e2e.yml

name: Candidate E2E

on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: candidate-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE_REPOSITORY: ghcr.io/squarewavesystems/squarebox

jobs:
  candidate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    outputs:
      digest: ${{ steps.build.outputs.digest }}
      image: ${{ steps.meta.outputs.image }}
      version: ${{ steps.meta.outputs.version }}
      prerelease: ${{ steps.meta.outputs.prerelease }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Validate Candidate identity
        id: meta
        run: |
          set -euo pipefail
          if [ "$GITHUB_REF_TYPE" = tag ]; then
            version="$GITHUB_REF_NAME"
          else
            version="v0.0.0-dev.${GITHUB_RUN_NUMBER}"
          fi
          identity=$(scripts/release-identity.sh inspect "$version")
          {
            echo "version=$version"
            echo "prerelease=$(jq -r .prerelease <<<"$identity")"
            echo "image=$IMAGE_REPOSITORY"
          } >> "$GITHUB_OUTPUT"

      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push immutable multi-architecture Candidate
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ env.IMAGE_REPOSITORY }}:candidate-${{ github.sha }}
          build-args: |
            SQUAREBOX_VERSION=${{ steps.meta.outputs.version }}
          provenance: mode=max
          sbom: true
          cache-from: |
            type=gha
            type=gha,scope=arm64
          cache-to: type=gha,mode=max

      - name: Generate Candidate identity and build Evidence
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
          VERSION: ${{ steps.meta.outputs.version }}
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          scripts/release-identity.sh create release.json "$VERSION" "$GITHUB_SHA" \
            "$IMAGE_REPOSITORY" "$DIGEST"
          scripts/release-identity.sh verify release.json
          scripts/e2e-evidence.sh pass build.amd64 "Candidate image builds for amd64"
          scripts/e2e-evidence.sh pass build.arm64 "Candidate image builds for arm64"
          scripts/e2e-evidence.sh pass release.identity "Candidate source and image digest share one validated identity"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: candidate-identity
          path: release.json
          retention-days: 14

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: evidence-candidate
          path: evidence
          retention-days: 14

  module-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Verified artifact and updater module tests
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          set -euo pipefail
          tests/test-tool-lib.sh
          scripts/e2e-evidence.sh pass artifact.fail-closed \
            "A rejected artifact cannot reach its destination"
          tests/test-tool-updater.sh
          scripts/e2e-evidence.sh pass update.installed-only \
            "Bulk update excludes absent optional tools"
          scripts/e2e-evidence.sh pass update.single \
            "A named tool update follows named-tool semantics"
          scripts/e2e-evidence.sh pass update.failure \
            "Updater failures produce a nonzero aggregate result"
          tests/test-tool-update-versions.sh

      - name: Install identity and lifecycle adapter tests
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          set -euo pipefail
          tests/test-lifecycle-install-state.sh
          tests/test-lifecycle-release-identity.sh
          tests/test-lifecycle-ownership.sh
          tests/test-lifecycle-static.sh
          tests/test-lifecycle-powershell.sh
          scripts/e2e-evidence.sh pass lifecycle.install-state \
            "Lifecycle state, release identity, ownership, and static contracts pass isolated fixtures"

      - name: Provisioning, release, and Evidence module tests
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          set -euo pipefail
          tests/test-provision-contract.sh
          tests/test-provision-dotfiles.sh
          tests/test-provision-install-failures.sh
          tests/test-provision-state.sh
          tests/test-release-identity.sh
          tests/test-repository-consistency.sh
          tests/test-e2e-evidence.sh
          tests/test-devcontainer-postcreate.sh
          scripts/e2e-evidence.sh pass devcontainer.postcreate-noninteractive \
            "Dev Container post-create defaults reconcile without prompts even when the orchestrator allocates a pseudo-TTY"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: evidence-modules
          path: evidence
          if-no-files-found: warn
          retention-days: 14

  security-scan:
    needs: candidate
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Scan Candidate linux/${{ matrix.arch }} for fixable critical vulnerabilities
        id: trivy
        continue-on-error: true
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        env:
          TRIVY_PLATFORM: linux/${{ matrix.arch }}
        with:
          image-ref: ${{ needs.candidate.outputs.image }}@${{ needs.candidate.outputs.digest }}
          format: table
          severity: CRITICAL
          ignore-unfixed: true
          exit-code: '1'

      - name: Record scan Evidence
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
          SCAN_OUTCOME: ${{ steps.trivy.outcome }}
          ARCH: ${{ matrix.arch }}
        run: |
          case "$ARCH" in
            amd64) evidence_id=security.scan.amd64 ;;
            arm64) evidence_id=security.scan.arm64 ;;
            *) echo "Unsupported scan architecture: $ARCH" >&2; exit 64 ;;
          esac
          description="Candidate linux/$ARCH has no fixable critical vulnerabilities"
          if [ "$SCAN_OUTCOME" = success ]; then
            scripts/e2e-evidence.sh pass "$evidence_id" "$description"
          else
            scripts/e2e-evidence.sh fail "$evidence_id" "$description" \
              "Trivy reported a fixable critical vulnerability for linux/$ARCH"
          fi

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: evidence-security-${{ matrix.arch }}
          path: evidence
          retention-days: 14

      - name: Enforce scan result
        env:
          SCAN_OUTCOME: ${{ steps.trivy.outcome }}
        run: test "$SCAN_OUTCOME" = success

  image-e2e:
    needs: candidate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull exact amd64 Candidate
        env:
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
        run: |
          docker pull --platform linux/amd64 "$IMAGE@$DIGEST"
          docker tag "$IMAGE@$DIGEST" squarebox:test

      - name: Tool and interactive-shell assertions
        run: |
          mkdir -p evidence
          chmod 0777 evidence
          for suite in tools shell; do
            docker run --rm \
              -e SQUAREBOX_EVIDENCE_DIR=/evidence \
              -v "$PWD/evidence:/evidence" \
              -v "$PWD/scripts:/workspace/scripts:ro" \
              squarebox:test bash -c "scripts/e2e-test.sh $suite"
          done

      - name: Setup, updater, rerun, and dotfile assertions
        run: |
          set -euo pipefail
          mkdir -p setup-state
          chmod 0777 setup-state evidence
          runtime_caps=(
            --cap-drop=ALL --cap-add=CHOWN --cap-add=DAC_OVERRIDE
            --cap-add=FOWNER --cap-add=SETUID --cap-add=SETGID --cap-add=KILL
          )
          docker run --rm \
            "${runtime_caps[@]}" \
            -e SQUAREBOX_EVIDENCE_DIR=/evidence \
            -v "$PWD/evidence:/evidence" \
            -v "$PWD/scripts:/workspace/scripts:ro" \
            -v "$PWD/setup-state:/workspace/.squarebox" \
            squarebox:test bash -c 'scripts/e2e-test.sh setup'
          docker run --rm \
            "${runtime_caps[@]}" \
            -e SQUAREBOX_EVIDENCE_DIR=/evidence \
            -v "$PWD/evidence:/evidence" \
            -v "$PWD/scripts:/workspace/scripts:ro" \
            -v /etc/localtime:/etc/localtime:ro \
            squarebox:test bash -c 'scripts/e2e-test.sh setup-editors'
          for suite in update setup-rerun dotfiles; do
            docker run --rm \
              "${runtime_caps[@]}" \
              -e SQUAREBOX_EVIDENCE_DIR=/evidence \
              -v "$PWD/evidence:/evidence" \
              -v "$PWD/scripts:/workspace/scripts:ro" \
              squarebox:test bash -c "scripts/e2e-test.sh $suite"
          done
          scripts/e2e-evidence.sh pass setup.rerun \
            "The setup wrapper validates input and a noninteractive Git-section rerun succeeds"
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence

      - name: Dev Container state assertions
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          scripts/e2e-test.sh devcontainer
          scripts/e2e-evidence.sh pass devcontainer.state \
            "Dev Container configuration aligns Workspace state under /workspace and declares an isolated rebuild-stable Managed-home volume"

      - name: Non-default identity handles read-only Managed-home binds
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          scripts/test-nondefault-id.sh squarebox:test
          scripts/e2e-evidence.sh pass lifecycle.nondefault-id \
            "A non-default Docker identity starts twice with its lifecycle-managed Bash profile mounted read-only under a writable Managed home"

      - name: Real stop/start and replacement reconciliation
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          set -euo pipefail
          home_volume="sqrbx-e2e-home-${GITHUB_RUN_ID}"
          workspace_volume="sqrbx-e2e-workspace-${GITHUB_RUN_ID}"
          box="sqrbx-e2e-${GITHUB_RUN_ID}"
          cleanup() {
            docker rm -f "$box" >/dev/null 2>&1 || true
            docker volume rm "$home_volume" "$workspace_volume" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT
          runtime_caps=(
            --cap-drop=ALL --cap-add=CHOWN --cap-add=DAC_OVERRIDE
            --cap-add=FOWNER --cap-add=SETUID --cap-add=SETGID --cap-add=KILL
          )
          wait_for_box_ready() {
            local _
            for _ in {1..60}; do
              if docker exec "$box" sh -c 'test "$(cat /proc/1/comm)" = sleep'; then
                return 0
              fi
              sleep 1
            done
            docker logs "$box" >&2
            return 1
          }
          docker volume create "$home_volume" >/dev/null
          docker volume create "$workspace_volume" >/dev/null
          docker run -d --name "$box" \
            "${runtime_caps[@]}" \
            -v "$home_volume:/home/dev" \
            -v "$workspace_volume:/workspace" \
            -v /etc/localtime:/etc/localtime:ro \
            squarebox:test sleep infinity
          wait_for_box_ready
          docker exec -u dev "$box" bash -c '
            mkdir -p /workspace/.squarebox
            printf "tmux\n" > /workspace/.squarebox/multiplexer
            /usr/local/lib/squarebox/setup.sh --reconcile-box
            command -v tmux >/dev/null
            printf "restart-ok\n" > ~/.squarebox-e2e-state
          '
          docker stop "$box" >/dev/null
          docker start "$box" >/dev/null
          wait_for_box_ready
          docker exec -u dev "$box" bash -c \
            'grep -qx restart-ok ~/.squarebox-e2e-state && command -v tmux >/dev/null'
          scripts/e2e-evidence.sh pass lifecycle.restart \
            "A stopped Box restarts with persisted Managed-home state and tmux availability"

          docker rm -f "$box" >/dev/null
          docker run -d --name "$box" \
            "${runtime_caps[@]}" \
            -v "$home_volume:/home/dev" \
            -v "$workspace_volume:/workspace" \
            -v /etc/localtime:/etc/localtime:ro \
            squarebox:test sleep infinity
          wait_for_box_ready
          docker exec -u dev "$box" bash -c \
            'grep -qx restart-ok ~/.squarebox-e2e-state && command -v tmux >/dev/null'
          scripts/e2e-evidence.sh pass lifecycle.recreate \
            "A saved tmux Selection is reconciled after Box replacement"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: evidence-image
          path: evidence
          if-no-files-found: warn
          retention-days: 14

  arm64-smoke:
    needs: candidate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Run exact Candidate under arm64 emulation
        env:
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          docker pull --platform linux/arm64 "$IMAGE@$DIGEST"
          docker run --rm --platform linux/arm64 \
            -v "$PWD/scripts:/workspace/scripts:ro" \
            "$IMAGE@$DIGEST" bash -c '
            test "$(uname -m)" = aarch64
            scripts/e2e-test.sh tools
          '
          scripts/e2e-evidence.sh pass image.arm64-smoke \
            "The exact Candidate starts and exposes pinned tools on arm64"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: evidence-arm64
          path: evidence
          if-no-files-found: warn
          retention-days: 14

  compose-lifecycle:
    needs: candidate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Recreate Compose Box from exact Candidate
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
          SQUAREBOX_IMAGE_REF: ${{ needs.candidate.outputs.image }}@${{ needs.candidate.outputs.digest }}
          SQUAREBOX_CONTAINER_NAME: sqrbx-compose-${{ github.run_id }}
          SQUAREBOX_HOME_VOLUME: sqrbx-compose-home-${{ github.run_id }}
          SQUAREBOX_INSTALL_ID: compose-ci-${{ github.run_id }}
        run: |
          set -euo pipefail
          export PUID PGID
          PUID=$(id -u)
          PGID=$(id -g)
          SQUAREBOX_WORKSPACE=$(mktemp -d)
          export SQUAREBOX_WORKSPACE
          cleanup() { docker compose down -v --remove-orphans >/dev/null 2>&1 || true; }
          wait_for_compose_workspace() {
            local _
            for _ in {1..30}; do
              if docker compose exec -T -u "$PUID:$PGID" squarebox sh -c \
                'test "$(stat -c %u /proc/1)" = "$1" && test -w /workspace' _ "$PUID"; then
                return 0
              fi
              sleep 1
            done
            docker compose logs squarebox >&2
            return 1
          }
          trap cleanup EXIT
          docker compose config >/dev/null
          docker compose up -d
          wait_for_compose_workspace
          original_box=$(docker compose ps -q squarebox)
          test -n "$original_box"
          test "$(docker inspect --format '{{.Config.Image}}' "$original_box")" = "$SQUAREBOX_IMAGE_REF"
          docker compose exec -T -u dev squarebox bash -c '
            printf "compose-ok\n" > ~/.squarebox-compose-e2e
            touch /workspace/from-compose
          '
          test -f "$SQUAREBOX_WORKSPACE/from-compose"

          docker compose up -d --force-recreate --no-deps squarebox
          wait_for_compose_workspace
          replacement_box=$(docker compose ps -q squarebox)
          test -n "$replacement_box"
          test "$replacement_box" != "$original_box"
          test "$(docker inspect --format '{{.Config.Image}}' "$replacement_box")" = "$SQUAREBOX_IMAGE_REF"
          docker compose exec -T -u dev squarebox bash -c \
            'grep -qx compose-ok ~/.squarebox-compose-e2e && test -f /workspace/from-compose'
          test "$(docker volume inspect --format '{{ index .Labels "io.squarebox.install-id" }}' "$SQUAREBOX_HOME_VOLUME")" = "$SQUAREBOX_INSTALL_ID"
          test "$(docker inspect --format '{{ index .Config.Labels "io.squarebox.install-id" }}' "$replacement_box")" = "$SQUAREBOX_INSTALL_ID"
          test "$(stat -c %u "$SQUAREBOX_WORKSPACE/from-compose")" = "$PUID"
          scripts/e2e-evidence.sh pass compose.lifecycle \
            "Compose force-recreates the exact Candidate while Managed home and Workspace state persist"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: evidence-compose
          path: evidence
          if-no-files-found: warn
          retention-days: 14

  rootless-podman:
    needs: candidate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Podman
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends podman uidmap slirp4netns fuse-overlayfs
      - name: Rootless keep-id dev mapping, provisioning, and persistence
        env:
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: |
          set -euo pipefail
          printf '%s' "$GH_TOKEN" | podman login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
          podman pull "$IMAGE@$DIGEST"
          workspace=$(mktemp -d)
          home_volume="sqrbx-podman-home-${GITHUB_RUN_ID}"
          box="sqrbx-podman-${GITHUB_RUN_ID}"
          cleanup() {
            podman rm -f "$box" >/dev/null 2>&1 || true
            podman volume rm "$home_volume" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT
          podman volume create "$home_volume" >/dev/null
          podman run -d --name "$box" \
            --userns=keep-id:uid=1000,gid=1000 \
            --security-opt label=disable \
            --cap-drop=ALL --cap-add=CHOWN --cap-add=DAC_OVERRIDE \
            --cap-add=FOWNER --cap-add=SETUID --cap-add=SETGID --cap-add=KILL \
            -e PUID="$(id -u)" -e PGID="$(id -g)" \
            -v "$workspace:/workspace" -v "$home_volume:/home/dev" \
            "$IMAGE@$DIGEST" sleep infinity
          podman exec -u dev -e HOME=/home/dev "$box" bash -c '
            test "$(id -u)" = 1000
            test "$(id -u dev)" = 1000
            mkdir -p /workspace/.squarebox
            printf "tmux\n" > /workspace/.squarebox/multiplexer
            /usr/local/lib/squarebox/setup.sh --reconcile-box
            command -v tmux >/dev/null
            printf "podman-ok\n" > /workspace/from-box
            printf "home-ok\n" > ~/.squarebox-podman-e2e
          '
          grep -qx podman-ok "$workspace/from-box"
          test "$(stat -c %u "$workspace/from-box")" = "$(id -u)"
          podman stop "$box" >/dev/null
          podman start "$box" >/dev/null
          podman exec -u dev -e HOME=/home/dev "$box" bash -c \
            'grep -qx home-ok ~/.squarebox-podman-e2e && command -v tmux >/dev/null'
          scripts/e2e-evidence.sh pass podman.rootless \
            "Rootless Podman maps the host user to dev, provisions Box-tier tools, and preserves Workspace and Managed-home state"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: evidence-podman
          path: evidence
          if-no-files-found: warn
          retention-days: 14

  powershell-static:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Parse every PowerShell adapter
        shell: pwsh
        run: |
          $failed = $false
          Get-ChildItem -Recurse -Filter *.ps1 | ForEach-Object {
            $tokens = $null
            $errors = $null
            [void][System.Management.Automation.Language.Parser]::ParseFile(
              $_.FullName, [ref]$tokens, [ref]$errors
            )
            if ($errors.Count -gt 0) {
              $errors | ForEach-Object { Write-Error $_ }
              $failed = $true
            }
          }
          if ($failed) { exit 1 }
      - name: Run native PowerShell lifecycle safety fixtures
        shell: pwsh
        run: ./tests/test-lifecycle-powershell.ps1
      - name: Record PowerShell Evidence
        shell: bash
        env:
          SQUAREBOX_EVIDENCE_DIR: evidence
        run: scripts/e2e-evidence.sh pass powershell.lifecycle "PowerShell lifecycle adapters parse and pass executable safety fixtures natively on Windows"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: evidence-powershell
          path: evidence
          if-no-files-found: warn
          retention-days: 14

  report:
    needs: [candidate, module-tests, security-scan, image-e2e, arm64-smoke, compose-lifecycle, rootless-podman, powershell-static]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: evidence-*
          path: evidence
          merge-multiple: true
      - name: Generate assertion-backed report
        run: scripts/e2e-report.sh evidence > e2e-report.md
      - name: Display report
        if: always()
        run: cat e2e-report.md
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: e2e-evidence-report
          path: e2e-report.md
          retention-days: 90

  prepare-release:
    needs: [candidate, module-tests, security-scan, image-e2e, arm64-smoke, compose-lifecycle, rootless-podman, powershell-static, report]
    if: ${{ success() && startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: candidate-identity
          path: release-assets
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: e2e-evidence-report
          path: release-assets
      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Verify exact Candidate identity and architecture content
        env:
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
        run: |
          set -euo pipefail
          verify_remote_tag_commit() {
            local tag_ref remote_refs direct_count peeled_count tag_commit
            tag_ref="refs/tags/$GITHUB_REF_NAME"
            remote_refs=$(git ls-remote origin "$tag_ref" "${tag_ref}^{}")
            direct_count=$(awk -v ref="$tag_ref" '$2 == ref { count++ } END { print count + 0 }' <<<"$remote_refs")
            peeled_count=$(awk -v ref="${tag_ref}^{}" '$2 == ref { count++ } END { print count + 0 }' <<<"$remote_refs")
            if [ "$direct_count" -ne 1 ] || [ "$peeled_count" -gt 1 ]; then
              echo "Release tag did not resolve to one remote Git object: $GITHUB_REF_NAME" >&2
              return 1
            fi
            tag_commit=$(awk -v direct="$tag_ref" -v peeled="${tag_ref}^{}" '
              $2 == direct { direct_sha = $1 }
              $2 == peeled { peeled_sha = $1 }
              END { print peeled_sha != "" ? peeled_sha : direct_sha }
            ' <<<"$remote_refs")
            test "$tag_commit" = "$GITHUB_SHA" || {
              echo "Release tag no longer resolves to Candidate source $GITHUB_SHA" >&2
              return 1
            }
          }
          verify_remote_tag_commit
          scripts/release-identity.sh verify release-assets/release.json
          test "$(jq -r .version release-assets/release.json)" = "$GITHUB_REF_NAME"
          test "$(jq -r .source_sha release-assets/release.json)" = "$GITHUB_SHA"
          test "$(jq -r .image_repository release-assets/release.json)" = "$IMAGE"
          test "$(jq -r .image_digest release-assets/release.json)" = "$DIGEST"

          for platform in linux/amd64 linux/arm64; do
            docker pull --platform "$platform" "$IMAGE@$DIGEST"
            docker run --rm --platform "$platform" "$IMAGE@$DIGEST" \
              grep -qx "$GITHUB_REF_NAME" /usr/local/lib/squarebox/VERSION
            # Docker's classic image store cannot associate two platform
            # members with the same manifest-list digest at once.
            docker image rm "$IMAGE@$DIGEST" >/dev/null
          done

      - name: Create, sign, and verify digest-bound release assets
        env:
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
        run: |
          set -euo pipefail
          mkdir -p prepared-release
          cp install.sh install.ps1 uninstall.sh uninstall.ps1 \
            scripts/e2e-required.tsv release-assets/release.json \
            release-assets/e2e-report.md prepared-release/

          report_sha=$(sha256sum prepared-release/e2e-report.md | awk '{print $1}')
          required_sha=$(sha256sum prepared-release/e2e-required.tsv | awk '{print $1}')
          jq -n \
            --argjson schema 1 \
            --arg version "$GITHUB_REF_NAME" \
            --arg source_sha "$GITHUB_SHA" \
            --arg image "$IMAGE" \
            --arg digest "$DIGEST" \
            --arg report_sha "$report_sha" \
            --arg required_sha "$required_sha" \
            '{
              schema: $schema,
              version: $version,
              source_sha: $source_sha,
              image_ref: ($image + "@" + $digest),
              evidence_report: "e2e-report.md",
              evidence_report_sha256: $report_sha,
              required_evidence: "e2e-required.tsv",
              required_evidence_sha256: $required_sha
            }' > prepared-release/evidence-manifest.json

          (
            cd prepared-release
            sha256sum e2e-report.md e2e-required.tsv evidence-manifest.json \
              install.ps1 install.sh release.json uninstall.ps1 uninstall.sh > SHA256SUMS
            sha256sum -c SHA256SUMS
          )
          cosign sign --yes "$IMAGE@$DIGEST"
          cosign sign-blob --yes \
            --bundle prepared-release/SHA256SUMS.sigstore.json \
            prepared-release/SHA256SUMS

          certificate_identity="https://github.com/${GITHUB_WORKFLOW_REF}"
          certificate_issuer="https://token.actions.githubusercontent.com"
          cosign verify \
            --certificate-identity "$certificate_identity" \
            --certificate-oidc-issuer "$certificate_issuer" \
            "$IMAGE@$DIGEST"
          cosign verify-blob \
            --bundle prepared-release/SHA256SUMS.sigstore.json \
            --certificate-identity "$certificate_identity" \
            --certificate-oidc-issuer "$certificate_issuer" \
            prepared-release/SHA256SUMS

          jq -e \
            --arg version "$GITHUB_REF_NAME" \
            --arg source_sha "$GITHUB_SHA" \
            --arg image_ref "$IMAGE@$DIGEST" \
            --arg report_sha "$report_sha" \
            --arg required_sha "$required_sha" \
            '.schema == 1 and .version == $version and
             .source_sha == $source_sha and .image_ref == $image_ref and
             .evidence_report_sha256 == $report_sha and
             .required_evidence_sha256 == $required_sha' \
            prepared-release/evidence-manifest.json >/dev/null

      - name: Create or reuse non-discoverable draft Release
        env:
          GH_TOKEN: ${{ github.token }}
          PRERELEASE: ${{ needs.candidate.outputs.prerelease }}
        run: |
          set -euo pipefail
          assets=(
            prepared-release/install.sh
            prepared-release/install.ps1
            prepared-release/uninstall.sh
            prepared-release/uninstall.ps1
            prepared-release/release.json
            prepared-release/e2e-report.md
            prepared-release/e2e-required.tsv
            prepared-release/evidence-manifest.json
            prepared-release/SHA256SUMS
            prepared-release/SHA256SUMS.sigstore.json
          )

          if release_json=$(gh release view "$GITHUB_REF_NAME" \
            --json isDraft,isPrerelease,name,tagName 2>/dev/null); then
            jq -e \
              --arg tag "$GITHUB_REF_NAME" \
              --argjson prerelease "$PRERELEASE" \
              '.isPrerelease == $prerelease and .name == $tag and .tagName == $tag' \
              <<<"$release_json" >/dev/null
            if [ "$(jq -r .isDraft <<<"$release_json")" = true ]; then
              # The workflow treats a draft awaiting qualification as
              # write-once. A rerun verifies its existing bytes below instead
              # of silently changing the asset set a reviewer may be testing;
              # the final job repeats this because GitHub itself permits draft
              # asset edits until publication.
              :
            else
              # Published release assets are immutable. A rerun verifies them
              # below and may later repair GHCR aliases, but never edits their
              # Release metadata or replaces their bytes.
              :
            fi
          else
            flags=(--draft --verify-tag --title "$GITHUB_REF_NAME" --generate-notes)
            [ "$PRERELEASE" = false ] || flags+=(--prerelease)
            gh release create "$GITHUB_REF_NAME" "${flags[@]}" "${assets[@]}"
          fi

      - name: Verify assets through the GitHub Release adapter
        env:
          GH_TOKEN: ${{ github.token }}
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
        run: |
          set -euo pipefail
          mkdir -p downloaded-release
          gh release download "$GITHUB_REF_NAME" --dir downloaded-release --clobber
          required_assets=(
            install.sh install.ps1 uninstall.sh uninstall.ps1 release.json
            e2e-report.md e2e-required.tsv evidence-manifest.json
            SHA256SUMS SHA256SUMS.sigstore.json
          )
          for asset in "${required_assets[@]}"; do
            test -f "downloaded-release/$asset"
          done
          expected_assets=$(printf '%s\n' "${required_assets[@]}" | sort)
          actual_assets=$(find downloaded-release -mindepth 1 -maxdepth 1 -printf '%f\n' | sort)
          test "$actual_assets" = "$expected_assets"
          (cd downloaded-release && sha256sum -c SHA256SUMS)
          scripts/release-identity.sh verify downloaded-release/release.json
          test "$(jq -r .version downloaded-release/release.json)" = "$GITHUB_REF_NAME"
          test "$(jq -r .source_sha downloaded-release/release.json)" = "$GITHUB_SHA"
          test "$(jq -r .image_ref downloaded-release/release.json)" = "$IMAGE@$DIGEST"

          report_sha=$(sha256sum downloaded-release/e2e-report.md | awk '{print $1}')
          required_sha=$(sha256sum downloaded-release/e2e-required.tsv | awk '{print $1}')
          jq -e \
            --arg version "$GITHUB_REF_NAME" \
            --arg source_sha "$GITHUB_SHA" \
            --arg image_ref "$IMAGE@$DIGEST" \
            --arg report_sha "$report_sha" \
            --arg required_sha "$required_sha" \
            '.schema == 1 and .version == $version and
             .source_sha == $source_sha and .image_ref == $image_ref and
             .evidence_report_sha256 == $report_sha and
             .required_evidence_sha256 == $required_sha' \
            downloaded-release/evidence-manifest.json >/dev/null

          certificate_identity="https://github.com/${GITHUB_WORKFLOW_REF}"
          certificate_issuer="https://token.actions.githubusercontent.com"
          cosign verify-blob \
            --bundle downloaded-release/SHA256SUMS.sigstore.json \
            --certificate-identity "$certificate_identity" \
            --certificate-oidc-issuer "$certificate_issuer" \
            downloaded-release/SHA256SUMS

  publish-release:
    needs: [candidate, prepare-release]
    if: ${{ needs.prepare-release.result == 'success' && startsWith(github.ref, 'refs/tags/v') }}
    environment:
      # Stable publication waits for the required reviewer configured on this
      # environment. The prerelease environment is intentionally unprotected.
      name: ${{ needs.candidate.outputs.prerelease == 'false' && 'stable-release' || 'prerelease-auto' }}
    runs-on: ubuntu-latest
    concurrency:
      group: squarebox-release-publication
      cancel-in-progress: false
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Reverify prepared assets through the Release adapter
        id: publication-input
        env:
          GH_TOKEN: ${{ github.token }}
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
          PRERELEASE: ${{ needs.candidate.outputs.prerelease }}
        run: |
          set -euo pipefail
          verify_remote_tag_commit() {
            local tag_ref remote_refs direct_count peeled_count tag_commit
            tag_ref="refs/tags/$GITHUB_REF_NAME"
            remote_refs=$(git ls-remote origin "$tag_ref" "${tag_ref}^{}")
            direct_count=$(awk -v ref="$tag_ref" '$2 == ref { count++ } END { print count + 0 }' <<<"$remote_refs")
            peeled_count=$(awk -v ref="${tag_ref}^{}" '$2 == ref { count++ } END { print count + 0 }' <<<"$remote_refs")
            if [ "$direct_count" -ne 1 ] || [ "$peeled_count" -gt 1 ]; then
              echo "Release tag did not resolve to one remote Git object: $GITHUB_REF_NAME" >&2
              return 1
            fi
            tag_commit=$(awk -v direct="$tag_ref" -v peeled="${tag_ref}^{}" '
              $2 == direct { direct_sha = $1 }
              $2 == peeled { peeled_sha = $1 }
              END { print peeled_sha != "" ? peeled_sha : direct_sha }
            ' <<<"$remote_refs")
            test "$tag_commit" = "$GITHUB_SHA" || {
              echo "Release tag no longer resolves to Candidate source $GITHUB_SHA" >&2
              return 1
            }
          }
          verify_remote_tag_commit
          release_json=$(gh release view "$GITHUB_REF_NAME" \
            --json isDraft,isPrerelease,name,tagName)
          jq -e \
            --arg tag "$GITHUB_REF_NAME" \
            --argjson prerelease "$PRERELEASE" \
            '.isPrerelease == $prerelease and .name == $tag and .tagName == $tag' \
            <<<"$release_json" >/dev/null
          if [ "$(jq -r .isDraft <<<"$release_json")" = true ]; then
            release_state=draft
          else
            release_state=published
          fi
          echo "release_state=$release_state" >> "$GITHUB_OUTPUT"

          mkdir -p publication-input
          gh release download "$GITHUB_REF_NAME" --dir publication-input --clobber
          required_assets=(
            install.sh install.ps1 uninstall.sh uninstall.ps1 release.json
            e2e-report.md e2e-required.tsv evidence-manifest.json
            SHA256SUMS SHA256SUMS.sigstore.json
          )
          for asset in "${required_assets[@]}"; do
            test -f "publication-input/$asset"
          done
          expected_assets=$(printf '%s\n' "${required_assets[@]}" | sort)
          actual_assets=$(find publication-input -mindepth 1 -maxdepth 1 -printf '%f\n' | sort)
          test "$actual_assets" = "$expected_assets"
          (cd publication-input && sha256sum -c SHA256SUMS)
          scripts/release-identity.sh verify publication-input/release.json
          test "$(jq -r .version publication-input/release.json)" = "$GITHUB_REF_NAME"
          test "$(jq -r .source_sha publication-input/release.json)" = "$GITHUB_SHA"
          test "$(jq -r .image_ref publication-input/release.json)" = "$IMAGE@$DIGEST"

          report_sha=$(sha256sum publication-input/e2e-report.md | awk '{print $1}')
          required_sha=$(sha256sum publication-input/e2e-required.tsv | awk '{print $1}')
          jq -e \
            --arg version "$GITHUB_REF_NAME" \
            --arg source_sha "$GITHUB_SHA" \
            --arg image_ref "$IMAGE@$DIGEST" \
            --arg report_sha "$report_sha" \
            --arg required_sha "$required_sha" \
            '.schema == 1 and .version == $version and
             .source_sha == $source_sha and .image_ref == $image_ref and
             .evidence_report_sha256 == $report_sha and
             .required_evidence_sha256 == $required_sha' \
            publication-input/evidence-manifest.json >/dev/null

          certificate_identity="https://github.com/${GITHUB_WORKFLOW_REF}"
          certificate_issuer="https://token.actions.githubusercontent.com"
          cosign verify-blob \
            --bundle publication-input/SHA256SUMS.sigstore.json \
            --certificate-identity "$certificate_identity" \
            --certificate-oidc-issuer "$certificate_issuer" \
            publication-input/SHA256SUMS
          cosign verify \
            --certificate-identity "$certificate_identity" \
            --certificate-oidc-issuer "$certificate_issuer" \
            "$IMAGE@$DIGEST"

      - name: Publish and verify authoritative GitHub Release metadata
        id: release-metadata
        env:
          GH_TOKEN: ${{ github.token }}
          PRERELEASE: ${{ needs.candidate.outputs.prerelease }}
          RELEASE_STATE: ${{ steps.publication-input.outputs.release_state }}
        run: |
          set -euo pipefail
          # "Latest" means the greatest published stable SemVer, not whichever
          # historical workflow happened to be rerun most recently. Resolve it
          # before publication because immutable Release metadata cannot be
          # changed afterward. The API call is captured directly so a transient
          # failure cannot collapse into an empty, apparently valid tag list.
          published_tags=$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases" \
            --jq '.[] | select(.draft == false and .prerelease == false) | .tag_name')
          stable_tags=()
          while IFS= read -r tag; do
            [ -n "$tag" ] || continue
            identity=$(scripts/release-identity.sh inspect "$tag" 2>/dev/null) || continue
            [ "$(jq -r .prerelease <<<"$identity")" = false ] && stable_tags+=("$tag")
          done <<<"$published_tags"
          if [ "$RELEASE_STATE" = draft ] && [ "$PRERELEASE" = false ]; then
            stable_tags+=("$GITHUB_REF_NAME")
          fi

          expected_latest=""
          greatest_stable=false
          if [ "${#stable_tags[@]}" -gt 0 ]; then
            expected_latest=$(printf '%s\n' "${stable_tags[@]}" | sort -V | tail -1)
            if [ "$PRERELEASE" = false ] && [ "$GITHUB_REF_NAME" = "$expected_latest" ]; then
              greatest_stable=true
            fi
          fi

          # Confirm the hosted runner's GitHub CLI can perform both immutable
          # Release checks before making a draft discoverable.
          gh release verify --help >/dev/null
          gh release view "$GITHUB_REF_NAME" --json isImmutable >/dev/null

          if [ "$RELEASE_STATE" = draft ]; then
            edit_flags=(
              --verify-tag --title "$GITHUB_REF_NAME"
              --prerelease="$PRERELEASE" --latest="$greatest_stable"
              --draft=false
            )
            gh release edit "$GITHUB_REF_NAME" "${edit_flags[@]}"
          fi

          # Publishing with repository immutability enabled creates GitHub's
          # signed Release attestation. Both signals can be briefly eventually
          # consistent, so retry within a bounded window. No output authorizes
          # a GHCR convenience alias unless both checks succeed.
          immutable_verified=false
          release_json=""
          verify_output=""
          for attempt in {1..12}; do
            if release_json=$(gh release view "$GITHUB_REF_NAME" \
                --json isDraft,isImmutable,isPrerelease,name,tagName 2>&1) \
              && jq -e \
                --arg tag "$GITHUB_REF_NAME" \
                --argjson prerelease "$PRERELEASE" \
                '.isDraft == false and .isImmutable == true and
                 .isPrerelease == $prerelease and .name == $tag and
                 .tagName == $tag' <<<"$release_json" >/dev/null 2>&1 \
              && verify_output=$(gh release verify "$GITHUB_REF_NAME" 2>&1); then
              immutable_verified=true
              printf '%s\n' "$verify_output"
              break
            fi
            [ "$attempt" -eq 12 ] || sleep 5
          done
          if [ "$immutable_verified" != true ]; then
            echo "Release did not become immutable with a valid GitHub attestation" >&2
            [ -z "$release_json" ] || printf '%s\n' "$release_json" >&2
            [ -z "$verify_output" ] || printf '%s\n' "$verify_output" >&2
            exit 1
          fi

          if [ "${#stable_tags[@]}" -gt 0 ]; then
            test "$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)" = "$expected_latest"
          fi
          printf 'expected_latest=%s\n' "$expected_latest" >> "$GITHUB_OUTPUT"
          printf 'greatest_stable=%s\n' "$greatest_stable" >> "$GITHUB_OUTPUT"

      - name: Promote convenience image aliases after authoritative Release
        env:
          IMAGE: ${{ needs.candidate.outputs.image }}
          DIGEST: ${{ needs.candidate.outputs.digest }}
          GREATEST_STABLE: ${{ steps.release-metadata.outputs.greatest_stable }}
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          aliases=("$GITHUB_REF_NAME" "$version")
          if [ "$GREATEST_STABLE" = true ]; then
            aliases+=(latest)
          fi
          tag_args=()
          for alias in "${aliases[@]}"; do
            tag_args+=(-t "$IMAGE:$alias")
          done
          docker buildx imagetools create "${tag_args[@]}" "$IMAGE@$DIGEST"
          for alias in "${aliases[@]}"; do
            alias_digest=$(docker buildx imagetools inspect "$IMAGE:$alias" \
              --format '{{json .Manifest}}' | jq -r .digest)
            test "$alias_digest" = "$DIGEST"
          done