release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  changelog:
    name: Generate CHANGELOG
    runs-on: ubuntu-24.04
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.14"

      - name: Generate CHANGELOG section
        run: python3 ci/release/gen_changelog.py "${{ github.ref_name }}"

      - name: Commit CHANGELOG
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add CHANGELOG
          git diff --cached --quiet || \
            git commit -m "docs(changelog): update for ${{ github.ref_name }}"
          git push origin HEAD:main

  python_sdist:
    name: Build sdist + Publish PyPI
    needs: [ changelog ]
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
      contents: read
    environment:
      name: pypi
      url: https://pypi.org/p/tachyon-ipc

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.14"

      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends gcc-14 g++-14 python3-dev
          sudo mkdir -p /usr/local/include/dlpack
          sudo curl -fsSL -o /usr/local/include/dlpack/dlpack.h \
            https://raw.githubusercontent.com/dmlc/dlpack/main/include/dlpack/dlpack.h

      - name: Build sdist
        env:
          CXX: g++-14
          CC: gcc-14
        working-directory: bindings/python
        run: |
          pip install build
          python -m build --sdist

      - name: Upload sdist artifact
        uses: actions/upload-artifact@v7
        with:
          name: python-sdist
          path: bindings/python/dist/*.tar.gz
          if-no-files-found: error

      - name: Publish to PyPI
        if: |
          !contains(github.ref_name, '-rc') &&
          !contains(github.ref_name, '-alpha') &&
          !contains(github.ref_name, '-beta')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: bindings/python/dist/

  rust_publish:
    name: Publish crates.io
    needs: [ changelog ]
    if: |
      !contains(github.ref_name, '-rc') &&
      !contains(github.ref_name, '-alpha') &&
      !contains(github.ref_name, '-beta')
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends gcc-14 g++-14

      - name: Vendor C++ core
        run: bash ci/vendor.sh rust

      - name: Publish tachyon-sys
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          CXX: g++-14
          CC: gcc-14
        working-directory: bindings/rust
        run: cargo publish -p tachyon-sys --allow-dirty

      - name: Wait for crates.io index propagation
        run: sleep 60

      - name: Publish tachyon-ipc
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          CXX: g++-14
          CC: gcc-14
        working-directory: bindings/rust
        run: cargo publish -p tachyon-ipc --allow-dirty

  go_publish:
    name: Tag Go Module
    needs: [ changelog ]
    if: |
      !contains(github.ref_name, '-rc') &&
      !contains(github.ref_name, '-alpha') &&
      !contains(github.ref_name, '-beta')
    runs-on: ubuntu-24.04
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Derive Go module tag
        id: gotag
        run: |
          VERSION="${{ github.ref_name }}"
          GO_TAG="bindings/go/${VERSION}"
          echo "tag=${GO_TAG}"     >> "$GITHUB_OUTPUT"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

      - name: Sanity-check go.mod
        run: |
          MODULE=$(grep '^module ' bindings/go/go.mod | awk '{print $2}')
          TOOLCHAIN=$(grep '^go ' bindings/go/go.mod | awk '{print $2}')
          echo "module:    ${MODULE}"
          echo "toolchain: go ${TOOLCHAIN}"
          [ "${MODULE}" = "github.com/riyaneel/tachyon/bindings/go" ] || \
            { echo "unexpected module path: ${MODULE}"; exit 1; }

      - name: Push Go module tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          GO_TAG="${{ steps.gotag.outputs.tag }}"
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          
          if git rev-parse "${GO_TAG}" >/dev/null 2>&1; then
            echo "Tag ${GO_TAG} already exists - skipping."
          else
            git tag "${GO_TAG}"
            git push origin "${GO_TAG}"
            echo "Pushed ${GO_TAG}"
          fi

      - name: Trigger pkg.go.dev indexing
        env:
          MODULE: github.com/riyaneel/tachyon/bindings/go
          VERSION: ${{ steps.gotag.outputs.version }}
        run: |
          echo "Triggering proxy fetch for ${MODULE}@${VERSION}"
          curl -fsSL --retry 3 --retry-delay 5 \
            "https://proxy.golang.org/${MODULE}/@v/${VERSION}.info" || true
          curl -fsSL --retry 3 --retry-delay 5 \
            "https://sum.golang.org/lookup/${MODULE}@${VERSION}"    || true

  java_native_linux:
    name: Build Native FFM (Linux ${{ matrix.arch }})
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            preset: clang-release
          - arch: aarch64
            preset: clang-aarch64-release

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Kitware APT repository
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y ca-certificates gpg wget
          wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | \
            gpg --dearmor - | sudo tee /usr/share/keyrings/kitware-archive-keyring.gpg >/dev/null
          echo 'deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ noble main' | \
            sudo tee /etc/apt/sources.list.d/kitware.list >/dev/null

      - name: Install dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends kitware-archive-keyring cmake ninja-build

      - name: Install aarch64 cross toolchain
        if: matrix.arch == 'aarch64'
        run: |
          sudo apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu libstdc++-14-dev-arm64-cross

      - name: Install LLVM 21
        run: bash ci/install_llvm.sh 21

      - name: Vendor C++ core
        run: bash ci/vendor.sh java

      - name: Build Linux FFM (${{ matrix.arch }})
        env:
          CC: clang-21
          CXX: clang++-21
        run: |
          cmake --preset ${{ matrix.preset }}
          cmake --build --preset ${{ matrix.preset }} --target tachyon_java_resources

      - name: Upload Linux Native asset
        uses: actions/upload-artifact@v7
        with:
          name: native-linux-${{ matrix.arch }}
          path: bindings/java/src/main/resources/native
          if-no-files-found: 'error'

  java_native_macos:
    name: Build Native FFM (${{ matrix.runner }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-26
            arch: arm64
          - runner: macos-26-intel
            arch: x86_64

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'
          cache: 'gradle'

      - name: Vendor C++ core
        run: bash ci/vendor.sh java

      - name: Build macOS FFM
        run: |
          cmake -B build/release -G Ninja -DCMAKE_BUILD_TYPE=Release
          cmake --build build/release --target tachyon_java_resources

      - name: Upload macOS Native asset
        uses: actions/upload-artifact@v7
        with:
          name: native-macos-${{ matrix.arch }}
          path: bindings/java/src/main/resources/native
          if-no-files-found: 'error'

  java_publish:
    name: Publish Fat JAR to Maven Central
    needs: [ java_native_linux, java_native_macos, changelog ]
    runs-on: ubuntu-24.04
    if: |
      !contains(github.ref_name, '-rc') &&
      !contains(github.ref_name, '-alpha') &&
      !contains(github.ref_name, '-beta')

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'
          cache: 'gradle'

      - name: Download Native Assets
        uses: actions/download-artifact@v8
        with:
          pattern: native-*
          path: bindings/java/src/main/resources/native
          merge-multiple: true

      - name: Publish to Central Portal
        working-directory: bindings/java
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.CENTRAL_TOKEN }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_PASSPHRASE }}
        run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-build-cache --rerun-tasks

      - name: Assemble Fat JAR for GitHub Release
        working-directory: bindings/java
        run: ./gradlew jar --no-daemon

      - name: Upload Fat JAR artifact
        uses: actions/upload-artifact@v7
        with:
          name: 'java-fat-jar'
          path: bindings/java/build/libs/tachyon-java-*.jar
          if-no-files-found: 'error'

  kotlin_publish:
    name: Publish Fat JAR to Maven Central
    needs: [ java_native_linux, java_native_macos, changelog ]
    runs-on: ubuntu-24.04
    if: |
      !contains(github.ref_name, '-rc') &&
      !contains(github.ref_name, '-alpha') &&
      !contains(github.ref_name, '-beta')

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'
          cache: 'gradle'

      - name: Download Native Assets
        uses: actions/download-artifact@v8
        with:
          pattern: native-*
          path: bindings/java/src/main/resources/native
          merge-multiple: true

      - name: Publish to Central Portal
        working-directory: bindings/kotlin
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.CENTRAL_TOKEN }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_PASSPHRASE }}
        run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-build-cache --rerun-tasks

      - name: Assemble Fat JAR for GitHub Release
        working-directory: bindings/kotlin
        run: ./gradlew jar --no-daemon

      - name: Upload Fat JAR artifact
        uses: actions/upload-artifact@v7
        with:
          name: 'kotlin-fat-jar'
          path: bindings/kotlin/build/libs/tachyon-kotlin-*.jar
          if-no-files-found: 'error'

  nodejs_prebuilt:
    name: Node.js Prebuilt (${{ matrix.platform }}-${{ matrix.arch }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            arch: x64
            platform: linux
          - os: macos-26-intel
            arch: x64
            platform: darwin
          - os: macos-26
            arch: arm64
            platform: darwin
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install LLVM 21 (Linux)
        if: matrix.platform == 'linux'
        run: bash ci/install_llvm.sh 21

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20

      - name: Vendor C++ core
        run: bash ci/vendor.sh node

      - name: Install dependencies
        working-directory: bindings/node
        env:
          CC: ${{ matrix.platform == 'linux' && 'clang-21' || 'clang' }}
          CXX: ${{ matrix.platform == 'linux' && 'clang++-21' || 'clang++' }}
        run: npm install

      - name: Build Prebuilt
        working-directory: bindings/node
        env:
          CC: ${{ matrix.platform == 'linux' && 'clang-21' || 'clang' }}
          CXX: ${{ matrix.platform == 'linux' && 'clang++-21' || 'clang++' }}
        run: |
          npx cmake-js compile --arch ${{ matrix.arch }}
          TARGET_DIR="prebuilds/${{ matrix.platform }}-${{ matrix.arch }}"
          mkdir -p "${TARGET_DIR}"
          cp build/Release/*.node "${TARGET_DIR}/node.napi.node"
          if [ "${{ matrix.platform }}" = "linux" ]; then
            strip "${TARGET_DIR}/node.napi.node"
          else
            strip -x "${TARGET_DIR}/node.napi.node"
          fi

      - name: Create Tarball Asset
        run: |
          mkdir -p dist
          tar -czf "dist/tachyon-node-${{ matrix.platform }}-${{ matrix.arch }}.tar.gz" -C bindings/node/prebuilds .

      - name: Upload Prebuilt Artifact (NPM publish)
        uses: actions/upload-artifact@v7
        with:
          name: node-prebuild-${{ matrix.platform }}-${{ matrix.arch }}
          path: bindings/node/prebuilds/

      - name: Upload Tarball Asset (GH Release)
        uses: actions/upload-artifact@v7
        with:
          name: node-tarball-${{ matrix.platform }}-${{ matrix.arch }}
          path: dist/*.tar.gz

  nodejs_publish:
    name: Publish Node.js to NPM
    needs: [ nodejs_prebuilt, changelog ]
    runs-on: ubuntu-24.04
    if: |
      !contains(github.ref_name, '-rc') &&
      !contains(github.ref_name, '-alpha') &&
      !contains(github.ref_name, '-beta')
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Vendor C++ core
        run: bash ci/vendor.sh node

      - name: Download all prebuilts
        uses: actions/download-artifact@v8
        with:
          path: bindings/node/prebuilds
          pattern: node-prebuild-*
          merge-multiple: 'true'

      - name: Build TypeScript
        working-directory: bindings/node
        env:
          CC: 'clang'
          CXX: 'clang++'
        run: npm install --ignore-scripts && npm run build:ts

      - name: Publish to NPM
        working-directory: bindings/node
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public

  csharp_native_linux:
    name: Build Native C# (${{ matrix.rid }})
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - rid: linux-x64
            arch: amd64
          - rid: linux-arm64
            arch: arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Kitware APT repository
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y ca-certificates gpg wget
          wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | \
            gpg --dearmor - | sudo tee /usr/share/keyrings/kitware-archive-keyring.gpg >/dev/null
          echo 'deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ noble main' | \
            sudo tee /etc/apt/sources.list.d/kitware.list >/dev/null

      - name: Install dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends kitware-archive-keyring cmake ninja-build

      - name: Install aarch64 cross toolchain
        if: matrix.arch == 'arm64'
        run: |
          sudo apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu libstdc++-14-dev-arm64-cross

      - name: Install LLVM 21
        run: bash ci/install_llvm.sh 21

      - name: Vendor C++ core
        run: bash ci/vendor.sh c#

      - name: Build libtachyon (x86-64)
        if: matrix.arch == 'amd64'
        env:
          CC: clang-21
          CXX: clang++-21
        run: |
          cmake --preset clang-release
          cmake --build --preset clang-release --target tachyon --parallel
          mkdir -p bindings/csharp/src/TachyonIpc/runtimes/linux-x64/native
          cp build/clang-release/core/libtachyon.so \
            bindings/csharp/src/TachyonIpc/runtimes/linux-x64/native/libtachyon.so

      - name: Build libtachyon (aarch64)
        if: matrix.arch == 'arm64'
        env:
          CC: clang-21
          CXX: clang++-21
        run: |
          cmake --preset clang-aarch64-release
          cmake --build --preset clang-aarch64-release --target tachyon --parallel
          mkdir -p bindings/csharp/src/TachyonIpc/runtimes/linux-arm64/native
          cp build/clang-aarch64-release/core/libtachyon.so \
            bindings/csharp/src/TachyonIpc/runtimes/linux-arm64/native/libtachyon.so

      - name: Upload native artifact
        uses: actions/upload-artifact@v7
        with:
          name: csharp-native-${{ matrix.rid }}
          path: bindings/csharp/src/TachyonIpc/runtimes/${{ matrix.rid }}/native/libtachyon.so
          if-no-files-found: error

  csharp_native_macos:
    name: Build Native C# (${{ matrix.rid }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-26
            rid: osx-arm64
          - runner: macos-26-intel
            rid: osx-x64

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Vendor C++ core
        run: bash ci/vendor.sh c#

      - name: Build libtachyon.dylib
        run: |
          cmake -B build/release -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DTACHYON_SANITIZER=none
          cmake --build build/release --target tachyon --parallel
          mkdir -p dist
          cp build/release/core/libtachyon.dylib dist/libtachyon.dylib

      - name: Upload native artifact
        uses: actions/upload-artifact@v7
        with:
          name: csharp-native-${{ matrix.rid }}
          path: dist/libtachyon.dylib
          if-no-files-found: error

  csharp_publish:
    name: NuGet Publish
    needs: [ csharp_native_linux, csharp_native_macos, changelog ]
    runs-on: ubuntu-24.04
    if: |
      !contains(github.ref_name, '-rc') &&
      !contains(github.ref_name, '-alpha') &&
      !contains(github.ref_name, '-beta')
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            8.x
            10.x

      - name: Download linux-x64 native
        uses: actions/download-artifact@v8
        with:
          name: csharp-native-linux-x64
          path: bindings/csharp/src/TachyonIpc/runtimes/linux-x64/native

      - name: Download linux-arm64 native
        uses: actions/download-artifact@v8
        with:
          name: csharp-native-linux-arm64
          path: bindings/csharp/src/TachyonIpc/runtimes/linux-arm64/native

      - name: Download osx-arm64 native
        uses: actions/download-artifact@v8
        with:
          name: csharp-native-osx-arm64
          path: bindings/csharp/src/TachyonIpc/runtimes/osx-arm64/native

      - name: Download osx-x64 native
        uses: actions/download-artifact@v8
        with:
          name: csharp-native-osx-x64
          path: bindings/csharp/src/TachyonIpc/runtimes/osx-x64/native

      - name: Pack NuGet
        working-directory: bindings/csharp/src/TachyonIpc
        run: dotnet pack -c Release -o dist/

      - name: NuGet Login
        uses: NuGet/login@v1
        id: login
        with:
          user: ${{ secrets.NUGET_USERNAME }}

      - name: NuGet push
        working-directory: bindings/csharp/src/TachyonIpc
        run: |
          dotnet nuget push dist/*.nupkg \
            --api-key ${{ steps.login.outputs.NUGET_API_KEY }} \
            --source https://api.nuget.org/v3/index.json \
            --skip-duplicate

      - name: Upload NuGet artifact
        uses: actions/upload-artifact@v7
        with:
          name: csharp-nupkg
          path: bindings/csharp/src/TachyonIpc/dist/*.nupkg
          if-no-files-found: error

  tachyon_top:
    name: Build tachyon-top CLI
    needs: [ changelog ]
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Kitware APT repository
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y ca-certificates gpg wget
          wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | \
            gpg --dearmor - | sudo tee /usr/share/keyrings/kitware-archive-keyring.gpg >/dev/null
          echo 'deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ noble main' | \
            sudo tee /etc/apt/sources.list.d/kitware.list >/dev/null

      - name: Install dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends kitware-archive-keyring cmake ninja-build

      - name: Install LLVM
        run: bash ci/install_llvm.sh 21

      - name: Configure and Build
        run: |
          cmake --preset tachyon-top-ci
          cmake --build --preset tachyon-top-ci --parallel
          strip --strip-all build/tachyon-top-ci/tools/tachyon-top/tachyon_top
          mv build/tachyon-top-ci/tools/tachyon-top/tachyon_top tachyon-top-linux-x86_64

      - name: Upload tachyon-top artifact
        uses: actions/upload-artifact@v7
        with:
          name: tachyon-top-linux-x86_64
          path: tachyon-top-linux-x86_64
          if-no-files-found: 'error'

  github_release:
    name: Create GitHub Release
    needs: [ python_sdist, rust_publish, go_publish, java_publish, kotlin_publish, nodejs_publish, csharp_publish, tachyon_top ]
    if: |
      always() &&
      needs.python_sdist.result == 'success' &&
      (needs.rust_publish.result == 'success' || needs.rust_publish.result == 'skipped') &&
      (needs.go_publish.result == 'success'   || needs.go_publish.result == 'skipped')  &&
      (needs.java_publish.result == 'success' || needs.java_publish.result == 'skipped') &&
      (needs.kotlin_publish.result == 'success' || needs.kotlin_publish.result == 'skipped') &&
      (needs.nodejs_publish.result == 'success' || needs.nodejs_publish.result == 'skipped') &&
      (needs.csharp_publish.result == 'success' || needs.csharp_publish.result == 'skipped') &&
      needs.tachyon_top.result == 'success'
    runs-on: ubuntu-24.04
    permissions:
      attestations: write
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: main
          fetch-depth: 0

      - name: Download Python sdist
        uses: actions/download-artifact@v8
        with:
          name: python-sdist
          path: dist/

      - name: Download Java Fat JAR
        if: needs.java_publish.result == 'success'
        uses: actions/download-artifact@v8
        with:
          name: java-fat-jar
          path: dist/

      - name: Download Kotlin Fat JAR
        if: needs.kotlin_publish.result == 'success'
        uses: actions/download-artifact@v8
        with:
          name: kotlin-fat-jar
          path: dist/

      - name: Download Node Tarballs
        uses: actions/download-artifact@v8
        with:
          path: dist/
          pattern: node-tarball-*
          merge-multiple: 'true'

      - name: Download NuGet package
        if: needs.csharp_publish.result == 'success'
        uses: actions/download-artifact@v8
        with:
          name: csharp-nupkg
          path: dist/

      - name: Download tachyon-top binary
        uses: actions/download-artifact@v8
        with:
          name: tachyon-top-linux-x86_64
          path: dist/

      - name: Create C++ source tarball
        run: |
          TAG="${{ github.ref_name }}"
          git archive \
            --format=tar.gz \
            --prefix="tachyon-${TAG}/" \
            --output="dist/tachyon-${TAG}-source.tar.gz" \
            "${TAG}"

      - name: Generate SHA256 checksums
        run: |
          cd dist
          find . -maxdepth 1 -type f | sort | xargs sha256sum > SHA256SUMS
          cat SHA256SUMS

      - name: Generate SLSA provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: 'dist/*'

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign artifacts
        run: |
          for f in dist/*; do
            [ -f "$f" ] || continue
            cosign sign-blob --yes "$f" \
              --bundle "${f}.bundle"
          done

      - name: Extract release notes from CHANGELOG
        id: notes
        run: |
          python3 - <<'EOF' > /tmp/release_notes.md
          import re, sys

          tag = "${{ github.ref_name }}"
          try:
              text = open("CHANGELOG").read()
              pattern = rf"(## \[{re.escape(tag)}\].*?)(?=\n## |\Z)"
              m = re.search(pattern, text, re.DOTALL)
              if m:
                  print(m.group(1).strip())
              else:
                  print(f"Release {tag}")
          except FileNotFoundError:
              print(f"Release {tag}")
          EOF

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ github.ref_name }}"
          PRERELEASE_FLAG=""
          if echo "${TAG}" | grep -qE '\-(rc|alpha|beta)'; then
            PRERELEASE_FLAG="--prerelease"
          fi

          gh release create "${TAG}" \
            --title "Tachyon ${TAG}" \
            --notes-file /tmp/release_notes.md \
            ${PRERELEASE_FLAG} \
            dist/*