publish-image.yml

# SPDX-FileCopyrightText: 2025 Weibo, Inc.
#
# SPDX-License-Identifier: Apache-2.0

name: Publish Image

on:
  pull_request:
    types: [closed]
  workflow_dispatch:
    inputs:
      version:
        description: 'Custom version to release (e.g. 1.2.3). If empty, auto-increment from latest git tag'
        type: string
        required: false

env:
  GIT_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.merge_commit_sha || 'main' }}
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }}

concurrency:
  group: publish-image
  cancel-in-progress: false

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: >
      ( github.event_name == 'pull_request' &&
        github.event.pull_request.base.ref == 'main' &&
        github.event.pull_request.merged == true &&
        contains(github.event.pull_request.title, 'Changeset version bump') ) ||
      github.event_name == 'workflow_dispatch'

    outputs:
      new_version: ${{ steps.get_version.outputs.version }}

    steps:
      - name: Checkout code (full history for version detection)
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}
          fetch-depth: 0

      - name: Get version from git tags (and bump patch)
        id: get_version
        shell: bash
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
        run: |
          set -euo pipefail

          # If custom version is provided, use it directly
          if [ -n "${INPUT_VERSION:-}" ]; then
            echo "Using custom version: ${INPUT_VERSION}"
            echo "version=${INPUT_VERSION}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Get the latest version tag (format: vX.X.X)
          LATEST_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -1 || true)

          if [ -z "$LATEST_TAG" ]; then
            echo "No existing version tags found, starting from v0.0.1"
            echo "version=0.0.1" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Remove 'v' prefix
          VERSION="${LATEST_TAG#v}"
          echo "Current version: $VERSION (from tag $LATEST_TAG)"

          IFS='.' read -ra VERSION_PARTS <<< "$VERSION"
          if [ ${#VERSION_PARTS[@]} -ne 3 ]; then
            echo "Error: Invalid version format '$VERSION'. Expected MAJOR.MINOR.PATCH"
            exit 1
          fi

          MAJOR=${VERSION_PARTS[0]}
          MINOR=${VERSION_PARTS[1]}
          PATCH=${VERSION_PARTS[2]}

          if ! [[ "$PATCH" =~ ^[0-9]+$ ]]; then
            echo "Error: PATCH '$PATCH' is not a number"
            exit 1
          fi

          NEW_PATCH=$((PATCH + 1))
          NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"

          echo "New version: $NEW_VERSION"
          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"

  # ============================================================================
  # Backend Image Build (parallel AMD64 + ARM64)
  # ============================================================================
  build-backend-amd64:
    needs: prepare-release
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push backend image (amd64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/backend/Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-backend:${{ needs.prepare-release.outputs.new_version }}-amd64
          cache-from: type=gha,scope=backend-amd64
          cache-to: type=gha,mode=max,scope=backend-amd64

  build-backend-arm64:
    needs: prepare-release
    runs-on: ubuntu-24.04-arm
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push backend image (arm64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/backend/Dockerfile
          push: true
          platforms: linux/arm64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-backend:${{ needs.prepare-release.outputs.new_version }}-arm64
          cache-from: type=gha,scope=backend-arm64
          cache-to: type=gha,mode=max,scope=backend-arm64

  # ============================================================================
  # Executor Image Build (parallel AMD64 + ARM64)
  # ============================================================================
  build-executor-amd64:
    needs: prepare-release
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push executor image (amd64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/executor/Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-executor:${{ needs.prepare-release.outputs.new_version }}-amd64
          cache-from: type=gha,scope=executor-amd64
          cache-to: type=gha,mode=max,scope=executor-amd64

  build-executor-arm64:
    needs: prepare-release
    runs-on: ubuntu-24.04-arm
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push executor image (arm64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/executor/Dockerfile
          push: true
          platforms: linux/arm64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-executor:${{ needs.prepare-release.outputs.new_version }}-arm64
          cache-from: type=gha,scope=executor-arm64
          cache-to: type=gha,mode=max,scope=executor-arm64

  # ============================================================================
  # Executor Manager Image Build (parallel AMD64 + ARM64)
  # ============================================================================
  build-executor-manager-amd64:
    needs: prepare-release
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push executor-manager image (amd64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/executor_manager/Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-executor-manager:${{ needs.prepare-release.outputs.new_version }}-amd64
          cache-from: type=gha,scope=executor-manager-amd64
          cache-to: type=gha,mode=max,scope=executor-manager-amd64

  build-executor-manager-arm64:
    needs: prepare-release
    runs-on: ubuntu-24.04-arm
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push executor-manager image (arm64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/executor_manager/Dockerfile
          push: true
          platforms: linux/arm64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-executor-manager:${{ needs.prepare-release.outputs.new_version }}-arm64
          cache-from: type=gha,scope=executor-manager-arm64
          cache-to: type=gha,mode=max,scope=executor-manager-arm64

  # ============================================================================
  # Frontend Image Build (parallel AMD64 + ARM64)
  # ============================================================================
  build-frontend-amd64:
    needs: prepare-release
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push frontend image (amd64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/frontend/Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-web:${{ needs.prepare-release.outputs.new_version }}-amd64
          cache-from: type=gha,scope=frontend-amd64
          cache-to: type=gha,mode=max,scope=frontend-amd64
          build-args: |
            NEXT_TELEMETRY_DISABLED=1
            APP_VERSION=${{ needs.prepare-release.outputs.new_version }}

  build-frontend-arm64:
    needs: prepare-release
    runs-on: ubuntu-24.04-arm
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push frontend image (arm64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/frontend/Dockerfile
          push: true
          platforms: linux/arm64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-web:${{ needs.prepare-release.outputs.new_version }}-arm64
          cache-from: type=gha,scope=frontend-arm64
          cache-to: type=gha,mode=max,scope=frontend-arm64
          build-args: |
            NEXT_TELEMETRY_DISABLED=1
            APP_VERSION=${{ needs.prepare-release.outputs.new_version }}

  # ============================================================================
  # Chat Shell Image Build (parallel AMD64 + ARM64)
  # ============================================================================
  build-chat-shell-amd64:
    needs: prepare-release
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push chat-shell image (amd64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/chat_shell/Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-chat-shell:${{ needs.prepare-release.outputs.new_version }}-amd64
          cache-from: type=gha,scope=chat-shell-amd64
          cache-to: type=gha,mode=max,scope=chat-shell-amd64

  build-chat-shell-arm64:
    needs: prepare-release
    runs-on: ubuntu-24.04-arm
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push chat-shell image (arm64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/chat_shell/Dockerfile
          push: true
          platforms: linux/arm64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-chat-shell:${{ needs.prepare-release.outputs.new_version }}-arm64
          cache-from: type=gha,scope=chat-shell-arm64
          cache-to: type=gha,mode=max,scope=chat-shell-arm64

  # ============================================================================
  # Standalone Image Build (parallel AMD64 + ARM64)
  # Single image containing Backend, Frontend, Chat Shell, and Executor
  # ============================================================================
  build-standalone-amd64:
    needs: prepare-release
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push standalone image (amd64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/standalone/Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-standalone:${{ needs.prepare-release.outputs.new_version }}-amd64
          cache-from: type=gha,scope=standalone-amd64
          cache-to: type=gha,mode=max,scope=standalone-amd64
          build-args: |
            APP_VERSION=${{ needs.prepare-release.outputs.new_version }}

  build-standalone-arm64:
    needs: prepare-release
    runs-on: ubuntu-24.04-arm
    permissions:
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push standalone image (arm64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/standalone/Dockerfile
          push: true
          platforms: linux/arm64
          tags: ${{ env.IMAGE_PREFIX }}/wegent-standalone:${{ needs.prepare-release.outputs.new_version }}-arm64
          cache-from: type=gha,scope=standalone-arm64
          cache-to: type=gha,mode=max,scope=standalone-arm64
          build-args: |
            APP_VERSION=${{ needs.prepare-release.outputs.new_version }}

  # ============================================================================
  # Executor Local Binary Build (macOS)
  # ============================================================================
  build-executor-local-macos-arm64:
    needs: prepare-release
    runs-on: macos-14  # Apple Silicon runner
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Install dependencies and build
        working-directory: executor
        env:
          GITHUB_REPO: ${{ github.repository }}
        run: |
          uv sync --group build
          uv run python scripts/build_local.py --version ${{ needs.prepare-release.outputs.new_version }}

      - name: Rename binary with platform suffix
        run: |
          mv executor/dist/wegent-executor executor/dist/wegent-executor-macos-arm64

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: wegent-executor-macos-arm64
          path: executor/dist/wegent-executor-macos-arm64
          retention-days: 1

  build-executor-local-macos-amd64:
    needs: prepare-release
    runs-on: macos-14  # Apple Silicon runner with Rosetta 2 for x86_64 build
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Install Rosetta 2
        run: |
          # Check if Rosetta 2 is already installed
          if ! /usr/bin/pgrep -q oahd; then
            sudo softwareupdate --install-rosetta --agree-to-license || true
          fi

      - name: Set up Python (x86_64 via Rosetta)
        run: |
          # Download and install Python for x86_64
          curl -L -o python-installer.pkg "https://www.python.org/ftp/python/3.11.9/python-3.11.9-macos11.pkg"
          sudo installer -pkg python-installer.pkg -target /
          rm python-installer.pkg

      - name: Install uv (x86_64)
        run: |
          arch -x86_64 /usr/local/bin/python3.11 -m pip install --upgrade pip
          arch -x86_64 /usr/local/bin/python3.11 -m pip install uv

      - name: Install dependencies and build (x86_64)
        working-directory: executor
        env:
          GITHUB_REPO: ${{ github.repository }}
        run: |
          # Use x86_64 Python and uv to install dependencies and build
          arch -x86_64 /usr/local/bin/python3.11 -m uv sync --group build
          arch -x86_64 /usr/local/bin/python3.11 -m uv run python scripts/build_local.py --version ${{ needs.prepare-release.outputs.new_version }}

      - name: Rename binary with platform suffix
        run: |
          mv executor/dist/wegent-executor executor/dist/wegent-executor-macos-amd64

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: wegent-executor-macos-amd64
          path: executor/dist/wegent-executor-macos-amd64
          retention-days: 1

  # ============================================================================
  # Executor Local Binary Build (Linux)
  # Note: Using Ubuntu 22.04 for better GLIBC compatibility (GLIBC 2.35)
  # This ensures the binary works on most Linux distributions including
  # CentOS 7/8, RHEL, Debian 11+, Ubuntu 20.04+, etc.
  # ============================================================================
  build-executor-local-linux-amd64:
    needs: prepare-release
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Install dependencies and build
        working-directory: executor
        env:
          GITHUB_REPO: ${{ github.repository }}
        run: |
          uv sync --group build
          uv run python scripts/build_local.py --version ${{ needs.prepare-release.outputs.new_version }}

      - name: Rename binary with platform suffix
        run: |
          mv executor/dist/wegent-executor executor/dist/wegent-executor-linux-amd64

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: wegent-executor-linux-amd64
          path: executor/dist/wegent-executor-linux-amd64
          retention-days: 1

  build-executor-local-linux-amd64-no-claude:
    needs: prepare-release
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Install dependencies and build without bundled Claude CLI
        working-directory: executor
        env:
          GITHUB_REPO: ${{ github.repository }}
        run: |
          uv sync --group build
          uv run python scripts/build_local.py --version ${{ needs.prepare-release.outputs.new_version }} --no-bundle-claude

      - name: Rename binary with platform suffix
        run: |
          mv executor/dist/wegent-executor executor/dist/wegent-executor-linux-amd64-no-claude

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: wegent-executor-linux-amd64-no-claude
          path: executor/dist/wegent-executor-linux-amd64-no-claude
          retention-days: 1

  build-executor-local-linux-arm64:
    needs: prepare-release
    runs-on: ubuntu-22.04-arm
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Install dependencies and build
        working-directory: executor
        env:
          GITHUB_REPO: ${{ github.repository }}
        run: |
          uv sync --group build
          uv run python scripts/build_local.py --version ${{ needs.prepare-release.outputs.new_version }}

      - name: Rename binary with platform suffix
        run: |
          mv executor/dist/wegent-executor executor/dist/wegent-executor-linux-arm64

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: wegent-executor-linux-arm64
          path: executor/dist/wegent-executor-linux-arm64
          retention-days: 1

  # ============================================================================
  # Executor Local Binary Build (Windows)
  # Note: Windows 10 1809+ required for ConPTY support
  # ============================================================================
  build-executor-local-windows-amd64:
    needs: prepare-release
    runs-on: windows-latest
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Install dependencies and build
        working-directory: executor
        shell: pwsh
        env:
          GITHUB_REPO: ${{ github.repository }}
        run: |
          uv sync --group build
          uv run python scripts/build_local.py --version ${{ needs.prepare-release.outputs.new_version }}

      - name: Rename binary with platform suffix
        shell: pwsh
        run: |
          Move-Item executor/dist/wegent-executor.exe executor/dist/wegent-executor-windows-amd64.exe

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: wegent-executor-windows-amd64
          path: executor/dist/wegent-executor-windows-amd64.exe
          retention-days: 1

  # ============================================================================
  # Create Multi-arch Manifests (combine amd64 + arm64 into single tag)
  # ============================================================================
  create-manifests:
    needs:
      - prepare-release
      - build-backend-amd64
      - build-backend-arm64
      - build-executor-amd64
      - build-executor-arm64
      - build-executor-manager-amd64
      - build-executor-manager-arm64
      - build-frontend-amd64
      - build-frontend-arm64
      - build-chat-shell-amd64
      - build-chat-shell-arm64
      - build-standalone-amd64
      - build-standalone-arm64
    runs-on: ubuntu-latest
    permissions:
      packages: write

    steps:
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Create and push multi-arch manifests
        env:
          VERSION: ${{ needs.prepare-release.outputs.new_version }}
        run: |
          set -euo pipefail

          # Function to create manifest for an image
          create_manifest() {
            local image_name=$1
            echo "Creating manifest for ${image_name}..."
            
            # Create versioned manifest
            docker buildx imagetools create -t "${IMAGE_PREFIX}/${image_name}:${VERSION}" \
              "${IMAGE_PREFIX}/${image_name}:${VERSION}-amd64" \
              "${IMAGE_PREFIX}/${image_name}:${VERSION}-arm64"
            
            # Create latest manifest
            docker buildx imagetools create -t "${IMAGE_PREFIX}/${image_name}:latest" \
              "${IMAGE_PREFIX}/${image_name}:${VERSION}-amd64" \
              "${IMAGE_PREFIX}/${image_name}:${VERSION}-arm64"
            
            echo "✅ Created manifests for ${image_name}:${VERSION} and ${image_name}:latest"
          }

          # Create manifests for all images
          create_manifest "wegent-backend"
          create_manifest "wegent-executor"
          create_manifest "wegent-executor-manager"
          create_manifest "wegent-web"
          create_manifest "wegent-chat-shell"
          create_manifest "wegent-standalone"

          echo "🎉 All multi-arch manifests created successfully!"

  # ============================================================================
  # Create Release Tag (after all images are built and manifests created)
  # ============================================================================
  create-release-tag:
    needs:
      - prepare-release
      - create-manifests
      - build-executor-local-macos-arm64
      - build-executor-local-macos-amd64
      - build-executor-local-linux-amd64
      - build-executor-local-linux-amd64-no-claude
      - build-executor-local-linux-arm64
      - build-executor-local-windows-amd64
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout code (full history + tags)
        uses: actions/checkout@v4
        with:
          ref: ${{ env.GIT_REF }}
          fetch-depth: 0

      - name: Download executor binaries
        uses: actions/download-artifact@v4
        with:
          pattern: wegent-executor-*
          path: ./executor-binaries
          merge-multiple: true

      - name: Create and push tag
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${{ needs.prepare-release.outputs.new_version }}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git fetch --tags --force

          if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
            echo "Tag v${VERSION} already exists, skipping tag creation"
          else
            git tag -a "v${VERSION}" -m "Release version ${VERSION}"
            git push origin "v${VERSION}"
            echo "Created and pushed tag v${VERSION}"
          fi

      - name: Generate Release Notes
        id: release-notes
        uses: actions/github-script@v7
        env:
          TAG: v${{ needs.prepare-release.outputs.new_version }}
        with:
          script: |
            const tag = process.env.TAG;
            if (!tag) {
              core.setFailed('TAG env is missing; cannot generate release notes.');
              return;
            }

            try {
              const { data } = await github.rest.repos.generateReleaseNotes({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag_name: tag,
              });
              core.setOutput("tag", tag);
              core.setOutput("body", data.body || '');
            } catch (error) {
              core.setFailed(`Failed to generate release notes: ${error.message}`);
            }

      - name: Create GitHub Release
        if: steps.release-notes.outputs.tag != ''
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.release-notes.outputs.tag }}
          name: Release ${{ steps.release-notes.outputs.tag }}
          body: ${{ steps.release-notes.outputs.body }}
          draft: false
          prerelease: false
          files: |
            ./executor-binaries/wegent-executor-macos-arm64
            ./executor-binaries/wegent-executor-macos-amd64
            ./executor-binaries/wegent-executor-linux-amd64
            ./executor-binaries/wegent-executor-linux-amd64-no-claude
            ./executor-binaries/wegent-executor-linux-arm64
            ./executor-binaries/wegent-executor-windows-amd64.exe
            ./executor/scripts/local_executor_install.sh
            ./executor/scripts/local_executor_install.ps1