release.yml

name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions: {}

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ─────────────────────────────────────────────
  # Linux AMD64: Headless emulator + toolchain
  # ─────────────────────────────────────────────
  linux-amd64:
    name: Linux AMD64
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    env:
      ROOT: ${{ github.workspace }}

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Extract version from tag
      id: version
      run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

    - name: Stamp build version
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        BUILD_DATE=$(date +%Y%m%d)
        SHORT_SHA=${GITHUB_SHA::8}
        sed -i "s|InferNode 0.1|InferNode ${VERSION} build ${BUILD_DATE}-${SHORT_SHA}|" include/version.h
        echo "Version: $(cat include/version.h)"

    - name: Install build dependencies
      run: sudo apt-get update && sudo apt-get install -y build-essential

    - name: Build (headless)
      run: |
        chmod +x build-linux-amd64.sh
        ./build-linux-amd64.sh headless

    - name: Verify build
      run: |
        test -x emu/Linux/o.emu || { echo "Emulator not built"; exit 1; }
        test -x Linux/amd64/bin/limbo || { echo "Limbo compiler not built"; exit 1; }
        test -x Linux/amd64/bin/mk || { echo "mk not built"; exit 1; }

    - name: Compile test suite
      run: |
        LIMBO="$ROOT/Linux/amd64/bin/limbo"

        mkdir -p dis/tests dis/lib

        COMPILE_FAILURES=0
        if [ -d tests/testing ]; then
          cd tests/testing
          for f in *.b; do
            if [ -f "$f" ]; then
              if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/dis/lib/${f%.b}.dis" "$f" 2>&1; then
                echo "ERROR: Failed to compile testing/$f"
                COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
              fi
            fi
          done
          cd "$ROOT"
        fi

        cd tests
        for f in *.b; do
          name="${f%.b}"
          echo "Compiling $f..."
          if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/tests/$name.dis" "$f" 2>&1; then
            echo "ERROR: Failed to compile $f"
            COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
          fi
        done
        cd "$ROOT"

        test -f tests/runner.dis || { echo "Test runner not compiled"; exit 1; }

        echo "Compiled test .dis files:"
        ls tests/*_test.dis 2>/dev/null | wc -l

        if [ "$COMPILE_FAILURES" -gt 0 ]; then
          echo "ERROR: $COMPILE_FAILURES test file(s) failed to compile"
          exit 1
        fi

    - name: Run test suite
      run: |
        mkdir -p tmp

        echo "Running test suite inside Inferno emulator..."
        timeout 60 ./emu/Linux/o.emu -c1 -r . /tests/runner.dis -v > test-output.txt 2>&1 || true

        cat test-output.txt

        if grep -q "^PASS$" test-output.txt; then
          echo "Tests passed."
        elif grep -q "^FAIL$" test-output.txt; then
          echo "Tests failed."
          exit 1
        else
          echo "No test result found in output — tests may not have run."
          exit 1
        fi

    - name: Run wallet and secstore integration tests
      run: |
        echo "Running host-side integration tests..."

        if [ -f tests/host/wallet9p_test.sh ]; then
          echo "--- wallet9p test ---"
          chmod +x tests/host/wallet9p_test.sh
          ROOT=. bash tests/host/wallet9p_test.sh > wallet9p-test.txt 2>&1 || true
          cat wallet9p-test.txt
          if grep -q "=== PASS ===" wallet9p-test.txt; then
            echo "wallet9p test: PASS"
          else
            echo "wallet9p test: SKIP (requires full Inferno namespace)"
          fi
        fi

        if [ -f tests/host/wallet_persist_test.sh ]; then
          echo "--- wallet persistence test ---"
          chmod +x tests/host/wallet_persist_test.sh
          ROOT=. bash tests/host/wallet_persist_test.sh > wallet-persist-test.txt 2>&1 || true
          cat wallet-persist-test.txt
          if grep -q "^PASS$" wallet-persist-test.txt; then
            echo "wallet persistence test: PASS"
          else
            echo "wallet persistence test: FAIL (non-fatal in CI)"
          fi
        fi

    - name: Package archive
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        STAGE="infernode-${VERSION}-linux-amd64"
        mkdir -p "$STAGE/emu/Linux" "$STAGE/Linux/amd64/bin"

        # Platform binaries (stripped for release)
        cp emu/Linux/o.emu "$STAGE/emu/Linux/"
        cp Linux/amd64/bin/limbo Linux/amd64/bin/mk "$STAGE/Linux/amd64/bin/"
        strip "$STAGE/emu/Linux/o.emu" "$STAGE/Linux/amd64/bin/limbo" "$STAGE/Linux/amd64/bin/mk"

        # Shared runtime tree
        for d in dis lib fonts module services locale usr mnt; do
          [ -d "$d" ] && cp -a "$d" "$STAGE/"
        done

        # tmp directory (needed by profile)
        mkdir -p "$STAGE/tmp"

        # mkconfig and mkfiles (needed for building from source)
        cp mkconfig "$STAGE/"
        [ -d mkfiles ] && cp -a mkfiles "$STAGE/"

        # Headless launcher
        cp Linux/infernode-headless "$STAGE/"
        chmod +x "$STAGE/infernode-headless"

        # Build scripts (so users can rebuild with SDL3)
        cp build-linux-amd64.sh "$STAGE/"
        cp install-sdl3.sh "$STAGE/"

        # Docs and legal
        for f in LICENCE NOTICE TRADEMARK.md README.md QUICKSTART.md; do
          [ -f "$f" ] && cp "$f" "$STAGE/"
        done

        tar czf "${STAGE}.tar.gz" "$STAGE"
        echo "Archive: $(ls -lh ${STAGE}.tar.gz)"

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: infernode-linux-amd64-archive
        path: infernode-*-linux-amd64.tar.gz
        retention-days: 3

  # ─────────────────────────────────────────────
  # Linux AMD64 GUI: SDL3 emulator + self-contained bundle
  # ─────────────────────────────────────────────
  linux-amd64-gui:
    name: Linux AMD64 GUI
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: read
    env:
      ROOT: ${{ github.workspace }}

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Extract version from tag
      id: version
      run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

    - name: Stamp build version
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        BUILD_DATE=$(date +%Y%m%d)
        SHORT_SHA=${GITHUB_SHA::8}
        sed -i "s|InferNode 0.1|InferNode ${VERSION} build ${BUILD_DATE}-${SHORT_SHA}|" include/version.h
        echo "Version: $(cat include/version.h)"

    - name: Install build dependencies
      run: |
        sudo apt-get update && sudo apt-get install -y \
          build-essential cmake ninja-build \
          libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev libxss-dev \
          libwayland-dev libxkbcommon-dev libegl-dev libgles-dev \
          libxtst-dev libdrm-dev libgbm-dev \
          patchelf

    - name: Build SDL3 from source
      run: |
        chmod +x install-sdl3.sh
        ./install-sdl3.sh

    - name: Build (SDL3 GUI)
      run: |
        chmod +x build-linux-amd64.sh
        ./build-linux-amd64.sh

    - name: Verify build
      run: |
        test -x emu/Linux/o.emu || { echo "Emulator not built"; exit 1; }
        test -x Linux/amd64/bin/limbo || { echo "Limbo compiler not built"; exit 1; }
        test -x Linux/amd64/bin/mk || { echo "mk not built"; exit 1; }

    - name: Verify SDL3 linkage
      run: |
        ldd emu/Linux/o.emu | grep libSDL3 || { echo "Emulator not linked against SDL3"; exit 1; }

    - name: Compile test suite
      run: |
        LIMBO="$ROOT/Linux/amd64/bin/limbo"

        mkdir -p dis/tests dis/lib

        COMPILE_FAILURES=0
        if [ -d tests/testing ]; then
          cd tests/testing
          for f in *.b; do
            if [ -f "$f" ]; then
              if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/dis/lib/${f%.b}.dis" "$f" 2>&1; then
                echo "ERROR: Failed to compile testing/$f"
                COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
              fi
            fi
          done
          cd "$ROOT"
        fi

        cd tests
        for f in *.b; do
          name="${f%.b}"
          echo "Compiling $f..."
          if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/tests/$name.dis" "$f" 2>&1; then
            echo "ERROR: Failed to compile $f"
            COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
          fi
        done
        cd "$ROOT"

        test -f tests/runner.dis || { echo "Test runner not compiled"; exit 1; }

        echo "Compiled test .dis files:"
        ls tests/*_test.dis 2>/dev/null | wc -l

        if [ "$COMPILE_FAILURES" -gt 0 ]; then
          echo "ERROR: $COMPILE_FAILURES test file(s) failed to compile"
          exit 1
        fi

    - name: Run test suite
      env:
        SDL_VIDEODRIVER: dummy
      run: |
        mkdir -p tmp

        echo "Running test suite inside Inferno emulator..."
        timeout 60 ./emu/Linux/o.emu -c1 -r . /tests/runner.dis -v > test-output.txt 2>&1 || true

        cat test-output.txt

        if grep -q "^PASS$" test-output.txt; then
          echo "Tests passed."
        elif grep -q "^FAIL$" test-output.txt; then
          echo "Tests failed."
          exit 1
        else
          echo "No test result found in output — tests may not have run."
          exit 1
        fi

    - name: Run wallet and secstore integration tests
      run: |
        echo "Running host-side integration tests..."

        if [ -f tests/host/wallet9p_test.sh ]; then
          echo "--- wallet9p test ---"
          chmod +x tests/host/wallet9p_test.sh
          ROOT=. bash tests/host/wallet9p_test.sh > wallet9p-test.txt 2>&1 || true
          cat wallet9p-test.txt
          if grep -q "=== PASS ===" wallet9p-test.txt; then
            echo "wallet9p test: PASS"
          else
            echo "wallet9p test: SKIP (requires full Inferno namespace)"
          fi
        fi

        if [ -f tests/host/wallet_persist_test.sh ]; then
          echo "--- wallet persistence test ---"
          chmod +x tests/host/wallet_persist_test.sh
          ROOT=. bash tests/host/wallet_persist_test.sh > wallet-persist-test.txt 2>&1 || true
          cat wallet-persist-test.txt
          if grep -q "^PASS$" wallet-persist-test.txt; then
            echo "wallet persistence test: PASS"
          else
            echo "wallet persistence test: FAIL (non-fatal in CI)"
          fi
        fi

    - name: Prepare self-contained binary
      run: |
        # Set RPATH so the emulator finds libSDL3.so.0 in its own directory
        patchelf --set-rpath '$ORIGIN' emu/Linux/o.emu

        # Verify
        echo "RPATH set to:"
        patchelf --print-rpath emu/Linux/o.emu

    - name: Package self-contained tarball
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        STAGE="infernode-${VERSION}-linux-amd64-gui"
        mkdir -p "$STAGE/bin" "$STAGE/resources"

        # GUI launcher (user runs this)
        cp Linux/infernode "$STAGE/"
        chmod +x "$STAGE/infernode"

        # Desktop integration
        cp Linux/infernode.desktop "$STAGE/"
        cp Nt/Assets/Square150x150Logo.png "$STAGE/infernode.png"

        # Build scripts
        cp build-linux-amd64.sh install-sdl3.sh "$STAGE/"

        # Docs and legal
        for f in LICENCE NOTICE TRADEMARK.md README.md QUICKSTART.md; do
          [ -f "$f" ] && cp "$f" "$STAGE/"
        done

        # Emulator binary + bundled SDL3 (stripped for release)
        cp emu/Linux/o.emu "$STAGE/bin/emu"

        # Find and bundle libSDL3.so.0
        SDL3_LIB=$(ldd emu/Linux/o.emu | grep libSDL3 | awk '{print $3}')
        cp "$SDL3_LIB" "$STAGE/bin/libSDL3.so.0"

        # Native tools
        cp Linux/amd64/bin/limbo Linux/amd64/bin/mk "$STAGE/bin/"
        strip "$STAGE/bin/emu" "$STAGE/bin/limbo" "$STAGE/bin/mk"

        # Runtime tree into resources/
        for d in dis lib fonts module services locale usr mnt; do
          [ -d "$d" ] && cp -a "$d" "$STAGE/resources/"
        done
        mkdir -p "$STAGE/resources/tmp"

        # mkconfig and mkfiles
        cp mkconfig "$STAGE/resources/"
        [ -d mkfiles ] && cp -a mkfiles "$STAGE/resources/"

        # Distribution defaults for LLM config
        cat > "$STAGE/resources/lib/ndb/llm" << 'LLMCONF'
        mode=local
        backend=api
        url=https://api.anthropic.com
        model=claude-sonnet-4-5-20250929
        dial=
        LLMCONF

        tar czf "${STAGE}.tar.gz" "$STAGE"
        echo "Archive: $(ls -lh ${STAGE}.tar.gz)"

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: infernode-linux-amd64-gui-archive
        path: infernode-*-linux-amd64-gui.tar.gz
        retention-days: 3

  # ─────────────────────────────────────────────
  # Linux ARM64: Headless emulator + toolchain
  # ─────────────────────────────────────────────
  linux-arm64:
    name: Linux ARM64
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 30
    permissions:
      contents: read
    env:
      ROOT: ${{ github.workspace }}

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Extract version from tag
      id: version
      run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

    - name: Stamp build version
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        BUILD_DATE=$(date +%Y%m%d)
        SHORT_SHA=${GITHUB_SHA::8}
        sed -i "s|InferNode 0.1|InferNode ${VERSION} build ${BUILD_DATE}-${SHORT_SHA}|" include/version.h
        echo "Version: $(cat include/version.h)"

    - name: Install build dependencies
      run: sudo apt-get update && sudo apt-get install -y build-essential

    - name: Build (headless)
      run: |
        chmod +x build-linux-arm64.sh
        ./build-linux-arm64.sh headless

    - name: Verify build
      run: |
        test -x emu/Linux/o.emu || { echo "Emulator not built"; exit 1; }
        test -x Linux/arm64/bin/limbo || { echo "Limbo compiler not built"; exit 1; }
        test -x Linux/arm64/bin/mk || { echo "mk not built"; exit 1; }

    - name: Compile test suite
      run: |
        LIMBO="$ROOT/Linux/arm64/bin/limbo"

        mkdir -p dis/tests dis/lib

        COMPILE_FAILURES=0
        if [ -d tests/testing ]; then
          cd tests/testing
          for f in *.b; do
            if [ -f "$f" ]; then
              if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/dis/lib/${f%.b}.dis" "$f" 2>&1; then
                echo "ERROR: Failed to compile testing/$f"
                COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
              fi
            fi
          done
          cd "$ROOT"
        fi

        cd tests
        for f in *.b; do
          name="${f%.b}"
          echo "Compiling $f..."
          if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/tests/$name.dis" "$f" 2>&1; then
            echo "ERROR: Failed to compile $f"
            COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
          fi
        done
        cd "$ROOT"

        test -f tests/runner.dis || { echo "Test runner not compiled"; exit 1; }

        echo "Compiled test .dis files:"
        ls tests/*_test.dis 2>/dev/null | wc -l

        if [ "$COMPILE_FAILURES" -gt 0 ]; then
          echo "ERROR: $COMPILE_FAILURES test file(s) failed to compile"
          exit 1
        fi

    - name: Run test suite
      run: |
        mkdir -p tmp

        echo "Running test suite inside Inferno emulator..."
        timeout 60 ./emu/Linux/o.emu -c1 -r . /tests/runner.dis -v > test-output.txt 2>&1 || true

        cat test-output.txt

        if grep -q "^PASS$" test-output.txt; then
          echo "Tests passed."
        elif grep -q "^FAIL$" test-output.txt; then
          echo "Tests failed."
          exit 1
        else
          echo "No test result found in output — tests may not have run."
          exit 1
        fi

    - name: Run wallet and secstore integration tests
      run: |
        echo "Running host-side integration tests..."

        if [ -f tests/host/wallet9p_test.sh ]; then
          echo "--- wallet9p test ---"
          chmod +x tests/host/wallet9p_test.sh
          ROOT=. bash tests/host/wallet9p_test.sh > wallet9p-test.txt 2>&1 || true
          cat wallet9p-test.txt
          if grep -q "=== PASS ===" wallet9p-test.txt; then
            echo "wallet9p test: PASS"
          else
            echo "wallet9p test: SKIP (requires full Inferno namespace)"
          fi
        fi

        if [ -f tests/host/wallet_persist_test.sh ]; then
          echo "--- wallet persistence test ---"
          chmod +x tests/host/wallet_persist_test.sh
          ROOT=. bash tests/host/wallet_persist_test.sh > wallet-persist-test.txt 2>&1 || true
          cat wallet-persist-test.txt
          if grep -q "^PASS$" wallet-persist-test.txt; then
            echo "wallet persistence test: PASS"
          else
            echo "wallet persistence test: FAIL (non-fatal in CI)"
          fi
        fi

    - name: Package archive
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        STAGE="infernode-${VERSION}-linux-arm64"
        mkdir -p "$STAGE/emu/Linux" "$STAGE/Linux/arm64/bin"

        # Platform binaries
        cp emu/Linux/o.emu "$STAGE/emu/Linux/"
        cp Linux/arm64/bin/limbo Linux/arm64/bin/mk "$STAGE/Linux/arm64/bin/"

        # Shared runtime tree
        for d in dis lib fonts module services locale usr mnt; do
          [ -d "$d" ] && cp -a "$d" "$STAGE/"
        done

        # tmp directory (needed by profile)
        mkdir -p "$STAGE/tmp"

        # mkconfig and mkfiles (needed for building from source)
        cp mkconfig "$STAGE/"
        [ -d mkfiles ] && cp -a mkfiles "$STAGE/"

        # Headless launcher
        cp Linux/infernode-headless "$STAGE/"
        chmod +x "$STAGE/infernode-headless"

        # Build scripts (so users can rebuild with SDL3)
        cp build-linux-arm64.sh "$STAGE/"
        cp install-sdl3.sh "$STAGE/"

        # Docs and legal
        for f in LICENCE NOTICE TRADEMARK.md README.md QUICKSTART.md; do
          [ -f "$f" ] && cp "$f" "$STAGE/"
        done

        tar czf "${STAGE}.tar.gz" "$STAGE"
        echo "Archive: $(ls -lh ${STAGE}.tar.gz)"

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: infernode-linux-arm64-archive
        path: infernode-*-linux-arm64.tar.gz
        retention-days: 3

  # ─────────────────────────────────────────────
  # Linux ARM64 GUI: SDL3 emulator + self-contained bundle
  # ─────────────────────────────────────────────
  linux-arm64-gui:
    name: Linux ARM64 GUI
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 45
    permissions:
      contents: read
    env:
      ROOT: ${{ github.workspace }}

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Extract version from tag
      id: version
      run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

    - name: Stamp build version
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        BUILD_DATE=$(date +%Y%m%d)
        SHORT_SHA=${GITHUB_SHA::8}
        sed -i "s|InferNode 0.1|InferNode ${VERSION} build ${BUILD_DATE}-${SHORT_SHA}|" include/version.h
        echo "Version: $(cat include/version.h)"

    - name: Install build dependencies
      run: |
        sudo apt-get update && sudo apt-get install -y \
          build-essential cmake ninja-build \
          libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev libxss-dev \
          libwayland-dev libxkbcommon-dev libegl-dev libgles-dev \
          libxtst-dev libdrm-dev libgbm-dev \
          patchelf

    - name: Build SDL3 from source
      run: |
        chmod +x install-sdl3.sh
        ./install-sdl3.sh

    - name: Build (SDL3 GUI)
      run: |
        chmod +x build-linux-arm64.sh
        ./build-linux-arm64.sh

    - name: Verify build
      run: |
        test -x emu/Linux/o.emu || { echo "Emulator not built"; exit 1; }
        test -x Linux/arm64/bin/limbo || { echo "Limbo compiler not built"; exit 1; }
        test -x Linux/arm64/bin/mk || { echo "mk not built"; exit 1; }

    - name: Verify SDL3 linkage
      run: |
        ldd emu/Linux/o.emu | grep libSDL3 || { echo "Emulator not linked against SDL3"; exit 1; }

    - name: Compile test suite
      run: |
        LIMBO="$ROOT/Linux/arm64/bin/limbo"

        mkdir -p dis/tests dis/lib

        COMPILE_FAILURES=0
        if [ -d tests/testing ]; then
          cd tests/testing
          for f in *.b; do
            if [ -f "$f" ]; then
              if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/dis/lib/${f%.b}.dis" "$f" 2>&1; then
                echo "ERROR: Failed to compile testing/$f"
                COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
              fi
            fi
          done
          cd "$ROOT"
        fi

        cd tests
        for f in *.b; do
          name="${f%.b}"
          echo "Compiling $f..."
          if ! "$LIMBO" -I "$ROOT/module" -o "$ROOT/tests/$name.dis" "$f" 2>&1; then
            echo "ERROR: Failed to compile $f"
            COMPILE_FAILURES=$((COMPILE_FAILURES + 1))
          fi
        done
        cd "$ROOT"

        test -f tests/runner.dis || { echo "Test runner not compiled"; exit 1; }

        echo "Compiled test .dis files:"
        ls tests/*_test.dis 2>/dev/null | wc -l

        if [ "$COMPILE_FAILURES" -gt 0 ]; then
          echo "ERROR: $COMPILE_FAILURES test file(s) failed to compile"
          exit 1
        fi

    - name: Run test suite
      env:
        SDL_VIDEODRIVER: dummy
      run: |
        mkdir -p tmp

        echo "Running test suite inside Inferno emulator..."
        timeout 60 ./emu/Linux/o.emu -c1 -r . /tests/runner.dis -v > test-output.txt 2>&1 || true

        cat test-output.txt

        if grep -q "^PASS$" test-output.txt; then
          echo "Tests passed."
        elif grep -q "^FAIL$" test-output.txt; then
          echo "Tests failed."
          exit 1
        else
          echo "No test result found in output — tests may not have run."
          exit 1
        fi

    - name: Run wallet and secstore integration tests
      run: |
        echo "Running host-side integration tests..."

        if [ -f tests/host/wallet9p_test.sh ]; then
          echo "--- wallet9p test ---"
          chmod +x tests/host/wallet9p_test.sh
          ROOT=. bash tests/host/wallet9p_test.sh > wallet9p-test.txt 2>&1 || true
          cat wallet9p-test.txt
          if grep -q "=== PASS ===" wallet9p-test.txt; then
            echo "wallet9p test: PASS"
          else
            echo "wallet9p test: SKIP (requires full Inferno namespace)"
          fi
        fi

        if [ -f tests/host/wallet_persist_test.sh ]; then
          echo "--- wallet persistence test ---"
          chmod +x tests/host/wallet_persist_test.sh
          ROOT=. bash tests/host/wallet_persist_test.sh > wallet-persist-test.txt 2>&1 || true
          cat wallet-persist-test.txt
          if grep -q "^PASS$" wallet-persist-test.txt; then
            echo "wallet persistence test: PASS"
          else
            echo "wallet persistence test: FAIL (non-fatal in CI)"
          fi
        fi

    - name: Prepare self-contained binary
      run: |
        # Set RPATH so the emulator finds libSDL3.so.0 in its own directory
        patchelf --set-rpath '$ORIGIN' emu/Linux/o.emu

        # Verify
        echo "RPATH set to:"
        patchelf --print-rpath emu/Linux/o.emu

    - name: Package self-contained tarball
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        STAGE="infernode-${VERSION}-linux-arm64-gui"
        mkdir -p "$STAGE/bin" "$STAGE/resources"

        # GUI launcher (user runs this)
        cp Linux/infernode "$STAGE/"
        chmod +x "$STAGE/infernode"

        # Desktop integration
        cp Linux/infernode.desktop "$STAGE/"
        cp Nt/Assets/Square150x150Logo.png "$STAGE/infernode.png"

        # Build scripts
        cp build-linux-arm64.sh install-sdl3.sh "$STAGE/"

        # Docs and legal
        for f in LICENCE NOTICE TRADEMARK.md README.md QUICKSTART.md; do
          [ -f "$f" ] && cp "$f" "$STAGE/"
        done

        cp emu/Linux/o.emu "$STAGE/bin/emu"

        # Find and bundle libSDL3.so.0
        SDL3_LIB=$(ldd emu/Linux/o.emu | grep libSDL3 | awk '{print $3}')
        cp "$SDL3_LIB" "$STAGE/bin/libSDL3.so.0"

        # Native tools
        cp Linux/arm64/bin/limbo Linux/arm64/bin/mk "$STAGE/bin/"

        # Runtime tree into resources/
        for d in dis lib fonts module services locale usr mnt; do
          [ -d "$d" ] && cp -a "$d" "$STAGE/resources/"
        done
        mkdir -p "$STAGE/resources/tmp"

        # mkconfig and mkfiles
        cp mkconfig "$STAGE/resources/"
        [ -d mkfiles ] && cp -a mkfiles "$STAGE/resources/"

        # Distribution defaults for LLM config
        cat > "$STAGE/resources/lib/ndb/llm" << 'LLMCONF'
        mode=local
        backend=api
        url=https://api.anthropic.com
        model=claude-sonnet-4-5-20250929
        dial=
        LLMCONF

        tar czf "${STAGE}.tar.gz" "$STAGE"
        echo "Archive: $(ls -lh ${STAGE}.tar.gz)"

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: infernode-linux-arm64-gui-archive
        path: infernode-*-linux-arm64-gui.tar.gz
        retention-days: 3

  # ─────────────────────────────────────────────
  # macOS ARM64: SDL3 GUI emulator + .app bundle
  # ─────────────────────────────────────────────
  macos-arm64:
    name: macOS ARM64
    runs-on: macos-15
    timeout-minutes: 30
    permissions:
      contents: read
    env:
      ROOT: ${{ github.workspace }}

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Extract version from tag
      id: version
      run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

    - name: Stamp build version
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        BUILD_DATE=$(date +%Y%m%d)
        SHORT_SHA=${GITHUB_SHA::8}
        sed -i '' "s|InferNode 0.1|InferNode ${VERSION} build ${BUILD_DATE}-${SHORT_SHA}|" include/version.h
        echo "Version: $(cat include/version.h)"

    - name: Install SDL3
      run: brew install sdl3 sdl3_ttf

    - name: Build mk
      run: |
        chmod +x makemk.sh
        ./makemk.sh
        test -x MacOSX/arm64/bin/mk || { echo "mk build failed"; exit 1; }

    - name: Build system libraries
      run: |
        export PATH="$ROOT/MacOSX/arm64/bin:/usr/bin:/bin"
        for dir in lib9 libbio libmp libsec libmath; do
          echo "Building $dir..."
          (cd $dir && "$ROOT/MacOSX/arm64/bin/mk" install) || exit 1
        done

    - name: Build limbo compiler
      run: |
        export PATH="$ROOT/MacOSX/arm64/bin:/usr/bin:/bin"
        (cd limbo && "$ROOT/MacOSX/arm64/bin/mk" install) || exit 1
        test -x MacOSX/arm64/bin/limbo || { echo "limbo not found"; exit 1; }

    - name: Build libinterp and remaining libraries
      run: |
        export PATH="$ROOT/MacOSX/arm64/bin:/usr/bin:/bin"
        (cd libinterp && "$ROOT/MacOSX/arm64/bin/mk" install) || exit 1
        for dir in libfreetype libkeyring libdraw libmemdraw libmemlayer; do
          echo "Building $dir..."
          (cd $dir && "$ROOT/MacOSX/arm64/bin/mk" install) || true
        done

    - name: Build SDL3 GUI emulator
      run: |
        export PATH="$ROOT/MacOSX/arm64/bin:/usr/bin:/bin"
        cd emu/MacOSX
        mk clean 2>/dev/null || true
        OBJTYPE=arm64 SYSTARG=MacOSX SHELL=/bin/sh mk GUIBACK=sdl3
        test -f o.emu || { echo "Emulator build failed"; exit 1; }

    - name: Prepare macOS binary
      run: |
        # Copy o.emu to InferNode so macOS shows correct app name in Dock/menu
        cp emu/MacOSX/o.emu emu/MacOSX/InferNode

        # Bundle SDL3 dylib next to the binary
        SDL3_DYLIB=$(otool -L emu/MacOSX/InferNode | grep libSDL3 | awk '{print $1}')
        cp "$SDL3_DYLIB" emu/MacOSX/libSDL3.0.dylib

        # Rewrite InferNode to load SDL3 from its own directory
        install_name_tool -change "$SDL3_DYLIB" \
          @executable_path/libSDL3.0.dylib emu/MacOSX/InferNode

        # Verify
        echo "Updated load paths:"
        otool -L emu/MacOSX/InferNode | grep -i sdl

    - name: Import signing certificate
      env:
        APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
        APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
      run: |
        echo "$APPLE_CERTIFICATE_P12" | base64 --decode > /tmp/certificate.p12
        security create-keychain -p "" build.keychain
        security default-keychain -s build.keychain
        security unlock-keychain -p "" build.keychain
        security import /tmp/certificate.p12 -k build.keychain \
          -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign
        security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain
        security find-identity -v -p codesigning build.keychain
        rm /tmp/certificate.p12

    - name: Package self-contained app bundle
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        APP="InferNode.app"
        CONTENTS="$APP/Contents"
        MACOS="$CONTENTS/MacOS"
        RESOURCES="$CONTENTS/Resources"

        # Start from the checked-out .app bundle (has Info.plist, icon, launcher)
        cp -a MacOSX/InferNode.app "$APP"

        # Emulator binary and SDL3 go in Contents/MacOS/ (stripped for release)
        cp emu/MacOSX/InferNode "$MACOS/emu"
        cp emu/MacOSX/libSDL3.0.dylib "$MACOS/"

        # Native tools
        mkdir -p "$MACOS/tools"
        cp MacOSX/arm64/bin/limbo MacOSX/arm64/bin/mk "$MACOS/tools/"

        # Strip debug symbols before signing
        strip "$MACOS/emu" "$MACOS/tools/limbo" "$MACOS/tools/mk"

        # Runtime tree goes in Contents/Resources/
        for d in dis lib fonts module services locale usr mnt; do
          [ -d "$d" ] && cp -a "$d" "$RESOURCES/"
        done
        mkdir -p "$RESOURCES/tmp" "$RESOURCES/usr/inferno/secstore" "$RESOURCES/usr/inferno/tmp"

        # Set distribution defaults for LLM config
        # (dev config may point to internal servers)
        cat > "$RESOURCES/lib/ndb/llm" << 'LLMCONF'
        mode=local
        backend=api
        url=https://api.anthropic.com
        model=claude-sonnet-4-5-20250929
        dial=
        LLMCONF
        cp mkconfig "$RESOURCES/"
        [ -d mkfiles ] && cp -a mkfiles "$RESOURCES/"

        # Docs and build scripts in Resources
        for f in LICENCE NOTICE TRADEMARK.md README.md QUICKSTART.md \
                 build-macos-sdl3.sh build-macos-headless.sh makemk.sh; do
          [ -f "$f" ] && cp "$f" "$RESOURCES/"
        done

    - name: Sign app bundle
      run: |
        IDENTITY="Developer ID Application: Synectify, Pte Ltd (TJ448C32Q3)"
        APP="InferNode.app"

        cat > /tmp/emu-entitlements.plist << 'PLIST'
        <?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
        <plist version="1.0">
        <dict>
            <key>com.apple.security.cs.allow-jit</key>
            <true/>
            <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
            <true/>
            <key>com.apple.security.device.audio-input</key>
            <true/>
        </dict>
        </plist>
        PLIST

        # Sign innermost binaries first
        codesign --force --options runtime --timestamp \
          --sign "$IDENTITY" "$APP/Contents/MacOS/libSDL3.0.dylib"
        codesign --force --options runtime --timestamp \
          --entitlements /tmp/emu-entitlements.plist \
          --sign "$IDENTITY" "$APP/Contents/MacOS/emu"
        for tool in "$APP/Contents/MacOS/tools/limbo" "$APP/Contents/MacOS/tools/mk"; do
          [ -f "$tool" ] && codesign --force --options runtime --timestamp \
            --sign "$IDENTITY" "$tool"
        done
        [ -f "$APP/Contents/MacOS/llm9p" ] && codesign --force --options runtime --timestamp \
          --sign "$IDENTITY" "$APP/Contents/MacOS/llm9p"

        # Sign the entire .app bundle (must be last)
        codesign --force --options runtime --timestamp \
          --entitlements /tmp/emu-entitlements.plist \
          --sign "$IDENTITY" "$APP"
        codesign -dvv "$APP"

    - name: Create and notarize DMG
      env:
        APPLE_ID: ${{ secrets.APPLE_ID }}
        APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        DMG="infernode-${VERSION}-macos-arm64.dmg"

        hdiutil create -volname "InferNode" \
          -srcfolder InferNode.app -ov -format UDZO "$DMG"

        xcrun notarytool submit "$DMG" \
          --apple-id "$APPLE_ID" \
          --team-id "$APPLE_TEAM_ID" \
          --password "$APPLE_APP_PASSWORD" \
          --wait --timeout 15m

        xcrun stapler staple "$DMG"
        echo "DMG: $(ls -lh $DMG)"

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: infernode-macos-arm64-archive
        path: infernode-*-macos-arm64.dmg
        retention-days: 3

  # Windows AMD64: deferred to v0.2 (linker issues with crypto libs)

  # ─────────────────────────────────────────────
  # Create GitHub Release with all archives
  # ─────────────────────────────────────────────
  release:
    name: Create Release
    needs: [linux-amd64, linux-amd64-gui, linux-arm64, linux-arm64-gui, macos-arm64]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write
      id-token: write       # cosign keyless signing via Sigstore
      attestations: write   # SLSA build provenance

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Extract version from tag
      id: version
      run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        path: artifacts
        merge-multiple: true

    - name: Generate checksums
      run: |
        cd artifacts
        sha256sum infernode-* > SHA256SUMS.txt
        cat SHA256SUMS.txt

    - name: Install cosign
      uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1

    - name: Sign release artifacts
      run: |
        cd artifacts
        for f in infernode-* SHA256SUMS.txt; do
          cosign sign-blob --yes --output-signature "${f}.sig" --output-certificate "${f}.pem" "$f"
        done

    - name: Attest build provenance
      run: |
        cd artifacts
        for f in infernode-*.tar.gz infernode-*.dmg; do
          [ -f "$f" ] && echo "Attesting $f" || continue
        done
    - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: artifacts/infernode-*.tar.gz
    - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: artifacts/infernode-*.dmg

    - name: Create GitHub Release
      uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
      with:
        tag_name: ${{ github.ref_name }}
        name: InferNode ${{ steps.version.outputs.version }}
        draft: true
        prerelease: false
        generate_release_notes: true
        files: |
          artifacts/*
        body: |
          ## InferNode ${{ steps.version.outputs.version }}

          64-bit Inferno® OS for embedded systems, servers, and AI agents.

          ### Downloads

          | Platform | Architecture | File |
          |----------|-------------|------|
          | Linux | AMD64 (SDL3 GUI) | `infernode-${{ steps.version.outputs.version }}-linux-amd64-gui.tar.gz` |
          | Linux | AMD64 (headless) | `infernode-${{ steps.version.outputs.version }}-linux-amd64.tar.gz` |
          | Linux | ARM64 (SDL3 GUI) | `infernode-${{ steps.version.outputs.version }}-linux-arm64-gui.tar.gz` |
          | Linux | ARM64 (headless) | `infernode-${{ steps.version.outputs.version }}-linux-arm64.tar.gz` |
          | macOS | ARM64 (Apple Silicon, SDL3 GUI) | `infernode-${{ steps.version.outputs.version }}-macos-arm64.dmg` |

          Windows support is in progress and will ship in a future release.

          ### Quick Start

          **macOS:** Open the DMG, drag InferNode.app to Applications, double-click to launch

          **Linux (GUI):** Extract, then `./infernode`

          **Linux (headless):** Extract, then `./infernode-headless`

          ### Verification

          All release artifacts are signed with [Sigstore](https://sigstore.dev) cosign (keyless).

          ```
          cosign verify-blob --signature <file>.sig --certificate <file>.pem \
            --certificate-identity-regexp 'github.com/infernode-os/infernode' \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>
          ```

          See `SHA256SUMS.txt` for SHA-256 checksums of all archives.