release.yml

name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write
  packages: write
  id-token: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ===========================================================
  # Linux: .deb package + AppImage
  # ===========================================================
  build-linux:
    name: Build — Linux x86_64
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential cmake libsdl2-dev libfuse2

      - name: Create include symlink
        run: ln -sf ebrowser include/eBrowser

      - name: Build Release
        run: |
          cmake -B build `
            -DCMAKE_BUILD_TYPE=Release `
            -DBUILD_TESTING=OFF `
            -DBUILD_SHARED_LIBS=OFF `
            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_INSTALLATION_ROOT\scripts\buildsystems\vcpkg.cmake"
          cmake --build build --config Release --parallel

      - name: Stage release files
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_INSTALL_PREFIX=/usr \
            -DBUILD_TESTING=ON \
            -DCMAKE_C_FLAGS="-O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE" \
            -DCMAKE_EXE_LINKER_FLAGS="-pie -Wl,-z,relro,-z,now"
          cmake --build build --parallel $(nproc)

      - name: Run tests
        run: |
          cd build
          ctest --output-on-failure \
            -R "test_memory_safety|test_sandbox|test_firewall|test_anti_fingerprint|test_extension|test_privacy|test_tab_manager|test_bookmark"

      - name: Strip binaries
        run: |
          strip build/port/eBrowser 2>/dev/null || true

      - name: Build .deb package
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"
          PKG_DIR="ebrowser_${VERSION}_amd64"
          mkdir -p ${PKG_DIR}/DEBIAN
          mkdir -p ${PKG_DIR}/usr/bin
          mkdir -p ${PKG_DIR}/usr/share/applications
          mkdir -p ${PKG_DIR}/usr/share/icons/hicolor/256x256/apps
          mkdir -p ${PKG_DIR}/usr/share/doc/ebrowser

          # Binary
          cp build/port/eBrowser ${PKG_DIR}/usr/bin/ebrowser

          # Desktop entry
          cat > ${PKG_DIR}/usr/share/applications/ebrowser.desktop << 'DESKTOP'
          [Desktop Entry]
          Name=eBrowser
          Comment=The Most Secure Lightweight Browser
          Exec=ebrowser %u
          Icon=ebrowser
          Type=Application
          Categories=Network;WebBrowser;
          MimeType=text/html;text/xml;application/xhtml+xml;x-scheme-handler/http;x-scheme-handler/https;
          StartupNotify=true
          DESKTOP
          # Fix indentation
          sed -i 's/^          //' ${PKG_DIR}/usr/share/applications/ebrowser.desktop

          # Icon (convert SVG to PNG)
          if command -v convert &>/dev/null; then
            convert assets/logo.svg -resize 256x256 ${PKG_DIR}/usr/share/icons/hicolor/256x256/apps/ebrowser.png 2>/dev/null || true
          fi

          # Docs
          cp README.md CHANGELOG.md LICENSE ${PKG_DIR}/usr/share/doc/ebrowser/

          # Control file
          cat > ${PKG_DIR}/DEBIAN/control << EOF
          Package: ebrowser
          Version: ${VERSION}
          Section: web
          Priority: optional
          Architecture: amd64
          Depends: libsdl2-2.0-0 (>= 2.0.0), libc6 (>= 2.17)
          Maintainer: EmbeddedOS <info@embeddedos.org>
          Homepage: https://github.com/embeddedos-org/eBrowser
          Description: eBrowser — The Most Secure Lightweight Browser
           A security-focused embedded browser with process sandboxing,
           hardened memory allocator, application firewall, anti-fingerprinting,
           DNS-over-HTTPS, built-in tracker blocker, and WebExtensions V3 support.
          EOF
          sed -i 's/^          //' ${PKG_DIR}/DEBIAN/control

          dpkg-deb --build --root-owner-group ${PKG_DIR}
          mv ${PKG_DIR}.deb eBrowser-${VERSION}-linux-x86_64.deb
          echo "=== .deb package ==="
          ls -lh eBrowser-${VERSION}-linux-x86_64.deb

      - name: Build AppImage
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"

          # Download appimagetool — pinned to stable release
          curl -fsSL -o appimagetool https://github.com/AppImage/appimagetool/releases/download/1.9.0/appimagetool-x86_64.AppImage
          chmod +x appimagetool

          # Create AppDir structure
          mkdir -p eBrowser.AppDir/usr/bin
          mkdir -p eBrowser.AppDir/usr/share/applications
          mkdir -p eBrowser.AppDir/usr/share/icons/hicolor/256x256/apps

          cp build/port/eBrowser eBrowser.AppDir/usr/bin/ebrowser

          # Desktop file
          cat > eBrowser.AppDir/ebrowser.desktop << 'DESKTOP'
          [Desktop Entry]
          Name=eBrowser
          Comment=The Most Secure Lightweight Browser
          Exec=ebrowser %u
          Icon=ebrowser
          Type=Application
          Categories=Network;WebBrowser;
          DESKTOP
          sed -i 's/^          //' eBrowser.AppDir/ebrowser.desktop
          cp eBrowser.AppDir/ebrowser.desktop eBrowser.AppDir/usr/share/applications/

          # Icon
          if command -v convert &>/dev/null; then
            convert assets/logo.svg -resize 256x256 eBrowser.AppDir/ebrowser.png 2>/dev/null || \
              cp assets/logo.svg eBrowser.AppDir/ebrowser.svg
          else
            cp assets/logo.svg eBrowser.AppDir/ebrowser.svg
          fi

          # AppRun
          cat > eBrowser.AppDir/AppRun << 'APPRUN'
          #!/bin/bash
          SELF=$(readlink -f "$0")
          HERE=${SELF%/*}
          exec "${HERE}/usr/bin/ebrowser" "$@"
          APPRUN
          chmod +x eBrowser.AppDir/AppRun

          # Build AppImage
          ARCH=x86_64 ./appimagetool eBrowser.AppDir eBrowser-${VERSION}-x86_64.AppImage 2>/dev/null || true
          if [ -f "eBrowser-${VERSION}-x86_64.AppImage" ]; then
            echo "=== AppImage ==="
            ls -lh eBrowser-${VERSION}-x86_64.AppImage
          fi

      - name: Upload .deb
        uses: actions/upload-artifact@v4
        with:
          name: ebrowser-linux-deb
          path: eBrowser-*-linux-x86_64.deb

      - name: Upload AppImage
        if: ${{ hashFiles('eBrowser-*-x86_64.AppImage') != '' }}
        uses: actions/upload-artifact@v4
        with:
          name: ebrowser-linux-appimage
          path: eBrowser-*-x86_64.AppImage

  # ===========================================================
  # Windows: Installer .exe (Inno Setup)
  # ===========================================================
  build-windows:
    name: Build — Windows x86_64
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install dependencies
        run: |
          choco install innosetup -y --no-progress
          vcpkg install sdl2:x64-windows openssl:x64-windows

      - name: Create include symlink
        shell: cmd
        run: |
          cd include
          if not exist eBrowser mklink /J eBrowser ebrowser

      - name: Build Release
        shell: pwsh
        run: |
          cmake -B build `
            -DCMAKE_BUILD_TYPE=Release `
            -DBUILD_TESTING=OFF `
            -DBUILD_SHARED_LIBS=OFF `
            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_INSTALLATION_ROOT\scripts\buildsystems\vcpkg.cmake"
          cmake --build build --config Release --parallel

      - name: Stage release files
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path release/bin
          # Copy eBrowser executable
          $exe = Get-ChildItem -Path build -Recurse -Filter "eBrowser.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
          if ($exe) { Copy-Item $exe.FullName -Destination release/bin/ }
          # Copy any DLLs from build tree
          Get-ChildItem -Path build -Recurse -Filter "*.dll" -ErrorAction SilentlyContinue | ForEach-Object {
            Copy-Item $_.FullName -Destination release/bin/ -Force
          }
          # Copy vcpkg runtime DLLs
          $vcpkgBin = "$env:VCPKG_INSTALLATION_ROOT\installed\x64-windows\bin"
          if (Test-Path $vcpkgBin) {
            foreach ($pattern in @("SDL2.dll", "libssl*.dll", "libcrypto*.dll")) {
              Get-ChildItem -Path $vcpkgBin -Filter $pattern -ErrorAction SilentlyContinue | ForEach-Object {
                Copy-Item $_.FullName -Destination release/bin/ -Force
                Write-Host "Copied: $($_.Name)"
              }
            }
          }
          # Fallback search for SDL2.dll
          if (-not (Test-Path "release/bin/SDL2.dll")) {
            Write-Warning "SDL2.dll NOT found — searching system..."
            Get-ChildItem -Path "$env:VCPKG_INSTALLATION_ROOT" -Recurse -Filter "SDL2.dll" -ErrorAction SilentlyContinue | Select-Object -First 1 | ForEach-Object {
              Copy-Item $_.FullName -Destination release/bin/ -Force
              Write-Host "Found and copied: $($_.FullName)"
            }
          }
          Write-Host "=== Release bin contents ==="
          Get-ChildItem release/bin/ | ForEach-Object { Write-Host "  $($_.Name) ($([math]::Round($_.Length/1KB)) KB)" }
          Copy-Item README.md, CHANGELOG.md, LICENSE -Destination release/ -ErrorAction SilentlyContinue

      - name: Build Installer
        shell: pwsh
        run: |
          $version = "${{ github.ref_name }}".TrimStart("v")
          # Ensure output directory exists
          New-Item -ItemType Directory -Force -Path build/installer | Out-Null
          # Find iscc
          $iscc = "C:\Program Files (x86)\Inno Setup 6\ISCC.exe"
          if (-not (Test-Path $iscc)) {
            $iscc = (Get-Command iscc -ErrorAction SilentlyContinue).Source
          }
          if (-not $iscc -or -not (Test-Path $iscc)) {
            Write-Error "Inno Setup (iscc) not found!"
            exit 1
          }
          Write-Host "Using: $iscc"
          Write-Host "Version: $version"
          Write-Host "Release bin contents:"
          Get-ChildItem release/bin/ -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "  $($_.Name)" }
          # Build installer
          & $iscc "/DEBROWSER_VERSION=$version" "installer\windows\ebrowser-setup.iss"
          if ($LASTEXITCODE -ne 0) { Write-Error "Inno Setup failed"; exit 1 }
          # Copy output to repo root for upload
          $installer = Get-ChildItem -Path build/installer -Filter "*.exe" | Select-Object -First 1
          if ($installer) {
            Copy-Item $installer.FullName -Destination "eBrowser-$version-Setup-x64.exe"
            Write-Host "=== Installer built ==="
            Write-Host "  $($installer.Name) ($([math]::Round($installer.Length/1MB, 1)) MB)"
          } else {
            Write-Error "Installer .exe not found in build/installer/"
            Get-ChildItem build/installer/ -ErrorAction SilentlyContinue
            exit 1
          }

      - name: Upload installer
        uses: actions/upload-artifact@v4
        with:
          name: ebrowser-windows-installer
          path: eBrowser-*-Setup-x64.exe

  # ===========================================================
  # macOS: .dmg disk image
  # ===========================================================
  build-macos-arm64:
    name: Build — macOS arm64
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install dependencies
        run: brew install sdl2

      - name: Create include symlink
        run: ln -sf ebrowser include/eBrowser 2>/dev/null || true

      - name: Build Release
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DBUILD_TESTING=OFF \
            -DCMAKE_PREFIX_PATH=$(brew --prefix)
          cmake --build build --parallel $(sysctl -n hw.ncpu)

      - name: Create .app bundle
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"
          APP="eBrowser.app"

          mkdir -p "${APP}/Contents/MacOS"
          mkdir -p "${APP}/Contents/Resources"
          mkdir -p "${APP}/Contents/Frameworks"

          # Binary
          cp build/port/eBrowser "${APP}/Contents/MacOS/eBrowser" 2>/dev/null || true

          # Copy SDL2 framework/dylib
          SDL2_LIB=$(brew --prefix sdl2)/lib
          if [ -d "${SDL2_LIB}" ]; then
            cp ${SDL2_LIB}/libSDL2*.dylib "${APP}/Contents/Frameworks/" 2>/dev/null || true
            # Fix rpath
            for dylib in "${APP}"/Contents/Frameworks/libSDL2*.dylib; do
              install_name_tool -id "@executable_path/../Frameworks/$(basename $dylib)" "$dylib" 2>/dev/null || true
            done
            if [ -f "${APP}/Contents/MacOS/eBrowser" ]; then
              install_name_tool -add_rpath "@executable_path/../Frameworks" "${APP}/Contents/MacOS/eBrowser" 2>/dev/null || true
            fi
          fi

          # Info.plist
          cat > "${APP}/Contents/Info.plist" << PLIST
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>CFBundleExecutable</key>
            <string>eBrowser</string>
            <key>CFBundleIdentifier</key>
            <string>org.embeddedos.ebrowser</string>
            <key>CFBundleName</key>
            <string>eBrowser</string>
            <key>CFBundleDisplayName</key>
            <string>eBrowser</string>
            <key>CFBundleVersion</key>
            <string>${VERSION}</string>
            <key>CFBundleShortVersionString</key>
            <string>${VERSION}</string>
            <key>CFBundlePackageType</key>
            <string>APPL</string>
            <key>CFBundleSignature</key>
            <string>eBrw</string>
            <key>CFBundleIconFile</key>
            <string>AppIcon</string>
            <key>LSMinimumSystemVersion</key>
            <string>12.0</string>
            <key>NSHighResolutionCapable</key>
            <true/>
            <key>CFBundleDocumentTypes</key>
            <array>
              <dict>
                <key>CFBundleTypeRole</key>
                <string>Viewer</string>
                <key>CFBundleTypeName</key>
                <string>HTML Document</string>
                <key>CFBundleTypeExtensions</key>
                <array>
                  <string>html</string>
                  <string>htm</string>
                </array>
                <key>LSHandlerRank</key>
                <string>Alternate</string>
              </dict>
            </array>
            <key>CFBundleURLTypes</key>
            <array>
              <dict>
                <key>CFBundleURLSchemes</key>
                <array>
                  <string>http</string>
                  <string>https</string>
                </array>
                <key>CFBundleURLName</key>
                <string>Web URL</string>
              </dict>
            </array>
          </dict>
          </plist>
          PLIST

          # Generate icns from SVG
          if command -v sips &>/dev/null && [ -f assets/logo.svg ]; then
            mkdir -p AppIcon.iconset
            for size in 16 32 64 128 256 512; do
              sips -z $size $size assets/logo.svg --out "AppIcon.iconset/icon_${size}x${size}.png" 2>/dev/null || true
              double=$((size * 2))
              sips -z $double $double assets/logo.svg --out "AppIcon.iconset/icon_${size}x${size}@2x.png" 2>/dev/null || true
            done
            iconutil -c icns AppIcon.iconset -o "${APP}/Contents/Resources/AppIcon.icns" 2>/dev/null || true
          fi

          echo "=== App bundle ==="
          find "${APP}" -type f | head -20

      - name: Create DMG
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"
          DMG_NAME="eBrowser-${VERSION}-macOS-arm64.dmg"

          # Create DMG with Applications symlink
          mkdir -p dmg_contents
          cp -R eBrowser.app dmg_contents/
          ln -s /Applications dmg_contents/Applications
          cp README.md dmg_contents/ 2>/dev/null || true

          hdiutil create -volname "eBrowser ${VERSION}" \
            -srcfolder dmg_contents \
            -ov -format UDZO \
            "${DMG_NAME}"

          echo "=== DMG ==="
          ls -lh "${DMG_NAME}"

      - name: Upload DMG
        uses: actions/upload-artifact@v4
        with:
          name: ebrowser-macos-dmg
          path: eBrowser-*-macOS-arm64.dmg

  # ===========================================================
  # Book PDF
  # ===========================================================
  build-pdf:
    name: Build Book PDF
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check book source
        id: check
        run: |
          if [ ! -f docs/book/book.md ]; then
            echo "has_book=false" >> $GITHUB_OUTPUT
          else
            echo "has_book=true" >> $GITHUB_OUTPUT
          fi

      - name: Install pandoc & LaTeX
        if: steps.check.outputs.has_book == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y pandoc texlive-xetex texlive-fonts-recommended texlive-fonts-extra

      - name: Clean source
        if: steps.check.outputs.has_book == 'true'
        run: sed -i 's/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]//g' docs/book/book.md

      - name: Generate PDF
        if: steps.check.outputs.has_book == 'true'
        run: |
          VERSION="${GITHUB_REF#refs/tags/}"
          pandoc \
            docs/book/book.md \
            -o eBrowser-guide.pdf \
            --pdf-engine=xelatex \
            --from=markdown+smart \
            -V geometry:margin=1in \
            -V fontsize=11pt \
            -V documentclass=report \
            -V "title=eBrowser — Official Reference Guide" \
            -V "subtitle=Version $VERSION" \
            -V "author=Srikanth Patchava \\& EmbeddedOS Contributors" \
            -V "date=$(date +'%B %Y')" \
            -V toc=true \
            -V toc-depth=3 \
            -V colorlinks=true \
            -V linkcolor=blue \
            -V urlcolor=blue \
            --highlight-style=tango \
            --number-sections

      - name: Verify PDF
        if: steps.check.outputs.has_book == 'true'
        run: |
          if [ ! -f eBrowser-guide.pdf ]; then
            echo "ERROR: PDF not generated"
            exit 1
          fi
          SIZE=$(du -h eBrowser-guide.pdf | cut -f1)
          echo "PDF generated: $SIZE"

      - name: Upload PDF artifact
        if: steps.check.outputs.has_book == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: book-pdf
          path: eBrowser-guide.pdf

  # ===========================================================
  # Promo Video
  # ===========================================================
  build-video:
    name: Build Promo Video
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4

      - name: Check promo source
        id: check
        run: |
          if [ -f promo/promo_scene.py ] && [ -f promo/generate_audio.py ]; then
            echo "has_promo=true" >> $GITHUB_OUTPUT
          else
            echo "has_promo=false" >> $GITHUB_OUTPUT
          fi

      - name: Set up Python
        if: steps.check.outputs.has_promo == 'true'
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install dependencies
        if: steps.check.outputs.has_promo == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg libcairo2-dev libpango1.0-dev
          pip install manim==0.18.1 edge-tts mutagen

      - name: Generate narration audio
        if: steps.check.outputs.has_promo == 'true'
        run: |
          cd promo
          python generate_audio.py
          ls -lh *.mp3

      - name: Render video
        if: steps.check.outputs.has_promo == 'true'
        run: |
          cd promo
          manim render -qh --format mp4 promo_scene.py ProductPromo

      - name: Merge video + audio
        if: steps.check.outputs.has_promo == 'true'
        run: |
          cd promo
          VIDEO=$(find media/videos -name "ProductPromo.mp4" | head -1)
          if [ -n "$VIDEO" ]; then
            ffmpeg -y -i "$VIDEO" -i narration.mp3 \
              -c:v copy -c:a aac -b:a 192k \
              -map 0:v:0 -map 1:a:0 \
              -shortest \
              eBrowser-promo.mp4
            ls -lh eBrowser-promo.mp4
          fi

      - name: Upload video
        if: steps.check.outputs.has_promo == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: ebrowser-promo-video
          path: promo/eBrowser-promo.mp4

  # ===========================================================
  # Create GitHub Release with installers
  # ===========================================================
  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [build-linux, build-windows, build-macos-arm64, build-pdf, build-video]
    if: always() && needs.build-linux.result == 'success'
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Extract version
        id: version
        run: echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Collect release files
        run: |
          mkdir -p final
          find artifacts -type f \( -name "*.deb" -o -name "*.AppImage" -o -name "*.exe" -o -name "*.dmg" -o -name "*.pdf" -o -name "*.mp4" \) \
            -exec cp {} final/ \;
          echo "=== Release assets ==="
          ls -lh final/

      - name: Generate SHA-256 checksums
        run: |
          cd final
          sha256sum * > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Generate CycloneDX SBOM
        uses: anchore/sbom-action@v0
        with:
          path: .
          format: cyclonedx-json
          output-file: final/sbom.cdx.json
          artifact-name: sbom.cdx.json

      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@v0
        with:
          path: .
          format: spdx-json
          output-file: final/sbom.spdx.json
          artifact-name: sbom.spdx.json

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign artifacts (cosign keyless)
        run: |
          set -e
          cd final
          for f in *.deb *.AppImage *.exe *.dmg *.pdf *.mp4; do
            [ -f "$f" ] || continue
            cosign sign-blob --yes --bundle "${f}.sig.bundle" "$f"
          done

      - name: Optional Linux GPG signing
        if: env.GPG_KEY != ''
        env:
          GPG_KEY: ${{ secrets.GPG_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          echo "$GPG_KEY" | gpg --batch --import
          cd final
          for f in *.deb *.AppImage; do
            [ -f "$f" ] || continue
            echo "$GPG_PASSPHRASE" | gpg --batch --yes --pinentry-mode loopback \
              --passphrase-fd 0 --detach-sign --armor "$f"
          done

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: "eBrowser ${{ steps.version.outputs.tag }}"
          fail_on_unmatched_files: false
          body: |
            ## eBrowser ${{ steps.version.outputs.tag }}

            ### Install

            | Platform | Download | Install |
            |----------|----------|---------|
            | **Windows** | `eBrowser-Setup-x64.exe` | Run the installer |
            | **macOS** (Apple Silicon) | `eBrowser-macOS-arm64.dmg` | Open DMG, drag to Applications |
            | **Linux** (Debian/Ubuntu) | `eBrowser-linux-x86_64.deb` | `sudo dpkg -i eBrowser-*.deb` |
            | **Linux** (Any distro) | `eBrowser-x86_64.AppImage` | `chmod +x eBrowser-*.AppImage && ./eBrowser-*.AppImage` |
            | **Reference Guide** | `eBrowser-guide.pdf` | |
            | **Promo Video** | `eBrowser-promo.mp4` | |

            ### Integrity & supply-chain
            - `SHA256SUMS.txt` — file checksums
            - `sbom.cdx.json` — CycloneDX SBOM
            - `sbom.spdx.json` — SPDX SBOM
            - `*.sig.bundle` — Sigstore cosign keyless signatures
            - `*.asc` — GPG detached signatures (when GPG_KEY is configured)

            ### Highlights
            - Process sandbox (seccomp-BPF + namespaces)
            - Hardened memory allocator (canaries, UAF detection)
            - Application firewall (domain blocklist, CIDR, rate limiting)
            - Anti-fingerprinting (4 levels incl. Tor-like)
            - DNS-over-HTTPS with DNSSEC
            - Built-in tracker/ad blocker (EasyList compatible)
            - WebExtensions V3 API
          files: final/*
          draft: false
          prerelease: false

  # ===========================================================
  # Docker
  # ===========================================================
  docker-release:
    name: Docker Release
    runs-on: ubuntu-22.04
    needs: create-release
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version
        id: meta
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Lowercase image name
        id: image
        run: echo "name=$(echo '${{ github.repository_owner }}/ebrowser' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: enterprise/docker/Dockerfile
          push: true
          tags: |
            ghcr.io/${{ steps.image.outputs.name }}:${{ steps.meta.outputs.version }}
            ghcr.io/${{ steps.image.outputs.name }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max