release.yml

name: Release

# Produces downloadable macOS, Windows, and Linux installers plus update feeds
# for a given ref and attaches them to a GitHub Release page. Two entry points:
#
#   1. Push a git tag matching v*.*.* (e.g. `git tag v1.2.3 && git push origin v1.2.3`).
#      This is the primary way to cut a release. The release name equals the tag.
#
#   2. Manual `workflow_dispatch` for dry-runs / tester builds. The `platform`
#      input can publish `mac`, `windows`, `linux`, or `all`. The optional
#      `tag` input defaults to a timestamp-based pre-release tag
#      (`v0.0.0-dev-<run-id>`) so the manual path always yields a prerelease
#      that is easy to identify and discard.
#
# Signing has three modes: unsigned, signed (Developer ID only), and
# notarized (signed + Apple notary). Tag pushes default to `signed` while
# Apple's notary queue is congested; switch back to `notarized` in the
# resolve step once turnaround normalizes. See SIGNING.md.
#
# The job also uploads the DMG/zip as a workflow artifact (14-day retention)
# so internal users can grab builds without waiting for the Release page to
# finish populating — belt-and-suspenders backup.

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      platform:
        description: 'Platform assets to build and publish'
        type: choice
        options:
          - all
          - mac
          - windows
          - linux
        default: all
      signing-mode:
        description: 'unsigned (fastest), signed (Developer ID, no notarization), notarized (signed + Apple notarization)'
        type: choice
        options:
          - unsigned
          - signed
          - notarized
        default: signed
      tag:
        description: 'Tag/release name for this manual run (defaults to v0.0.0-dev-<timestamp>)'
        type: string
        required: false
        default: ''

# Scope concurrency per tag and platform. Windows and Linux can publish
# independent assets to the same release concurrently, while duplicate jobs for
# the same platform/tag still queue instead of overwriting each other.

env:
  NODE_VERSION: '22'

jobs:
  release-metadata:
    name: Resolve release metadata
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      tag: ${{ steps.metadata.outputs.tag }}
      release_name: ${{ steps.metadata.outputs.release_name }}
      previous_tag: ${{ steps.metadata.outputs.previous_tag }}
      prerelease: ${{ steps.metadata.outputs.prerelease }}
    steps:
      - uses: actions/checkout@v6
        with:
          # Full history and tags make the previous-tag choice explicit and
          # stable instead of relying on GitHub's implicit previous release.
          fetch-depth: 0

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Resolve tag and previous stable tag
        id: metadata
        run: node .github/scripts/resolve-release-metadata.mjs
        env:
          INPUT_TAG: ${{ github.event.inputs.tag }}

  make:
    name: Package + make DMG (macOS)
    needs: release-metadata
    if: ${{ github.event_name == 'push' || github.event.inputs.platform == 'all' || github.event.inputs.platform == 'mac' }}
    concurrency:
      group: release-${{ github.event.inputs.tag || github.ref_name }}-mac
      cancel-in-progress: false
    runs-on: macos-latest
    # 90 min covers a slow Apple notary queue (we've seen 30+ min of "In
    # Progress"). If the workflow times out mid-notarize, no release is
    # published and /releases/latest stays pinned to the previous good
    # notarized version — users keep getting a working DMG.
    timeout-minutes: 90
    # Least-privilege: only this job needs contents:write (to publish the
    # Release + upload assets via softprops/action-gh-release).
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          # Keep full history in release jobs so packaging and diagnostics
          # have complete tag metadata available.
          fetch-depth: 0

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      # yarn.lock contains a git+ssh URL for a baileys dep
      # (whiskeysockets/libsignal-node). CI has no SSH key, so rewrite to HTTPS.
      - name: Rewrite git SSH to HTTPS
        run: git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"

      - name: Install JS dependencies
        working-directory: app
        # Repo's source of truth is yarn.lock (Taskfile runs `yarn install`).
        # --frozen-lockfile keeps CI deps identical to dev.
        run: yarn install --frozen-lockfile

      # Decide signing mode. Three values:
      #   unsigned   — SKIP_SIGNING=1, no Apple credentials needed
      #   signed     — Developer ID code-signed, NOT notarized (fast; users
      #                must right-click → Open the first time)
      #   notarized  — fully signed + Apple-notarized (slow; depends on
      #                Apple's notary queue, can take 5-60+ min)
      #
      # Resolution rules:
      #   - workflow_dispatch: honor the `signing-mode` input (default `signed`).
      #   - tag push: default to `signed` for now while Apple's notary queue
      #     is congested. Switch back to `notarized` here once queues normalize.
      #     Falls back to `unsigned` if signing secrets are missing.
      - name: Resolve signing mode
        id: signing
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          MODE_INPUT: ${{ github.event.inputs.signing-mode }}
          HAS_SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY != '' }}
          HAS_CERT: ${{ secrets.APPLE_CERT_P12_BASE64 != '' }}
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            mode="${MODE_INPUT:-notarized}"
          else
            # Tag push always notarizes — Sequoia removed the right-click
            # bypass, so signed-only is unusable for end users on macOS 15+.
            mode="notarized"
          fi
          # Fall back to unsigned if cert secrets are missing (so manual
          # workflow_dispatch runs don't fail on a fresh fork).
          if [[ "$mode" != "unsigned" ]]; then
            if [[ "$HAS_SIGNING_IDENTITY" != "true" || "$HAS_CERT" != "true" ]]; then
              echo "::warning::Signing requested but APPLE_CERT_P12_BASE64 / SIGNING_IDENTITY not set — falling back to unsigned"
              mode="unsigned"
            fi
          fi
          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
          echo "Signing mode: ${mode}"

      # Import the Developer ID Application certificate into a temporary
      # keychain so codesign can find it. macos-latest runners ship with an
      # empty user keychain — without this, signing silently no-ops.
      #
      # Required secrets:
      #   APPLE_CERT_P12_BASE64 — base64-encoded .p12 export of the
      #     Developer ID Application cert + private key
      #   APPLE_CERT_PASSWORD   — password used when exporting the .p12
      - name: Import signing certificate
        if: ${{ steps.signing.outputs.mode != 'unsigned' }}
        env:
          APPLE_CERT_P12_BASE64: ${{ secrets.APPLE_CERT_P12_BASE64 }}
          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
        run: |
          set -euo pipefail
          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 32)"
          CERT_PATH="$RUNNER_TEMP/cert.p12"

          echo "$APPLE_CERT_P12_BASE64" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$APPLE_CERT_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Prepend our keychain so codesign finds it before the empty default.
          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychain -d user | tr -d '"')

          rm -f "$CERT_PATH"
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: electron-forge make (unsigned)
        if: ${{ steps.signing.outputs.mode == 'unsigned' }}
        working-directory: app
        env:
          SKIP_SIGNING: '1'
        run: npm run make

      - name: electron-forge make (signed, no notarization)
        if: ${{ steps.signing.outputs.mode == 'signed' }}
        working-directory: app
        env:
          # Forge config notarizes only when APPLE_ID is set, so we
          # deliberately omit it here.
          SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
        run: npm run make

      - name: electron-forge make (signed + notarized)
        if: ${{ steps.signing.outputs.mode == 'notarized' }}
        working-directory: app
        env:
          SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: npm run make

      - name: Validate package version for tag releases
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: |
          set -euo pipefail
          tag="${{ needs.release-metadata.outputs.tag }}"
          tag_version="${tag#v}"
          package_version="$(node -p "require('./app/package.json').version")"
          if [[ "$tag_version" != "$package_version" ]]; then
            echo "::error::Tag ${tag} does not match app/package.json version ${package_version}. electron-updater compares against the packaged app version, so publishing would not update users correctly."
            exit 1
          fi
          echo "Package version matches release tag: ${package_version}"

      - name: Collect release assets + compute update feed
        id: assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p release-assets

          sanitize_asset_name() {
            basename "$1" | tr ' ' '.'
          }

          # macOS runner's /bin/bash is 3.2 — no `globstar` or `mapfile`.
          # Use `find` loops instead.
          dmg_count=0
          while IFS= read -r f; do
            [[ -z "$f" ]] && continue
            cp "$f" "release-assets/$(sanitize_asset_name "$f")"
            dmg_count=$((dmg_count + 1))
            # Version-less copy so the
            # `/releases/latest/download/<file>` URL stays stable across
            # releases. Arch is derived from the original filename (e.g.
            # `...-arm64.dmg`, `...-x64.dmg`, `...-universal.dmg`).
            base="$(basename "$f" .dmg)"
            case "$base" in
              *arm64)     stable="Browser-Use-arm64.dmg" ;;
              *x64)       stable="Browser-Use-x64.dmg" ;;
              *universal) stable="Browser-Use-universal.dmg" ;;
              *)          stable="Browser-Use.dmg" ;;
            esac
            cp "$f" "release-assets/${stable}"
          done < <(find app/out/make -type f -name '*.dmg')

          zip_count=0
          while IFS= read -r app; do
            [[ -z "$app" ]] && continue
            if [[ ! -f "$app/Contents/Resources/app-update.yml" ]]; then
              echo "::error::Packaged app is missing Contents/Resources/app-update.yml; electron-updater cannot complete macOS downloads without it."
              exit 1
            fi
            parent="$(basename "$(dirname "$app")")"
            case "$parent" in
              *arm64*)     arch="arm64" ;;
              *x64*)       arch="x64" ;;
              *x86_64*)    arch="x64" ;;
              *universal*) arch="universal" ;;
              *)
                arch="$(uname -m)"
                [[ "$arch" == "x86_64" ]] && arch="x64"
                ;;
            esac
            zip="release-assets/Browser-Use-${arch}-mac.zip"
            ditto -c -k --sequesterRsrc --keepParent "$app" "$zip"
            zip_count=$((zip_count + 1))
          done < <(find app/out -type d -name '*.app' -prune -print)

          if [[ "$zip_count" -eq 0 ]]; then
            echo "::error::No .app bundle found under app/out — cannot create Squirrel.Mac update ZIP."
            find app/out -maxdepth 4 -type d -print || true
            exit 1
          fi

          while IFS= read -r f; do
            [[ -z "$f" ]] && continue
            cp "$f" release-assets/
            zip_count=$((zip_count + 1))
          done < <(find app/out/make -type f -name '*.zip')

          if [[ "$dmg_count" -eq 0 ]]; then
            echo "::error::No DMG produced by electron-forge make — refusing to publish empty release."
            ls -R app/out/make || true
            exit 1
          fi

          shopt -s nullglob
          release_version="$(node -p "require('./app/package.json').version")"
          release_date="$(date -u +%Y-%m-%dT%H:%M:%S.000Z)"
          node app/scripts/generate-mac-update-feed.mjs \
            --version "$release_version" \
            --release-date "$release_date" \
            --output release-assets/latest-mac.yml \
            release-assets/*-mac.zip \
            release-assets/*.dmg

          echo "dmg_count=${dmg_count}" >> "$GITHUB_OUTPUT"
          echo "zip_count=${zip_count}" >> "$GITHUB_OUTPUT"
          echo "Collected ${dmg_count} DMG(s) and ${zip_count} zip(s):"
          ls -la release-assets/
          echo "---- latest-mac.yml ----"
          cat release-assets/latest-mac.yml

      # Backup path: the raw DMG/zip/feed stay available as a workflow
      # artifact for 14 days regardless of what happens to the Release page.
      - name: Upload DMG artifact (backup)
        uses: actions/upload-artifact@v7
        with:
          name: agentic-browser-${{ github.sha }}
          path: |
            release-assets/*.dmg
            release-assets/*.zip
            release-assets/*.yml
          if-no-files-found: error
          retention-days: 14

      - name: Generate deterministic release notes
        env:
          GITHUB_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.release-metadata.outputs.tag }}
          PREVIOUS_TAG: ${{ needs.release-metadata.outputs.previous_tag }}
        run: node .github/scripts/generate-release-notes.mjs

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.release-metadata.outputs.tag }}
          name: ${{ needs.release-metadata.outputs.release_name }}
          prerelease: ${{ needs.release-metadata.outputs.prerelease == 'true' }}
          body_path: release-notes.md
          # For workflow_dispatch runs the tag doesn't exist yet — let the
          # action create it against the workflow's sha.
          target_commitish: ${{ github.sha }}
          # We already hard-fail on missing DMG in the asset-collection
          # step, so false here tolerates the legitimate case where Forge
          # didn't emit a .zip.
          fail_on_unmatched_files: false
          files: |
            release-assets/*.dmg
            release-assets/*.zip
            release-assets/*.yml

      - name: Verify published updater feed
        shell: bash
        env:
          TAG: ${{ needs.release-metadata.outputs.tag }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          base_url="https://github.com/${REPOSITORY}/releases/download/${TAG}"
          for attempt in {1..12}; do
            if curl -fsSL "${base_url}/latest-mac.yml" -o latest-mac.yml; then
              break
            fi
            if [[ "$attempt" -eq 12 ]]; then
              echo "::error::latest-mac.yml is not publicly downloadable at ${base_url}/latest-mac.yml. electron-updater runs without GitHub credentials, so release assets must be public."
              exit 1
            fi
            echo "Waiting for latest-mac.yml to become publicly downloadable (attempt ${attempt}/12)"
            sleep 5
          done
          node <<'NODE' > update-assets.txt
          const fs = require('fs');
          const manifest = fs.readFileSync('latest-mac.yml', 'utf8');
          const pathMatch = manifest.match(/^path:\s*['"]?([^'"\n]+)['"]?/m);
          if (!pathMatch || !pathMatch[1].endsWith('-mac.zip')) {
            throw new Error('latest-mac.yml must use a -mac.zip as its primary path');
          }
          const urls = [...manifest.matchAll(/url:\s*['"]?([^'"\n]+)['"]?/g)].map((match) => match[1]);
          if (!urls.some((url) => url.endsWith('-mac.zip'))) {
            throw new Error('latest-mac.yml does not reference a macOS update ZIP');
          }
          if (!urls.some((url) => url.endsWith('.dmg'))) {
            throw new Error('latest-mac.yml does not reference a DMG');
          }
          for (const url of urls) {
            console.log(url);
          }
          NODE
          while IFS= read -r asset; do
            [[ -z "$asset" ]] && continue
            echo "Verifying ${base_url}/${asset}"
            for attempt in {1..12}; do
              if curl -fsIL "${base_url}/${asset}" >/dev/null; then
                break
              fi
              if [[ "$attempt" -eq 12 ]]; then
                echo "::error::${asset} is not publicly downloadable at ${base_url}/${asset}. electron-updater cannot install updates unless every manifest asset URL is public."
                exit 1
              fi
              echo "Waiting for ${asset} to become publicly downloadable (attempt ${attempt}/12)"
              sleep 5
            done
          done < update-assets.txt

  make-windows:
    name: Package + make Squirrel (Windows)
    needs: release-metadata
    if: ${{ github.event_name == 'push' || github.event.inputs.platform == 'all' || github.event.inputs.platform == 'windows' }}
    concurrency:
      group: release-${{ github.event.inputs.tag || github.ref_name }}-windows
      cancel-in-progress: false
    runs-on: windows-latest
    timeout-minutes: 60
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: yarn
          cache-dependency-path: app/yarn.lock

      - name: Rewrite git SSH to HTTPS
        shell: pwsh
        run: git config --global 'url.https://github.com/.insteadOf' 'ssh://git@github.com/'

      - name: Install JS dependencies
        working-directory: app
        run: yarn install --frozen-lockfile

      - name: Validate package version for tag releases
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        run: |
          $tag = '${{ needs.release-metadata.outputs.tag }}'
          $tagVersion = $tag.TrimStart('v')
          $packageVersion = node -p "require('./app/package.json').version"
          if ($tagVersion -ne $packageVersion) {
            Write-Error "Tag $tag does not match app/package.json version $packageVersion. Windows updates compare against the packaged app version, so publishing would not update users correctly."
            exit 1
          }
          "Package version matches release tag: $packageVersion"

      - name: electron-forge make (Windows Squirrel)
        working-directory: app
        env:
          WINDOWS_SIGN_WITH_PARAMS: ${{ secrets.WINDOWS_SIGN_WITH_PARAMS }}
        run: yarn run make -- --platform=win32 --arch=x64

      - name: Collect Windows release assets
        shell: pwsh
        run: |
          $assetDir = 'release-assets-windows'
          $sourceDir = 'app/out/make/squirrel.windows/x64'
          New-Item -ItemType Directory -Force $assetDir | Out-Null
          if (-not (Test-Path $sourceDir)) {
            Write-Error "No Squirrel.Windows output found at $sourceDir"
            exit 1
          }
          Copy-Item -Path "$sourceDir/*" -Destination $assetDir -Force

          if (-not (Test-Path "$assetDir/RELEASES")) {
            Write-Error 'No RELEASES file produced by Squirrel.Windows'
            exit 1
          }
          if (@(Get-ChildItem $assetDir -Filter '*.nupkg' -File).Count -eq 0) {
            Write-Error 'No .nupkg file produced by Squirrel.Windows'
            exit 1
          }
          if (@(Get-ChildItem $assetDir -Filter '*.exe' -File).Count -eq 0) {
            Write-Error 'No setup .exe produced by Squirrel.Windows'
            exit 1
          }

          Get-ChildItem $assetDir | Format-Table -AutoSize

      - name: Upload Windows artifact (backup)
        uses: actions/upload-artifact@v7
        with:
          name: windows-squirrel-${{ github.sha }}
          path: release-assets-windows/*
          if-no-files-found: error
          retention-days: 14

      - name: Generate deterministic release notes
        env:
          GITHUB_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.release-metadata.outputs.tag }}
          PREVIOUS_TAG: ${{ needs.release-metadata.outputs.previous_tag }}
        run: node .github/scripts/generate-release-notes.mjs

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.release-metadata.outputs.tag }}
          name: ${{ needs.release-metadata.outputs.release_name }}
          prerelease: ${{ needs.release-metadata.outputs.prerelease == 'true' }}
          body_path: release-notes.md
          target_commitish: ${{ github.sha }}
          fail_on_unmatched_files: false
          files: release-assets-windows/*

      - name: Verify published Windows update feed
        shell: pwsh
        env:
          TAG: ${{ needs.release-metadata.outputs.tag }}
          REPOSITORY: ${{ github.repository }}
        run: |
          $baseUrl = "https://github.com/$env:REPOSITORY/releases/download/$env:TAG"
          $releaseFile = 'RELEASES'
          for ($attempt = 1; $attempt -le 12; $attempt++) {
            curl.exe -fsSL "$baseUrl/RELEASES" -o $releaseFile
            if ($LASTEXITCODE -eq 0) {
              break
            }
            if ($attempt -eq 12) {
              Write-Error "RELEASES is not publicly downloadable at $baseUrl/RELEASES. Windows autoUpdater runs without GitHub credentials, so release assets must be public."
              exit 1
            }
            "Waiting for RELEASES to become publicly downloadable (attempt $attempt/12)"
            Start-Sleep -Seconds 5
          }

          $packages = Get-Content $releaseFile |
            Where-Object { $_.Trim() } |
            ForEach-Object {
              $tokens = $_.TrimStart([char]0xFEFF) -split '\s+'
              $tokens | Where-Object { $_ -like '*.nupkg' }
            } |
            Where-Object { $_ -like '*.nupkg' }
          if (@($packages).Count -eq 0) {
            Write-Error 'RELEASES does not reference any .nupkg package'
            exit 1
          }
          foreach ($package in $packages) {
            "Verifying $baseUrl/$package"
            for ($attempt = 1; $attempt -le 12; $attempt++) {
              curl.exe -fsIL "$baseUrl/$package" | Out-Null
              if ($LASTEXITCODE -eq 0) {
                break
              }
              if ($attempt -eq 12) {
                Write-Error "$package is not publicly downloadable at $baseUrl/$package. Windows autoUpdater cannot install updates unless the RELEASES package assets are public."
                exit 1
              }
              "Waiting for $package to become publicly downloadable (attempt $attempt/12)"
              Start-Sleep -Seconds 5
            }
          }

  make-linux:
    name: Package Linux distros (Docker)
    needs: release-metadata
    if: ${{ github.event_name == 'push' || github.event.inputs.platform == 'all' || github.event.inputs.platform == 'linux' }}
    concurrency:
      group: release-${{ github.event.inputs.tag || github.ref_name }}-linux
      cancel-in-progress: false
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Validate package version for tag releases
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: |
          set -euo pipefail
          tag="${{ needs.release-metadata.outputs.tag }}"
          tag_version="${tag#v}"
          package_version="$(node -p "require('./app/package.json').version")"
          if [[ "$tag_version" != "$package_version" ]]; then
            echo "::error::Tag ${tag} does not match app/package.json version ${package_version}. Linux packages would report the wrong app version."
            exit 1
          fi
          echo "Package version matches release tag: ${package_version}"

      - name: Build Linux .deb/.rpm/AppImage in Docker
        run: bash scripts/build-linux-docker.sh

      - name: Prepare Linux release assets
        shell: bash
        run: |
          set -euo pipefail
          rm -rf linux-release-assets
          mkdir -p linux-release-assets

          find app/out/make/deb/x64 -type f -name '*.deb' -exec cp {} linux-release-assets/ \;
          find app/out/make/rpm/x64 -type f -name '*.rpm' -exec cp {} linux-release-assets/ \;
          find app/out/make/appimage/x64 -type f -name '*.AppImage' -exec cp {} linux-release-assets/ \;
          cp app/out/make/latest-linux.yml linux-release-assets/

          appimage_count="$(find linux-release-assets -maxdepth 1 -type f -name '*.AppImage' | wc -l | tr -d ' ')"
          if [[ "$appimage_count" -ne 1 ]]; then
            echo "::error::Expected exactly one Linux AppImage, found ${appimage_count}."
            ls -la linux-release-assets || true
            exit 1
          fi
          cp "$(find linux-release-assets -maxdepth 1 -type f -name '*.AppImage' | head -n 1)" \
            linux-release-assets/Browser-Use-x64.AppImage

          node scripts/verify-linux-artifacts.mjs linux-release-assets
          echo "Prepared Linux release assets:"
          ls -la linux-release-assets

      - name: Upload Linux artifact (backup)
        uses: actions/upload-artifact@v7
        with:
          name: linux-packages-${{ github.sha }}
          path: |
            linux-release-assets/*
          if-no-files-found: error
          retention-days: 14

      - name: Generate deterministic release notes
        env:
          GITHUB_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.release-metadata.outputs.tag }}
          PREVIOUS_TAG: ${{ needs.release-metadata.outputs.previous_tag }}
        run: node .github/scripts/generate-release-notes.mjs

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.release-metadata.outputs.tag }}
          name: ${{ needs.release-metadata.outputs.release_name }}
          prerelease: ${{ needs.release-metadata.outputs.prerelease == 'true' }}
          body_path: release-notes.md
          target_commitish: ${{ github.sha }}
          fail_on_unmatched_files: false
          files: |
            linux-release-assets/*

      - name: Verify published Linux update feed
        shell: bash
        env:
          TAG: ${{ needs.release-metadata.outputs.tag }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          base_url="https://github.com/${REPOSITORY}/releases/download/${TAG}"
          for attempt in {1..12}; do
            if curl -fsSL "${base_url}/latest-linux.yml" -o latest-linux.yml; then
              break
            fi
            if [[ "$attempt" -eq 12 ]]; then
              echo "::error::latest-linux.yml is not publicly downloadable at ${base_url}/latest-linux.yml. Linux AppImage updates run without GitHub credentials, so release assets must be public."
              exit 1
            fi
            echo "Waiting for latest-linux.yml to become publicly downloadable (attempt ${attempt}/12)"
            sleep 5
          done
          node <<'NODE' > linux-update-assets.txt
          const fs = require('fs');
          const manifest = fs.readFileSync('latest-linux.yml', 'utf8');
          const pathMatch = manifest.match(/^path:\s*['"]?([^'"\n]+)['"]?/m);
          if (!pathMatch || !pathMatch[1].endsWith('.AppImage')) {
            throw new Error('latest-linux.yml must use an AppImage as its primary path');
          }
          const urls = [...manifest.matchAll(/url:\s*['"]?([^'"\n]+)['"]?/g)].map((match) => match[1]);
          if (!urls.some((url) => url.endsWith('.AppImage'))) {
            throw new Error('latest-linux.yml does not reference a Linux AppImage');
          }
          for (const url of urls) {
            console.log(url);
          }
          NODE
          while IFS= read -r asset; do
            [[ -z "$asset" ]] && continue
            echo "Verifying ${base_url}/${asset}"
            for attempt in {1..12}; do
              if curl -fsIL "${base_url}/${asset}" >/dev/null; then
                break
              fi
              if [[ "$attempt" -eq 12 ]]; then
                echo "::error::${asset} is not publicly downloadable at ${base_url}/${asset}. Linux AppImage updates cannot install unless every manifest asset URL is public."
                exit 1
              fi
              echo "Waiting for ${asset} to become publicly downloadable (attempt ${attempt}/12)"
              sleep 5
            done
          done < linux-update-assets.txt
          echo "Verifying ${base_url}/Browser-Use-x64.AppImage"
          for attempt in {1..12}; do
            if curl -fsIL "${base_url}/Browser-Use-x64.AppImage" >/dev/null; then
              break
            fi
            if [[ "$attempt" -eq 12 ]]; then
              echo "::error::Browser-Use-x64.AppImage is not publicly downloadable at ${base_url}/Browser-Use-x64.AppImage. The README download link would 404."
              exit 1
            fi
            echo "Waiting for Browser-Use-x64.AppImage to become publicly downloadable (attempt ${attempt}/12)"
            sleep 5
          done