open-design/.github/workflows/dsh-bootstrap-publish.yml

name: dsh-bootstrap-publish

# Publish immutable DeepSeek Harness bootstrap installers to R2 from the
# product-owned canonical source under tools/release/resources/dsh-bootstrap/.
#
# Standalone and outside the merge gate (like nix.yml / docker-image.yml).

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - "tools/release/resources/dsh-bootstrap/**"
      - "tools/release/src/storage/dsh-bootstrap-*.ts"
      - "tools/release/src/storage/publish-dsh-bootstrap.ts"
      - "tools/release/src/storage/common.ts"
      - "tools/release/src/storage/s3-upload.ts"
      - ".github/workflows/dsh-bootstrap-publish.yml"

permissions:
  contents: read

concurrency:
  # The publisher uses a monotonic CAS update so queued reruns cannot rewind
  # latest after a newer version ships.
  group: dsh-bootstrap-publish
  cancel-in-progress: false

jobs:
  publish:
    name: Publish DeepSeek Harness bootstrap installers
    if: github.repository == 'nexu-io/open-design' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          ref: ${{ github.sha }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build tools-release
        run: pnpm --filter @open-design/tools-release build

      - name: Verify publisher checkout is current main
        run: |
          set -euo pipefail
          published_sha="$(git rev-parse HEAD)"
          if [ "$published_sha" != "$GITHUB_SHA" ]; then
            echo "::error::publisher checkout resolved $published_sha but workflow dispatch SHA is $GITHUB_SHA"
            exit 1
          fi
          main_sha="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
          if [ "$GITHUB_SHA" != "$main_sha" ]; then
            echo "::error::refusing DSH bootstrap publish for stale workflow SHA $GITHUB_SHA; current origin/main is $main_sha"
            echo "::error::dispatch a fresh workflow from current main instead of rerunning an old publish."
            exit 1
          fi

      # Canonical installer bytes. Version is derived from content: unchanged
      # installers reuse the published version; edits mint the next one.
      # `DSH_BOOTSTRAP_VERSION` remains an escape hatch that forces one version
      # and still fails closed on a content mismatch.
      - name: Publish immutable DeepSeek Harness bootstrap installers to R2
        id: dsh_bootstrap
        env:
          DSH_BOOTSTRAP_SOURCE_DIR: tools/release/resources/dsh-bootstrap
          RELEASE_BRANCH: ${{ github.ref_name }}
          RELEASE_COMMIT: ${{ github.sha }}
          RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
          RELEASE_REPOSITORY: ${{ github.repository }}
          RELEASE_RUN_ATTEMPT: ${{ github.run_attempt }}
          RELEASE_RUN_ID: ${{ github.run_id }}
          RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
          RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
          RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
          RELEASE_STORAGE_REGION: auto
          RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
          RELEASE_WORKFLOW: ${{ github.workflow }}
        run: pnpm exec tools-release publish-dsh-bootstrap

      - name: Verify public DeepSeek Harness bootstrap downloads
        env:
          DSH_BOOTSTRAP_VERSION: ${{ steps.dsh_bootstrap.outputs.version }}
          RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
        run: |
          set -euo pipefail
          if [ -z "$DSH_BOOTSTRAP_VERSION" ]; then
            echo "::error::publish step did not report a bootstrap version"
            exit 1
          fi
          download_dir="$(mktemp -d)"
          trap 'rm -rf "$download_dir"' EXIT
          for name in install-dsh.sh install-dsh.ps1 install-dsh.cmd SHA256SUMS; do
            curl --fail --silent --show-error --location \
              --retry 5 --retry-delay 1 --retry-all-errors \
              "$RELEASE_PUBLIC_ORIGIN/bootstrap/dsh/$DSH_BOOTSTRAP_VERSION/$name" \
              --output "$download_dir/$name"
          done
          (
            cd "$download_dir"
            sha256sum --check SHA256SUMS
          )