release.yml

---
# WRAITH Protocol Release Workflow
#
# This workflow handles automated release builds and
# GitHub Release creation. It builds cross-platform release binaries,
# generates checksums, and publishes artifacts.
#
# Triggered by:
# 1. Pushing semantic version tags (v*.*.*)
# 2. Manual workflow dispatch with version input
#
# Release process:
# 1. Validate tag format and CHANGELOG entry
# 2. Run full test suite
# 3. Build release binaries for all supported platforms
# 4. Generate SHA256 checksums
# 5. Create GitHub Release with artifacts

name: Release

"on":
  # Trigger on semantic version tags (v0.1.0, v1.2.3, v2.0.0-beta.1, etc.)
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+*'

  # Allow manual release creation
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., v0.1.0)'
        required: true
        type: string
      prerelease:
        description: 'Mark as pre-release'
        required: false
        type: boolean
        default: false
      draft:
        description: 'Create as draft'
        required: false
        type: boolean
        default: false

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  #############################################################################
  # Job 1: Validate release metadata
  #############################################################################
  validate:
    name: Validate Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.extract.outputs.version }}
      is_prerelease: ${{ steps.extract.outputs.is_prerelease }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Extract version from tag or input
        id: extract
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_VERSION: ${{ inputs.version }}
          INPUT_PRERELEASE: ${{ inputs.prerelease }}
          GITHUB_REF: ${{ github.ref }}
        run: |
          # Determine version from tag or manual input
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            VERSION="$INPUT_VERSION"
          else
            VERSION="${GITHUB_REF#refs/tags/}"
          fi

          echo "version=$VERSION" >> $GITHUB_OUTPUT

          # Check if pre-release (alpha, beta, rc, or manual flag)
          if [[ "$VERSION" =~ (alpha|beta|rc) ]] || \
             [ "$INPUT_PRERELEASE" = "true" ]; then
            echo "is_prerelease=true" >> $GITHUB_OUTPUT
            echo "✓ Pre-release detected: $VERSION"
          else
            echo "is_prerelease=false" >> $GITHUB_OUTPUT
            echo "✓ Stable release: $VERSION"
          fi

      - name: Validate semantic version format
        env:
          VERSION: ${{ steps.extract.outputs.version }}
        run: |
          # Validate semantic version (vX.Y.Z or vX.Y.Z-prerelease)
          if [[ ! "$VERSION" =~ \
                ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "❌ Invalid version format: $VERSION"
            echo "Expected format: vX.Y.Z or vX.Y.Z-prerelease"
            exit 1
          fi

          echo "✓ Valid semantic version: $VERSION"

      - name: Check CHANGELOG entry
        env:
          VERSION: ${{ steps.extract.outputs.version }}
        run: |
          VERSION_NO_V="${VERSION#v}"  # Remove leading 'v'

          # Check if CHANGELOG.md contains entry for this version
          if grep -q "\[${VERSION_NO_V}\]" CHANGELOG.md || \
             grep -q "## ${VERSION}" CHANGELOG.md; then
            echo "✓ CHANGELOG.md entry found for version $VERSION"
          else
            echo "⚠️  WARNING: No CHANGELOG.md entry found for version $VERSION"
            echo "Please update CHANGELOG.md before releasing"
            # Don't fail - allow release but warn
          fi

  #############################################################################
  # Job 2: Run comprehensive test suite
  #############################################################################
  test:
    name: Test Suite
    runs-on: ubuntu-latest
    needs: validate

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install system dependencies (Ubuntu)
        run: |
          sudo apt-get update
          sudo apt-get install -y libglib2.0-dev libwebkit2gtk-4.1-dev librsvg2-dev patchelf libgtk-3-dev libayatana-appindicator3-dev libsqlcipher-dev libasound2-dev protobuf-compiler

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-test-
            ${{ runner.os }}-cargo-

      - name: Run tests
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          echo "Running test suite for version $VERSION"
          cargo test --workspace --all-features --exclude wraith-transfer --exclude wraith-chat --exclude wraith-sync --exclude wraith-share --exclude wraith-stream --exclude wraith-mesh --exclude wraith-publish --exclude wraith-vault --exclude wraith-recon --exclude operator-client --exclude team-server --verbose

      - name: Run clippy checks
        run: cargo clippy --workspace --all-features --exclude wraith-transfer --exclude wraith-chat --exclude wraith-sync --exclude wraith-share --exclude wraith-stream --exclude wraith-mesh --exclude wraith-publish --exclude wraith-vault --exclude wraith-recon --exclude operator-client --exclude team-server -- -D warnings

      - name: Check formatting
        run: cargo fmt --all -- --check

  #############################################################################
  # Job 3: Build release binaries for all platforms
  #############################################################################
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    needs: [validate, test]

    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64 (glibc)
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            binary_name: wraith
            artifact_name: wraith-x86_64-linux-gnu
            cross: false

          # Linux x86_64 (musl - static binary)
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            binary_name: wraith
            artifact_name: wraith-x86_64-linux-musl
            cross: true

          # Linux aarch64
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            binary_name: wraith
            artifact_name: wraith-aarch64-linux-gnu
            cross: true

          # macOS x86_64 (Intel)
          - target: x86_64-apple-darwin
            os: macos-latest
            binary_name: wraith
            artifact_name: wraith-x86_64-macos
            cross: false

          # macOS aarch64 (Apple Silicon)
          - target: aarch64-apple-darwin
            os: macos-latest
            binary_name: wraith
            artifact_name: wraith-aarch64-macos
            cross: false

          # Windows x86_64
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            binary_name: wraith.exe
            artifact_name: wraith-x86_64-windows
            cross: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install protobuf compiler (Ubuntu)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler

      - name: Install protobuf compiler (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          brew install protobuf

      - name: Install protobuf compiler (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          choco install protoc -y

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tool
        if: matrix.cross
        run: |
          cargo install cross --git https://github.com/cross-rs/cross

      - name: Cache cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: >-
            ${{ runner.os }}-cargo-release-${{ matrix.target }}-
            ${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-release-${{ matrix.target }}-

      - name: Clean target directory for cross builds
        if: matrix.cross
        run: |
          # Cross-compilation uses Docker containers with older glibc.
          # Cached host-compiled build scripts (requiring glibc 2.32+) fail
          # inside the container. Cleaning prevents stale artifact reuse.
          # See: https://github.com/rust-lang/cargo/issues/10367
          cargo clean
        shell: bash

      - name: Build release binary
        env:
          TARGET: ${{ matrix.target }}
          ARTIFACT_NAME: ${{ matrix.artifact_name }}
          USE_CROSS: ${{ matrix.cross }}
        run: |
          echo "Building $ARTIFACT_NAME for $TARGET"
          if [ "$USE_CROSS" = "true" ]; then
            cross build --release --target "$TARGET" -p wraith-cli --verbose
          else
            cargo build --release --target "$TARGET" -p wraith-cli --verbose
          fi
        shell: bash

      - name: Strip binary (Linux/macOS)
        if: matrix.os != 'windows-latest'
        env:
          TARGET: ${{ matrix.target }}
          BINARY_NAME: ${{ matrix.binary_name }}
        run: |
          # Strip debug symbols for smaller binaries
          BINARY_PATH="target/$TARGET/release/$BINARY_NAME"
          if command -v strip &> /dev/null; then
            strip "$BINARY_PATH" || true
          fi
        shell: bash

      - name: Generate versioned archive
        env:
          TARGET: ${{ matrix.target }}
          BINARY_NAME: ${{ matrix.binary_name }}
          ARTIFACT_NAME: ${{ matrix.artifact_name }}
          VERSION: ${{ needs.validate.outputs.version }}
          OS_TYPE: ${{ matrix.os }}
        run: |
          VERSION_NO_V="${VERSION#v}"
          VERSIONED_NAME="${ARTIFACT_NAME}-${VERSION_NO_V}"

          mkdir -p release-staging
          cd "target/$TARGET/release"

          # Generate checksum
          if [ "$OS_TYPE" = "windows-latest" ]; then
            certutil -hashfile "$BINARY_NAME" SHA256 > "../../../release-staging/${VERSIONED_NAME}.sha256"
          else
            shasum -a 256 "$BINARY_NAME" | sed "s/$BINARY_NAME/${VERSIONED_NAME}/" > "../../../release-staging/${VERSIONED_NAME}.sha256"
          fi

          # Create archive with version in filename
          if [ "$OS_TYPE" = "windows-latest" ]; then
            7z a "../../../release-staging/${VERSIONED_NAME}.zip" "$BINARY_NAME"
          else
            tar czf "../../../release-staging/${VERSIONED_NAME}.tar.gz" "$BINARY_NAME"
          fi

          cd ../../..
          echo "Release staging contents:"
          ls -lh release-staging/
        shell: bash

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: ${{ matrix.artifact_name }}-${{ needs.validate.outputs.version }}
          path: release-staging/*
          if-no-files-found: error
          retention-days: 7

  #############################################################################
  # Job 4: Build All Tauri Client Applications (Bundled Per Platform)
  #############################################################################
  build-clients:
    name: Build All Clients (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: [validate, test]

    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux x86_64 configuration
          - os: ubuntu-latest
            platform: linux
            arch: x86_64
          # macOS configuration (universal binary)
          - os: macos-latest
            platform: macos
            arch: universal
          # Windows x86_64 configuration
          - os: windows-latest
            platform: windows
            arch: x86_64

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install system dependencies (Ubuntu)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libglib2.0-dev \
            libwebkit2gtk-4.1-dev \
            librsvg2-dev \
            patchelf \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            libsqlcipher-dev \
            libasound2-dev \
            protobuf-compiler

      - name: Install system dependencies (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          brew install sqlcipher opus protobuf

      - name: Install system dependencies (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          choco install protoc -y
          vcpkg install sqlcipher:x64-windows

      - name: Set SQLCipher environment (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          $VCPKG_ROOT = "C:\vcpkg"
          echo "SQLCIPHER_LIB_DIR=$VCPKG_ROOT\installed\x64-windows\lib" >> $env:GITHUB_ENV
          echo "SQLCIPHER_INCLUDE_DIR=$VCPKG_ROOT\installed\x64-windows\include" >> $env:GITHUB_ENV

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '22'

      - name: Install jq (for JSON manipulation)
        if: matrix.os != 'windows-latest'
        run: |
          if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then
            sudo apt-get install -y jq
          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
            # Check if jq is already installed to avoid brew warning
            if ! command -v jq &> /dev/null; then
              brew install jq
            fi
          fi
        shell: bash

      - name: Cache Cargo registry
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: >-
            ${{ matrix.os }}-cargo-tauri-all-clients-
            ${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ matrix.os }}-cargo-tauri-all-clients-
            ${{ matrix.os }}-cargo-tauri-
            ${{ matrix.os }}-cargo-

      - name: Install Tauri CLI
        run: npm install -g @tauri-apps/cli@^2.0.0

      - name: Update Tauri config versions to match release tag
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          VERSION_NO_V="${VERSION#v}"
          echo "Setting all client versions to $VERSION_NO_V"

          # List of all Tauri clients
          CLIENTS=(
            "wraith-transfer"
            "wraith-chat"
            "wraith-sync"
            "wraith-share"
            "wraith-stream"
            "wraith-mesh"
            "wraith-publish"
            "wraith-vault"
            "wraith-recon"
          )

          for client in "${CLIENTS[@]}"; do
            CONFIG_FILE="clients/$client/src-tauri/tauri.conf.json"
            if [ -f "$CONFIG_FILE" ]; then
              echo "Updating $CONFIG_FILE to version $VERSION_NO_V"
              # Use jq on Unix, or sed as fallback
              if command -v jq &> /dev/null; then
                jq --arg ver "$VERSION_NO_V" '.version = $ver' "$CONFIG_FILE" > tmp.json && mv tmp.json "$CONFIG_FILE"
              else
                sed -i.bak "s/\"version\": \"[^\"]*\"/\"version\": \"$VERSION_NO_V\"/" "$CONFIG_FILE"
                rm -f "${CONFIG_FILE}.bak"
              fi
            fi
          done

          echo "✓ All Tauri configs updated to version $VERSION_NO_V"
        shell: bash

      - name: Update Tauri config versions (Windows)
        if: matrix.os == 'windows-latest'
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        shell: pwsh
        run: |
          $VERSION_NO_V = $env:VERSION -replace '^v', ''
          Write-Host "Setting all client versions to $VERSION_NO_V"

          $clients = @(
            "wraith-transfer",
            "wraith-chat",
            "wraith-sync",
            "wraith-share",
            "wraith-stream",
            "wraith-mesh",
            "wraith-publish",
            "wraith-vault",
            "wraith-recon"
          )

          foreach ($client in $clients) {
            $configFile = "clients/$client/src-tauri/tauri.conf.json"
            if (Test-Path $configFile) {
              Write-Host "Updating $configFile to version $VERSION_NO_V"
              $json = Get-Content $configFile -Raw | ConvertFrom-Json
              $json.version = $VERSION_NO_V
              $json | ConvertTo-Json -Depth 10 | Set-Content $configFile -Encoding UTF8
            }
          }

          Write-Host "All Tauri configs updated to version $VERSION_NO_V"

      - name: Build all Tauri clients
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          PLATFORM: ${{ matrix.platform }}
        run: |
          VERSION_NO_V="${VERSION#v}"
          echo "Building all clients for $PLATFORM (version $VERSION_NO_V)"

          # List of production-ready clients to build
          # Note: Some clients may not have complete frontends yet
          CLIENTS=(
            "wraith-transfer"
            "wraith-chat"
            "wraith-sync"
          )

          # Clients that are planned but may not build yet
          OPTIONAL_CLIENTS=(
            "wraith-share"
            "wraith-stream"
            "wraith-mesh"
            "wraith-publish"
            "wraith-vault"
            "wraith-recon"
          )

          # Build production clients (fail on error)
          for client in "${CLIENTS[@]}"; do
            echo ""
            echo "=========================================="
            echo "Building $client..."
            echo "=========================================="
            cd "clients/$client"

            # Install dependencies
            if [ -f "package.json" ]; then
              npm ci || npm install
            fi
            if [ -d "frontend" ] && [ -f "frontend/package.json" ]; then
              cd frontend && npm ci || npm install && cd ..
            fi

            # Build
            npm run tauri build || {
              echo "ERROR: Failed to build $client"
              exit 1
            }

            cd ../..
          done

          # Build optional clients (continue on error)
          for client in "${OPTIONAL_CLIENTS[@]}"; do
            echo ""
            echo "=========================================="
            echo "Building $client (optional)..."
            echo "=========================================="
            if [ -d "clients/$client" ]; then
              cd "clients/$client"

              # Install dependencies
              if [ -f "package.json" ]; then
                npm ci || npm install || true
              fi
              if [ -d "frontend" ] && [ -f "frontend/package.json" ]; then
                cd frontend && (npm ci || npm install || true) && cd ..
              fi

              # Build (continue on failure)
              npm run tauri build || echo "WARNING: $client build failed (optional)"

              cd ../..
            else
              echo "Skipping $client (directory not found)"
            fi
          done

          echo ""
          echo "✓ Client builds complete"
        shell: bash

      - name: Collect and bundle Linux artifacts
        if: matrix.os == 'ubuntu-latest'
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          ARCH: ${{ matrix.arch }}
        run: |
          VERSION_NO_V="${VERSION#v}"
          BUNDLE_NAME="wraith-clients-${VERSION_NO_V}-linux-${ARCH}"

          mkdir -p "bundle-staging/$BUNDLE_NAME"
          mkdir -p "appimage-staging"

          # Collect all client artifacts
          if [ -d "target/release/bundle" ]; then
            # AppImages - collect separately for individual upload
            while IFS= read -r -d '' file; do
              # Copy to separate staging for individual upload
              cp "$file" "appimage-staging/"
              echo "Found AppImage: $(basename "$file")"
            done < <(find target/release/bundle -type f -name "*.AppImage" -print0 2>/dev/null)

            # Debian packages - include in bundle
            while IFS= read -r -d '' file; do
              cp "$file" "bundle-staging/$BUNDLE_NAME/"
              echo "Found DEB: $(basename "$file")"
            done < <(find target/release/bundle -type f -name "*.deb" -print0 2>/dev/null)

            # RPM packages - include in bundle
            while IFS= read -r -d '' file; do
              cp "$file" "bundle-staging/$BUNDLE_NAME/"
              echo "Found RPM: $(basename "$file")"
            done < <(find target/release/bundle -type f -name "*.rpm" -print0 2>/dev/null)
          fi

          # Create README for the bundle
          cat > "bundle-staging/$BUNDLE_NAME/README.txt" << EOF
          WRAITH Protocol Client Applications
          Version: ${VERSION}
          Platform: Linux ${ARCH}

          This bundle contains .deb and .rpm packages.
          AppImages are available as separate downloads.

          Installation:
          - Debian/Ubuntu: sudo dpkg -i *.deb
          - Fedora/RHEL: sudo rpm -i *.rpm

          For more information: https://github.com/doublegate/WRAITH-Protocol
          EOF

          # Generate checksums for bundle
          cd "bundle-staging/$BUNDLE_NAME"
          sha256sum * > SHA256SUMS.txt 2>/dev/null || true
          cd ../..

          # Create the bundle archive (deb + rpm only)
          mkdir -p client-bundle
          cd bundle-staging
          tar czf "../client-bundle/${BUNDLE_NAME}.tar.gz" "$BUNDLE_NAME"
          cd ..

          # Also create individual checksums for the bundle
          cd client-bundle
          sha256sum "${BUNDLE_NAME}.tar.gz" > "${BUNDLE_NAME}.tar.gz.sha256"
          cd ..

          echo ""
          echo "Linux bundle created (deb + rpm):"
          ls -lh client-bundle/

          echo ""
          echo "AppImages staged for separate upload:"
          ls -lh appimage-staging/ 2>/dev/null || echo "No AppImages found"

      - name: Collect and bundle macOS artifacts
        if: matrix.os == 'macos-latest'
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          ARCH: ${{ matrix.arch }}
        run: |
          VERSION_NO_V="${VERSION#v}"
          BUNDLE_NAME="wraith-clients-${VERSION_NO_V}-macos-${ARCH}"

          mkdir -p "bundle-staging/$BUNDLE_NAME"

          # Collect all DMG files - use while loop for proper handling of spaces in filenames
          if [ -d "target/release/bundle" ]; then
            DMG_COUNT=0
            while IFS= read -r -d '' file; do
              cp "$file" "bundle-staging/$BUNDLE_NAME/"
              echo "Found DMG: $(basename "$file")"
              DMG_COUNT=$((DMG_COUNT + 1))
            done < <(find target/release/bundle -type f -name "*.dmg" -print0 2>/dev/null)

            echo "Total DMGs found: $DMG_COUNT"
          fi

          # List what was collected
          echo ""
          echo "Contents of bundle-staging/$BUNDLE_NAME:"
          ls -la "bundle-staging/$BUNDLE_NAME/" || true

          # Create README for the bundle
          cat > "bundle-staging/$BUNDLE_NAME/README.txt" << EOF
          WRAITH Protocol Client Applications
          Version: ${VERSION}
          Platform: macOS ${ARCH}

          Installation:
          - Double-click the .dmg file
          - Drag the application to your Applications folder

          For more information: https://github.com/doublegate/WRAITH-Protocol
          EOF

          # Generate checksums
          cd "bundle-staging/$BUNDLE_NAME"
          shasum -a 256 * > SHA256SUMS.txt 2>/dev/null || true
          cd ../..

          # Create the bundle archive
          mkdir -p client-bundle
          cd bundle-staging
          tar czf "../client-bundle/${BUNDLE_NAME}.tar.gz" "$BUNDLE_NAME"
          cd ..

          # Also create individual checksums for the bundle
          cd client-bundle
          shasum -a 256 "${BUNDLE_NAME}.tar.gz" > "${BUNDLE_NAME}.tar.gz.sha256"
          cd ..

          echo ""
          echo "macOS bundle created:"
          ls -lh client-bundle/

      - name: Collect and bundle Windows artifacts
        if: matrix.os == 'windows-latest'
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          ARCH: ${{ matrix.arch }}
        shell: pwsh
        run: |
          $VERSION_NO_V = $env:VERSION -replace '^v', ''
          $BUNDLE_NAME = "wraith-clients-$VERSION_NO_V-windows-$env:ARCH"

          New-Item -ItemType Directory -Force -Path "bundle-staging\$BUNDLE_NAME"

          # Collect all MSI and EXE installers
          if (Test-Path "target\release\bundle") {
            Get-ChildItem -Path "target\release\bundle" -Recurse -Include "*.msi" -ErrorAction SilentlyContinue |
              Copy-Item -Destination "bundle-staging\$BUNDLE_NAME" -ErrorAction SilentlyContinue

            # Only include NSIS installers, not the actual executables
            Get-ChildItem -Path "target\release\bundle\nsis" -Recurse -Include "*.exe" -ErrorAction SilentlyContinue |
              Copy-Item -Destination "bundle-staging\$BUNDLE_NAME" -ErrorAction SilentlyContinue
          }

          # Create README for the bundle
          @"
          WRAITH Protocol Client Applications
          Version: $env:VERSION
          Platform: Windows $env:ARCH

          Installation:
          - MSI: Double-click the .msi file to install
          - EXE: Run the .exe installer

          For more information: https://github.com/doublegate/WRAITH-Protocol
          "@ | Out-File -FilePath "bundle-staging\$BUNDLE_NAME\README.txt" -Encoding UTF8

          # Generate checksums
          Push-Location "bundle-staging\$BUNDLE_NAME"
          Get-ChildItem -File | ForEach-Object {
            $hash = (Get-FileHash $_.Name -Algorithm SHA256).Hash.ToLower()
            "$hash  $($_.Name)" | Out-File -Append -FilePath "SHA256SUMS.txt" -Encoding UTF8
          }
          Pop-Location

          # Create the bundle archive
          New-Item -ItemType Directory -Force -Path "client-bundle"
          Compress-Archive -Path "bundle-staging\$BUNDLE_NAME" -DestinationPath "client-bundle\$BUNDLE_NAME.zip"

          # Create checksum for the bundle
          Push-Location "client-bundle"
          $hash = (Get-FileHash "$BUNDLE_NAME.zip" -Algorithm SHA256).Hash.ToLower()
          "$hash  $BUNDLE_NAME.zip" | Out-File -FilePath "$BUNDLE_NAME.zip.sha256" -Encoding UTF8
          Pop-Location

          Write-Host "Windows bundle created:"
          Get-ChildItem client-bundle

      - name: Upload client bundle
        uses: actions/upload-artifact@v6
        with:
          name: wraith-clients-${{ matrix.platform }}-${{ matrix.arch }}
          path: client-bundle/*
          if-no-files-found: warn
          retention-days: 7

      - name: Upload Linux AppImages separately
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v6
        with:
          name: wraith-appimages-linux-${{ matrix.arch }}
          path: appimage-staging/*.AppImage
          if-no-files-found: warn
          retention-days: 7

  #############################################################################
  # Job 5: Create GitHub Release
  #############################################################################
  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [validate, test, build, build-clients]
    permissions:
      contents: write  # Required to create releases

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Fetch all history for changelog generation

      - name: Download all artifacts
        uses: actions/download-artifact@v7
        with:
          path: artifacts

      - name: Organize release assets
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          VERSION_NO_V="${VERSION#v}"
          mkdir -p release-assets

          echo "Organizing artifacts for version $VERSION..."
          echo ""
          echo "Artifact structure:"
          find artifacts -type f | head -50

          # Move protocol binary archives and checksums
          find artifacts -type f \
            \( -name "*.tar.gz" -o -name "*.zip" \) \
            ! -name "wraith-clients-*" \
            ! -name "*.AppImage" \
            -exec mv {} release-assets/ \; 2>/dev/null || true

          # Move protocol binary checksums
          find artifacts -type f -name "*.sha256" \
            ! -name "wraith-clients-*" \
            ! -name "wraith-appimages-*" \
            -exec mv {} release-assets/ \; 2>/dev/null || true

          # Move client bundle archives (tar.gz for Linux/macOS, zip for Windows)
          find artifacts -type f -name "wraith-clients-*.tar.gz" \
            -exec mv {} release-assets/ \; 2>/dev/null || true
          find artifacts -type f -name "wraith-clients-*.zip" \
            -exec mv {} release-assets/ \; 2>/dev/null || true

          # Move client bundle checksums
          find artifacts -type f -name "wraith-clients-*.sha256" \
            -exec mv {} release-assets/ \; 2>/dev/null || true

          # Move AppImages as separate downloadable files (not in bundle)
          # Handle filenames with spaces properly
          echo ""
          echo "Processing AppImages..."
          while IFS= read -r -d '' file; do
            basename_file=$(basename "$file")
            # Rename with version if not already versioned
            if [[ "$basename_file" != *"$VERSION_NO_V"* ]]; then
              # Extract app name (remove _version_arch.AppImage)
              app_name=$(echo "$basename_file" | sed 's/_[0-9]*\.[0-9]*\.[0-9]*_.*.AppImage$//')
              new_name="${app_name}_${VERSION_NO_V}_amd64.AppImage"
            else
              new_name="$basename_file"
            fi
            mv "$file" "release-assets/$new_name"
            echo "  Added AppImage: $new_name"
          done < <(find artifacts -type f -name "*.AppImage" -print0 2>/dev/null)

          # Create combined checksums file
          cd release-assets

          # Protocol binary checksums
          echo "# WRAITH Protocol CLI Binaries - SHA256 Checksums" > SHA256SUMS.txt
          echo "# Version: $VERSION" >> SHA256SUMS.txt
          echo "" >> SHA256SUMS.txt
          if ls wraith-x86_64-*.sha256 wraith-aarch64-*.sha256 1> /dev/null 2>&1; then
            cat wraith-x86_64-*.sha256 wraith-aarch64-*.sha256 >> SHA256SUMS.txt 2>/dev/null || true
          fi

          # Client bundle checksums
          echo "# WRAITH Client Application Bundles - SHA256 Checksums" > SHA256SUMS-clients.txt
          echo "# Version: $VERSION" >> SHA256SUMS-clients.txt
          echo "" >> SHA256SUMS-clients.txt
          if ls wraith-clients-*.sha256 1> /dev/null 2>&1; then
            cat wraith-clients-*.sha256 >> SHA256SUMS-clients.txt 2>/dev/null || true
          fi

          # Generate checksums for AppImages and add to clients file
          echo "" >> SHA256SUMS-clients.txt
          echo "# AppImages (Linux)" >> SHA256SUMS-clients.txt
          for appimage in *.AppImage; do
            if [ -f "$appimage" ]; then
              sha256sum "$appimage" >> SHA256SUMS-clients.txt 2>/dev/null || true
            fi
          done

          # Remove individual .sha256 files (they're now in the combined files)
          rm -f wraith-x86_64-*.sha256 wraith-aarch64-*.sha256 wraith-clients-*.sha256 2>/dev/null || true

          echo ""
          echo "Release assets:"
          ls -lh

      - name: Check if release already exists with notes
        id: check_release
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Check if release exists and has a body
          if gh release view "$VERSION" &> /dev/null; then
            echo "✓ Release $VERSION already exists"

            # Get the release body
            RELEASE_BODY=$(gh release view "$VERSION" \
              --json body --jq '.body')

            # Check if body is non-empty (more than just whitespace)
            RELEASE_BODY_STRIPPED=$(echo "$RELEASE_BODY" | \
              tr -d '[:space:]')
            if [ -n "$RELEASE_BODY" ] && \
               [ "$RELEASE_BODY_STRIPPED" != "" ]; then
              CHAR_COUNT=$(echo "$RELEASE_BODY" | wc -c)
              echo "✓ Release already has notes ($CHAR_COUNT chars)"
              echo "use_existing_notes=true" >> $GITHUB_OUTPUT
              MSG="⚠️  SKIPPING automatic note generation"
              echo "$MSG to preserve existing content"
            else
              echo "⚠️  Release exists but has no body"
              echo "use_existing_notes=false" >> $GITHUB_OUTPUT
            fi
          else
            echo "✓ Release does not exist yet"
            echo "use_existing_notes=false" >> $GITHUB_OUTPUT
          fi

      - name: Extract changelog for this version
        id: changelog
        if: steps.check_release.outputs.use_existing_notes != 'true'
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          VERSION_NO_V="${VERSION#v}"

          # Extract changelog section for this version
          # This is a simple extraction - enhance as needed
          if grep -q "\[${VERSION_NO_V}\]" CHANGELOG.md; then
            # Extract from version header to next version or end
            CHANGELOG_BODY=$(sed -n \
              "/\[${VERSION_NO_V}\]/,/^## \[/p" CHANGELOG.md | \
              sed '$d' | tail -n +2)

            # Save to file for release notes
            echo "$CHANGELOG_BODY" > release-notes.md
            echo "✓ Extracted changelog for version $VERSION"
          else
            echo "⚠️  No specific changelog entry found," \
              "using generic notes"
            echo "Release $VERSION" > release-notes.md
            echo "" >> release-notes.md
            REPO="https://github.com/doublegate"
            CHANGELOG_URL="$REPO/WRAITH-Protocol/blob/main/CHANGELOG.md"
            echo "See [CHANGELOG.md]($CHANGELOG_URL)" \
              "for details." >> release-notes.md
          fi

      - name: Create GitHub Release (with auto-generated notes)
        if: steps.check_release.outputs.use_existing_notes != 'true'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.validate.outputs.version }}
          name: WRAITH Protocol ${{ needs.validate.outputs.version }}
          body_path: release-notes.md
          draft: ${{ inputs.draft || false }}
          prerelease: ${{ needs.validate.outputs.is_prerelease }}
          files: |
            release-assets/*
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Update GitHub Release (preserve notes, upload assets)
        if: steps.check_release.outputs.use_existing_notes == 'true'
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "✓ Uploading assets to existing release (preserving notes)"

          # Upload all assets to the existing release
          for asset in release-assets/*; do
            if [ -f "$asset" ]; then
              echo "Uploading: $(basename "$asset")"
              gh release upload "$VERSION" "$asset" --clobber
            fi
          done

          echo "✓ Assets uploaded successfully"

      - name: Release summary
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          IS_PRERELEASE: ${{ needs.validate.outputs.is_prerelease }}
        run: |
          VERSION_NO_V="${VERSION#v}"
          S=$GITHUB_STEP_SUMMARY

          echo "## Release Created Successfully" >> $S
          echo "" >> $S
          echo "**Version:** $VERSION" >> $S
          echo "**Pre-release:** $IS_PRERELEASE" >> $S
          echo "" >> $S

          echo "### Protocol CLI Binaries" >> $S
          echo "" >> $S
          echo "| Platform | Artifact |" >> $S
          echo "|----------|----------|" >> $S
          echo "| Linux x86_64 (glibc) | wraith-x86_64-linux-gnu-${VERSION_NO_V}.tar.gz |" >> $S
          echo "| Linux x86_64 (musl) | wraith-x86_64-linux-musl-${VERSION_NO_V}.tar.gz |" >> $S
          echo "| Linux aarch64 | wraith-aarch64-linux-gnu-${VERSION_NO_V}.tar.gz |" >> $S
          echo "| macOS x86_64 | wraith-x86_64-macos-${VERSION_NO_V}.tar.gz |" >> $S
          echo "| macOS Apple Silicon | wraith-aarch64-macos-${VERSION_NO_V}.tar.gz |" >> $S
          echo "| Windows x86_64 | wraith-x86_64-windows-${VERSION_NO_V}.zip |" >> $S
          echo "" >> $S

          echo "### Desktop Client Application Bundles" >> $S
          echo "" >> $S
          echo "Client applications are bundled together per platform:" >> $S
          echo "" >> $S
          echo "| Platform | Bundle Archive | Contents |" >> $S
          echo "|----------|----------------|----------|" >> $S
          echo "| Linux x86_64 | wraith-clients-${VERSION_NO_V}-linux-x86_64.tar.gz | .deb and .rpm packages |" >> $S
          echo "| macOS | wraith-clients-${VERSION_NO_V}-macos-universal.tar.gz | .dmg installers |" >> $S
          echo "| Windows x86_64 | wraith-clients-${VERSION_NO_V}-windows-x86_64.zip | .msi installers |" >> $S
          echo "" >> $S

          echo "**Linux AppImages** are available as separate downloads (not bundled)." >> $S
          echo "" >> $S

          echo "**Included Clients:**" >> $S
          echo "- WRAITH Transfer - Secure file transfer" >> $S
          echo "- WRAITH Chat - Encrypted messaging with voice/video" >> $S
          echo "- WRAITH Sync - File synchronization" >> $S
          echo "- WRAITH Share, Stream, Mesh, Publish, Vault, Recon (when available)" >> $S
          echo "" >> $S

          echo "### Checksums" >> $S
          echo "" >> $S
          echo "- **SHA256SUMS.txt** - Protocol CLI binary checksums" >> $S
          echo "- **SHA256SUMS-clients.txt** - Client bundle and AppImage checksums" >> $S
          echo "" >> $S

          echo "### Installation" >> $S
          echo "" >> $S
          echo "**Protocol CLI:**" >> $S
          echo '```bash' >> $S
          echo "# Linux/macOS" >> $S
          echo "tar xzf wraith-x86_64-linux-gnu-${VERSION_NO_V}.tar.gz" >> $S
          echo "chmod +x wraith" >> $S
          echo "./wraith --version" >> $S
          echo "" >> $S
          echo "# Windows (PowerShell)" >> $S
          echo "Expand-Archive wraith-x86_64-windows-${VERSION_NO_V}.zip" >> $S
          echo ".\\wraith.exe --version" >> $S
          echo '```' >> $S
          echo "" >> $S

          echo "**Desktop Clients:**" >> $S
          echo '```bash' >> $S
          echo "# Linux (AppImage - download separately)" >> $S
          echo "chmod +x 'WRAITH Transfer_${VERSION_NO_V}_amd64.AppImage'" >> $S
          echo "./'WRAITH Transfer_${VERSION_NO_V}_amd64.AppImage'" >> $S
          echo "" >> $S
          echo "# Linux (Debian/Ubuntu - from bundle)" >> $S
          echo "tar xzf wraith-clients-${VERSION_NO_V}-linux-x86_64.tar.gz" >> $S
          echo "cd wraith-clients-${VERSION_NO_V}-linux-x86_64" >> $S
          echo "sudo dpkg -i *.deb" >> $S
          echo "" >> $S
          echo "# macOS - Extract and double-click the .dmg files" >> $S
          echo "# Windows - Extract and run the .msi installers" >> $S
          echo '```' >> $S