desktop-release.yml

name: 'Desktop Release'

run-name: 'Desktop release ${{ inputs.version }}'

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Desktop version, for example 0.1.0 or v0.1.0.'
        required: true
        type: 'string'
      qwen_code_ref:
        description: 'Qwen Code branch, tag, or commit to bundle.'
        required: true
        default: 'main'
        type: 'string'
      electron_bridge:
        description: 'Publish the one-time macOS Electron-to-Tauri update bridge.'
        required: true
        default: false
        type: 'boolean'
      dry_run:
        description: 'Build unsigned installers without publishing.'
        required: true
        default: true
        type: 'boolean'
      draft:
        description: 'Create a draft GitHub release.'
        required: true
        default: true
        type: 'boolean'
      prerelease:
        description: 'Mark the release as a prerelease.'
        required: true
        default: false
        type: 'boolean'
      clobber:
        description: 'Replace same-named assets when uploading to an existing release.'
        required: true
        default: false
        type: 'boolean'

permissions:
  contents: 'read'

concurrency:
  group: 'desktop-release-${{ inputs.version }}'
  cancel-in-progress: false

env:
  BUN_VERSION: '1.3.9'
  NODE_VERSION: '22.20.0'
  DESKTOP_FEED_TAG: 'desktop-latest'

jobs:
  prepare:
    name: 'Prepare release metadata'
    runs-on: 'ubuntu-latest'
    timeout-minutes: 10
    outputs:
      qwen_code_sha: '${{ steps.source.outputs.sha }}'
      tag: '${{ steps.version.outputs.tag }}'
      version: '${{ steps.version.outputs.version }}'
    steps:
      - uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
        with:
          fetch-depth: 0

      - name: 'Resolve version'
        id: 'version'
        shell: 'bash'
        env:
          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
          INPUT_VERSION: '${{ inputs.version }}'
        run: |
          set -euo pipefail
          version="${INPUT_VERSION#v}"
          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::Desktop version must be valid SemVer: $INPUT_VERSION"
            exit 1
          fi
          if [ "$ELECTRON_BRIDGE" = 'true' ]; then
            core="${version%%[-+]*}"
            IFS='.' read -r major minor patch <<< "$core"
            if [ "$major" -eq 0 ] && [ "$minor" -eq 0 ] && [ "$patch" -le 5 ]; then
              echo '::error::The Electron bridge version must be newer than desktop-v0.0.5.'
              exit 1
            fi
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=desktop-v$version" >> "$GITHUB_OUTPUT"

      - name: 'Resolve Qwen Code source'
        id: 'source'
        shell: 'bash'
        env:
          INPUT_REF: '${{ inputs.qwen_code_ref }}'
          IS_DRY_RUN: '${{ inputs.dry_run }}'
        run: |
          set -euo pipefail
          git fetch origin "$INPUT_REF"
          sha="$(git rev-parse FETCH_HEAD)"
          if [ "$IS_DRY_RUN" = 'false' ]; then
            if [ "$GITHUB_REF_NAME" != 'main' ]; then
              echo '::error::Published desktop releases must run from main.'
              exit 1
            fi
            git fetch origin main:refs/remotes/origin/main
            if ! git merge-base --is-ancestor "$sha" refs/remotes/origin/main; then
              echo '::error::Published desktop releases may only bundle commits reachable from main.'
              exit 1
            fi
          fi
          echo "sha=$sha" >> "$GITHUB_OUTPUT"

  build:
    name: 'Build ${{ matrix.name }}'
    needs: 'prepare'
    runs-on: '${{ matrix.os }}'
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: 'macOS arm64'
            os: 'macos-latest'
            legacy_arch: 'arm64'
            rust_target: 'aarch64-apple-darwin'
            tauri_args: '--target aarch64-apple-darwin --bundles app,dmg'
          - name: 'macOS x64'
            os: 'macos-15'
            legacy_arch: 'x64'
            rust_target: 'x86_64-apple-darwin'
            tauri_args: '--target x86_64-apple-darwin --bundles app,dmg'
          - name: 'Windows x64'
            os: 'windows-latest'
            legacy_arch: ''
            rust_target: 'x86_64-pc-windows-msvc'
            tauri_args: '--target x86_64-pc-windows-msvc --bundles nsis'
          - name: 'Linux x64'
            os: 'ubuntu-22.04'
            legacy_arch: ''
            rust_target: 'x86_64-unknown-linux-gnu'
            tauri_args: '--target x86_64-unknown-linux-gnu --bundles appimage,deb'
    env:
      QWEN_CODE_COMMIT: '${{ needs.prepare.outputs.qwen_code_sha }}'
      QWEN_DESKTOP_TARGET: '${{ matrix.rust_target }}'
    steps:
      - uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
      - name: 'Configure source directory'
        shell: 'bash'
        run: 'echo "QWEN_CODE_ROOT=$RUNNER_TEMP/qwen-code-source" >> "$GITHUB_ENV"'

      - name: 'Check out Qwen Code source'
        shell: 'bash'
        run: |
          set -euo pipefail
          git init "$QWEN_CODE_ROOT"
          git -C "$QWEN_CODE_ROOT" remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
          git -C "$QWEN_CODE_ROOT" fetch --depth=1 origin "$QWEN_CODE_COMMIT"
          git -C "$QWEN_CODE_ROOT" checkout --detach "$QWEN_CODE_COMMIT"

      - uses: 'actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e' # v6.4.0
        with:
          node-version: '${{ env.NODE_VERSION }}'
          cache: 'npm'
          cache-dependency-path: |
            package-lock.json
            packages/desktop-shell/package-lock.json

      - uses: 'dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4' # stable
        with:
          targets: '${{ matrix.rust_target }}'

      - uses: 'Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae' # v2
        with:
          workspaces: 'packages/desktop-shell/src-tauri -> target'

      - name: 'Install Linux dependencies'
        if: "runner.os == 'Linux'"
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libatk-bridge2.0-0 at-spi2-core dbus-x11 patchelf libfuse2 xdg-utils xvfb

      - name: 'Install Qwen Code dependencies'
        working-directory: '${{ runner.temp }}/qwen-code-source'
        env:
          QWEN_SKIP_PREPARE: '1'
        run: 'npm ci --no-audit --progress=false'

      - name: 'Install desktop dependencies'
        working-directory: 'packages/desktop-shell'
        run: 'npm ci'

      - name: 'Set desktop version'
        working-directory: 'packages/desktop-shell'
        run: 'node scripts/version.js "${{ needs.prepare.outputs.version }}"'

      - name: 'Require updater signing key for publishing'
        if: '${{ inputs.dry_run == false }}'
        shell: 'bash'
        env:
          TAURI_SIGNING_PRIVATE_KEY: '${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}'
        run: |
          set -euo pipefail
          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
            echo '::error::TAURI_SIGNING_PRIVATE_KEY is required for published releases.'
            exit 1
          fi

      - name: 'Import macOS certificate'
        if: "runner.os == 'macOS' && inputs.dry_run == false"
        shell: 'bash'
        env:
          APPLE_CERTIFICATE: '${{ secrets.APPLE_CERTIFICATE }}'
          APPLE_CERTIFICATE_PASSWORD: '${{ secrets.APPLE_CERTIFICATE_PASSWORD }}'
          LEGACY_APPLE_CERTIFICATE: '${{ secrets.MAC_CSC_LINK }}'
          LEGACY_APPLE_CERTIFICATE_PASSWORD: '${{ secrets.MAC_CSC_KEY_PASSWORD }}'
          KEYCHAIN_PASSWORD: '${{ secrets.APPLE_KEYCHAIN_PASSWORD }}'
        run: |
          set -euo pipefail
          if [ -n "$APPLE_CERTIFICATE" ] && [ -n "$APPLE_CERTIFICATE_PASSWORD" ]; then
            certificate_data="$APPLE_CERTIFICATE"
            certificate_password="$APPLE_CERTIFICATE_PASSWORD"
          elif [ -n "$LEGACY_APPLE_CERTIFICATE" ] && [ -n "$LEGACY_APPLE_CERTIFICATE_PASSWORD" ]; then
            certificate_data="$LEGACY_APPLE_CERTIFICATE"
            certificate_password="$LEGACY_APPLE_CERTIFICATE_PASSWORD"
          else
            echo '::error::A complete APPLE_CERTIFICATE pair or MAC_CSC pair is required for published macOS releases.'
            exit 1
          fi
          keychain_password="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 32)}"
          certificate="$RUNNER_TEMP/qwen-code-desktop.p12"
          keychain="$RUNNER_TEMP/qwen-code-desktop.keychain-db"
          certificate_data="${certificate_data#*base64,}"
          printf '%s' "$certificate_data" | base64 --decode > "$certificate"
          security create-keychain -p "$keychain_password" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "$keychain_password" "$keychain"
          security import "$certificate" -P "$certificate_password" -A -t cert -f pkcs12 -k "$keychain"
          security list-keychains -d user -s "$keychain" login.keychain-db
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain"
          identity="$(security find-identity -v -p codesigning "$keychain" | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)"
          if [ -z "$identity" ]; then echo '::error::Developer ID Application identity was not found.'; exit 1; fi
          echo "APPLE_SIGNING_IDENTITY=$identity" >> "$GITHUB_ENV"

      - name: 'Configure macOS notarization'
        if: "runner.os == 'macOS' && inputs.dry_run == false"
        shell: 'bash'
        env:
          APPLE_API_ISSUER: '${{ secrets.APPLE_API_ISSUER }}'
          APPLE_API_KEY: '${{ secrets.APPLE_API_KEY }}'
          APPLE_API_KEY_P8: '${{ secrets.APPLE_API_KEY_P8 }}'
          LEGACY_APPLE_API_ISSUER: '${{ secrets.APPLE_NOTARY_ISSUER_ID }}'
          LEGACY_APPLE_API_KEY: '${{ secrets.APPLE_NOTARY_KEY_ID }}'
          LEGACY_APPLE_API_KEY_P8: '${{ secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}'
        run: |
          set -euo pipefail
          if [ -n "$APPLE_API_ISSUER" ] && [ -n "$APPLE_API_KEY" ] && [ -n "$APPLE_API_KEY_P8" ]; then
            api_issuer="$APPLE_API_ISSUER"
            api_key="$APPLE_API_KEY"
            key_path="$RUNNER_TEMP/AuthKey_${api_key}.p8"
            printf '%s' "$APPLE_API_KEY_P8" > "$key_path"
          elif [ -n "$LEGACY_APPLE_API_ISSUER" ] && [ -n "$LEGACY_APPLE_API_KEY" ] && [ -n "$LEGACY_APPLE_API_KEY_P8" ]; then
            api_issuer="$LEGACY_APPLE_API_ISSUER"
            api_key="$LEGACY_APPLE_API_KEY"
            key_path="$RUNNER_TEMP/AuthKey_${api_key}.p8"
            printf '%s' "$LEGACY_APPLE_API_KEY_P8" | base64 --decode > "$key_path"
          else
            echo '::error::A complete APPLE_API notarization set or APPLE_NOTARY set is required.'
            exit 1
          fi
          {
            echo "APPLE_API_KEY_PATH=$key_path"
            echo "APPLE_API_ISSUER=$api_issuer"
            echo "APPLE_API_KEY=$api_key"
          } >> "$GITHUB_ENV"

      - name: 'Import Windows certificate'
        if: "runner.os == 'Windows' && inputs.dry_run == false"
        shell: 'pwsh'
        env:
          WINDOWS_CERTIFICATE: '${{ secrets.WINDOWS_CERTIFICATE }}'
          WINDOWS_CERTIFICATE_PASSWORD: '${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}'
          LEGACY_WIN_CSC_LINK: '${{ secrets.WIN_CSC_LINK }}'
          LEGACY_WIN_CSC_KEY_PASSWORD: '${{ secrets.WIN_CSC_KEY_PASSWORD }}'
        run: |
          # Prefer the Tauri-style WINDOWS_CERTIFICATE pair; fall back to the
          # legacy electron-builder WIN_CSC_LINK pair if only that exists.
          $pfx = $null
          $pfxPassword = $null
          $primaryIncomplete = ([bool]$env:WINDOWS_CERTIFICATE) -ne ([bool]$env:WINDOWS_CERTIFICATE_PASSWORD)
          $legacyIncomplete = ([bool]$env:LEGACY_WIN_CSC_LINK) -ne ([bool]$env:LEGACY_WIN_CSC_KEY_PASSWORD)
          if ($primaryIncomplete -or $legacyIncomplete) {
            throw 'Incomplete Windows signing configuration: provide a complete WINDOWS_CERTIFICATE/WINDOWS_CERTIFICATE_PASSWORD pair or WIN_CSC_LINK/WIN_CSC_KEY_PASSWORD pair.'
          }
          if ($env:WINDOWS_CERTIFICATE -and $env:WINDOWS_CERTIFICATE_PASSWORD) {
            $pfx = $env:WINDOWS_CERTIFICATE
            $pfxPassword = $env:WINDOWS_CERTIFICATE_PASSWORD
          } elseif ($env:LEGACY_WIN_CSC_LINK -and $env:LEGACY_WIN_CSC_KEY_PASSWORD) {
            $pfx = $env:LEGACY_WIN_CSC_LINK
            $pfxPassword = $env:LEGACY_WIN_CSC_KEY_PASSWORD
          }
          if ($pfx) {
            $path = Join-Path $env:RUNNER_TEMP 'qwen-code-desktop.pfx'
            [IO.File]::WriteAllBytes($path, [Convert]::FromBase64String($pfx))
            $password = ConvertTo-SecureString $pfxPassword -AsPlainText -Force
            $certificate = Import-PfxCertificate -FilePath $path -CertStoreLocation Cert:\CurrentUser\My -Password $password
            $windowsConfig = @{ bundle = @{ windows = @{ certificateThumbprint = $certificate.Thumbprint } } } | ConvertTo-Json -Compress -Depth 3
            "WINDOWS_CONFIG=$windowsConfig" | Out-File -FilePath $env:GITHUB_ENV -Append
          } else {
            Write-Output "::warning::Windows signing certificate is not configured. Windows artifacts will be unsigned and may trigger SmartScreen warnings."
          }

      - name: 'Prepare bundled runtime'
        working-directory: 'packages/desktop-shell'
        run: 'npm run build:runtime'

      - name: 'Verify bundled runtime'
        working-directory: 'packages/desktop-shell'
        run: 'npm run smoke:runtime'

      - name: 'Run desktop tests'
        working-directory: 'packages/desktop-shell'
        run: 'npm test'

      - name: 'Run desktop release tests'
        working-directory: 'packages/desktop-shell'
        run: 'npm run test:release'

      - name: 'Sign bundled vendor binaries (macOS)'
        if: "runner.os == 'macOS' && inputs.dry_run == false"
        working-directory: 'packages/desktop-shell'
        shell: 'bash'
        env:
          APPLE_SIGNING_IDENTITY: '${{ env.APPLE_SIGNING_IDENTITY }}'
        run: |
          set -euo pipefail
          # Sign all native macOS executables in the bundled runtime so
          # notarization does not reject them. Tauri only signs the main
          # app binary; resources like ripgrep and the Node.js runtime are
          # embedded verbatim and must be signed beforehand.
          runtime_dir="runtime/qwen-code"
          # ripgrep vendor binaries
          rg_dir="$runtime_dir/lib/vendor/ripgrep"
          if [ -d "$rg_dir" ]; then
            find "$rg_dir" -type f -name 'rg' -path '*-darwin/*' -exec \
              codesign --force --sign "$APPLE_SIGNING_IDENTITY" \
              --options runtime --timestamp \
              --entitlements src-tauri/Entitlements.plist {} +
          else
            echo "::warning::Ripgrep vendor directory not found at $rg_dir; no ripgrep binaries signed."
          fi
          # Node.js runtime binary
          node_bin="$runtime_dir/node/bin/node"
          if [ -f "$node_bin" ]; then
            codesign --force --sign "$APPLE_SIGNING_IDENTITY" \
              --options runtime --timestamp \
              --entitlements src-tauri/Entitlements.plist "$node_bin"
          else
            echo "::warning::Node.js runtime binary not found at $node_bin; no Node.js binary signed."
          fi

      - name: 'Build desktop installers'
        working-directory: 'packages/desktop-shell'
        shell: 'bash'
        env:
          DRY_RUN: '${{ inputs.dry_run }}'
          TAURI_SIGNING_PRIVATE_KEY: '${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}'
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: '${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}'
          WINDOWS_CONFIG: '${{ env.WINDOWS_CONFIG }}'
        run: |
          set -euo pipefail
          args=( ${{ matrix.tauri_args }} )
          if [ "$DRY_RUN" = 'true' ]; then
            args+=(--no-sign)
          elif [ "$RUNNER_OS" = 'Windows' ] && [ -n "$WINDOWS_CONFIG" ]; then
            args+=(--config "$WINDOWS_CONFIG")
          fi
          npm run tauri -- build "${args[@]}"

      - name: 'Verify macOS signature'
        if: "runner.os == 'macOS' && inputs.dry_run == false"
        shell: 'bash'
        run: |
          set -euo pipefail
          app="$(find packages/desktop-shell/src-tauri/target/${{ matrix.rust_target }}/release/bundle/macos -maxdepth 1 -name '*.app' -print -quit)"
          codesign --verify --deep --strict --verbose=2 "$app"
          spctl --assess --type execute --verbose=2 "$app"

      - name: 'Verify Windows signature'
        if: "runner.os == 'Windows' && inputs.dry_run == false"
        shell: 'pwsh'
        env:
          WINDOWS_CONFIG: '${{ env.WINDOWS_CONFIG }}'
        run: |
          $installer = Get-ChildItem packages/desktop-shell/src-tauri/target/${{ matrix.rust_target }}/release/bundle/nsis/*.exe | Select-Object -First 1
          $signature = Get-AuthenticodeSignature $installer.FullName
          if ($signature.Status -eq 'Valid') {
            Write-Output "Windows installer is Authenticode-signed."
          } elseif ($signature.Status -eq 'NotSigned' -and -not $env:WINDOWS_CONFIG) {
            Write-Output "::warning::Windows installer is unsigned (no code signing certificate configured). SmartScreen will warn users on first install."
          } else {
            throw "Invalid Authenticode signature: $($signature.Status)"
          }

      - name: 'Create Electron bridge archive'
        if: "runner.os == 'macOS' && inputs.electron_bridge"
        shell: 'bash'
        env:
          LEGACY_ARCH: '${{ matrix.legacy_arch }}'
        run: |
          set -euo pipefail
          app="$(find packages/desktop-shell/src-tauri/target/${{ matrix.rust_target }}/release/bundle/macos -maxdepth 1 -name 'Qwen Code Desktop.app' -print -quit)"
          if [ -z "$app" ]; then
            echo '::error::The legacy-named macOS app bundle was not produced.'
            exit 1
          fi
          destination="packages/desktop-shell/src-tauri/target/${{ matrix.rust_target }}/release/bundle/electron-bridge"
          mkdir -p "$destination"
          ditto -c -k --sequesterRsrc --keepParent "$app" "$destination/Qwen-Code-Desktop-$LEGACY_ARCH.zip"

      - name: 'Smoke packaged application'
        if: "runner.os == 'macOS'"
        working-directory: 'packages/desktop-shell'
        shell: 'bash'
        run: |
          set -euo pipefail
          executable="$(find src-tauri/target/${{ matrix.rust_target }}/release/bundle/macos -path '*.app/Contents/MacOS/*' -type f -perm -111 -print -quit)"
          npm run smoke:packaged -- "$executable"

      - name: 'Smoke packaged application'
        if: "runner.os == 'Windows'"
        working-directory: 'packages/desktop-shell'
        shell: 'pwsh'
        run: |
          $executable = Get-ChildItem src-tauri/target/${{ matrix.rust_target }}/release/qwen-code-desktop.exe | Select-Object -First 1
          npm run smoke:packaged -- $executable.FullName

      - name: 'Smoke packaged application'
        if: "runner.os == 'Linux'"
        working-directory: 'packages/desktop-shell'
        shell: 'bash'
        run: |
          set -euo pipefail
          xvfb-run -a npm run smoke:packaged -- src-tauri/target/${{ matrix.rust_target }}/release/qwen-code-desktop

      - name: 'Collect artifacts'
        shell: 'bash'
        env:
          LEGACY_ARCH: '${{ matrix.legacy_arch }}'
        run: |
          set -euo pipefail
          destination="$RUNNER_TEMP/desktop-artifacts"
          mkdir -p "$destination"
          bundle_root="packages/desktop-shell/src-tauri/target/${{ matrix.rust_target }}/release/bundle"
          while IFS= read -r -d '' artifact; do
            name="$(basename "$artifact")"
            if [ "$RUNNER_OS" = 'macOS' ]; then
              extension=''
              stem="$name"
              case "$name" in
                *.app.tar.gz.sig) stem="${name%.app.tar.gz.sig}"; extension='.app.tar.gz.sig' ;;
                *.app.tar.gz) stem="${name%.app.tar.gz}"; extension='.app.tar.gz' ;;
                *.dmg) name="Qwen-Code-Desktop-$LEGACY_ARCH.dmg" ;;
                Qwen-Code-Desktop-*.zip) ;;
                *) continue ;;
              esac
              if [ -n "$extension" ]; then
                name="${stem}-${{ matrix.rust_target }}${extension}"
              fi
            fi
            name="${name// /-}"
            cp "$artifact" "$destination/$name"
          done < <(find "$bundle_root" -type f \( -name '*.dmg' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.exe' -o -name '*.zip' -o -name '*.app.tar.gz' -o -name '*.sig' \) -print0)
          if [ -z "$(find "$destination" -type f -print -quit)" ]; then
            echo '::error::No desktop artifacts were produced.'
            exit 1
          fi

      - if: "${{ github.repository == 'QwenLM/qwen-code' }}"
        uses: 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' # v7.0.1
        with:
          name: 'desktop-${{ matrix.rust_target }}'
          path: '${{ runner.temp }}/desktop-artifacts/*'
          if-no-files-found: 'error'
          retention-days: 14
      - name: 'List artifacts for fork dry run'
        if: "${{ github.repository != 'QwenLM/qwen-code' }}"
        shell: 'bash'
        run: |
          set -euo pipefail
          find "$RUNNER_TEMP/desktop-artifacts" -maxdepth 1 -type f -print

  publish:
    name: 'Publish GitHub release'
    if: "${{ inputs.dry_run == false && github.repository == 'QwenLM/qwen-code' }}"
    needs:
      - 'prepare'
      - 'build'
    runs-on: 'ubuntu-latest'
    timeout-minutes: 20
    permissions:
      contents: 'write'
    steps:
      - uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3

      - uses: 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' # v8.0.1
        with:
          path: 'release-assets'
          merge-multiple: true

      - name: 'Generate checksums and updater manifest'
        shell: 'bash'
        env:
          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
          GH_REPO: '${{ github.repository }}'
          RELEASE_TAG: '${{ needs.prepare.outputs.tag }}'
          RELEASE_VERSION: '${{ needs.prepare.outputs.version }}'
        run: |
          set -euo pipefail
          cd release-assets
          # Generate the updater manifest before checksumming so SHA256SUMS.txt
          # also covers desktop-latest.json (fetched unauthenticated by clients).
          node ../.github/scripts/create-desktop-update-manifest.mjs \
            --assets . \
            --repository "$GH_REPO" \
            --tag "$RELEASE_TAG" \
            --version "$RELEASE_VERSION" \
            --output desktop-latest.json
          if [ "$ELECTRON_BRIDGE" = 'true' ]; then
            node ../.github/scripts/create-electron-bridge-manifest.mjs \
              --assets . \
              --version "$RELEASE_VERSION" \
              --output latest-mac.yml
          fi
          sha256sum -- * > SHA256SUMS.txt

      - name: 'Create GitHub release'
        id: 'release'
        env:
          GH_TOKEN: '${{ github.token }}'
          RELEASE_TAG: '${{ needs.prepare.outputs.tag }}'
          RELEASE_VERSION: '${{ needs.prepare.outputs.version }}'
          RELEASE_DRAFT: '${{ inputs.draft }}'
          RELEASE_PRERELEASE: '${{ inputs.prerelease }}'
          RELEASE_CLOBBER: '${{ inputs.clobber }}'
        run: |
          set -euo pipefail
          args=("$RELEASE_TAG" release-assets/* --target "$GITHUB_SHA" --title "Qwen Code Desktop v$RELEASE_VERSION" --generate-notes --latest=false)
          if [ "$RELEASE_DRAFT" = 'true' ]; then args+=(--draft); fi
          if [ "$RELEASE_PRERELEASE" = 'true' ]; then args+=(--prerelease); fi
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            if [ "$RELEASE_CLOBBER" != 'true' ]; then
              echo "::error::Release $RELEASE_TAG already exists. Re-run with clobber=true to replace its assets."
              exit 1
            fi
            gh release upload "$RELEASE_TAG" release-assets/* --clobber
            edit_args=()
            if [ "$RELEASE_DRAFT" = 'true' ]; then edit_args+=(--draft); else edit_args+=(--draft=false); fi
            if [ "$RELEASE_PRERELEASE" = 'true' ]; then edit_args+=(--prerelease); else edit_args+=(--prerelease=false); fi
            gh release edit "$RELEASE_TAG" "${edit_args[@]}"
            release_url="$(gh release view "$RELEASE_TAG" --json url --jq '.url')"
          else
            release_url="$(gh release create "${args[@]}")"
          fi
          echo "url=$release_url" >> "$GITHUB_OUTPUT"

      - name: 'Update stable updater feed'
        if: '${{ inputs.draft == false && inputs.prerelease == false }}'
        env:
          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
          GH_TOKEN: '${{ github.token }}'
          FEED_TAG: '${{ env.DESKTOP_FEED_TAG }}'
        run: |
          set -euo pipefail
          feed_assets=(release-assets/desktop-latest.json)
          if [ "$ELECTRON_BRIDGE" = 'true' ]; then
            feed_assets+=(
              release-assets/latest-mac.yml
              release-assets/Qwen-Code-Desktop-arm64.zip
              release-assets/Qwen-Code-Desktop-x64.zip
              release-assets/Qwen-Code-Desktop-arm64.dmg
              release-assets/Qwen-Code-Desktop-x64.dmg
            )
          fi
          if gh release view "$FEED_TAG" >/dev/null 2>&1; then
            gh release upload "$FEED_TAG" "${feed_assets[@]}" --clobber
          else
            gh release create "$FEED_TAG" "${feed_assets[@]}" --title 'Qwen Code Desktop latest' --notes 'Stable desktop updater feed.' --latest=false
          fi

      - name: 'Publish release summary'
        env:
          RELEASE_TAG: '${{ needs.prepare.outputs.tag }}'
          RELEASE_VERSION: '${{ needs.prepare.outputs.version }}'
          RELEASE_URL: '${{ steps.release.outputs.url }}'
        run: |
          {
            echo '## Desktop release'
            echo
            echo "Version: $RELEASE_VERSION"
            echo "Tag: $RELEASE_TAG"
            echo "Release: $RELEASE_URL"
          } >> "$GITHUB_STEP_SUMMARY"