publish.yaml

# =============================================================================
# Publish
# =============================================================================
#
# Single workflow for preview publish AND release cuts. Both triggers are
# manual (workflow_dispatch). The build + npm publish steps run identically for
# both modes. Only the build profile (debug vs release), npm dist-tag, and the
# release-only tail (crates.io, GitHub release assets, R2, git tag) differ.
#
# Triggers and mapping:
#   workflow_dispatch (no version)   → trigger=branch  npm_tag=<sanitized branch>  build=debug
#   workflow_dispatch (with version) → trigger=release npm_tag=latest              build=release
#                                       (npm_tag becomes `rc` if version contains `-rc.`, or
#                                        `next` if `latest=false`)
#
# Preview publishes are fast: debug sidecar build, npm only (the binary ships
# inside the npm platform package), crates dry-run. Releases add the crates.io
# publish, GitHub release assets, R2 mirror, and git tag.
# =============================================================================

name: publish

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. 0.2.0 or 0.2.0-rc.1). Leave empty for preview publish on the dispatched branch."
        required: false
        type: string
      latest:
        description: "Tag as @latest (release only)"
        required: true
        type: boolean
        default: true
      secure_exec_version:
        description: "secure-exec RELEASE version to publish against (REQUIRED when version is set; must exist on npm AND crates.io). Ignored for previews — they auto-cut a secure-exec preview at the committed .github/refs/secure-exec."
        required: false
        type: string

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

env:
  R2_BUCKET: rivet-releases
  R2_ENDPOINT: https://2a94c6a0ced8d35ea63cddc86c2681e7.r2.cloudflarestorage.com
  # Platform list kept in sync with packages/*sidecar*/npm/* and the build
  # matrix below. Also consumed by scripts/publish discovery via SIDECAR_PLATFORMS.
  SIDECAR_PLATFORMS: "linux-x64-gnu linux-arm64-gnu darwin-x64 darwin-arm64"

jobs:
  # ---------------------------------------------------------------------------
  # context — resolve PublishContext once, pin as job outputs
  # ---------------------------------------------------------------------------
  context:
    name: "Context"
    runs-on: ubuntu-latest
    outputs:
      trigger: ${{ steps.ctx.outputs.trigger }}
      version: ${{ steps.ctx.outputs.version }}
      npm_tag: ${{ steps.ctx.outputs.npm_tag }}
      sha: ${{ steps.ctx.outputs.sha }}
      latest: ${{ steps.ctx.outputs.latest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      # Committed deps are link: into ../secure-exec — a bare clone at the
      # committed ref is enough for pnpm install to resolve the links.
      - name: Materialize secure-exec sibling (clone-only)
        run: node scripts/secure-exec-dep.mjs prepare-build --clone-only
      - name: Install publish scripts
        run: pnpm install --frozen-lockfile --filter=publish
      - id: ctx
        name: Resolve publish context
        run: pnpm --filter=publish exec tsx src/ci/bin.ts context-output

  # ---------------------------------------------------------------------------
  # secure-exec-version — the published secure-exec this publish builds against
  # ---------------------------------------------------------------------------
  # The committed state is file deps at .github/refs/secure-exec; a PUBLISH needs real
  # resolvable versions. Previews auto-cut (or reuse) a secure-exec preview at
  # that exact sha; releases REQUIRE the secure_exec_version input to be a real
  # secure-exec release (npm + crates.io) so npm and crates stay coherent.
  # Cross-repo dispatch needs a token with workflow rights on secure-exec:
  # SECURE_EXEC_DISPATCH_TOKEN (falls back to github.token, which can only
  # verify, not dispatch).
  secure-exec-version:
    needs: [context]
    name: "Resolve secure-exec version"
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve.outputs.version }}
      registry_tag: ${{ steps.resolve.outputs.registry_tag }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - id: resolve
        name: Resolve (release) or cut (preview) the secure-exec version
        env:
          GH_TOKEN: ${{ secrets.SECURE_EXEC_DISPATCH_TOKEN || github.token }}
          SECURE_EXEC_REPO: rivet-dev/secure-exec
        run: |
          set -euo pipefail
          if [ "${{ needs.context.outputs.trigger }}" = "release" ]; then
            v="${{ github.event.inputs.secure_exec_version }}"
            if [ -z "$v" ]; then
              echo "::error::releases require the secure_exec_version input (a real secure-exec release)"; exit 1
            fi
            case "$v" in 0.0.0-*) echo "::error::secure_exec_version must be a real release, not a preview"; exit 1;; esac
            npm view "@secure-exec/core@$v" version >/dev/null
            curl -sf "https://index.crates.io/se/cu/secure-exec-sidecar" | grep -q "\"vers\":\"$v\"" || { echo "::error::secure-exec-sidecar@$v is not on crates.io"; exit 1; }
            echo "version=$v" >> "$GITHUB_OUTPUT"
            echo "registry_tag=latest" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          sha=$(tr -d '[:space:]' < .github/refs/secure-exec)
          short=${sha:0:7}
          branch="agentos-dep-${short}"
          version="0.0.0-${branch}.${short}"
          if npm view "@secure-exec/core@${version}" version >/dev/null 2>&1; then
            echo "secure-exec preview ${version} already published — reusing it"
          else
            echo "cutting secure-exec preview at ${sha} (branch ${branch})"
            gh api "repos/${SECURE_EXEC_REPO}/git/refs" -f ref="refs/heads/${branch}" -f sha="${sha}"               || echo "branch ${branch} already exists"
            gh workflow run publish.yaml -R "${SECURE_EXEC_REPO}" --ref "${branch}"
            sleep 15
            run=$(gh run list -R "${SECURE_EXEC_REPO}" --workflow=publish.yaml --branch "${branch}" -L1 --json databaseId --jq '.[0].databaseId')
            gh run watch -R "${SECURE_EXEC_REPO}" "$run" --exit-status
            npm view "@secure-exec/core@${version}" version >/dev/null
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "registry_tag=${branch}" >> "$GITHUB_OUTPUT"

  # ---------------------------------------------------------------------------
  # build-sidecar — debug (preview) or release (release) sidecar binaries
  # ---------------------------------------------------------------------------
  build-sidecar:
    needs: [context, secure-exec-version]
    name: "Build sidecar (${{ matrix.platform }})"
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-x64-gnu
            runner: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - platform: linux-arm64-gnu
            runner: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          key: ${{ matrix.target }}-${{ needs.context.outputs.trigger }}
      - uses: actions/cache@v4
        with:
          path: ~/.cargo/.rusty_v8
          key: ${{ runner.os }}-${{ matrix.target }}-rusty-v8-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-rusty-v8-
      - name: Swap deps to published versions (transient, never committed)
        run: node scripts/secure-exec-dep.mjs release-swap "${{ needs.secure-exec-version.outputs.version }}" "${{ needs.secure-exec-version.outputs.registry_tag }}"
      - run: pnpm install --no-frozen-lockfile --filter='!@agentos/website'
      # On a preview the cargo deps stay path-based (crates.io has no preview
      # track) — materialize ../secure-exec at the committed ref. No-op on
      # releases (release-swap pinned the crates to the real release).
      - name: Prepare secure-exec sibling
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/secure-exec-dep.mjs prepare-build
      - name: Build sidecar binary
        id: build
        run: |
          set -euo pipefail
          out="target/sidecar-artifacts/${{ matrix.platform }}"
          mkdir -p "$out"
          if [ "${{ needs.context.outputs.trigger }}" = "release" ]; then
            cargo build --release -p agentos-sidecar --target ${{ matrix.target }}
            profile="release"
          else
            cargo build -p agentos-sidecar --target ${{ matrix.target }}
            profile="debug"
          fi
          cp "target/${{ matrix.target }}/${profile}/agentos-sidecar" "$out/agentos-sidecar"
          echo "dir=$out" >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@v4
        with:
          name: sidecar-${{ matrix.platform }}
          path: ${{ steps.build.outputs.dir }}
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # build-plugin — agent-os actor plugin cdylib (debug preview / release)
  # ---------------------------------------------------------------------------
  # Ships inside the @rivet-dev/agentos-plugin-<platform> npm packages, declared
  # as optionalDependencies of @rivet-dev/agentos.
  build-plugin:
    needs: [context, secure-exec-version]
    name: "Build plugin (${{ matrix.platform }})"
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-x64-gnu
            runner: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - platform: linux-arm64-gnu
            runner: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
          key: plugin-${{ matrix.target }}-${{ needs.context.outputs.trigger }}
      - uses: actions/cache@v4
        with:
          path: ~/.cargo/.rusty_v8
          key: ${{ runner.os }}-${{ matrix.target }}-rusty-v8-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-rusty-v8-
      - name: Swap deps to published versions (transient, never committed)
        run: node scripts/secure-exec-dep.mjs release-swap "${{ needs.secure-exec-version.outputs.version }}" "${{ needs.secure-exec-version.outputs.registry_tag }}"
      - run: pnpm install --no-frozen-lockfile --filter='!@agentos/website'
      # Preview: cargo stays path-based — materialize ../secure-exec at the
      # committed ref. No-op on releases.
      - name: Prepare secure-exec sibling
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/secure-exec-dep.mjs prepare-build
      - name: Build plugin cdylib
        id: build
        run: |
          set -euo pipefail
          out="target/plugin-artifacts/${{ matrix.platform }}"
          mkdir -p "$out"
          if [ "${{ needs.context.outputs.trigger }}" = "release" ]; then
            cargo build --release -p agentos-actor-plugin --target ${{ matrix.target }}
            profile="release"
          else
            cargo build -p agentos-actor-plugin --target ${{ matrix.target }}
            profile="debug"
          fi
          cp "target/${{ matrix.target }}/${profile}/libagentos_actor_plugin.so" \
            "$out/libagentos_actor_plugin.so"
          echo "dir=$out" >> "$GITHUB_OUTPUT"
      - uses: actions/upload-artifact@v4
        with:
          name: plugin-${{ matrix.platform }}
          path: ${{ steps.build.outputs.dir }}
          if-no-files-found: error

  # darwin via osxcross in a Linux container (rivet's approach) — no macOS
  # runners. The image builds both the sidecar binary and actor plugin cdylib.
  build-sidecar-darwin:
    needs: [context, secure-exec-version]
    name: "Build darwin binaries (${{ matrix.platform }})"
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: darwin-x64
            target: x86_64-apple-darwin
            clang: x86_64-apple-darwin20.4
          - platform: darwin-arm64
            target: aarch64-apple-darwin
            clang: aarch64-apple-darwin20.4
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - name: Swap deps to published versions (transient, never committed)
        run: node scripts/secure-exec-dep.mjs release-swap "${{ needs.secure-exec-version.outputs.version }}" "${{ needs.secure-exec-version.outputs.registry_tag }}"
      - name: Log in to ghcr.io (pull the osxcross base image)
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
      - name: Cross-compile via osxcross
        run: |
          set -euo pipefail
          DOCKER_BUILDKIT=1 docker build \
            -f docker/build/darwin.Dockerfile \
            --build-arg TARGET=${{ matrix.target }} \
            --build-arg CLANG=${{ matrix.clang }} \
            --build-arg TRIGGER=${{ needs.context.outputs.trigger }} \
            -t agentos-darwin-${{ matrix.platform }} .

          sidecar_out="target/sidecar-artifacts/${{ matrix.platform }}"
          plugin_out="target/plugin-artifacts/${{ matrix.platform }}"
          mkdir -p "$sidecar_out" "$plugin_out"
          cid=$(docker create agentos-darwin-${{ matrix.platform }})
          docker cp "$cid:/artifacts/agentos-sidecar" "$sidecar_out/agentos-sidecar"
          docker cp "$cid:/artifacts/libagentos_actor_plugin.dylib" "$plugin_out/libagentos_actor_plugin.dylib"
          docker rm "$cid"
          test -f "$sidecar_out/agentos-sidecar"
          test -f "$plugin_out/libagentos_actor_plugin.dylib"
      - uses: actions/upload-artifact@v4
        with:
          name: sidecar-${{ matrix.platform }}
          path: target/sidecar-artifacts/${{ matrix.platform }}
          if-no-files-found: error
      - uses: actions/upload-artifact@v4
        with:
          name: plugin-${{ matrix.platform }}
          path: target/plugin-artifacts/${{ matrix.platform }}
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # publish-npm — place binaries, build TS, publish all packages (all triggers)
  # ---------------------------------------------------------------------------
  publish-npm:
    needs: [context, secure-exec-version, build-sidecar, build-plugin, build-sidecar-darwin]
    name: "Publish npm"
    if: ${{ !cancelled() && needs.build-sidecar.result == 'success' && needs.build-plugin.result == 'success' && needs.build-sidecar-darwin.result == 'success' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
          registry-url: https://registry.npmjs.org
      - name: Swap deps to published versions (transient, never committed)
        run: node scripts/secure-exec-dep.mjs release-swap "${{ needs.secure-exec-version.outputs.version }}" "${{ needs.secure-exec-version.outputs.registry_tag }}"
      - run: pnpm install --no-frozen-lockfile --filter='!@agentos/website'
      - uses: actions/download-artifact@v4
        with:
          pattern: sidecar-*
          path: artifacts
      - uses: actions/download-artifact@v4
        with:
          pattern: plugin-*
          path: artifacts
      - name: Place sidecar binaries into platform packages
        run: |
          set -euo pipefail
          for p in $SIDECAR_PLATFORMS; do
            agent_bin="artifacts/sidecar-${p}/agentos-sidecar"
            agent_dest="packages/sidecar-binary/npm/${p}"
            if [ ! -f "$agent_bin" ]; then
              echo "::error::missing agentos-sidecar binary artifact for ${p}"
              exit 1
            fi
            if [ ! -d "$agent_dest" ]; then
              echo "::error::missing platform package dir $agent_dest"
              exit 1
            fi
            cp "$agent_bin" "${agent_dest}/agentos-sidecar"
            chmod +x "${agent_dest}/agentos-sidecar"
            echo "Placed binaries for ${p}"
          done
      - name: Place plugin cdylib into platform packages
        run: |
          set -euo pipefail
          for p in $SIDECAR_PLATFORMS; do
            case "$p" in
              darwin-*) lib_name="libagentos_actor_plugin.dylib" ;;
              *) lib_name="libagentos_actor_plugin.so" ;;
            esac
            lib="artifacts/plugin-${p}/${lib_name}"
            dest="packages/agentos-plugin/npm/${p}"
            if [ ! -f "$lib" ]; then
              echo "::error::missing plugin cdylib artifact for ${p}"
              exit 1
            fi
            if [ ! -d "$dest" ]; then
              echo "::error::missing plugin platform package dir $dest"
              exit 1
            fi
            cp "$lib" "${dest}/${lib_name}"
            echo "Placed plugin cdylib for ${p}"
          done
      - name: Bump package versions for build (version-only)
        run: |
          pnpm --filter=publish exec tsx src/ci/bin.ts bump-versions \
            --version ${{ needs.context.outputs.version }} \
            --version-only
      - name: Install wasm-pack (for @rivet-dev/agentos-browser wasm build)
        run: |
          rustup target add wasm32-unknown-unknown
          curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
      - name: Build TypeScript packages
        run: |
          npx turbo build \
            --filter='!@rivet-dev/agentos-playground' \
            --filter='!./examples/*' \
            --filter='!./examples/quickstart/*'
      - name: Finalize package versions for publish (inject optionalDeps)
        run: |
          pnpm --filter=publish exec tsx src/ci/bin.ts bump-versions \
            --version ${{ needs.context.outputs.version }}
      - name: Publish npm packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          pnpm --filter=publish exec tsx src/ci/bin.ts publish-npm \
            --tag ${{ needs.context.outputs.npm_tag }} \
            --parallel 16 \
            --retries 3 \
            ${{ needs.context.outputs.trigger == 'release' && '--release-mode' || '' }}

  # ---------------------------------------------------------------------------
  # release-assets — GitHub release + sidecar/pyodide assets + R2 (release only)
  # ---------------------------------------------------------------------------
  release-assets:
    needs: [context, build-sidecar, build-sidecar-darwin]
    name: "Release assets"
    # Runs on BOTH preview and release: the "Stage release assets" step is
    # exercised on every preview so staging bugs surface before a real release
    # (this is exactly the kind of bug that previously only failed at release
    # time). The GitHub-release + R2 upload steps below stay release-only.
    if: ${{ !cancelled() && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      # Bare sibling clone so the committed link: deps resolve for install.
      - name: Materialize secure-exec sibling (clone-only)
        run: node scripts/secure-exec-dep.mjs prepare-build --clone-only
      - run: pnpm install --frozen-lockfile --filter=publish
      - uses: actions/download-artifact@v4
        with:
          pattern: sidecar-*
          path: artifacts
      - name: Stage release assets
        env:
          VERSION: ${{ needs.context.outputs.version }}
        run: |
          set -euo pipefail
          declare -A PLATFORM_TARGET=(
            [linux-x64-gnu]=x86_64-unknown-linux-gnu
            [linux-arm64-gnu]=aarch64-unknown-linux-gnu
            [darwin-x64]=x86_64-apple-darwin
            [darwin-arm64]=aarch64-apple-darwin
          )
          # Stage release assets: the platform sidecar binaries only.
          #
          # agent-os does NOT host pyodide. Those assets live in secure-exec
          # (crates/execution/assets/pyodide), which does not exist in this repo:
          # agent-os builds against the *published* secure-exec execution crate,
          # whose build.rs stages zero-byte placeholders and disables guest
          # Python ("no CDN dependency"), and nothing in agent-os fetches pyodide
          # from its own release/R2 — secure-exec's release hosts it. Copying it
          # here was vestigial copy-paste from secure-exec's publish.yaml and
          # failed every release with
          #   cp: cannot stat 'crates/execution/assets/pyodide/...': No such file
          mkdir -p release-assets
          for p in $SIDECAR_PLATFORMS; do
            agent_bin="artifacts/sidecar-${p}/agentos-sidecar"
            if [ -f "$agent_bin" ]; then
              target="${PLATFORM_TARGET[$p]}"
              cp "$agent_bin" "release-assets/agentos-sidecar-${target}"
            else
              echo "::warning::missing agentos-sidecar binary for ${p}"
            fi
          done
      - name: Create GitHub release and upload assets
        if: ${{ needs.context.outputs.trigger == 'release' }}
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.context.outputs.version }}
          NPM_TAG: ${{ needs.context.outputs.npm_tag }}
        run: |
          set -euo pipefail
          if ! gh release view "v${VERSION}" >/dev/null 2>&1; then
            PRERELEASE=""
            if [ "${NPM_TAG}" = "rc" ]; then PRERELEASE="--prerelease"; fi
            gh release create "v${VERSION}" --title "v${VERSION}" --generate-notes $PRERELEASE
          fi
          # --clobber so re-runs overwrite assets idempotently.
          gh release upload "v${VERSION}" release-assets/* --clobber
      - name: Upload sidecar binaries to R2 (best-effort)
        if: ${{ needs.context.outputs.trigger == 'release' }}
        env:
          R2_RELEASES_ACCESS_KEY_ID: ${{ secrets.R2_RELEASES_ACCESS_KEY_ID }}
          R2_RELEASES_SECRET_ACCESS_KEY: ${{ secrets.R2_RELEASES_SECRET_ACCESS_KEY }}
          VERSION: ${{ needs.context.outputs.version }}
          SHA: ${{ needs.context.outputs.sha }}
          LATEST: ${{ needs.context.outputs.latest }}
        run: |
          set -uo pipefail
          if [ -z "${R2_RELEASES_ACCESS_KEY_ID:-}" ] || [ -z "${R2_RELEASES_SECRET_ACCESS_KEY:-}" ]; then
            echo "R2 credentials not configured; skipping R2 upload (GitHub release assets are authoritative)."
            exit 0
          fi
          set -e
          pnpm --filter=publish exec tsx src/ci/bin.ts upload-r2 \
            --source "$GITHUB_WORKSPACE/release-assets" --sha "$SHA"
          pnpm --filter=publish exec tsx src/ci/bin.ts copy-r2 \
            --sha "$SHA" --version "$VERSION" --latest "$LATEST"

  # ---------------------------------------------------------------------------
  # publish-crates — crates.io (dry-run on preview, full publish on release)
  # ---------------------------------------------------------------------------
  publish-crates:
    needs: [context, secure-exec-version, build-sidecar, release-assets]
    name: "Publish crates.io"
    if: ${{ !cancelled() && needs.build-sidecar.result == 'success' && (needs.release-assets.result == 'success' || needs.release-assets.result == 'skipped') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target
      - uses: actions/cache@v4
        with:
          path: ~/.cargo/.rusty_v8
          key: ${{ runner.os }}-x86_64-unknown-linux-gnu-rusty-v8-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-x86_64-unknown-linux-gnu-rusty-v8-
      - name: Swap deps to published versions (transient, never committed)
        run: node scripts/secure-exec-dep.mjs release-swap "${{ needs.secure-exec-version.outputs.version }}" "${{ needs.secure-exec-version.outputs.registry_tag }}"
      - run: pnpm install --no-frozen-lockfile --filter='!@agentos/website'
      # Preview dry-run: cargo stays path-based — materialize the sibling.
      - name: Prepare secure-exec sibling
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/secure-exec-dep.mjs prepare-build
      - name: Bump Cargo versions
        run: |
          pnpm --filter=publish exec tsx src/ci/bin.ts bump-versions \
            --version ${{ needs.context.outputs.version }} \
            --version-only
      - name: Dry-run crate publish (preview)
        if: ${{ needs.context.outputs.trigger != 'release' }}
        run: |
          pnpm --filter=publish exec tsx src/ci/bin.ts publish-crates \
            --version ${{ needs.context.outputs.version }} \
            --dry-run \
            --allow-dirty
      - name: Publish crates (release)
        if: ${{ needs.context.outputs.trigger == 'release' }}
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          pnpm --filter=publish exec tsx src/ci/bin.ts publish-crates \
            --version ${{ needs.context.outputs.version }} \
            --allow-dirty