arstack-studio-linux-auto-release.yml

name: Attach Linux AppImage On Stable Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      release_tag:
        description: 'Published latest stable tag to package (manual fallback if release event was suppressed)'
        required: true
        type: string
  pull_request:
    paths:
      - '.github/workflows/arstack-studio-linux-auto-release.yml'

permissions:
  contents: read
  actions: write

jobs:
  dispatch-matched-linux-package:
    name: Build tested AppImage for newly published stable tag
    if: ${{ (github.event_name == 'release' && !github.event.release.draft && !github.event.release.prerelease) || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check published release assets before dispatch
        id: eligibility
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}
        run: |
          set -euo pipefail
          gh api "repos/$GITHUB_REPOSITORY/releases/tags/$TAG" > release.json
          gh api "repos/$GITHUB_REPOSITORY/releases/latest" > latest.json
          python3 - <<'PY'
          import json,os,sys
          r=json.load(open('release.json'))
          latest=json.load(open('latest.json'))
          tag=os.environ['TAG']
          assert r['tag_name']==tag, 'GitHub release tag mismatch'
          assert not r['draft'] and not r['prerelease'], 'Only published stable releases are eligible'
          assert r['id']==latest['id'], 'Only the latest stable release may receive a Linux package'
          # M3.H is frozen under its existing five-asset immutable acceptance record.
          frozen_tag='processbus-sim-m3h-20261024'
          if tag==frozen_tag:
              print('SKIP: immutable historical M3.H stays unchanged; Linux ships with a future stable tag')
              with open(os.environ['GITHUB_OUTPUT'],'a') as out: out.write('dispatch=false\n')
              sys.exit(0)
          assets={a['name']:a for a in r['assets']}
          required={'firmware-manifest.json','SHA256SUMS.txt'}
          assert required.issubset(assets), 'Missing signed-off firmware manifest or checksums'
          assert any(n.lower().endswith('.bin') for n in assets), 'Board firmware not published'
          assert len([n for n in assets if n.lower().endswith('setup.exe') and 'win' in n.lower()])==1, 'Missing unambiguous Windows setup'
          assert any(n.lower().endswith('portable.zip') for n in assets), 'Windows portable package not published'
          for n,a in assets.items():
              if n.lower().endswith(('setup.exe','.bin','portable.zip')):
                  assert (a.get('digest') or '').startswith('sha256:'), f'Unverified release asset: {n}'
          linux='ARStack-Studio-linux-x86_64.AppImage'
          checksum='ARStack-Studio-linux-x86_64.sha256'
          assert (linux in assets)==(checksum in assets), 'Linux AppImage/checksum incomplete pair'
          available=linux in assets
          with open(os.environ['GITHUB_OUTPUT'],'a') as out:
              out.write(f"dispatch={'false' if available else 'true'}\n")
          if available:
              print('PASS: latest stable release already contains Linux AppImage and checksum')
          else:
              print('PASS: latest stable Windows + firmware release is complete; start exact-tag Linux build')
          PY

      - name: Dispatch exact-tag Linux AppImage build, smoke and attach workflow
        if: ${{ steps.eligibility.outputs.dispatch == 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}
        run: |
          gh workflow run arstack-studio-linux-appimage.yml \
            --repo "$GITHUB_REPOSITORY" --ref main \
            --field release_tag="$TAG"
          echo "Dispatched Linux build for release tag: $TAG"