to fail before notarization
            echo "=== Gatekeeper assessment (expected to fail before notarization) ==="
            if spctl --assess --verbose ${CLEAN_BINARY}; then
              echo "✅ Gatekeeper assessment: PASSED (unexpected but good!)"
            else
              echo "⚠️  Gatekeeper assessment: REJECTED (expected - binary needs notarization)"
              echo "This is normal - the binary will pass after Apple completes notarization"
            fi

            echo "✅ Binary signed successfully with hardened runtime and timestamp"
          fi

          # Create archive with version info
          ARCHIVE_BASE="mcpproxy-${VERSION#v}-${{ matrix.goos }}-${{ matrix.goarch }}"
          LATEST_ARCHIVE_BASE="mcpproxy-latest-${{ matrix.goos }}-${{ matrix.goarch }}"

          # Archives ship the tarball-stamped core from ${TARBALL_STAGE} (Spec 092
          # FR-020); everything downstream (DMG/PKG, .deb/.rpm, installers) keeps
          # using the unstamped ${CLEAN_BINARY} in the working directory.
          # Archive members must stay at the archive root, so the tray binary is
          # copied into the stage directory and archives are created from there.
          FILES_TO_ARCHIVE="${CLEAN_BINARY}"

          # Add tray binary if it exists (Windows and macOS)
          if [ "${{ matrix.goos }}" = "windows" ] && [ -f "mcpproxy-tray.exe" ]; then
            cp mcpproxy-tray.exe "${TARBALL_STAGE}/"
            FILES_TO_ARCHIVE="${FILES_TO_ARCHIVE} mcpproxy-tray.exe"
            echo "Including mcpproxy-tray.exe in archive"
          elif [ "${{ matrix.goos }}" = "darwin" ] && [ -f "mcpproxy-tray" ]; then
            cp mcpproxy-tray "${TARBALL_STAGE}/"
            FILES_TO_ARCHIVE="${FILES_TO_ARCHIVE} mcpproxy-tray"
            echo "Including mcpproxy-tray in archive"
          elif [ "$EDITION" != "server" ] && { [ "${{ matrix.goos }}" = "darwin" ] || [ "${{ matrix.goos }}" = "windows" ]; }; then
            # The tray self-update extracts the mcpproxy-tray member by exact
            # name and fails closed without it, so a tray-less archive strands
            # every tray on this platform. This branch is the one that used to
            # degrade silently: the conditions above simply did not fire and
            # the archive shipped core-only. Linux and the server edition fall
            # through untouched — neither ships a tray.
            echo "::error::no tray binary to archive for ${{ matrix.goos }}; a core-only archive would strand every tray self-update"
            exit 1
          fi

          ARCHIVE_OUT="$(pwd)"

          if [ "${{ matrix.archive_format }}" = "zip" ]; then
            # Create ZIP archive (Windows)
            # Use PowerShell Compress-Archive on Windows since zip command isn't available
            if [ "${{ matrix.goos }}" = "windows" ]; then
              # Convert space-separated list to comma-separated for PowerShell.
              # Compress-Archive stores each file at the archive root regardless
              # of the source directory, so the staged paths are safe here.
              PS_FILES=$(echo ${FILES_TO_ARCHIVE} | sed "s#[^ ]*#${TARBALL_STAGE}/&#g" | sed 's/ /,/g')
              powershell -Command "Compress-Archive -Path ${PS_FILES} -DestinationPath '${ARCHIVE_BASE}.zip'"
              powershell -Command "Compress-Archive -Path ${PS_FILES} -DestinationPath '${LATEST_ARCHIVE_BASE}.zip'"
            else
              (cd "${TARBALL_STAGE}" && zip "${ARCHIVE_OUT}/${ARCHIVE_BASE}.zip" ${FILES_TO_ARCHIVE})
              (cd "${TARBALL_STAGE}" && zip "${ARCHIVE_OUT}/${LATEST_ARCHIVE_BASE}.zip" ${FILES_TO_ARCHIVE})
            fi
          else
            # Create versioned archive
            tar -czf "${ARCHIVE_BASE}.tar.gz" -C "${TARBALL_STAGE}" ${FILES_TO_ARCHIVE}
            # Create latest archive
            tar -czf "${LATEST_ARCHIVE_BASE}.tar.gz" -C "${TARBALL_STAGE}" ${FILES_TO_ARCHIVE}
          fi

          # Fail loudly if the stamp did not land. A silently unstamped archive
          # would leave every tarball install on the `unknown` channel and
          # `mcpproxy update` permanently guidance-only — the exact failure
          # FR-020 exists to prevent. `go version -m` reads the recorded build
          # settings, so this works for cross-compiled targets too.
          # Capture first, match second: this step runs under `bash -eo pipefail`,
          # where `go version -m … | grep -q …` can report the pipeline as failed
          # when grep exits on the first match and go takes SIGPIPE.
          STAMP_INFO="$(go version -m "${TARBALL_STAGE}/${CLEAN_BINARY}" || true)"
          case "$STAMP_INFO" in
            *updatecheck.buildChannel=tarball*)
              echo "✅ Archive core carries the tarball install-channel marker"
              ;;
            *)
              echo "❌ Archive core is missing the tarball install-channel marker"
              exit 1
              ;;
          esac

      - name: Build Linux .deb and .rpm packages
        if: matrix.goos == 'linux' && matrix.edition != 'server'
        uses: ./.github/actions/build-linux-packages
        with:
          goarch: ${{ matrix.goarch }}

      - name: Install Inno Setup (Windows)
        if: matrix.goos == 'windows'
        shell: pwsh
        run: |
          choco install innosetup -y
          # Verify installation
          if (Test-Path "C:\Program Files (x86)\Inno Setup 6\ISCC.exe") {
            Write-Host "✅ Inno Setup installed successfully"
          } else {
            Write-Host "❌ Inno Setup installation failed"
            exit 1
          }

      - name: Create Windows installer (Windows)
        if: matrix.goos == 'windows'
        shell: pwsh
        run: |
          $VERSION = "${{ github.ref_name }}"
          $ARCH = "${{ matrix.goarch }}"

          Write-Host "Building Windows installer for version ${VERSION} (${ARCH})"

          # Run the build script
          .\scripts\build-windows-installer.ps1 -Version $VERSION -Arch $ARCH

          # Verify installer was created
          $INSTALLER_NAME = "mcpproxy-setup-${VERSION}-${ARCH}.exe"
          $INSTALLER_PATH = "dist\${INSTALLER_NAME}"

          if (Test-Path $INSTALLER_PATH) {
            Write-Host "✅ Windows installer created: ${INSTALLER_NAME}"
            $size = (Get-Item $INSTALLER_PATH).Length / 1MB
            Write-Host "   Size: $([math]::Round($size, 2)) MB"
          } else {
            Write-Host "❌ Windows installer not found at ${INSTALLER_PATH}"
            exit 1
          }

      - name: Upload unsigned Windows installer for signing
        if: matrix.goos == 'windows'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        id: upload-unsigned-installer
        with:
          name: unsigned-installer-windows-${{ matrix.goarch }}
          # Upload exe directly - GitHub Actions will ZIP it automatically
          path: dist/mcpproxy-setup-${{ github.ref_name }}-${{ matrix.goarch }}.exe

      - name: Create .icns icon (macOS)
        if: matrix.goos == 'darwin'
        run: |
          chmod +x scripts/create-icns.sh
          ./scripts/create-icns.sh

      - name: Create DMG installer (macOS)
        if: matrix.goos == 'darwin'
        env:
          # Ensure DMG creation also uses correct deployment target
          MACOSX_DEPLOYMENT_TARGET: "13.0"
          CGO_CFLAGS: "-mmacosx-version-min=13.0"
          CGO_LDFLAGS: "-mmacosx-version-min=13.0"
        run: |
          VERSION=${GITHUB_REF#refs/tags/}
          chmod +x scripts/create-dmg.sh

          # Determine binary names
          CORE_BINARY="mcpproxy"

          # Use Swift app for DMG when available, fall back to Go tray binary
          if [ -n "$SWIFT_APP_PATH" ] && [ -d "$SWIFT_APP_PATH" ]; then
            echo "Using Swift app bundle for DMG: $SWIFT_APP_PATH"
            ./scripts/create-dmg.sh "$SWIFT_APP_PATH" ${CORE_BINARY} ${VERSION} ${{ matrix.goarch }}
          else
            echo "Using Go tray binary for DMG"
            TRAY_BINARY="mcpproxy-tray"
            ./scripts/create-dmg.sh ${TRAY_BINARY} ${CORE_BINARY} ${VERSION} ${{ matrix.goarch }}
          fi

          # Sign DMG
          DMG_NAME="mcpproxy-${VERSION#v}-darwin-${{ matrix.goarch }}.dmg"
          echo "Signing DMG: ${DMG_NAME}"

          # Find the Developer ID certificate identity
          CERT_IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | grep -o '"[^"]*"' | tr -d '"')

          # Verify we found a valid certificate
          if [ -n "${CERT_IDENTITY}" ]; then
            echo "✅ Found Developer ID certificate for DMG: ${CERT_IDENTITY}"
          else
            echo "❌ No Developer ID certificate found for DMG, using team ID as fallback"
            CERT_IDENTITY="${{ secrets.APPLE_TEAM_ID }}"
            echo "⚠️  Using fallback identity for DMG: ${CERT_IDENTITY}"
          fi

          # Sign DMG with proper certificate and timestamp
          codesign --force \
            --sign "${CERT_IDENTITY}" \
            --timestamp \
            "${DMG_NAME}"

          # Verify DMG signing
          echo "=== Verifying DMG signature ==="
          codesign --verify --verbose "${DMG_NAME}"
          echo "DMG verification: $?"

          codesign --display --verbose=4 "${DMG_NAME}"

          echo "✅ DMG created and signed successfully: ${DMG_NAME}"

      - name: Create PKG installer (macOS)
        if: matrix.goos == 'darwin'
        env:
          # Ensure PKG creation also uses correct deployment target
          MACOSX_DEPLOYMENT_TARGET: "13.0"
          CGO_CFLAGS: "-mmacosx-version-min=13.0"
          CGO_LDFLAGS: "-mmacosx-version-min=13.0"
        run: |
          VERSION=${GITHUB_REF#refs/tags/}
          chmod +x scripts/create-pkg.sh
          chmod +x scripts/create-installer-dmg.sh

          # Set up certificate environment for PKG creation (reuse from binary signing)
          echo "=== Setting up certificate environment for PKG creation ==="

          # Debug: List all available certificates for PKG creation
          echo "=== Available certificates for PKG creation ==="
          echo "Codesigning certificates:"
          security find-identity -v -p codesigning || echo "No codesigning certificates found"
          echo "Basic certificates:"
          security find-identity -v -p basic || echo "No basic certificates found"
          echo "All certificates:"
          security find-identity -v || echo "No certificates found"

          # Prefer identities exported during certificate import, fallback to keychain lookup
          APP_CERT_IDENTITY="${APP_CERT_IDENTITY:-}"
          PKG_CERT_IDENTITY="${PKG_CERT_IDENTITY:-}"

          if [ -z "${APP_CERT_IDENTITY}" ]; then
            APP_CERT_IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | grep -o '"[^"]*"' | tr -d '"')
          fi

          if [ -z "${PKG_CERT_IDENTITY}" ]; then
            PKG_CERT_IDENTITY=$(security find-identity -v -p basic | grep "Developer ID Installer" | head -1 | grep -o '"[^"]*"' | tr -d '"')
          fi

          if [ -z "${APP_CERT_IDENTITY}" ]; then
            echo "❌ Developer ID Application certificate not available in the build keychain"
            exit 1
          fi

          if [ -z "${PKG_CERT_IDENTITY}" ]; then
            echo "❌ Developer ID Installer certificate not available in the isolated keychain"
            echo "   Embed the 'Developer ID Installer' identity in APPLE_DEVELOPER_ID_CERT"
            exit 1
          fi

          echo "✅ Using Developer ID Application certificate: ${APP_CERT_IDENTITY}"
          echo "✅ Using Developer ID Installer certificate: ${PKG_CERT_IDENTITY}"

          export APP_CERT_IDENTITY
          export PKG_CERT_IDENTITY

          # Determine binary names
          CORE_BINARY="mcpproxy"

          # Use Swift app for PKG when available, fall back to Go tray binary
          echo "Creating signed PKG installer with certificate: ${PKG_CERT_IDENTITY}"
          if [ -n "$SWIFT_APP_PATH" ] && [ -d "$SWIFT_APP_PATH" ]; then
            echo "Using Swift app bundle for PKG: $SWIFT_APP_PATH"
            ./scripts/create-pkg.sh "$SWIFT_APP_PATH" ${CORE_BINARY} ${VERSION} ${{ matrix.goarch }}
          else
            echo "Using Go tray binary for PKG"
            TRAY_BINARY="mcpproxy-tray"
            ./scripts/create-pkg.sh ${TRAY_BINARY} ${CORE_BINARY} ${VERSION} ${{ matrix.goarch }}
          fi

          # Create installer DMG containing the PKG
          PKG_NAME="mcpproxy-${VERSION#v}-darwin-${{ matrix.goarch }}.pkg"
          ./scripts/create-installer-dmg.sh ${PKG_NAME} ${VERSION} ${{ matrix.goarch }}

          echo "✅ PKG installer and installer DMG created successfully"

      - name: Submit for notarization (macOS)
        if: matrix.goos == 'darwin'
        run: |
          set -euo pipefail

          VERSION=${GITHUB_REF#refs/tags/}
          PKG_NAME="mcpproxy-${VERSION#v}-darwin-${{ matrix.goarch }}.pkg"
          INSTALLER_DMG_NAME="mcpproxy-${VERSION#v}-darwin-${{ matrix.goarch }}-installer.dmg"

          notarize_and_staple() {
            local FILE_NAME="$1"
            local FILE_LABEL="$2"

            if [ ! -f "${FILE_NAME}" ]; then
              echo "❌ ${FILE_LABEL} (${FILE_NAME}) not found"
              return 1
            fi

            echo "Submitting ${FILE_LABEL} for notarization: ${FILE_NAME}"

            local SUBMISSION_OUTPUT
            if ! SUBMISSION_OUTPUT=$(xcrun notarytool submit "${FILE_NAME}" \
              --apple-id "${{ secrets.APPLE_ID_USERNAME }}" \
              --password "${{ secrets.APPLE_ID_APP_PASSWORD }}" \
              --team-id "${{ secrets.APPLE_TEAM_ID }}" \
              --wait \
              --output-format json 2>&1); then
              echo "❌ ${FILE_LABEL} notarization failed"
              echo "Output: ${SUBMISSION_OUTPUT}"
              return 1
            fi

            local SUBMISSION_ID
            SUBMISSION_ID=$(echo "${SUBMISSION_OUTPUT}" | jq -r '.id // empty')
            local STATUS
            STATUS=$(echo "${SUBMISSION_OUTPUT}" | jq -r '.status // empty')

            if [ -z "${SUBMISSION_ID}" ] || [ "${SUBMISSION_ID}" = "null" ] || [ "${STATUS}" != "Accepted" ]; then
              echo "❌ ${FILE_LABEL} notarization did not succeed"
              echo "Response: ${SUBMISSION_OUTPUT}"
              return 1
            fi

            echo "✅ ${FILE_LABEL} notarization accepted (ID: ${SUBMISSION_ID})"
            echo "${SUBMISSION_ID}" > "${FILE_NAME}.submission_id"

            echo "Stapling notarization ticket to ${FILE_LABEL}"
            # Apple ticket delivery (CloudKit) drops connections intermittently
            # ("network connection was lost", exit 68); retry with backoff.
            for attempt in 1 2 3 4 5; do
              xcrun stapler staple "${FILE_NAME}" && break
              if [ "$attempt" = 5 ]; then exit 1; fi
              echo "stapler staple failed (attempt $attempt), retrying"; sleep $((attempt * 15))
            done
            for attempt in 1 2 3 4 5; do
              xcrun stapler validate "${FILE_NAME}" && break
              if [ "$attempt" = 5 ]; then exit 1; fi
              echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
            done
          }

          notarize_and_staple "${PKG_NAME}" "PKG installer"
          notarize_and_staple "${INSTALLER_DMG_NAME}" "Installer DMG"

          echo "✅ Notarization and stapling complete"

      # Spec 092 FR-013 — the Sparkle update enclosure.
      #
      # NOT the DMG or the PKG: Sparkle installs an .app, and the archive has to
      # preserve symlinks and extended attributes or the bundle's code signature
      # seal breaks and macOS answers with "Killed: 9". `ditto -c -k
      # --sequesterRsrc --keepParent` is the only archiver Apple documents for
      # this; `zip` is not a substitute.
      #
      # Notarized and stapled here rather than relying on the PKG's ticket:
      # a stapled ticket lives inside the bundle it was stapled to, and the .app
      # extracted from this zip is a different copy from the one inside the PKG.
      # An unstapled enclosure would make the first launch after every update
      # wait on Apple's servers — or fail offline.
      #
      # The signing step order above is untouched: the bundle was already signed
      # nested-first, and this step only archives, notarizes and staples it.
      - name: Build Sparkle enclosure (macOS)
        if: matrix.goos == 'darwin' && matrix.edition != 'server'
        env:
          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
        run: |
          set -euo pipefail

          mkdir -p sparkle-enclosure

          # Fork guard: without the signing key there is no appcast job to feed,
          # so the (slow) extra notarization is pure waste. Skipping is not a
          # failure — the DMG/PKG assets are unaffected.
          if [ -z "${SPARKLE_ED_PRIVATE_KEY:-}" ]; then
            echo "ℹ️  SPARKLE_ED_PRIVATE_KEY is not configured — skipping the Sparkle enclosure."
            exit 0
          fi

          # The enclosure must ship the SAME bundle users run: the DMG staging
          # copy that create-dmg.sh signed (core + certs + Developer ID deep
          # signature) and exported. SWIFT_APP_PATH is the raw swift-build
          # output — no core, not notarization-signed — and must never be
          # zipped as an update (it failed notarization and would install a
          # coreless app).
          APP_SRC="signed-app-${{ matrix.goarch }}/mcpproxy.app"
          if [ ! -d "${APP_SRC}" ]; then
            echo "❌ signed bundle export missing: ${APP_SRC} (create-dmg.sh exports it)"
            exit 1
          fi

          VERSION=${GITHUB_REF#refs/tags/}
          ENCLOSURE="mcpproxy-${VERSION#v}-darwin-${{ matrix.goarch }}.app.zip"
          NOTARIZE_ZIP="sparkle-notarize-${{ matrix.goarch }}.zip"

          echo "=== Archiving ${APP_SRC} for notarization ==="
          ditto -c -k --sequesterRsrc --keepParent "${APP_SRC}" "${NOTARIZE_ZIP}"

          echo "=== Submitting the app bundle for notarization ==="
          SUBMISSION_OUTPUT=$(xcrun notarytool submit "${NOTARIZE_ZIP}" \
            --apple-id "${{ secrets.APPLE_ID_USERNAME }}" \
            --password "${{ secrets.APPLE_ID_APP_PASSWORD }}" \
            --team-id "${{ secrets.APPLE_TEAM_ID }}" \
            --wait \
            --output-format json)
          STATUS=$(echo "${SUBMISSION_OUTPUT}" | jq -r '.status // empty')
          if [ "${STATUS}" != "Accepted" ]; then
            echo "❌ App-bundle notarization did not succeed"
            echo "Response: ${SUBMISSION_OUTPUT}"
            exit 1
          fi
          echo "✅ App bundle notarization accepted"

          # Staple the BUNDLE, then re-archive it: the ticket must travel inside
          # the .app the user ends up running.
          # Apple ticket delivery (CloudKit) drops connections intermittently
          # ("network connection was lost", exit 68); retry with backoff.
          for attempt in 1 2 3 4 5; do
            xcrun stapler staple "${APP_SRC}" && break
            if [ "$attempt" = 5 ]; then exit 1; fi
            echo "stapler staple failed (attempt $attempt), retrying"; sleep $((attempt * 15))
          done
          for attempt in 1 2 3 4 5; do
            xcrun stapler validate "${APP_SRC}" && break
            if [ "$attempt" = 5 ]; then exit 1; fi
            echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
          done

          echo "=== Creating the stapled enclosure ==="
          ditto -c -k --sequesterRsrc --keepParent "${APP_SRC}" "sparkle-enclosure/${ENCLOSURE}"
          rm -f "${NOTARIZE_ZIP}"

          # Prove the archive round-trips with its signature intact before it
          # becomes a release asset — a broken seal only shows up as a crash on
          # the user's machine otherwise.
          VERIFY_DIR=$(mktemp -d)
          ditto -x -k "sparkle-enclosure/${ENCLOSURE}" "${VERIFY_DIR}"
          codesign --verify --deep --strict --verbose=2 "${VERIFY_DIR}/mcpproxy.app"
          # Apple ticket delivery (CloudKit) drops connections intermittently
          # ("network connection was lost", exit 68); retry with backoff.
          for attempt in 1 2 3 4 5; do
            xcrun stapler validate "${VERIFY_DIR}/mcpproxy.app" && break
            if [ "$attempt" = 5 ]; then exit 1; fi
            echo "stapler validate failed (attempt $attempt), retrying"; sleep $((attempt * 15))
          done
          spctl -a -t exec -vv "${VERIFY_DIR}/MCPProxy.app"
          rm -rf "${VERIFY_DIR}"

          ls -la sparkle-enclosure/
          echo "✅ Sparkle enclosure ready: ${ENCLOSURE}"

      - name: Upload Sparkle enclosure artifact
        if: matrix.goos == 'darwin' && matrix.edition != 'server'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: sparkle-enclosure-${{ matrix.goarch }}
          path: sparkle-enclosure/*
          # Empty on forks and until the signing key exists — see the guard above.
          if-no-files-found: ignore

      - name: Cleanup isolated keychain (macOS)
        if: matrix.goos == 'darwin' && always()
        run: |
          # Clean up the isolated keychain we created for this worker
          if [ -f .keychain_name ]; then
            TEMP_KEYCHAIN=$(cat .keychain_name)
            echo "Cleaning up keychain: ${TEMP_KEYCHAIN}"

            # Remove from search list and delete
            security delete-keychain "$TEMP_KEYCHAIN" 2>/dev/null || echo "Keychain already cleaned up"
            rm -f .keychain_name
            echo "✅ Keychain cleanup completed"
          else
            echo "No keychain to clean up"
          fi

      - name: Upload versioned archive artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: versioned-${{ matrix.edition || 'personal' }}-${{ matrix.goos }}-${{ matrix.goarch }}
          path: mcpproxy-*-${{ matrix.goos }}-${{ matrix.goarch }}.${{ matrix.archive_format }}

      - name: Upload latest archive artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: latest-${{ matrix.edition || 'personal' }}-${{ matrix.goos }}-${{ matrix.goarch }}
          path: mcpproxy-latest-${{ matrix.goos }}-${{ matrix.goarch }}.${{ matrix.archive_format }}

      - name: Upload macOS installer DMG
        if: matrix.goos == 'darwin'
        run: |
          set -euo pipefail

          VERSION=${GITHUB_REF#refs/tags/}
          INSTALLER_DMG_NAME="mcpproxy-${VERSION#v}-darwin-${{ matrix.goarch }}-installer.dmg"

          echo "Looking for files:"
          echo "  Installer DMG: ${INSTALLER_DMG_NAME}"
          if [ ! -f "${INSTALLER_DMG_NAME}" ]; then
            echo "❌ Installer DMG not found: ${INSTALLER_DMG_NAME}"
            exit 1
          fi

          mkdir -p installers-artifact
          cp "${INSTALLER_DMG_NAME}" installers-artifact/

          SUBMISSION_ID_FILE="${INSTALLER_DMG_NAME}.submission_id"
          if [ -f "${SUBMISSION_ID_FILE}" ]; then
            echo "✅ Found submission ID file: ${SUBMISSION_ID_FILE}"
            cp "${SUBMISSION_ID_FILE}" installers-artifact/
          else
            echo "⚠️  No submission ID file found: ${SUBMISSION_ID_FILE}"
          fi

          echo "Files to upload:"
          ls -la installers-artifact/

      - name: Upload macOS installers artifact
        if: matrix.goos == 'darwin'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: installers-${{ matrix.goos }}-${{ matrix.goarch }}
          path: installers-artifact/*

  # Sign Windows installers with SignPath
  sign-windows:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    # Stable releases only — RC tags are signed via prerelease.yml.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    strategy:
      matrix:
        arch: [amd64, arm64]

    steps:
      - name: Download unsigned installer
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          name: unsigned-installer-windows-${{ matrix.arch }}
          path: unsigned

      - name: Re-upload for SignPath
        id: reupload
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: signpath-input-windows-${{ matrix.arch }}
          # Upload exe - GitHub Actions will ZIP it for SignPath
          path: unsigned/*.exe

      - name: Submit to SignPath for signing
        uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627  # v2.3
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '84efd51b-c11c-4a85-82e6-7c3b1157d7ca'
          project-slug: 'mcpproxy-go'
          signing-policy-slug: 'release-signing'
          artifact-configuration-slug: 'initial'
          github-artifact-id: '${{ steps.reupload.outputs.artifact-id }}'
          wait-for-completion: true
          # SignPath routinely takes 41m-1h per arch and exceeded 1h twice on
          # v0.56.0 (both attempts timed out at 1h01) — give it 3h.
          wait-for-completion-timeout-in-seconds: 10800
          output-artifact-directory: signed

      - name: Prepare signed installer
        run: |
          VERSION=${GITHUB_REF#refs/tags/}
          ARCH="${{ matrix.arch }}"
          TARGET="mcpproxy-setup-${VERSION}-${ARCH}.exe"

          echo "Preparing signed installer..."
          cd signed
          ls -la

          # SignPath returns signed exe - verify it exists
          if [ -f "$TARGET" ]; then
            echo "✅ Signed installer already named correctly: $TARGET"
          else
            # Find and rename if needed
            SIGNED_EXE=$(find . -name "*.exe" -type f | head -1)
            if [ -n "$SIGNED_EXE" ]; then
              mv "$SIGNED_EXE" "$TARGET"
              echo "✅ Renamed to: $TARGET"
            else
              echo "❌ No signed .exe found in SignPath output"
              exit 1
            fi
          fi

      - name: Upload signed Windows installer
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: installer-windows-${{ matrix.arch }}
          path: signed/mcpproxy-setup-${{ github.ref_name }}-${{ matrix.arch }}.exe

  build-docker:
    runs-on: ubuntu-latest
    # `qa-gate` is load-bearing, not cosmetic: this job pushes to GHCR (including
    # the `:latest` pointer), which is publishing to users. Without it in the
    # closure a tag whose gate failed would still ship a container image — the
    # exact hole cmd/release-gate's TestPublishJobsGatedOnQAGate exists to catch.
    needs: [build, qa-gate]
    # Stable releases only, matching `build`/`release` — release.yml fires on every
    # `v*` tag, and an RC must never move `mcpproxy-server:latest`. prerelease.yml
    # owns the RC channel and publishes no image.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003  # v4.4.0
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
        with:
          context: .
          push: true
          # linux/arm64 matters for Raspberry Pi / Graviton hosts, and the release
          # already ships an arm64 Linux binary. The Dockerfile cross-compiles from
          # $BUILDPLATFORM, so this costs a second native build, not QEMU emulation.
          platforms: linux/amd64,linux/arm64
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT=${{ github.sha }}
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
          tags: |
            ghcr.io/smart-mcp-proxy/mcpproxy-server:${{ github.ref_name }}
            ghcr.io/smart-mcp-proxy/mcpproxy-server:latest
          # image.source links the GHCR package back to this repo so it inherits the
          # repo's README and shows up under the org's packages. It does NOT make the
          # package public: a package first created by GITHUB_TOKEN is private, and
          # visibility has to be flipped once by hand after the first push. Until that
          # happens an anonymous `docker pull` gets `denied`.
          labels: |
            org.opencontainers.image.source=https://github.com/smart-mcp-proxy/mcpproxy-go
            org.opencontainers.image.description=MCPProxy Server Edition — headless MCP proxy with tool discovery and quarantine
            org.opencontainers.image.licenses=MIT
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ github.ref_name }}

  # Spec 081: release qualification gate. Runs the server-type matrix +
  # invariants + assembled suites and produces one pass/fail verdict. The
  # `release` job (and therefore every public-facing job that cascades from it)
  # depends on this, so a red gate publishes nothing (FR-002). Guarded to the
  # same stable-only condition as `release` so the expensive gate does not also
  # run on RC tags here — prerelease.yml owns the RC gate. If the gate is
  # skipped (non-stable ref), `release` is skipped too (never un-gated).
  qa-gate:
    uses: ./.github/workflows/release-qa-gate.yml
    permissions:
      contents: read
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')

  release:
    needs: [build, build-docker, sign-windows, generate-notes, qa-gate]
    runs-on: ubuntu-latest
    environment: production
    # Explicit guard (belt-and-suspenders on top of the cascade from needs:) — RC tags
    # publish via prerelease.yml's own release step, never through this stable channel.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    outputs:
      # base64-encoded checksums.txt — consumed by the SLSA provenance job (WP-C3)
      hashes: ${{ steps.checksums.outputs.hashes }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          path: dist

      - name: Reorganize files
        run: |
          VERSION=${GITHUB_REF#refs/tags/}
          # Create a flat structure to avoid duplicates
          mkdir -p release-files

          # Copy archives (tar.gz and zip files).
          # The QA gate runs as a reusable workflow of THIS run, so its artifacts
          # land in dist/ too. Its Playwright HTML report stores traces as
          # playwright-report/data/<sha>.zip (retained on failure — precisely the
          # case the advisory sweep tolerates), which would otherwise be published
          # as unnamed release assets. Excluded here, not upstream, so the report
          # stays downloadable as a CI artifact for post-mortems.
          find dist -not -path "*/web-ui-sweep-playwright-report/*" \( -name "*.tar.gz" -o -name "*.zip" \) | while read file; do
            filename=$(basename "$file")
            cp "$file" "release-files/$filename"
          done

          # Copy Linux .deb and .rpm packages
          find dist -path "*/linux-packages-*" \( -name "*.deb" -o -name "*.rpm" \) | while read pkg_file; do
            filename=$(basename "$pkg_file")
            echo "Found Linux package: $filename"
            cp "$pkg_file" "release-files/$filename"
          done

          # Copy Windows installer files (.exe)
          find dist -path "*/installer-windows-*" -name "*.exe" | while read installer_file; do
            filename=$(basename "$installer_file")
            echo "Found Windows installer: $filename"
            cp "$installer_file" "release-files/$filename"
          done

          # Handle installer files (DMG and PKG) and notarization submissions
          mkdir -p pending-notarizations

          # Process installer artifacts (only notarized installer DMGs)
          find dist -path "*/installers-*" -name "*.dmg" | while read installer_file; do
            filename=$(basename "$installer_file")
            submission_id_file="${installer_file}.submission_id"

            if [ -f "$submission_id_file" ]; then
              # File has pending notarization
              SUBMISSION_ID=$(cat "$submission_id_file")

              # Validate submission ID before creating pending file
              if [ -n "$SUBMISSION_ID" ] && [ "$SUBMISSION_ID" != "null" ] && [ ${#SUBMISSION_ID} -gt 10 ]; then
                echo "Found valid pending notarization for $filename (ID: $SUBMISSION_ID)"
                cp "$installer_file" "release-files/$filename"

                # Create pending notarization record
                cat > "pending-notarizations/${filename}.pending" << EOF
          {
            "submission_id": "$SUBMISSION_ID",
            "file_name": "$filename",
            "version": "$VERSION",
            "submitted_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          }
          EOF
              else
                echo "❌ Invalid submission ID for $filename: '$SUBMISSION_ID'"
                echo "Copying installer file without notarization tracking"
                cp "$installer_file" "release-files/$filename"
              fi
            else
              # No notarization submission (shouldn't happen, but handle it)
              echo "No submission ID for $filename, copying as-is"
              cp "$installer_file" "release-files/$filename"
            fi
          done

      # Set version variable early so SBOM step (WP-C2) and the release body
      # can both reference $CLEAN_VERSION. Moved before "Generate checksums"
      # so the SBOM filename is deterministic and the SBOM file itself is
      # present in release-files/ when checksums run (WP-C2 ordering requirement).
      - name: Set version variable
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "CLEAN_VERSION=${VERSION}" >> $GITHUB_ENV

      # WP-C2: Generate SPDX-JSON SBOM from source tree and drop it into
      # release-files/ so it is included in the checksums + uploaded with all
      # other release assets by the "Create release" step below.
      # upload-artifact/upload-release-assets are both disabled because this
      # workflow is tag-push triggered (not a `release` event), so we handle
      # distribution ourselves via the release-files/ directory.
      - name: Generate SBOM (SPDX JSON)
        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
        with:
          path: .
          format: spdx-json
          output-file: release-files/mcpproxy-${{ env.CLEAN_VERSION }}.spdx.json
          upload-artifact: false
          upload-release-assets: false

      # WP-C4: Generate cumulative CHANGELOG.md with git-cliff and place it in
      # release-files/ so it is checksummed + uploaded alongside all other assets.
      #
      # Rationale for NOT committing back to main:
      #   Pushing a generated file back to main requires a PAT (GITHUB_TOKEN lacks
      #   push access on protected branches) and creates a race condition when two
      #   releases are cut close together.  Distributing CHANGELOG.md as a release
      #   asset is simpler, reproducible, and sufficient for open-source consumers.
      #
      # fetch-depth: 0 is already set on this job's Checkout step (line ~1065) so
      # git-cliff sees the full tag history without an extra checkout here.
      - name: Generate CHANGELOG (git-cliff)
        uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
        with:
          config: cliff.toml
          args: --verbose
        env:
          OUTPUT: release-files/CHANGELOG.md
          GITHUB_REPO: ${{ github.repository }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate checksums
        id: checksums
        run: |
          cd release-files
          # checksum every artifact except the checksums file and its signature
          # bundle, so re-runs / pre-existing files can't make checksums.txt
          # reference itself. xargs -r guards against an empty artifact list.
          find . -maxdepth 1 -type f ! -name 'checksums.txt' ! -name 'checksums.txt.cosign.bundle' -printf '%P\n' \
            | sort | xargs -r sha256sum > checksums.txt
          echo "Generated checksums:"
          cat checksums.txt
          # base64-encode for SLSA provenance generator (WP-C3)
          echo "hashes=$(base64 -w0 checksums.txt)" >> "$GITHUB_OUTPUT"

      - name: List files for upload
        run: |
          echo "Files to upload:"
          ls -la release-files/
          echo "Pending notarizations:"
          ls -la pending-notarizations/ || echo "No pending notarizations"

      # A hand-written notice that must reach the release body verbatim.
      #
      # The notes above this line are generated by an LLM from the commit log,
      # which is fine for a feature summary and wrong for anything a user has
      # to ACT on — a security advisory, a migration step, a breaking change.
      # Those cannot depend on a summarizer choosing to include them, so they
      # are authored in .github/RELEASE_NOTICE.md and prepended here.
      #
      # Delete .github/RELEASE_NOTICE.md once the release that needs it has
      # shipped, or it will repeat on the next one. The step is a no-op when
      # the file is absent.
      - name: Load hand-written release notice
        id: notice
        run: |
          if [ -f .github/RELEASE_NOTICE.md ]; then
            echo "Found .github/RELEASE_NOTICE.md - prepending to the release body"
            {
              echo "notice<<RELEASE_NOTICE_EOF"
              cat .github/RELEASE_NOTICE.md
              echo ""
              echo "---"
              echo "RELEASE_NOTICE_EOF"
            } >> "$GITHUB_OUTPUT"
          else
            echo "No .github/RELEASE_NOTICE.md - nothing to prepend"
            echo "notice=" >> "$GITHUB_OUTPUT"
          fi

      - name: Create release with binaries
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
        with:
          files: release-files/*
          body: |
            ${{ steps.notice.outputs.notice }}

            ${{ needs.generate-notes.outputs.notes }}

            ${{ needs.generate-notes.outputs.contributors }}

            ---

            ## Download Installers

            | Platform | Download | Notes |
            |----------|----------|-------|
            | **macOS (Apple Silicon)** | [**Download DMG**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-darwin-arm64-installer.dmg) | Signed & Notarized - Recommended for M1/M2/M3/M4 |
            | **macOS (Intel)** | [**Download DMG**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-darwin-amd64-installer.dmg) | Signed & Notarized |
            | **Windows (64-bit)** | [**Download Setup**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-setup-${{ github.ref_name }}-amd64.exe) | Setup wizard |
            | **Windows (ARM64)** | [**Download Setup**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-setup-${{ github.ref_name }}-arm64.exe) | For ARM Windows devices |
            | **Linux Debian/Ubuntu (AMD64)** | [**Download .deb**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy_${{ env.CLEAN_VERSION }}_amd64.deb) | `sudo apt install ./mcpproxy_*.deb` |
            | **Linux Debian/Ubuntu (ARM64)** | [**Download .deb**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy_${{ env.CLEAN_VERSION }}_arm64.deb) | For ARM64 (Raspberry Pi etc.) |
            | **Linux Fedora/RHEL (AMD64)** | [**Download .rpm**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-1.x86_64.rpm) | `sudo dnf install ./mcpproxy-*.rpm` |
            | **Linux Fedora/RHEL (ARM64)** | [**Download .rpm**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-1.aarch64.rpm) | For ARM64 |
            | **Linux (AMD64) — tarball** | [**Download tar.gz**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-linux-amd64.tar.gz) | Binary only |
            | **Linux (ARM64) — tarball** | [**Download tar.gz**](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-linux-arm64.tar.gz) | Binary only |

            **Homebrew (macOS/Linux):**
            ```bash
            brew install smart-mcp-proxy/mcpproxy/mcpproxy
            ```

            <details>
            <summary>Other download options (auto-update URLs, archives)</summary>

            **Auto-update URLs** (always points to latest):
            - [Linux AMD64](https://github.com/${{ github.repository }}/releases/latest/download/mcpproxy-latest-linux-amd64.tar.gz) | [Linux ARM64](https://github.com/${{ github.repository }}/releases/latest/download/mcpproxy-latest-linux-arm64.tar.gz)
            - [Windows AMD64](https://github.com/${{ github.repository }}/releases/latest/download/mcpproxy-latest-windows-amd64.zip) | [Windows ARM64](https://github.com/${{ github.repository }}/releases/latest/download/mcpproxy-latest-windows-arm64.zip)
            - [macOS AMD64](https://github.com/${{ github.repository }}/releases/latest/download/mcpproxy-latest-darwin-amd64.tar.gz) | [macOS ARM64](https://github.com/${{ github.repository }}/releases/latest/download/mcpproxy-latest-darwin-arm64.tar.gz)

            **Binary archives (this version):**
            - [macOS AMD64](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-darwin-amd64.tar.gz) | [macOS ARM64](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-darwin-arm64.tar.gz)
            - [Windows AMD64](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-windows-amd64.zip) | [Windows ARM64](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/mcpproxy-${{ env.CLEAN_VERSION }}-windows-arm64.zip)

            </details>

            ---

            <details>
            <summary>Installation Instructions</summary>

            ### Windows
            1. Download the installer for your architecture
            2. Run `mcpproxy-setup-*.exe`
            3. Follow the installation wizard (requires Administrator privileges)
            4. Launch "MCPProxy" from Start Menu

            ### macOS
            1. Download the signed DMG for your Mac
            2. Double-click the DMG to mount it
            3. Double-click the PKG installer inside
            4. Follow the installation wizard
            5. Launch mcpproxy.app from Applications folder

            ### Linux / Manual Installation
            1. Download the appropriate archive
            2. Extract: `tar -xzf mcpproxy-*.tar.gz`
            3. Make executable: `chmod +x mcpproxy`
            4. Run: `./mcpproxy serve`

            </details>

            <details>
            <summary>Platform Support & Usage</summary>

            ### Platform Support
            - **macOS**: Full system tray support with menu and icons
            - **Windows**: Full system tray support with menu and icons
            - **Linux**: Headless mode only (CLI)

            ### Usage

            **GUI (Recommended):**
            - Launch mcpproxy.app from Applications (auto-starts core server)
            - Manages server via system tray menu

            **CLI:**
            ```bash
            mcpproxy serve                           # Start server
            mcpproxy serve --listen 127.0.0.1:8081  # Custom port
            export MCPPROXY_API_KEY=your-secret-key  # Set API key
            ```

            </details>
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign checksums (keyless)
        # Cosign keyless signing — OIDC identity comes from the GitHub Actions JWT
        # (id-token: write is granted at the workflow level).
        # Produces a single bundle file (signature + certificate + Rekor transparency log entry).
        #
        # To verify after download:
        #   cosign verify-blob \
        #     --bundle checksums.txt.cosign.bundle \
        #     --certificate-identity-regexp "^https://github.com/smart-mcp-proxy/mcpproxy-go/.github/workflows/release.yml@refs/tags/v" \
        #     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
        #     checksums.txt
        run: |
          cosign sign-blob \
            --yes \
            --bundle release-files/checksums.txt.cosign.bundle \
            release-files/checksums.txt

      - name: Upload cosign bundle to release
        run: |
          gh release upload "${{ github.ref_name }}" \
            release-files/checksums.txt.cosign.bundle \
            --clobber
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload pending notarizations
        if: hashFiles('pending-notarizations/*.pending') != ''
        run: |
          # Upload pending notarization files as release assets
          for pending_file in pending-notarizations/*.pending; do
            if [ -f "$pending_file" ]; then
              echo "Uploading pending notarization: $(basename "$pending_file")"
              gh release upload "${{ github.ref_name }}" "$pending_file" --clobber
            fi
          done
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # WP-C3: SLSA build provenance — generates a SLSA v1 attestation for all
  # release artifacts and uploads it to the GitHub release as a .intoto.jsonl file.
  # Spec 092 FR-013 — the Sparkle update feed.
  #
  # Runs AFTER `release` on purpose: generate_appcast bakes absolute download
  # URLs into the feed, so the assets those URLs point at must already be
  # published or the very first client to read the feed gets a 404.
  #
  # ONE FEED PER ARCHITECTURE. A Sparkle appcast has no architecture selector,
  # and both macOS bundles carry the same CFBundleShortVersionString — a single
  # merged feed would hand an Intel user the Apple-Silicon build. The tray asks
  # for its own feed; the rewrite rule lives in
  # native/macos/MCPProxy/MCPProxy/Services/SparkleFeedURL.swift, and the file
  # names below are the other half of that contract.
  #
  # The shipped Info.plist points at https://mcpproxy.app/appcast.xml (decision
  # #1 in docs/research/auto-updater-issue-957-2026-08-07.html). This job feeds
  # the site via a repository-dispatch below; the feeds are also (a) attached to
  # the release and (b) exported as a workflow artifact (`sparkle-appcast`) as
  # backfill sources. The GitHub-hosted stable URL
  #   https://github.com/OWNER/REPO/releases/latest/download/appcast-<arch>.xml
  # works as an alternative SUFeedURL for the STABLE channel only (it resolves to
  # the newest non-prerelease release); set repository variable SPARKLE_FEED_URL to
  # use it. It does NOT serve the beta channel — see prerelease.yml.
  sparkle-appcast:
    needs: [release]
    runs-on: macos-15
    permissions:
      contents: write
    steps:
      - name: Download Sparkle enclosures
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          pattern: sparkle-enclosure-*
          path: enclosures

      - name: Generate and publish the appcast
        id: appcast
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # This job deliberately does not check the repo out (it only needs the
          # enclosure artifacts), so `gh` has no git remote to infer the
          # repository from — it does NOT read GITHUB_REPOSITORY. Without
          # GH_REPO the final `gh release upload` fails with "could not
          # determine what repo to use". Every other `gh release upload` in this
          # workflow lives in a job that ran actions/checkout.
          GH_REPO: ${{ github.repository }}
          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
          # Keep in step with Package.resolved (Sparkle 2.9.3).
          SPARKLE_VERSION: "2.9.3"
        run: |
          set -euo pipefail

          mkdir -p appcast-out

          if [ -z "${SPARKLE_ED_PRIVATE_KEY:-}" ]; then
            echo "::notice::SPARKLE_ED_PRIVATE_KEY is not configured — no appcast generated."
            exit 0
          fi
          if [ -z "$(find enclosures -name '*.app.zip' -print -quit 2>/dev/null)" ]; then
            echo "::notice::No Sparkle enclosures were produced — no appcast generated."
            exit 0
          fi

          echo "=== Fetching Sparkle ${SPARKLE_VERSION} tools ==="
          curl -fsSL -o sparkle-tools.tar.xz \
            "https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
          mkdir -p sparkle-tools
          tar xf sparkle-tools.tar.xz -C sparkle-tools
          GENERATE_APPCAST=$(find sparkle-tools -name generate_appcast -type f -perm +111 | head -1)
          if [ -z "${GENERATE_APPCAST}" ]; then
            echo "❌ generate_appcast not found in the Sparkle ${SPARKLE_VERSION} tarball"
            find sparkle-tools -maxdepth 3 -type d
            exit 1
          fi
          echo "Using ${GENERATE_APPCAST}"

          PREFIX="https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/"

          for ARCH in arm64 amd64; do
            SRC=$(find enclosures -name "*-darwin-${ARCH}.app.zip" | head -1)
            if [ -z "${SRC}" ]; then
              echo "::warning::No ${ARCH} enclosure — skipping its feed."
              continue
            fi
            WORK="appcast-work-${ARCH}"
            rm -rf "${WORK}"
            mkdir -p "${WORK}"
            cp "${SRC}" "${WORK}/"

            echo "=== Generating appcast-${ARCH}.xml from $(basename "${SRC}") ==="
            # The key goes in on stdin so it never lands on disk or in `ps`.
            echo "${SPARKLE_ED_PRIVATE_KEY}" | "${GENERATE_APPCAST}" \
              --ed-key-file - \
              --download-url-prefix "${PREFIX}" \
              --link "https://github.com/${GITHUB_REPOSITORY}/releases/tag/${GITHUB_REF_NAME}" \
              -o "appcast-out/appcast-${ARCH}.xml" \
              "${WORK}"
          done

          if [ -z "$(ls -A appcast-out 2>/dev/null)" ]; then
            echo "❌ generate_appcast produced no feeds"
            exit 1
          fi

          echo "=== Generated feeds ==="
          for f in appcast-out/*.xml; do
            echo "--- ${f} ---"
            cat "${f}"
            # Fail loudly rather than publish a feed with no enclosure signature:
            # an unsigned item is one Sparkle will refuse, silently, forever.
            grep -q 'sparkle:edSignature' "${f}" || { echo "❌ ${f} has no EdDSA signature"; exit 1; }
          done

          # Channel policy: RC users update to the next RC OR the next stable,
          # whichever is newer; stable users only ever see stables. A stable
          # release therefore also refreshes the BETA feeds with its (untagged,
          # visible-to-every-channel) item — otherwise RC users would sit on
          # their last RC forever once the cycle ends. SemVer precedence in the
          # tray orders X.Y.Z above X.Y.Z-rc.N, so the stable always wins.
          for ARCH in arm64 amd64; do
            if [ -f "appcast-out/appcast-${ARCH}.xml" ]; then
              cp "appcast-out/appcast-${ARCH}.xml" "appcast-out/appcast-beta-${ARCH}.xml"
            fi
          done

          gh release upload "${GITHUB_REF_NAME}" appcast-out/*.xml --clobber
          echo "generated=true" >> "$GITHUB_OUTPUT"

      - name: Upload appcast artifact for the website repo
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: sparkle-appcast
          path: appcast-out/*
          if-no-files-found: ignore

      # Tell mcpproxy.app to serve the freshly uploaded feeds (they are public
      # release assets by now — the site's publish-appcast workflow downloads
      # them from the release, so no artifact plumbing crosses repos).
      # This step MUST fail loudly: on v0.60.0 an expired
      # MARKETING_SITE_DISPATCH_TOKEN made this dispatch 401 under
      # continue-on-error, the site kept serving the 0.59.0 feed, and Sparkle
      # told users they were up to date while doctor/tray offered v0.60.0.
      # Failing here blocks nothing — every release asset (feeds included) is
      # uploaded by earlier steps; a red job is the recovery signal. Backfill by
      # re-running this job, or by hand via the site's publish-appcast
      # workflow_dispatch.
      - name: Publish feeds to mcpproxy.app
        if: steps.appcast.outputs.generated == 'true'
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697  # v4.0.1
        with:
          token: ${{ secrets.MARKETING_SITE_DISPATCH_TOKEN }}
          repository: smart-mcp-proxy/mcpproxy.app-website
          event-type: publish-appcast
          client-payload: '{"version": "${{ github.ref_name }}", "channel": "stable"}'

      # Second dispatch: the same stable release also refreshes the beta feeds
      # (see the channel-policy comment above).
      - name: Publish stable item to the beta feeds
        if: steps.appcast.outputs.generated == 'true'
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697  # v4.0.1
        with:
          token: ${{ secrets.MARKETING_SITE_DISPATCH_TOKEN }}
          repository: smart-mcp-proxy/mcpproxy.app-website
          event-type: publish-appcast
          client-payload: '{"version": "${{ github.ref_name }}", "channel": "beta"}'

      # End-to-end freshness check: the dispatch above only queues the site's
      # publish-appcast workflow — a failed site run, a queued run replaced by
      # its sibling in the site's concurrency group, or a stale Cloudflare
      # Pages deploy would still leave the live feed behind. Poll until the
      # LIVE bytes match what this job generated (the site's own verify step
      # does the same from its side, but it never runs if the dispatch is
      # lost). One 15-min deadline SHARED across all feeds: dispatch → site
      # workflow queue → commit → Pages deploy is ~3-5 min per channel, and a
      # shared budget keeps a total site outage from holding this macOS runner
      # for 15 min per file. The beta copies are byte-identical to the stable
      # feeds (cp above), so this loop verifies both dispatches.
      - name: Verify live feeds are fresh
        if: steps.appcast.outputs.generated == 'true'
        run: |
          set -euo pipefail
          DEADLINE=$(( $(date +%s) + 15 * 60 ))
          FAILED=0
          for f in appcast-out/*.xml; do
            NAME=$(basename "$f")
            WANT=$(shasum -a 256 "$f" | cut -d' ' -f1)
            OK=""
            # Check-first: every feed gets at least one probe even after an
            # earlier feed has exhausted the shared deadline.
            while :; do
              GOT=$(curl -fsSL "https://mcpproxy.app/${NAME}" 2>/dev/null | shasum -a 256 | cut -d' ' -f1 || true)
              if [ "$GOT" = "$WANT" ]; then OK=yes; break; fi
              if [ "$(date +%s)" -ge "$DEADLINE" ]; then break; fi
              sleep 15
            done
            if [ -n "$OK" ]; then
              echo "✅ https://mcpproxy.app/${NAME} serves the ${GITHUB_REF_NAME} feed"
            else
              echo "::error::https://mcpproxy.app/${NAME} still does not serve the ${GITHUB_REF_NAME} feed after 15 minutes — Sparkle users will be offered a stale version"
              FAILED=1
            fi
          done
          # A fresh feed is useless if its enclosure 404s — Sparkle then fails
          # every update with "couldn't download the update" (v0.69.0).
          for f in appcast-out/*.xml; do
            URL=$(sed -n 's/.*enclosure url="\([^"]*\)".*/\1/p' "$f" | head -1)
            if [ -z "$URL" ] || ! curl -fsIL -o /dev/null "$URL"; then
              echo "::error::$(basename "$f") enclosure is not downloadable: ${URL:-<none>}"
              FAILED=1
            else
              echo "✅ $(basename "$f") enclosure downloadable: ${URL}"
            fi
          done
          exit "$FAILED"

  # Open the PR that deletes .github/RELEASE_NOTICE.md once this release has
  # carried it. Called here rather than left to retire-release-notice.yml's own
  # `release: published` trigger, because events raised with GITHUB_TOKEN (which
  # is what creates the release above) never start a workflow run — the
  # trigger silently did nothing for v0.64.0. The called workflow is a no-op
  # when no notice file exists.
  retire-release-notice:
    needs: [release]
    permissions:
      contents: write
      pull-requests: write
    uses: ./.github/workflows/retire-release-notice.yml
    with:
      tag: ${{ github.ref_name }}

  provenance:
    needs: [release]
    permissions:
      actions: read       # detect the GitHub Actions environment (trusted builder)
      id-token: write     # keyless signing of the provenance via OIDC
      contents: write     # upload the attestation to the release
    # SLSA generator MUST be referenced by semver tag, not SHA — it verifies its own
    # ref to establish the trusted builder identity; SHA or branch references break the
    # provenance trust model. This is the documented exception to the repo's SHA-pin rule
    # (see WP-C3 spec, WP-B5 exception).
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ needs.release.outputs.hashes }}
      upload-assets: true   # attach the .intoto.jsonl attestation to the release

  update-homebrew:
    needs: release
    runs-on: ubuntu-latest
    environment: production
    # Stable channel only: skip pre-release tags (v*-rc1, v*-beta, etc.) so an
    # RC tag never overwrites the stable formula/cask in the tap.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') && github.repository == 'smart-mcp-proxy/mcpproxy-go'

    steps:
      - name: Checkout tap repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: smart-mcp-proxy/homebrew-mcpproxy
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: tap

      - name: Download platform binaries and calculate SHA256
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "Processing version: ${VERSION}"

          # Wait a bit for GitHub release assets to be available
          sleep 15

          # Define platforms
          PLATFORMS=("darwin-arm64" "darwin-amd64" "linux-arm64" "linux-amd64")
          BASE_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}"

          # Download each platform tarball and calculate SHA256
          for PLATFORM in "${PLATFORMS[@]}"; do
            TARBALL="mcpproxy-${VERSION}-${PLATFORM}.tar.gz"
            URL="${BASE_URL}/${TARBALL}"
            echo "Downloading ${PLATFORM}: ${URL}"

            # Try downloading with retries
            for i in {1..5}; do
              echo "  Attempt ${i}/5..."
              if curl -fsSL "${URL}" -o "${TARBALL}"; then
                echo "  Download successful"
                break
              else
                echo "  Download failed, retrying in 10 seconds..."
                sleep 10
              fi

              if [ $i -eq 5 ]; then
                echo "All download attempts failed for ${PLATFORM}"
                curl -I "${URL}" || true
                exit 1
              fi
            done

            # Calculate SHA256 and export as environment variable
            SHA=$(sha256sum "${TARBALL}" | cut -d' ' -f1)
            VAR_NAME="SHA256_$(echo ${PLATFORM} | tr '-' '_' | tr '[:lower:]' '[:upper:]')"
            echo "${VAR_NAME}=${SHA}" >> $GITHUB_ENV
            echo "  SHA256: ${SHA}"

            # Clean up tarball
            rm -f "${TARBALL}"
          done

          echo "VERSION=${VERSION}" >> $GITHUB_ENV

      - name: Generate Homebrew formula
        run: |
          cd tap
          mkdir -p Formula

          # NOTE: deliberately NO `version` stanza. Every url below embeds the
          # version, so Homebrew scans it from the URL, and since ~2026-08-05
          # `brew audit --formula --online` FAILS an explicit stanza with
          # "Stable: `version X` is redundant with version scanned from URL".
          # That kept the tap's audit workflow red on every release from v0.53.0
          # to v0.62.0. `version` is still available to the test block below —
          # it is derived, not absent. Do not re-add it.
          cat > Formula/mcpproxy.rb << 'FORMULA_EOF'
          class Mcpproxy < Formula
            desc "Smart MCP Proxy - Intelligent tool discovery and proxying for MCP servers"
            homepage "https://github.com/smart-mcp-proxy/mcpproxy-go"
            license "MIT"

            on_macos do
              if Hardware::CPU.arm?
                url "https://github.com/smart-mcp-proxy/mcpproxy-go/releases/download/v${VERSION}/mcpproxy-${VERSION}-darwin-arm64.tar.gz"
                sha256 "${SHA256_DARWIN_ARM64}"
              else
                url "https://github.com/smart-mcp-proxy/mcpproxy-go/releases/download/v${VERSION}/mcpproxy-${VERSION}-darwin-amd64.tar.gz"
                sha256 "${SHA256_DARWIN_AMD64}"
              end
            end

            on_linux do
              if Hardware::CPU.arm?
                url "https://github.com/smart-mcp-proxy/mcpproxy-go/releases/download/v${VERSION}/mcpproxy-${VERSION}-linux-arm64.tar.gz"
                sha256 "${SHA256_LINUX_ARM64}"
              else
                url "https://github.com/smart-mcp-proxy/mcpproxy-go/releases/download/v${VERSION}/mcpproxy-${VERSION}-linux-amd64.tar.gz"
                sha256 "${SHA256_LINUX_AMD64}"
              end
            end

            def install
              bin.install "mcpproxy"
              bin.install "mcpproxy-tray" if OS.mac? && File.exist?("mcpproxy-tray")
            end

            test do
              assert_match version.to_s, shell_output("#{bin}/mcpproxy --version")
            end
          end
          FORMULA_EOF

          # Remove the 10-space YAML indentation from the formula
          sed -i 's/^          //' Formula/mcpproxy.rb

          # Substitute environment variables
          sed -i "s/\${VERSION}/${VERSION}/g" Formula/mcpproxy.rb
          sed -i "s/\${SHA256_DARWIN_ARM64}/${SHA256_DARWIN_ARM64}/g" Formula/mcpproxy.rb
          sed -i "s/\${SHA256_DARWIN_AMD64}/${SHA256_DARWIN_AMD64}/g" Formula/mcpproxy.rb
          sed -i "s/\${SHA256_LINUX_ARM64}/${SHA256_LINUX_ARM64}/g" Formula/mcpproxy.rb
          sed -i "s/\${SHA256_LINUX_AMD64}/${SHA256_LINUX_AMD64}/g" Formula/mcpproxy.rb

          echo "Formula created successfully:"
          cat Formula/mcpproxy.rb

      - name: Download installer DMGs and calculate SHA256 for cask
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          BASE_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}"

          for ARCH in arm64 amd64; do
            DMG="mcpproxy-${VERSION}-darwin-${ARCH}-installer.dmg"
            URL="${BASE_URL}/${DMG}"
            echo "Downloading ${DMG}..."
            for i in {1..5}; do
              echo "  Attempt ${i}/5..."
              if curl -fsSL "${URL}" -o "${DMG}"; then
                echo "  Download successful"
                break
              else
                echo "  Download failed, retrying in 10 seconds..."
                sleep 10
              fi
              if [ $i -eq 5 ]; then
                echo "All download attempts failed for ${DMG}"
                curl -I "${URL}" || true
                exit 1
              fi
            done
            SHA=$(sha256sum "${DMG}" | cut -d' ' -f1)
            VAR_NAME="SHA256_CASK_$(echo ${ARCH} | tr '[:lower:]' '[:upper:]')"
            echo "${VAR_NAME}=${SHA}" >> $GITHUB_ENV
            echo "  SHA256: ${SHA}"
            rm -f "${DMG}"
          done

      - name: Update Homebrew cask
        run: |
          cd tap
          mkdir -p Casks
          CASK_FILE="Casks/mcpproxy.rb"

          if [ ! -f "${CASK_FILE}" ]; then
            echo "Cask file not found at ${CASK_FILE}, skipping cask update"
            exit 0
          fi

          # Bump version and both sha256 values in place
          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "${CASK_FILE}"
          # arm64 sha256 is the first occurrence, amd64 is the second
          sed -i "0,/sha256 \"[^\"]*\"/{s/sha256 \"[^\"]*\"/sha256 \"${SHA256_CASK_ARM64}\"/}" "${CASK_FILE}"
          sed -i "0,/sha256 \"${SHA256_CASK_ARM64}\"/{b}; s/sha256 \"[^\"]*\"/sha256 \"${SHA256_CASK_AMD64}\"/" "${CASK_FILE}"

          echo "Cask updated:"
          cat "${CASK_FILE}"

      - name: Commit and push changes
        run: |
          cd tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/mcpproxy.rb Casks/mcpproxy.rb

          # Check if there are changes to commit
          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "Update mcpproxy to ${VERSION} (pre-built binaries)"
            git push
            echo "Changes committed and pushed successfully"
          fi

  # Publish signed apt/yum repositories to Cloudflare R2 (apt.mcpproxy.app, rpm.mcpproxy.app)
  publish-linux-repos:
    needs: [build, release]
    # Stable channel only: skip pre-release tags (v*-rc1, v*-beta, etc.)
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') && github.repository == 'smart-mcp-proxy/mcpproxy-go'
    runs-on: ubuntu-latest
    environment: production

    env:
      APT_BUCKET: mcpproxy-apt
      RPM_BUCKET: mcpproxy-rpm
      APT_BASE_URL: https://apt.mcpproxy.app
      RPM_BASE_URL: https://rpm.mcpproxy.app
      GPG_KEY_ID: ${{ vars.PACKAGES_GPG_KEY_ID }}
      RETAIN_N: "10"
      AWS_ENDPOINT_URL: https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com
      AWS_DEFAULT_REGION: auto
      AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
      PACKAGES_GPG_PRIVATE_KEY: ${{ secrets.PACKAGES_GPG_PRIVATE_KEY }}
      PACKAGES_GPG_PASSPHRASE: ${{ secrets.PACKAGES_GPG_PASSPHRASE }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install repo tooling
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq apt-utils createrepo-c gnupg rpm
          aws --version

      - name: Download package artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          path: release-artifacts
          pattern: linux-packages-*
          merge-multiple: true

      - name: List downloaded artifacts
        run: |
          echo "Contents of release-artifacts:"
          find release-artifacts -type f | sort

      - name: Publish apt + rpm repositories to R2
        run: contrib/linux-repos/publish.sh release-artifacts

      - name: Smoke-test install (Debian)
        run: contrib/linux-repos/smoke-test-debian.sh "${GITHUB_REF_NAME#v}"

      - name: Smoke-test install (Fedora)
        run: contrib/linux-repos/smoke-test-fedora.sh "${GITHUB_REF_NAME#v}"

  # Deploy documentation to Cloudflare Pages
  deploy-docs:
    needs: release
    runs-on: ubuntu-latest
    # Stable releases only — don't publish docs for RC/prerelease tags.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') && github.repository == 'smart-mcp-proxy/mcpproxy-go'
    # Non-blocking: docs failure doesn't block release
    continue-on-error: true

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: website/package-lock.json

      - name: Install dependencies
        working-directory: website
        run: npm ci

      # DOCS_VERSION, not the old `sed s/__VERSION__/.../`: the navbar badge is
      # now built from that env var (website/docusaurus.config.js), and the
      # placeholder it used to rewrite no longer exists in the config. Without
      # this the release deploy would overwrite the site docs.yml published with
      # a badge-less build.
      - name: Build docs with version
        working-directory: website
        env:
          DOCS_VERSION: ${{ github.ref_name }}
        run: npm run build

      - name: Deploy to Cloudflare Pages
        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0  # v4.1.3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy website/build --project-name=mcpproxy-docs

  # Trigger marketing site to update download links
  trigger-marketing-update:
    needs: release
    runs-on: ubuntu-latest
    # Stable releases only — don't fire marketing automation for RC/prerelease tags.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') && github.repository == 'smart-mcp-proxy/mcpproxy-go'
    # Non-blocking: marketing update failure doesn't block release
    continue-on-error: true

    steps:
      - name: Trigger marketing site update
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697  # v4.0.1
        with:
          token: ${{ secrets.MARKETING_SITE_DISPATCH_TOKEN }}
          repository: smart-mcp-proxy/mcpproxy.app-website
          event-type: update-version
          client-payload: '{"version": "${{ github.ref_name }}"}'

  mcp-registry:
    name: Publish to MCP Registry
    needs: release
    runs-on: ubuntu-latest
    # Stable releases only — never publish an RC to the official MCP registry.
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
    continue-on-error: true
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Install mcp-publisher
        run: |
          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher

      - name: Authenticate to MCP Registry
        run: ./mcp-publisher login github-oidc

      - name: Update version in server.json
        run: |
          jq --arg v "${{ steps.version.outputs.VERSION }}" '.version = $v' server.json > server.tmp && mv server.tmp server.json

      - name: Publish to MCP Registry
        run: ./mcp-publisher publish