revert: roll back post-5831626 CI pipeline changes

.github/workflows/prerelease.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   prepare-release:
     name: Prepare Prerelease
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
 
     outputs:
       release_tag: ${{ steps.prerelease-meta.outputs.release_tag }}
@@ -73,15 +73,17 @@ jobs:
             --prerelease
 
   publish-tauri:
-    name: Build + Package (${{ matrix.target }})
+    name: Build + Publish (${{ matrix.target }})
     needs: prepare-release
-    # Use explicit per-target runner labels so each release build can scale independently.
-    runs-on: ${{ matrix.runs_on }}
+    # Set OPENWORK_LINUX_X64_RUNNER_LABEL to route only the Linux x86_64 build to a larger runner.
+    runs-on: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
     timeout-minutes: 360
 
     env:
+      RELEASE_TAG: ${{ needs.prepare-release.outputs.release_tag }}
+      RELEASE_NAME: ${{ needs.prepare-release.outputs.release_name }}
+      RELEASE_BODY: ${{ needs.prepare-release.outputs.release_body }}
       MACOS_NOTARIZE: ${{ vars.MACOS_NOTARIZE || 'false' }}
-      RUSTFLAGS: ${{ matrix.os_type == 'linux' && '-C link-arg=-fuse-ld=lld' || '' }}
       OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
       OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
 
@@ -89,53 +91,223 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os_type: macos
+          - platform: macos-14
+            os_type: macos
             target: aarch64-apple-darwin
-            runs_on: macos-latest
             args: "--target aarch64-apple-darwin --bundles dmg,app"
-          - os_type: macos
+          - platform: macos-14
+            os_type: macos
             target: x86_64-apple-darwin
-            runs_on: macos-26-intel
             args: "--target x86_64-apple-darwin --bundles dmg,app"
-          - os_type: linux
+          - platform: ubuntu-22.04
+            os_type: linux
             target: x86_64-unknown-linux-gnu
-            runs_on: blacksmith-16vcpu-ubuntu-2404
             args: "--target x86_64-unknown-linux-gnu --bundles deb,rpm"
-          - os_type: windows
+          - platform: ubuntu-22.04-arm
+            os_type: linux
+            target: aarch64-unknown-linux-gnu
+            args: "--target aarch64-unknown-linux-gnu --bundles deb,rpm"
+          - platform: windows-2022
+            os_type: windows
             target: x86_64-pc-windows-msvc
-            runs_on: blacksmith-16vcpu-windows-2025
             args: "--target x86_64-pc-windows-msvc --bundles msi"
 
     steps:
       - name: Log runner selection
         shell: bash
         run: |
-          echo "Configured runs-on: ${RUNS_ON}"
-          echo "Build target: ${TARGET}"
+          echo "Requested larger runner label: ${RUNNER_LABEL:-<unset>}"
+          echo "Effective runs-on: ${EFFECTIVE_RUNS_ON}"
         env:
-          RUNS_ON: ${{ matrix.runs_on }}
-          TARGET: ${{ matrix.target }}
+          RUNNER_LABEL: ${{ vars.OPENWORK_LINUX_X64_RUNNER_LABEL }}
+          EFFECTIVE_RUNS_ON: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
 
       - name: Checkout
         uses: actions/checkout@v4
         with:
           ref: ${{ github.sha }}
 
-      - name: Setup desktop build environment
-        uses: ./.github/actions/setup-desktop-build-env
+      - name: Setup Node
+        uses: actions/setup-node@v4
         with:
-          os-type: ${{ matrix.os_type }}
-          rust-target: ${{ matrix.target }}
+          node-version: 20
 
-      - name: Install OpenCode sidecar
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install OpenTUI x64 core (macOS x86_64)
+        if: matrix.os_type == 'macos' && matrix.target == 'x86_64-apple-darwin'
+        run: pnpm add -w --ignore-workspace-root-check @opentui/core-darwin-x64@0.1.77
+
+      - name: Install Linux build dependencies
+        if: matrix.os_type == 'linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libgtk-3-dev \
+            libglib2.0-dev \
+            libayatana-appindicator3-dev \
+            libsoup-3.0-dev \
+            libwebkit2gtk-4.1-dev \
+            libssl-dev \
+            rpm \
+            libdbus-1-dev \
+            librsvg2-dev
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Resolve OpenCode version
+        id: opencode-version
+        shell: bash
         env:
           GITHUB_TOKEN: ${{ github.token }}
-          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-          TARGET: ${{ matrix.target }}
-          OS_TYPE: ${{ matrix.os_type }}
         run: |
-          node scripts/release/install-opencode-sidecar.mjs
+          node <<'NODE' >> "$GITHUB_OUTPUT"
+          const fs = require('fs');
+          const repo = (process.env.OPENCODE_GITHUB_REPO || 'anomalyco/opencode').trim() || 'anomalyco/opencode';
+
+          async function resolveLatest() {
+            const token = (process.env.GITHUB_TOKEN || '').trim();
+            const headers = {
+              'Accept': 'application/vnd.github+json',
+              'X-GitHub-Api-Version': '2022-11-28',
+              'User-Agent': 'openwork-ci',
+            };
+            if (token) headers.Authorization = `Bearer ${token}`;
+
+            // Prefer API, but fall back to the web "latest" redirect if rate-limited (403) or otherwise blocked.
+            try {
+              const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, { headers });
+              if (res.ok) {
+                const data = await res.json();
+                const tag = (typeof data.tag_name === 'string' ? data.tag_name : '').trim();
+                let v = tag.startsWith('v') ? tag.slice(1) : tag;
+                v = v.trim();
+                if (v) return v;
+              }
+              if (res.status !== 403) {
+                throw new Error(`Failed to resolve latest OpenCode version (HTTP ${res.status})`);
+              }
+            } catch {
+              // continue to fallback
+            }
+
+            const web = await fetch(`https://github.com/${repo}/releases/latest`, {
+              headers: { 'User-Agent': 'openwork-ci' },
+              redirect: 'follow',
+            });
+            const url = (web && web.url) ? String(web.url) : '';
+            const match = url.match(/\/tag\/v([^/?#]+)/);
+            if (!match) throw new Error('Failed to resolve latest OpenCode version (web redirect).');
+            return match[1];
+          }
+
+          async function main() {
+            const pkg = JSON.parse(fs.readFileSync('./packages/desktop/package.json', 'utf8'));
+            const configuredRaw = (process.env.OPENCODE_VERSION || pkg.opencodeVersion || '').toString().trim();
+            if (configuredRaw && configuredRaw.toLowerCase() !== 'latest') {
+              const normalized = configuredRaw.startsWith('v') ? configuredRaw.slice(1) : configuredRaw;
+              const resolved = normalized.trim();
+              if (process.env.GITHUB_ENV) {
+                fs.appendFileSync(process.env.GITHUB_ENV, `OPENCODE_VERSION=${resolved}\n`);
+              }
+              console.log('version=' + resolved);
+              return;
+            }
+            const latest = await resolveLatest();
+            if (process.env.GITHUB_ENV) {
+              fs.appendFileSync(process.env.GITHUB_ENV, `OPENCODE_VERSION=${latest}\n`);
+            }
+            console.log('version=' + latest);
+          }
+
+          main().catch((err) => {
+            console.error(err);
+            process.exit(1);
+          });
+          NODE
+
+      - name: Download OpenCode sidecar
+        shell: bash
+        env:
+          OPENCODE_VERSION: ${{ steps.opencode-version.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          case "${{ matrix.target }}" in
+            aarch64-apple-darwin)
+              opencode_asset="opencode-darwin-arm64.zip"
+              ;;
+            x86_64-apple-darwin)
+              opencode_asset="opencode-darwin-x64-baseline.zip"
+              ;;
+            x86_64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-x64-baseline.tar.gz"
+              ;;
+            aarch64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-arm64.tar.gz"
+              ;;
+            x86_64-pc-windows-msvc)
+              opencode_asset="opencode-windows-x64-baseline.zip"
+              ;;
+            *)
+              echo "Unsupported target: ${{ matrix.target }}"
+              exit 1
+              ;;
+          esac
+
+          repo="${OPENCODE_GITHUB_REPO:-anomalyco/opencode}"
+          url="https://github.com/${repo}/releases/download/v${OPENCODE_VERSION}/${opencode_asset}"
+          tmp_dir="$RUNNER_TEMP/opencode"
+          extract_dir="$tmp_dir/extracted"
+          rm -rf "$tmp_dir"
+          mkdir -p "$extract_dir"
+          curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 -o "$tmp_dir/$opencode_asset" "$url"
+
+          if [[ "$opencode_asset" == *.tar.gz ]]; then
+            tar -xzf "$tmp_dir/$opencode_asset" -C "$extract_dir"
+          else
+            if command -v unzip >/dev/null 2>&1; then
+              unzip -q "$tmp_dir/$opencode_asset" -d "$extract_dir"
+            elif command -v 7z >/dev/null 2>&1; then
+              7z x "$tmp_dir/$opencode_asset" -o"$extract_dir" >/dev/null
+            else
+              echo "No unzip utility available"
+              exit 1
+            fi
+          fi
+
+          if [ -f "$extract_dir/opencode" ]; then
+            bin_path="$extract_dir/opencode"
+          elif [ -f "$extract_dir/opencode.exe" ]; then
+            bin_path="$extract_dir/opencode.exe"
+          else
+            echo "OpenCode binary not found in archive"
+            ls -la "$extract_dir"
+            exit 1
+          fi
+
+          target_name="opencode-${{ matrix.target }}"
+          if [ "${{ matrix.os_type }}" = "windows" ]; then
+            target_name="${target_name}.exe"
+          fi
+
+          mkdir -p packages/desktop/src-tauri/sidecars
+          cp "$bin_path" "packages/desktop/src-tauri/sidecars/${target_name}"
+          chmod 755 "packages/desktop/src-tauri/sidecars/${target_name}"
 
       - name: Write notary API key
         if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
@@ -150,181 +322,59 @@ jobs:
 
           echo "NOTARY_KEY_PATH=$NOTARY_KEY_PATH" >> "$GITHUB_ENV"
 
-      - name: Build desktop workflow artifacts
-        uses: ./.github/actions/run-tauri-release-build
+      - name: Build + upload (notarized)
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        uses: tauri-apps/tauri-action@v0.5.17
         env:
+          CI: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # Tauri updater signing
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+          # macOS signing
           APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+
+          # macOS notarization (App Store Connect API key)
           APPLE_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
           APPLE_API_ISSUER: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
           APPLE_API_KEY_PATH: ${{ env.NOTARY_KEY_PATH }}
         with:
-          os-type: ${{ matrix.os_type }}
-          notarize: ${{ matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true' }}
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          prerelease: true
+          releaseDraft: false
+          projectPath: packages/desktop
+          tauriScript: pnpm exec tauri -vvv
           args: ${{ matrix.args }}
-          upload-updater-json: false
-          updater-json-prefer-nsis: true
-          workflow-artifact-name-pattern: desktop-release-[platform]-[arch]-[bundle]
+          retryAttempts: 3
 
-      - name: Verify versions.json bundled (macOS)
-        if: success() && matrix.os_type == 'macos'
-        shell: bash
-        run: |
-          set -euo pipefail
-          app_path="packages/desktop/src-tauri/target/${{ matrix.target }}/release/bundle/macos/OpenWork.app"
-          manifest_path="$app_path/Contents/MacOS/versions.json"
-
-          if [ ! -f "$manifest_path" ]; then
-            echo "ERROR: versions.json missing from app bundle: $manifest_path" >&2
-            echo "Hint: ensure packages/desktop/src-tauri/tauri.conf.json bundles sidecars/versions.json" >&2
-            exit 1
-          fi
-
-          echo "Found bundled versions.json at $manifest_path"
-
-  build-tauri-linux-arm64:
-    name: Build ARM64 Linux binary
-    needs: prepare-release
-    runs-on: blacksmith-16vcpu-ubuntu-2404-arm
-    timeout-minutes: 360
-
-    env:
-      RUSTFLAGS: -C link-arg=-fuse-ld=lld
-      OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-      OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-
-    steps:
-      - name: Log runner selection
-        shell: bash
-        run: |
-          echo "Configured runs-on: blacksmith-16vcpu-ubuntu-2404-arm"
-          echo "Build target: aarch64-unknown-linux-gnu"
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.sha }}
-
-      - name: Setup desktop build environment
-        uses: ./.github/actions/setup-desktop-build-env
-        with:
-          os-type: linux
-          rust-target: aarch64-unknown-linux-gnu
-
-      - name: Install OpenCode sidecar
+      - name: Build + upload
+        if: matrix.os_type != 'macos' || env.MACOS_NOTARIZE != 'true'
+        uses: tauri-apps/tauri-action@v0.5.17
         env:
-          GITHUB_TOKEN: ${{ github.token }}
-          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-          TARGET: aarch64-unknown-linux-gnu
-          OS_TYPE: linux
-        run: node scripts/release/install-opencode-sidecar.mjs
+          CI: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build ARM64 binary without bundling
-        run: pnpm --dir packages/desktop exec tauri build --target aarch64-unknown-linux-gnu --no-bundle
+          # Tauri updater signing
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
-      - name: Upload ARM64 target directory
-        uses: actions/upload-artifact@v4
+          # macOS signing
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
         with:
-          name: desktop-build-linux-arm64-target-dir
-          path: packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu
-          if-no-files-found: error
-
-  bundle-tauri-linux-arm64:
-    name: Bundle ARM64 Linux packages
-    needs: [prepare-release, build-tauri-linux-arm64]
-    runs-on: blacksmith-16vcpu-ubuntu-2404
-    timeout-minutes: 360
-
-    env:
-      RUSTFLAGS: -C link-arg=-fuse-ld=lld
-      OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-      OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-
-    steps:
-      - name: Log runner selection
-        shell: bash
-        run: |
-          echo "Configured runs-on: blacksmith-16vcpu-ubuntu-2404"
-          echo "Bundle target: aarch64-unknown-linux-gnu"
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.sha }}
-
-      - name: Setup desktop build environment
-        uses: ./.github/actions/setup-desktop-build-env
-        with:
-          os-type: linux
-          rust-target: aarch64-unknown-linux-gnu
-
-      - name: Install OpenCode sidecar
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-          TARGET: aarch64-unknown-linux-gnu
-          OS_TYPE: linux
-        run: node scripts/release/install-opencode-sidecar.mjs
-
-      - name: Restore ARM64 target directory
-        uses: actions/download-artifact@v4
-        with:
-          name: desktop-build-linux-arm64-target-dir
-          path: packages/desktop/src-tauri/target
-
-      - name: Bundle ARM64 Linux packages on x86 runner
-        run: pnpm --dir packages/desktop exec tauri bundle --target aarch64-unknown-linux-gnu --bundles deb,rpm
-
-      - name: Upload ARM64 deb workflow artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: desktop-release-linux-arm64-deb
-          path: |
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/deb/*.deb
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/deb/*.deb.sig
-          if-no-files-found: error
-
-      - name: Upload ARM64 rpm workflow artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: desktop-release-linux-aarch64-rpm
-          path: |
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/rpm/*.rpm
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/rpm/*.rpm.sig
-          if-no-files-found: error
-
-  upload-tauri-release-assets:
-    name: Upload desktop release assets
-    needs: [prepare-release, publish-tauri, bundle-tauri-linux-arm64]
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-
-    env:
-      RELEASE_TAG: ${{ needs.prepare-release.outputs.release_tag }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.sha }}
-
-      - name: Download desktop workflow artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: desktop-release-*
-          path: ${{ runner.temp }}/desktop-release-artifacts
-
-      - name: Upload desktop assets to prerelease
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          node scripts/release/upload-desktop-release-assets.mjs \
-            --repo "$GITHUB_REPOSITORY" \
-            --tag "$RELEASE_TAG" \
-            --artifacts-dir "$RUNNER_TEMP/desktop-release-artifacts"
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          prerelease: true
+          releaseDraft: false
+          projectPath: packages/desktop
+          tauriScript: pnpm exec tauri -vvv
+          args: ${{ matrix.args }}
+          retryAttempts: 3