orca/.github/workflows/adhoc-mac-build.yml

name: Adhoc macOS + Windows Dev Build

# Why: lets anyone cut installable macOS and Windows builds of a trusted repo ref
# so the team can run an experimental feature instead of reasoning from a diff.
# Hourly covers current main; this covers experiments and on-demand validation.
#
# Deliberately narrow scope:
#   - macOS and Windows desktop installers. Linux keeps using RC/stable.
#   - No tests, no lint, no e2e. PR CI and release-cut remain the gates. The one
#     exception is the orcad template: like release-cut, it is merged from the
#     node-server lanes that build and qualify each SSH target's slot.
#   - macOS is signed and notarized so TCC grants survive updates.
#   - Windows is unsigned; the published release notes explain the one-time
#     SmartScreen/manual-install requirement.
#
# Artifacts publish to stablyai/orca-adhoc — separate from both orca and
# orca-hourly. Separate from orca because the main repo's releases atom feed
# exposes only its 10 newest entries. Separate from orca-hourly because a build
# from someone's branch must never be picked up by a developer who only meant to
# ride main; the two are different levels of "unvetted".
#
# From the Actions tab: pick this workflow, "Run workflow", leave "Use workflow
# from" on main, and type your branch in the first field. Or from the CLI:
#
#   gh workflow run adhoc-mac-build.yml --ref main -f ref=my-branch -f label=wasm-terminal
#
# Leaving the ref field empty builds whatever "Use workflow from" is set to, which
# is what someone who only touched that picker means. Naming the branch explicitly
# is still better: the workflow file is always read from the dispatch ref, so a
# branch carrying a stale copy of this file would otherwise run that copy.
#
# GITHUB_TOKEN is scoped to this repo and cannot publish there, so writes use the
# same GitHub App as hourly, additionally installed on orca-adhoc with
# Contents: Read and write. The secret names below are historical — one App, one
# private key, both dev-channel repos — and rotating it stays a single operation.
# Provision with `bash config/scripts/setup-hourly-release-token.sh`.
#
# The requested ref is vetted before checkout: it must be a branch or tag of this
# repo, or a commit reachable from one. PR refs are refused outright — this
# workflow runs the checked-out code next to MAC_CERTS and the notary password,
# so "just build that community PR" must not become a way to hand fork code the
# release identity. A branch here always belongs to someone with write access,
# which is the same trust the dispatch button itself already requires.

on:
  workflow_dispatch:
    inputs:
      ref:
        # Why optional: the Actions UI already shows its own "Use workflow from"
        # branch picker directly above this field, and picking a branch there is
        # what most people will read as "build this". Defaulting to that branch
        # makes the obvious action correct. Fill this in only to build a ref other
        # than the one the workflow file itself is read from — normally leave the
        # picker on main and name your branch here, so a stale copy of this
        # workflow on an old branch is not what runs.
        description: 'Branch, tag, or SHA to build — must live in stablyai/orca; PR refs are refused (default: the branch selected above)'
        required: false
        default: ''
        type: string
      label:
        description: 'Short name shown in the release title (default: the ref)'
        required: false
        default: ''
        type: string

permissions:
  contents: read

concurrency:
  # Why keyed on the ref rather than global: two people cutting builds from two
  # different branches at the same time is the ordinary case here, and serialising
  # them would make each wait out the other's notary queue. Re-dispatching the
  # *same* branch still queues, so a push mid-build cannot race itself.
  group: adhoc-mac-build-${{ inputs.ref || github.ref_name }}
  cancel-in-progress: false

env:
  ADHOC_REPO: stablyai/orca-adhoc
  # Why age and not a count like hourly: this channel is low-volume and bursty, so
  # a count would either hold one week's experiments forever or evict a build
  # someone is still running after a busy afternoon. A month is well past the "few
  # days" these exist for, and by then the branch has landed or been abandoned.
  ADHOC_RETAIN_DAYS: 30

jobs:
  # Why: every job below checks out its own copy, and a branch name read per job builds whatever
  # the branch points at when that job starts. A push mid-run then mixes commits, e.g. slot lanes
  # from one commit merged by a template step from the next. Resolving once pins the whole run.
  # The mac job still vets this commit's reachability before anything is signed.
  resolve-ref:
    if: github.repository == 'stablyai/orca'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      sha: ${{ steps.resolve.outputs.sha }}
    steps:
      - name: Resolve the requested ref to one commit
        id: resolve
        shell: bash
        env:
          REQUESTED_REF: ${{ inputs.ref || github.ref_name }}
          REPO_URL: https://github.com/${{ github.repository }}
        run: |
          set -euo pipefail
          case "$REQUESTED_REF" in
            refs/pull/*|pull/*)
              echo "::error::Refusing to build PR ref '$REQUESTED_REF'; push the code to a branch of stablyai/orca instead."
              exit 1
              ;;
          esac
          if [[ "$REQUESTED_REF" =~ ^[0-9a-f]{40}$ ]]; then
            sha="$REQUESTED_REF"
          else
            # Branch first, as the mac job's vet does; a peeled annotated tag names its commit.
            refs="$(git ls-remote "$REPO_URL" "refs/heads/$REQUESTED_REF" "refs/tags/$REQUESTED_REF" "refs/tags/$REQUESTED_REF^{}")"
            sha=""
            for name in "refs/heads/$REQUESTED_REF" "refs/tags/$REQUESTED_REF^{}" "refs/tags/$REQUESTED_REF"; do
              sha="$(awk -v ref="$name" '$2 == ref { print $1; exit }' <<<"$refs")"
              [[ -n "$sha" ]] && break
            done
          fi
          if [[ -z "$sha" ]]; then
            echo "::error::'$REQUESTED_REF' is not a branch, tag, or full commit SHA of stablyai/orca."
            exit 1
          fi
          echo "Resolved $REQUESTED_REF -> $sha"
          echo "sha=$sha" >>"$GITHUB_OUTPUT"

  # Why: a branch cut before the orcad template landed has none to build or ship.
  orcad-template-support:
    needs: resolve-ref
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      ships: ${{ steps.detect.outputs.ships }}
    steps:
      - name: Checkout the template packager only
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.resolve-ref.outputs.sha }}
          sparse-checkout: |
            /config/scripts/packaged-orcad-template.cjs
            /config/tsconfig.relay.json
          sparse-checkout-cone-mode: false
          persist-credentials: false
      # Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
      - name: Refuse a ref that still ships the SSH relay
        shell: bash
        run: |
          if [[ -e config/tsconfig.relay.json ]]; then
            echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
            exit 1
          fi
      - name: Detect whether the ref ships the orcad template
        id: detect
        shell: bash
        run: |
          if [[ -f config/scripts/packaged-orcad-template.cjs ]]; then
            echo "ships=true" >>"$GITHUB_OUTPUT"
          else
            echo "ships=false" >>"$GITHUB_OUTPUT"
            echo "::notice::This ref predates the orcad template; the build ships without it."
          fi

  # Design D2, as release-cut does: every desktop build ships the orcad template (server JS plus
  # every target's addons), merged from the node-server lanes that qualify each slot at this ref.
  # Without it an adhoc build cannot deploy managed orcad to an SSH host. No secrets, and the mac
  # job vets the ref before anything is signed.
  orcad-template:
    needs: [resolve-ref, orcad-template-support]
    if: needs.orcad-template-support.outputs.ships == 'true'
    permissions:
      contents: read
    uses: ./.github/workflows/node-server-tests.yml
    with:
      ref: ${{ needs.resolve-ref.outputs.sha }}
      build_template: true

  build-adhoc-mac:
    needs: [resolve-ref, orcad-template-support, orcad-template]
    # Why not the implicit success(): a ref without the orcad template skips that job on purpose.
    if: >-
      !cancelled() && github.repository == 'stablyai/orca' &&
      needs.orcad-template-support.result == 'success' &&
      (needs.orcad-template.result == 'success' ||
        (needs.orcad-template.result == 'skipped' &&
          needs.orcad-template-support.outputs.ships == 'false'))
    # Why an environment: it gives the signing/notary/App secrets somewhere to
    # live that a stale copy of this workflow on an old branch cannot reach.
    # Referencing it is a no-op until repo settings give it teeth; the intended
    # follow-up is to move MAC_CERTS, MAC_CERTS_PASSWORD, APPLE_ID,
    # APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID, HOURLY_RELEASE_APP_ID, and
    # HOURLY_RELEASE_APP_PRIVATE_KEY into it, then pin its deployment branch
    # policy to main so only main's copy of this file can read them.
    environment: adhoc-mac-build
    outputs:
      tag: ${{ steps.release.outputs.tag }}
      version: ${{ steps.adhoc.outputs.version }}
      head_sha: ${{ steps.adhoc.outputs.head_sha }}
      published: ${{ steps.publish_live.outcome == 'success' && 'true' || 'false' }}
      ships_orcad_template: ${{ needs.orcad-template-support.outputs.ships }}
    runs-on: blacksmith-6vcpu-macos-15
    # Why 150: it must exceed the worst case the retry budgets below can produce
    # (install 3x10 + publish 2x45 = 120, plus ~25 for checkout/build/verify), or
    # the job is killed mid-retry and no cleanup step runs at all.
    timeout-minutes: 150
    env:
      NODE_OPTIONS: --max-old-space-size=4096
    steps:
      # Why vet before checkout: everything after this step runs the checked-out
      # code with release signing credentials in reach. Branches and tags of this
      # repo are the intended audience; refs/pull/* would smuggle in fork code,
      # and a raw SHA is only accepted when some branch or tag of this repo can
      # actually reach it. Resolving to a pinned SHA here also means the commit
      # that was vetted is the commit that gets checked out — a push to the
      # branch between the two steps cannot swap it.
      - name: Vet the requested ref
        id: vetted
        shell: bash
        env:
          # The commit resolve-ref pinned for every job; vetting it keeps the reachability test.
          REQUESTED_REF: ${{ needs.resolve-ref.outputs.sha }}
          REPO_URL: https://github.com/${{ github.repository }}
        run: |
          set -euo pipefail
          case "$REQUESTED_REF" in
            refs/pull/*|pull/*)
              echo "::error::Refusing to build PR ref '$REQUESTED_REF': this workflow signs with release credentials, so it only builds branches, tags, or commits of stablyai/orca. Push the code to a branch of this repo instead."
              exit 1
              ;;
          esac
          # Bare: a work-tree repo refuses to fetch over its own checked-out
          # branch. tree:0 keeps the fetch to the commit graph — no trees, no
          # blobs — so this stays cheap next to the build it fronts. reftable
          # because this repo has branches that differ only in casing, and the
          # files backend cannot store both on a case-insensitive runner disk —
          # it fails the entire fetch, not just the one ref.
          scratch="$RUNNER_TEMP/vet-requested-ref"
          git init -q --bare --ref-format=reftable "$scratch"
          git -C "$scratch" fetch -q --filter=tree:0 "$REPO_URL" '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'
          # Branch first to keep actions/checkout's old tie-break: bare
          # rev-parse would prefer the tag when a branch shares its name.
          sha=""
          for cand in "refs/heads/$REQUESTED_REF" "refs/tags/$REQUESTED_REF" "$REQUESTED_REF"; do
            if sha="$(git -C "$scratch" rev-parse --verify --quiet "$cand^{commit}")"; then
              break
            fi
            sha=""
          done
          if [[ -z "$sha" ]]; then
            echo "::error::'$REQUESTED_REF' does not resolve to a branch, tag, or commit of stablyai/orca."
            exit 1
          fi
          # The object resolving locally is not proof a branch or tag reaches
          # it: a partial clone can lazily fetch a bare SHA on demand, and
          # GitHub serves PR-only commits by SHA. Reachability is the actual
          # trust test.
          if [[ -z "$(git -C "$scratch" for-each-ref --contains "$sha" refs/heads refs/tags | head -1)" ]]; then
            echo "::error::Commit $REQUESTED_REF is not reachable from any branch or tag of stablyai/orca; refusing to build it with release credentials."
            exit 1
          fi
          echo "Vetted $REQUESTED_REF -> $sha"
          echo "sha=$sha" >>"$GITHUB_OUTPUT"

      - name: Checkout the requested ref
        uses: actions/checkout@v6
        with:
          # Why an input at all rather than just github.ref: the whole point is to
          # build code that has not landed, and the workflow definition itself
          # always comes from the dispatch ref — naming the branch here instead
          # applies main's current copy of this file to an arbitrary branch.
          ref: ${{ steps.vetted.outputs.sha }}
          # Version helpers only read HEAD; published versions come from the release API.
          fetch-depth: 1
          # This job only reads stablyai/orca and never pushes; every write goes
          # to the adhoc repo through a minted App token passed by env. Not
          # persisting the checkout credential shrinks the blast radius if a build
          # step is compromised (zizmor: artipacked).
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/setup@v2
        with:
          install: false

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json
          cache: pnpm
          cache-dependency-path: |
            pnpm-lock.yaml
            mobile/pnpm-lock.yaml

      # Why: packaging bundles the pinned Node into the macOS terminal host. Keyed on the pin alone
      # with no restore-keys, so a pin bump starts empty instead of carrying old archives forward.
      - name: Locate the pinned Node runtime cache
        shell: bash
        run: echo "ORCA_NODE_RUNTIME_CACHE_DIR=$HOME/Library/Caches/orca-node-runtime" >>"$GITHUB_ENV"

      - name: Cache the pinned Node runtime
        uses: actions/cache@v5
        with:
          path: ~/Library/Caches/orca-node-runtime
          key: orca-node-runtime-mac-${{ hashFiles('src/shared/node-runtime-pin.ts') }}

      - name: Cache electron-builder downloads
        uses: actions/cache@v5
        with:
          path: |
            ~/Library/Caches/electron
            ~/Library/Caches/electron-builder
          key: electron-builder-mac-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            electron-builder-mac-

      # Why both CPUs: the mac config packages x64 and arm64 from this arm64
      # runner, so the install must carry both variants of the native optional deps.
      - name: Install dependencies
        uses: nick-fields/retry@v4
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: pnpm install --frozen-lockfile --cpu=current,x64,arm64

      # Why here: electron-builder's beforePack requires out/mobile-web, and the bundle
      # build resolves React Native and Expo from mobile/node_modules.
      - uses: ./.github/actions/install-mobile-dependencies

      # Why: signing is what makes an adhoc build installable over an existing
      # Orca, so a missing cert must fail here rather than after a 20-minute build.
      - name: Verify macOS signing environment
        run: node config/scripts/verify-macos-release-env.mjs
        env:
          CSC_LINK: ${{ secrets.MAC_CERTS }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Compute adhoc version
        id: adhoc
        shell: bash
        env:
          REF: ${{ inputs.ref || github.ref_name }}
          LABEL: ${{ inputs.label }}
          MAIN_REPO_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          # Why this check: the version scripts are read from the branch being built,
          # not from main, so a branch cut before the adhoc channel landed has no
          # copy of them. Say that plainly instead of failing with a module-not-found.
          for script in adhoc-build-version dev-channel-base-version; do
            if [[ ! -f "config/scripts/$script.mjs" ]]; then
              echo "::error::$REF has no config/scripts/$script.mjs; rebase it onto a main that has the adhoc channel."
              exit 1
            fi
          done
          echo "head_sha=$(git rev-parse HEAD)" >>"$GITHUB_OUTPUT"
          # Why git tags, not GitHub releases: unpublishing a buggy cut deletes the
          # GitHub release and leaves the tag, which still owns that number.
          # Releases-only let adhoc sit on a number already taken, so the updater
          # would not install it. Empty on failure — the script then falls back
          # to package.json.
          published="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh api \
            "repos/$GITHUB_REPOSITORY/git/matching-refs/tags/v" \
            --jq '.[].ref | sub("^refs/tags/"; "")' || true)"
          ORCA_PUBLISHED_VERSIONS="$published" ORCA_ADHOC_LABEL="${LABEL:-$REF}" \
            node config/scripts/adhoc-build-version.mjs \
            >"$RUNNER_TEMP/adhoc-identity.txt"
          if ! grep -q '^name=' "$RUNNER_TEMP/adhoc-identity.txt"; then
            echo "::error::adhoc-build-version.mjs emitted no release name; $REF's copy of the script is out of sync with this workflow."
            exit 1
          fi
          cat "$RUNNER_TEMP/adhoc-identity.txt" >>"$GITHUB_OUTPUT"

      - name: Build app
        run: pnpm build:release
        env:
          NODE_OPTIONS: --max-old-space-size=4096
          # Why: adhoc builds are not an official channel — telemetry's transport
          # gate accepts only 'stable' or 'rc', so leaving this unset keeps them
          # silent, which is correct for unvetted branch artifacts.
          ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token

      # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
      - name: Download the orcad deployment template
        if: needs.orcad-template-support.outputs.ships == 'true'
        uses: actions/download-artifact@v8
        with:
          name: orcad-template
          path: out/orcad-template

      # Why the token is minted here and not at the top: installation tokens live
      # one hour, everything before this point writes nothing, and the notary round
      # trip inside the publish step can be tens of minutes. Minting after the build
      # starts the clock at the first call that actually uses it.
      - name: Mint adhoc repo token
        id: app_token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HOURLY_RELEASE_APP_ID }}
          private-key: ${{ secrets.HOURLY_RELEASE_APP_PRIVATE_KEY }}
          owner: stablyai
          repositories: orca-adhoc

      - name: Create adhoc release
        id: release
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
          TAG: v${{ steps.adhoc.outputs.version }}
          NAME: ${{ steps.adhoc.outputs.name }}
          SHA: ${{ steps.adhoc.outputs.head_sha }}
          REF: ${{ inputs.ref || github.ref_name }}
          # Via env, not inline `${{ }}`: both land inside a shell string, and an
          # expression expanded there is substituted before bash parses the line
          # (zizmor: template-injection).
          ACTOR: ${{ github.actor }}
        run: |
          set -euo pipefail
          short_sha="${SHA:0:12}"
          # Why create it up front: electron-builder then uploads into a known tag
          # rather than inferring one from package.json.
          #
          # Why --draft: everything between here and the manifest check is a window
          # where the release exists but has no installable assets. A draft is
          # absent from the releases list and from listReleaseBuilds, so a job that
          # dies in that window — including a hard kill by the job timeout, which
          # runs no cleanup step at all — leaves something invisible rather than a
          # tag the picker offers and the download 404s on.
          gh release create "$TAG" \
            --repo "$ADHOC_REPO" \
            --title "$NAME" \
            --draft \
            --notes "Adhoc macOS and Windows dev build of \`$REF\` at commit \`$short_sha\`.

          Built from [\`stablyai/orca@$short_sha\`](https://github.com/stablyai/orca/commit/$SHA), cut by @$ACTOR.

          **Unlanded and unvetted.** This is somebody's branch, not main. No tests
          ran. The macOS build is signed and notarized like a release, so it installs
          through Orca's in-app updater and opens without a Gatekeeper prompt — but the
          branch may never merge, and this build is deleted after $ADHOC_RETAIN_DAYS days.

          **Windows builds are unsigned.** They install and update normally once you
          are on one, but a signed Stable or RC build cannot install one through the
          in-app updater — download \`orca-windows-setup.exe\` below and run it once
          (SmartScreen will warn about an unknown publisher). Every later switch,
          including back to Stable, works in-app from there."
          echo "tag=$TAG" >>"$GITHUB_OUTPUT"

      - name: Publish adhoc macOS artifacts
        uses: nick-fields/retry@v4
        with:
          # Why 45: an attempt is pack + notarize + upload, and the notary queue is
          # the unbounded part. Two attempts, because a failed adhoc build has a
          # person waiting on it who can simply dispatch again.
          timeout_minutes: 45
          max_attempts: 2
          retry_wait_seconds: 30
          command: node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/pinned-node-downloads.mjs darwin-arm64 darwin-x64 && node config/scripts/ensure-native-runtime.mjs --runtime=electron && ORCA_MAC_ADHOC=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish always
        env:
          # Why: electron-builder's github publisher targets the repo named in the
          # config; the token must therefore carry write access to orca-adhoc.
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
          ORCA_ADHOC_BUILD_VERSION: ${{ steps.adhoc.outputs.version }}
          ORCA_BUILD_COMMIT: ${{ steps.adhoc.outputs.commit }}
          # beforePack and afterPack fail the package when the template is absent.
          ORCA_REQUIRE_ORCAD_TEMPLATE: ${{ needs.orcad-template-support.outputs.ships == 'true' && '1' || '' }}
          CSC_LINK: ${{ secrets.MAC_CERTS }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
          # Why all three: electron-builder's notarize step authenticates to the
          # Apple notary service with the app-specific password, not with the
          # signing cert. Omitting them fails the build rather than skipping it.
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      # Why: the updater resolves a tag, then fetches latest-mac.yml from it. A
      # release missing that manifest is a tag the picker offers and the download
      # 404s on, so fail loudly instead of leaving a broken entry.
      - name: Verify update manifest published
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          assets="$(gh release view "$TAG" --repo "$ADHOC_REPO" --json assets --jq '.assets[].name')"
          echo "Published assets:"
          echo "$assets"
          # Why exit 1 without deleting here: the release is still a draft, so it is
          # already invisible to users, and the failure handler below owns cleanup.
          for required in latest-mac.yml; do
            if ! grep -qx "$required" <<<"$assets"; then
              echo "::error::Adhoc draft $TAG is missing $required; the updater could not install it."
              exit 1
            fi
          done
          if ! grep -q '\.zip$' <<<"$assets"; then
            echo "::error::Adhoc draft $TAG has no ZIP artifact for the updater to download."
            exit 1
          fi

      # Why this is the last mutating step: publishing the draft is what makes the
      # build visible to listReleaseBuilds. Doing it only after the manifest check
      # means the picker can never offer a release whose assets are incomplete.
      - name: Publish the verified release
        id: publish_live
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
          TAG: ${{ steps.release.outputs.tag }}
          NAME: ${{ steps.adhoc.outputs.name }}
        run: |
          set -euo pipefail
          # --title again: electron-builder resolves this draft by tag and may
          # rewrite its title on upload. Re-asserting here means the name the
          # picker reads is the one composed above, whatever it did in between.
          gh release edit "$TAG" --repo "$ADHOC_REPO" --draft=false --prerelease --title "$NAME"
          echo "Published $TAG as \"$NAME\""

      # Why: a draft left behind by a failed publish is invisible to users but still
      # holds its tag name. Gated on publish_live not having succeeded so a later
      # failure (the prune step) cannot delete a release that already went live and
      # that people may already be installing. Why cancelled() too: a run stopped
      # from the Actions UI is not a failure(), so without it a manual cancel
      # mid-publish would strand the draft.
      - name: Discard the draft release on failure
        if: >-
          (failure() || cancelled()) && steps.release.outputs.tag != '' &&
          steps.publish_live.outcome != 'success'
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -uo pipefail
          # No --cleanup-tag: an unpublished draft never created a git tag.
          echo "Run failed before publish; discarding draft $TAG"
          gh release delete "$TAG" --repo "$ADHOC_REPO" --yes ||
            echo "::warning::Could not discard draft $TAG; remove it manually."

      - name: Prune expired adhoc releases
        # Only after a live publish: $TAG is then a non-draft this step must not
        # delete, and a run that failed before publishing has nothing to retire.
        if: steps.publish_live.outcome == 'success'
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
          # Protect the tag this run just shipped, so no filter mistake can delete
          # a build minutes after the person who cut it was told it exists.
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          # Why compute the cutoff in bash rather than with jq's `now`: this runs
          # once per dispatch, and a fixed epoch makes the threshold visible in the
          # log when someone asks where their build went.
          cutoff=$(( $(date -u +%s) - ADHOC_RETAIN_DAYS * 86400 ))
          echo "Pruning adhoc releases published before $(date -u -r "$cutoff" '+%Y-%m-%dT%H:%M:%SZ')"
          # --cleanup-tag so pruning does not leave orphan tags with no release or
          # assets attached. Drafts are excluded: a stale draft is the failure
          # path's business, not the retention window's.
          #
          # Age comes from publishedAt, never createdAt. GitHub reports createdAt
          # as the date of the *commit* a release's tag points at, and every tag
          # here is cut from this repo's one seed commit — so all of them carry
          # that same createdAt, and the day the window rolled past it the entire
          # channel expired at once and a single run deleted it. A release with no
          # publishedAt is kept rather than aged by guesswork.
          jq_filter='map(select(.isDraft | not))'
          if [[ -n "${TAG:-}" ]]; then
            jq_filter+=" | map(select(.tagName != \"${TAG//\"/\\\"}\"))"
          fi
          jq_filter+=" | map(select((.publishedAt // \"\") != \"\"))"
          jq_filter+=" | map(select((.publishedAt | fromdateiso8601) < $cutoff)) | .[].tagName"
          stale="$(gh release list --repo "$ADHOC_REPO" --limit 200 --json tagName,publishedAt,isDraft \
            --jq "$jq_filter")"
          if [[ -z "$stale" ]]; then
            echo "Nothing to prune."
            exit 0
          fi
          while read -r tag; do
            [[ -n "$tag" ]] || continue
            # Belt-and-suspenders: the filter above should already exclude $TAG.
            if [[ -n "${TAG:-}" && "$tag" == "$TAG" ]]; then
              echo "::warning::Prune list still included just-published $tag after protect; skipping delete."
              continue
            fi
            echo "Pruning $tag"
            gh release delete "$tag" --repo "$ADHOC_REPO" --yes --cleanup-tag || \
              echo "::warning::Could not prune $tag"
          done <<<"$stale"

  # Why this runs after the mac leg rather than beside it: the tag and version
  # are computed inside that job, so until it has run nothing else can name the
  # release to upload into. The cost is small enough not to matter — the Windows
  # leg measures ~7.5 min (install 2m45, build 35s, NSIS package 3m) against a
  # ~9.5 min mac run, which keeps a adhoc run far inside its interval.
  #
  # Why `./` rather than a pinned `@main`: `uses:` resolves against the ref this
  # file itself came from, which for an ordinary dispatch is main. Someone who
  # deliberately points the Actions "Use workflow from" picker at a branch
  # already gets that branch's copy of this entire file, so this follows the same
  # rule instead of inventing a second one.
  build-adhoc-win:
    needs: build-adhoc-mac
    # Only once the mac release is actually live: there is no release to upload
    # into otherwise, and the Windows workflow refuses to create one.
    if: needs.build-adhoc-mac.outputs.published == 'true'
    uses: ./.github/workflows/dev-channel-win-build.yml
    secrets: inherit
    with:
      channel: adhoc
      tag: ${{ needs.build-adhoc-mac.outputs.tag }}
      ref: ${{ needs.build-adhoc-mac.outputs.head_sha }}
      version: ${{ needs.build-adhoc-mac.outputs.version }}
      orcad_template: ${{ needs.build-adhoc-mac.outputs.ships_orcad_template == 'true' }}