ci.yml

name: CI
on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    # Ref: GHA Filter pattern syntax: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#filter-pattern-cheat-sheet
    # Run on pushes to main, release branches, and previous/future major version branches
    branches:
      - main
      - 'v[0-9]+.*' # Matches any release branch, e.g. v6.0.3, v12.1.0
      - '[0-9]+.x' # Matches any major version branch, e.g. 5.x, 23.x
    tags:
      - 'v[0-9]*' # Version tags trigger release publishing (npm, GitHub Release, Docker)

env:
  FORCE_COLOR: 1
  HEAD_COMMIT: ${{ github.sha }}
  NODE_VERSION: 22.23.1
  # Disable v8-compile-cache to prevent intermittent V8 deserializer crashes
  # when multiple parallel Nx workers race to read/write shared bytecode cache
  # files. The cache lives in /tmp and is discarded after each run anyway,
  # so disabling it has no meaningful performance impact in CI.
  # See: https://github.com/nodejs/node/issues/51555
  DISABLE_V8_COMPILE_CACHE: 1
  # Nx's native (Rust/NAPI) command runner intermittently segfaults on the CI
  # runners when it forks a task through its pseudo-terminal — the process is
  # killed with SIGSEGV before the target script even starts. It's an upstream
  # Nx instability (see nrwl/nx#27917, nrwl/nx#2956), not a Ghost bug, and it
  # can hit any job that runs `nx run`/`nx run-many`, so the switch to the
  # legacy child_process runner is set globally rather than per-job. The legacy
  # runner was Nx's default before the native one existed; parallelism is
  # unaffected and output/colour is preserved (FORCE_COLOR is set above), so
  # there's no meaningful cost in CI.
  NX_NATIVE_COMMAND_RUNNER: "false"

concurrency:
  # Tag pushes get a unique uninterruptible group so a release CI run always
  # finishes; branch / PR pushes keep cancel-on-newer behavior.
  group: ${{ startsWith(github.ref, 'refs/tags/') && format('release-{0}', github.ref) || github.head_ref || github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

# Default least-privilege token for all jobs; jobs that need more declare
# their own permissions block, which overrides this default.
permissions:
  contents: read

jobs:
  job_setup:
    name: Setup
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      IS_MAIN: ${{ github.ref == 'refs/heads/main' }}
      IS_TAG: ${{ startsWith(github.ref, 'refs/tags/v') }}
      IS_DEVELOPMENT: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/6.x' }}
      IS_SIX: ${{ github.ref == 'refs/heads/6.x' }}
      IS_SIX_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref == '6.x' }}
    permissions:
      actions: read
      contents: read
      # Required by dorny/paths-filter, which calls pulls.listFiles on
      # pull_request events. Private forks of this repo don't grant this
      # implicitly when an explicit permissions block is present, so it must
      # be listed here for the Setup job to succeed on those forks.
      pull-requests: read
    steps:
      - name: Checkout current commit
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ env.HEAD_COMMIT }}
          fetch-depth: 0
          # fetch a treeless clone to improve checkout speed, the job will fetch contents later if needed
          filter: 'tree:0'

      - name: Output GitHub context
        if: env.RUNNER_DEBUG == '1'
        run: |
          echo "GITHUB_EVENT_NAME: ${{ github.event_name }}"
          echo "GITHUB_CONTEXT: ${{ toJson(github.event) }}"

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - name: Set up Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      # Replaced nrwl/nx-set-shas, which verified each candidate commit over the
      # API and hid the errors — see scripts/nx-set-shas.js.
      - name: Set SHAs for Nx Commands
        if: env.IS_TAG != 'true'
        env:
          GITHUB_TOKEN: ${{ github.token }}
          BRANCH: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.ref_name }}
          # Canonical main is the one branch where too narrow a base means
          # untested commits land, so there a lookup that comes up empty fails
          # the run rather than falling back to the previous commit.
          ON_MISSING: ${{ (env.IS_MAIN == 'true' && github.repository == 'TryGhost/Ghost') && 'error' || 'previous-commit' }}
        run: node scripts/nx-set-shas.js --branch "$BRANCH" --head "$HEAD_COMMIT" --on-missing "$ON_MISSING"

      - name: Check user org membership
        id: check_user_org_membership
        if: github.event_name == 'pull_request'
        run: |
          echo "Looking up: ${{ github.triggering_actor }}"
          ENCODED_USERNAME=$(printf '%s' '${{ github.triggering_actor }}' | jq -sRr @uri)

          LOOKUP_USER=$(curl --write-out "%{http_code}" --silent --output /dev/null --location "https://api.github.com/orgs/tryghost/members/$ENCODED_USERNAME" --header "Authorization: Bearer ${{ secrets.CANARY_DOCKER_BUILD }}")

          if [ "$LOOKUP_USER" == "204" ]; then
            echo "User is in the org"
            echo "is_member=true" >> $GITHUB_OUTPUT
          else
            echo "User is not in the org"
            echo "is_member=false" >> $GITHUB_OUTPUT
          fi

      - name: Determine changed packages
        if: env.IS_TAG != 'true'
        uses: AurorNZ/paths-filter@c9dd42e99db87803313ff6f4b1150cc9f6c836af # v5.0.0
        id: changed
        with:
          base: ${{ env.NX_BASE }}
          filters: |
            shared: &shared
              - '.github/**'
              # The @internal/scripts workspace sits outside .github but is
              # invoked by the workflows below, so it needs the same treatment
              # the '.github/**' glob used to give it when it lived there.
              - 'scripts/**'
              # Renovate config / workflow files have no Ghost
              # runtime/test impact. Anchored as &renovate_only and
              # referenced from every filter below so a PR touching
              # only these files skips all downstream jobs; the
              # rollup gate passes on skipped deps.
              - &renovate_only
                - '!.github/renovate.json5'
                - '!.github/renovate-bot.cjs'
                - '!.github/workflows/renovate.yml'
              - '.npmrc'
              - 'nx.json'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
            ci:
              - '.github/workflows/**'
              - *renovate_only
              - '.github/actions/**'
              - '.github/scripts/**'
              - 'scripts/**'
            docs:
              - '**/*.md'
              - '.agents/**'
              - '.claude/**'
              - '.github/workflows/ci.yml'
              - 'package.json'
              - 'scripts/check-agent-skill-links.js'
              - 'scripts/test/check-agent-skill-links.test.js'
            core:
              - *shared
              # Repository documentation and ownership metadata do not affect
              # Ghost runtime behaviour, even though they live in .github.
              - '!.github/**/*.md'
              - '!.github/CODEOWNERS'
              - 'ghost/**'
              - '!ghost/core/core/server/data/tinybird/**'
              # Unit tests + vitest config are exercised only by job_unit-tests;
              # they never affect the acceptance / legacy / ghost-cli jobs.
              - '!ghost/core/test/unit/**'
              - '!ghost/core/vitest.config.ts'
              - '!ghost/core/test/utils/vitest-setup.ts'
              # Koenig packages that are runtime deps of ghost/core — changes
              # here alter server rendering behaviour, so the acceptance /
              # legacy suites must run. Editor-only packages are excluded.
              - 'koenig/**'
              - '!koenig/koenig-lexical/**'
              - '!koenig/kg-unsplash-selector/**'
              - '!koenig/kg-simplemde/**'
              - '!koenig/*/test/**'
            unit-test-globals:
              - 'vitest.config.mjs'
            core-unit-test-globals:
              - 'ghost/core/vitest.config.ts'
              - 'ghost/core/test/utils/vitest-*.ts'
            any-code:
              - '!**/*.md'
              - '!.devcontainer/**'
              - '!.vscode/**'
              - *renovate_only
            # Drives the run_e2e output: matches any changed file that could
            # affect a running Ghost instance. Test files, test config and
            # docs are excluded — a change confined to them cannot alter
            # product behaviour, so the build + E2E lane is skipped.
            # ghost/core test paths are listed today; app test paths can be
            # added here as their conventions are confirmed.
            e2e:
              - '!**/*.md'
              - '!.devcontainer/**'
              - '!.vscode/**'
              - '!ghost/core/test/**'
              - '!ghost/core/vitest.config.ts'
              - '!koenig/*/test/**'
              - *renovate_only
            # The Analytics E2E shards normally pull a prebuilt tb-cli image
            # from GHCR, which is only republished from main. Without this the
            # PR that changes the Dockerfile is the one PR that never exercises
            # it — the break lands on main and surfaces in someone else's PR.
            tb-cli:
              - 'docker/tb-cli/**'

      - name: Define Node test matrix
        id: node_matrix
        run: |
          echo 'matrix=["22.23.1"]' >> $GITHUB_OUTPUT

      - name: Start Nx Cloud CI run
        run: pnpm nx start-ci-run

      - name: Determine Affected Projects
        id: affected
        run: |
          # if the ci files have changed or we're in a tag, ensure we don't just look at affected
          # projects and we run the necessary jobs on all projects
          AFFECTED_ARG="--affected"
          if [[ "${{ steps.changed.outputs.ci }}" == 'true' || "${{ env.IS_TAG }}" == 'true' ]]; then
            AFFECTED_ARG=""
          fi

          AFFECTED_PROJECTS=$(pnpm -s nx show projects ${AFFECTED_ARG} --json)
          echo "affected_projects=$AFFECTED_PROJECTS" >> "$GITHUB_OUTPUT"
          # string list for use in run-many commands
          AFFECTED_PROJECTS_STR=$(pnpm -s nx show projects ${AFFECTED_ARG} --sep=, | tr -d '\n')
          echo "affected_projects_str=$AFFECTED_PROJECTS_STR" >> "$GITHUB_OUTPUT"

          UNIT_TEST_AFFECTED_ARG="$AFFECTED_ARG"
          if [[ "${{ steps.changed.outputs.unit-test-globals }}" == 'true' ]]; then
            UNIT_TEST_AFFECTED_ARG=""
          fi
          UNIT_TEST_PROJECTS_STR=$(pnpm -s nx show projects ${UNIT_TEST_AFFECTED_ARG} --withTarget test:unit --sep=, | tr -d '\n')
          if [[ "${{ steps.changed.outputs.core-unit-test-globals }}" == 'true' ]]; then
            UNIT_TEST_PROJECTS_STR=$(printf '%s\n%s\n' "$UNIT_TEST_PROJECTS_STR" "ghost" | awk 'NF && !seen[$0]++' | paste -sd, -)
          fi
          echo "unit_test_projects_str=$UNIT_TEST_PROJECTS_STR" >> "$GITHUB_OUTPUT"

          # "i18n" tag = packages whose source is scanned by @tryghost/i18n's
          # translate:* scripts (not packages that merely import @tryghost/i18n).
          I18N_PROJECTS=$(pnpm -s nx show projects ${AFFECTED_ARG} --projects 'tag:i18n' --sep=, | tr -d '\n')
          echo "affected_i18n_projects=${I18N_PROJECTS}" >> "$GITHUB_OUTPUT"

          # "playwright" tag = projects whose test:acceptance suite runs in
          # job_apps_acceptance-tests. Tag-based rather than directory-based so
          # the matrix isn't coupled to the workspace layout (apps/*, koenig/*, ...).
          PLAYWRIGHT_PROJECTS=$(pnpm -s nx show projects ${AFFECTED_ARG} \
            --withTarget test:acceptance \
            --projects 'tag:playwright' \
            --json)
          echo "affected_playwright_projects=$PLAYWRIGHT_PROJECTS" >> "$GITHUB_OUTPUT"

          # Build the publish matrix for affected public apps. Matrix context
          # isn't available in a job-level `if:`, so the publish job can't filter
          # itself per-app — instead we emit the matrix here and it skips when
          # the result is `[]`. The publish job's own is_main / event gates keep
          # tags and PRs from publishing regardless of what this lists.
          PUBLISH_PUBLIC_APPS_MATRIX=$(node scripts/build-public-apps-matrix.js "$AFFECTED_PROJECTS")
          echo "publish_public_apps_matrix=$PUBLISH_PUBLIC_APPS_MATRIX" >> "$GITHUB_OUTPUT"

    outputs:
      affected_projects: ${{ steps.affected.outputs.affected_projects }}
      affected_projects_str: ${{ steps.affected.outputs.affected_projects_str }}
      unit_test_projects_str: ${{ steps.affected.outputs.unit_test_projects_str }}
      affected_playwright_projects: ${{ steps.affected.outputs.affected_playwright_projects }}
      publish_public_apps_matrix: ${{ steps.affected.outputs.publish_public_apps_matrix }}
      changed_i18n_apps: ${{ steps.affected.outputs.affected_i18n_projects != '' }}
      changed_core: ${{ steps.changed.outputs.core }}
      changed_any_code: ${{ steps.changed.outputs.any-code }}
      changed_docs: ${{ steps.changed.outputs.docs }}
      changed_tb_cli: ${{ steps.changed.outputs.tb-cli }}
      # Single gate for the build + browser-E2E lane. True for tags, or when a
      # changed file could affect a running Ghost instance (see the `e2e` path
      # filter above). A test-only / docs-only change keeps this false.
      run_e2e: ${{ env.IS_TAG == 'true' || steps.changed.outputs.e2e == 'true' }}
      # Coverage instrumentation (c8 for core, ember-cli-code-coverage for
      # admin) and the Codecov upload only happen on the canonical repo. Forks
      # — including TryGhost's private ones — don't report to Ghost's Codecov
      # project, so instrumenting their test runs just slows CI down to produce
      # a report nothing consumes.
      coverage_enabled: ${{ github.repository == 'TryGhost/Ghost' }}
      is_main: ${{ env.IS_MAIN }}
      is_tag: ${{ env.IS_TAG }}
      is_development: ${{ env.IS_DEVELOPMENT }}
      is_six: ${{ env.IS_SIX }}
      is_six_pr: ${{ env.IS_SIX_PR }}
      member_is_in_org: ${{ steps.check_user_org_membership.outputs.is_member }}
      has_perf_tests_label: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'perf-tests') }}
      node_version: ${{ env.NODE_VERSION }}
      node_test_matrix: ${{ steps.node_matrix.outputs.matrix }}
      nx_base: ${{ env.NX_BASE }}

  job_app_version_bump_check:
    name: Check app version bump
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout PR head commit
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Fetch main branch
        run: git fetch --no-tags origin main

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      # The script's only runtime dep is semver, so install @internal/scripts
      # alone rather than the whole workspace — ~0.5s and a single package.
      - name: Install scripts dependencies
        run: pnpm install --frozen-lockfile --filter @internal/scripts --prod --ignore-scripts

      - name: Check app version bump
        env:
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_COMPARE_SHA: ${{ github.event.pull_request.head.sha }}
        run: node scripts/check-app-version-bump.js

      # Fail the PR if a publishable package changed (source or a catalog entry
      # it consumes) but the branch adds no changeset covering it. Prototype of
      # pnpm's forthcoming `pnpm change check`.
      - name: Check for missing changesets
        env:
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_COMPARE_SHA: ${{ github.event.pull_request.head.sha }}
        run: node scripts/change-check.js

  job_migration_integrity_check:
    name: Check migration integrity
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout PR head commit
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Fetch PR base branch
        run: git fetch --no-tags origin "${{ github.event.pull_request.base.ref }}"

      - name: Check migration integrity
        env:
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_COMPARE_SHA: ${{ github.event.pull_request.head.sha }}
        run: node scripts/check-migration-integrity.cjs

  job_lint:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.affected_projects_str != ''
    name: Lint
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 1000
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: ghost/**/.eslintcache
          key: eslint-cache

      - name: Lint projects
        run: pnpm nx run-many -t lint -p "${{ needs.job_setup.outputs.affected_projects_str }}"
        env:
          NX_BASE: ${{ needs.job_setup.outputs.nx_base }}
          NX_HEAD: ${{ env.HEAD_COMMIT }}

      - name: Lint boundaries
        run: pnpm nx run ghost-monorepo:lint:boundaries

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_lint_docs:
    name: Lint docs
    runs-on: ubuntu-slim
    needs: [job_setup]
    if: needs.job_setup.outputs.changed_docs == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Lint agent skills
        run: node scripts/check-agent-skill-links.js

  job_i18n:
    runs-on: ubuntu-latest
    needs: [job_setup]
    name: i18n
    if: |
      needs.job_setup.outputs.is_tag == 'true'
      || needs.job_setup.outputs.changed_i18n_apps == 'true'
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --filter @tryghost/i18n... --ignore-scripts

      - name: Run i18n tests
        run: pnpm --filter @tryghost/i18n test

  job_admin-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: |
      needs.job_setup.outputs.is_tag == 'true'
      || contains(fromJSON(needs.job_setup.outputs.affected_projects), 'ghost-admin')
    name: Admin tests - Chrome
    env:
      MOZ_HEADLESS: 1
      JOBS: 1
      CI: true
      COVERAGE: ${{ needs.job_setup.outputs.coverage_enabled }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - run: pnpm nx run ghost-admin:test
        env:
          BROWSER: Chrome

      # Merge coverage reports and upload
      - name: Merge Admin test coverage
        if: needs.job_setup.outputs.coverage_enabled == 'true'
        run: pnpm ember coverage-merge
        working-directory: apps/ember-admin
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: needs.job_setup.outputs.coverage_enabled == 'true'
        with:
          name: admin-coverage
          path: apps/*/coverage/cobertura-coverage.xml

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  # Measures Ghost's boot time with hyperfine and appends the result to the
  # long-running series charted at https://tryghost.github.io/Ghost-Benchmarks/
  # (data lives on the gh-pages branch of TryGhost/Ghost-Benchmarks).
  #
  # Changing the runner label or the hyperfine version makes new results
  # incomparable with the existing history - treat both as pinned.
  job_perf-tests:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    needs: [job_setup]
    if: (needs.job_setup.outputs.changed_core == 'true' && needs.job_setup.outputs.is_development == 'true') || needs.job_setup.outputs.has_perf_tests_label == 'true'
    name: Performance tests
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          # Boot activates the default theme, which is a submodule
          submodules: true

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        # --force for the same reason as job_unit-tests: better-sqlite3 is an
        # optionalDependency and boot uses it for the development database.
        run: pnpm install --frozen-lockfile --force

      - name: Install hyperfine
        uses: ./.github/actions/install-hyperfine

      - name: Build TS code
        run: pnpm nx run-many -t build:tsc

      - name: Run hyperfine on boot
        working-directory: ghost/core
        run: hyperfine --show-output --warmup 3 'GHOST_CI_SHUTDOWN_AFTER_BOOT=1 node index.js' --export-json boot-perf.json

      - name: Report result
        uses: ./.github/actions/report-boot-benchmark
        with:
          results-file: ghost/core/boot-perf.json
          series: Benchmark
          metric: Boot time
          title: Boot time (dev tree)
          github-token: ${{ secrets.CANARY_DOCKER_BUILD }}

  # Boot time of the production image, as a series separate from job_perf-tests:
  # that one tracks the code, this one tracks what ships (NODE_ENV=production, no
  # devDependencies, jemalloc, baked compile cache). Never merge them - a base image
  # bump would land in the code series as a regression with no Ghost commit behind it.
  job_perf-tests-image:
    name: Performance tests (production image)
    runs-on: blacksmith-2vcpu-ubuntu-2404
    needs: [job_setup, job_docker]
    # Registry path only: benchmarks are a canonical-repo series, so this pulls the
    # core image from GHCR rather than loading the artifact-path tarball.
    if: |
      needs.job_docker.result == 'success' &&
      needs.job_docker.outputs.use-artifact == 'false' &&
      ((needs.job_setup.outputs.changed_core == 'true' && needs.job_setup.outputs.is_development == 'true') || needs.job_setup.outputs.has_perf_tests_label == 'true')
    permissions:
      contents: read
      packages: read
    steps:
      # Only for .github/actions/load-docker-image; nothing is built from source here.
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install hyperfine
        uses: ./.github/actions/install-hyperfine

      - name: Load core image
        uses: ./.github/actions/load-docker-image
        id: load
        with:
          use-artifact: 'false'
          image-tags: ${{ needs.job_docker.outputs.image-core-tags }}

      - name: Start MySQL
        # Own network rather than a service container, so Ghost can reach it by name.
        # Pinned by digest: a MySQL bump moves the measurement, so it should be a
        # deliberate baseline change rather than drift in the series.
        run: |
          docker network create ghost-perf
          docker run -d --name mysql --network ghost-perf \
            --tmpfs /var/lib/mysql \
            -e MYSQL_DATABASE=ghost \
            -e MYSQL_ROOT_PASSWORD=root \
            --health-cmd "mysqladmin ping -h 127.0.0.1 -uroot -proot" \
            --health-interval=2s \
            --health-timeout=5s \
            --health-retries=60 \
            mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b
          for _ in $(seq 1 60); do
            if [ "$(docker inspect -f '{{.State.Health.Status}}' mysql)" = "healthy" ]; then
              exit 0
            fi
            sleep 2
          done
          echo "MySQL did not become healthy"
          docker logs mysql
          exit 1

      - name: Start Ghost container
        # Kept alive with `sleep` so each measured run is a `docker exec`; timing
        # `docker run` would put container create/start inside the measurement.
        env:
          IMAGE_TAG: ${{ steps.load.outputs.image-tag }}
        run: |
          docker run -d --name ghost --network ghost-perf --entrypoint sleep \
            -e GHOST_CI_SHUTDOWN_AFTER_BOOT=1 \
            -e database__client=mysql \
            -e database__connection__host=mysql \
            -e database__connection__user=root \
            -e database__connection__password=root \
            -e database__connection__database=ghost \
            "$IMAGE_TAG" infinity

      - name: Run migrations (discarded first boot)
        # A fresh database costs ~6.5s of migrations vs ~2.3s steady state.
        run: docker exec ghost node index.js

      - name: Run hyperfine on boot
        run: hyperfine --show-output --warmup 3 'docker exec ghost node index.js' --export-json boot-perf-image.json

      - name: Report result
        uses: ./.github/actions/report-boot-benchmark
        with:
          results-file: boot-perf-image.json
          # Own subdirectory in the benchmarks repo (like dx/), so this series gets its
          # own chart and data file and the root series is left untouched.
          data-dir: docker
          series: Production image
          metric: Boot time
          title: Boot time (production image)
          github-token: ${{ secrets.CANARY_DOCKER_BUILD }}

  job_unit-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.unit_test_projects_str != ''
    strategy:
      matrix:
        node: ${{ fromJSON(needs.job_setup.outputs.node_test_matrix) }}
    name: Unit tests (Node ${{ matrix.node }})
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 1000
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm

      - name: Install dependencies
        # better-sqlite3 is an optionalDependency. Without --force, pnpm may skip
        # installing/linking it when restoring from a cached store. --force
        # ensures all optional deps are installed regardless.
        # (ghost core's test:unit job requires better-sqlite3)
        run: pnpm install --frozen-lockfile --force

      - name: Set timezone (non-UTC)
        uses: szenius/set-timezone@1f9716b0f7120e344f0c62bb7b1ee98819aefd42 # v2.0
        with:
          timezoneLinux: "America/New_York"

      - name: Run unit tests
        # ghost/core's unit tests run on vitest (see ghost/core/vitest.config.ts);
        # other packages run their own test:unit target.
        #
        # Retried up to 3 attempts: ghost/core's vitest run intermittently
        # crashes a worker on loaded CI runners — an abnormal process exit,
        # not a reported test failure. nx caches the projects that already
        # passed, so a retry only re-runs the crashed one. Interim stopgap
        # until the vitest worker/teardown issue is fixed.
        #
        # Each attempt is bounded by `timeout`: a test process that finishes
        # its suites but never exits (lingering worker/handle) would otherwise
        # wedge the job until the 6h runner limit. Killing it turns the hang
        # into a retriable failure. A full cold (uncached) run takes ~10min.
        run: |
          for attempt in 1 2 3; do
            timeout 25m pnpm nx run-many -t test:unit -p "${{ needs.job_setup.outputs.unit_test_projects_str }}" && exit 0
            if [ "${attempt}" -lt 3 ]; then
              echo "::warning::Unit tests attempt ${attempt} failed — retrying"
            else
              echo "::error::Unit tests failed after ${attempt} attempts — no more retries"
            fi
          done
          exit 1
        env:
          FORCE_COLOR: 0
          NX_SKIP_LOG_GROUPING: true
          logging__level: fatal

      - name: Check for unexpected file changes
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "Tests generated unexpected file changes. Commit them before merging:"
            git status
            git diff
            exit 1
          fi

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_acceptance-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.changed_core == 'true'
    services:
      mysql:
        image: ${{ matrix.env.DB == 'mysql8' && 'mysql:8.0' || '' }}
        env:
          MYSQL_DATABASE: ghost_testing
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306
        # Poll the healthcheck every 2s instead of 10s — same max wait window
        # (120s = 60 × 2s), but ready-state is discovered ~8s earlier on a
        # typical boot. Same change on the redis service below.
        options: >-
          --tmpfs /var/lib/mysql
          --health-cmd "mysqladmin ping -h 127.0.0.1 -uroot -proot"
          --health-interval=2s
          --health-timeout=5s
          --health-retries=60
      redis:
        image: redis:7.4@sha256:a8f08480e1f88f2647fed492d1178c06abb0d0c1fbf02c682a61e2f483fb3954
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval=2s
          --health-timeout=5s
          --health-retries=60
    strategy:
      matrix:
        node: ${{ fromJSON(needs.job_setup.outputs.node_test_matrix) }}
        env:
          - DB: mysql8
            NODE_ENV: testing-mysql
        include:
          - node: ${{ needs.job_setup.outputs.node_version }}
            env:
              DB: better-sqlite3
              NODE_ENV: testing
    env:
      DB: ${{ matrix.env.DB }}
      NODE_ENV: ${{ matrix.env.NODE_ENV }}
      # The `test:ci:*` targets wrap the suites in c8. Only the sqlite leg is
      # instrumented (mysql covers the same code), and only on the canonical
      # repo — see job_setup's coverage_enabled output.
      COVERAGE_ENABLED: ${{ needs.job_setup.outputs.coverage_enabled == 'true' && matrix.env.DB == 'better-sqlite3' }}
    name: Acceptance tests (Node ${{ matrix.node }}, ${{ matrix.env.DB }})
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm

      - name: Install dependencies
        # better-sqlite3 is an optionalDependency. Without --force, pnpm may skip
        # installing/linking it when restoring from a cached store. --force
        # ensures all optional deps are installed regardless. The mysql leg
        # doesn't need better-sqlite3, so it skips --force and gets a fast cache
        # restore (matches the legacy-tests job below).
        run: |
          if [ "${{ matrix.env.DB }}" = "better-sqlite3" ]; then
            pnpm install --frozen-lockfile --force
          else
            pnpm install --frozen-lockfile
          fi

      - name: Set timezone (non-UTC)
        uses: szenius/set-timezone@1f9716b0f7120e344f0c62bb7b1ee98819aefd42 # v2.0
        with:
          timezoneLinux: "America/New_York"

      - name: Set env vars (SQLite)
        if: contains(matrix.env.DB, 'sqlite')
        run: echo "database__connection__filename=/dev/shm/ghost-test.db" >> "$GITHUB_ENV"

      - name: Set env vars (MySQL)
        if: contains(matrix.env.DB, 'mysql')
        run: |
          {
            echo "database__connection__host=127.0.0.1"
            echo "database__connection__port=${{ job.services.mysql.ports['3306'] }}"
            echo "database__connection__password=root"
          } >> "$GITHUB_ENV"

      - name: E2E tests
        run: |
          if [ "$COVERAGE_ENABLED" = "true" ]; then
            pnpm nx run ghost:test:ci:e2e
          else
            pnpm nx run ghost:test:e2e
          fi

      - name: Start MinIO for integration tests
        run: |
          docker run -d --rm --name minio \
            -p 9000:9000 \
            -e MINIO_ROOT_USER=minio-user \
            -e MINIO_ROOT_PASSWORD=minio-pass \
            minio/minio:RELEASE.2024-12-13T22-19-12Z@sha256:149fdd73108553247ceee85fc65466f51034bd6e145d6e0c0e415167f5f1274f \
            server /data
          for i in $(seq 1 30); do
            if curl -sf http://127.0.0.1:9000/minio/health/ready; then
              echo "MinIO ready after ${i}s"
              exit 0
            fi
            sleep 1
          done
          echo "MinIO did not become ready in time" >&2
          docker logs minio
          exit 1

      - name: Integration tests
        run: |
          if [ "$COVERAGE_ENABLED" = "true" ]; then
            pnpm nx run ghost:test:ci:integration
          else
            pnpm nx run ghost:test:integration
          fi

      - name: Check for unexpected file changes
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "Tests generated unexpected file changes. Commit them before merging:"
            git status
            git diff
            exit 1
          fi

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: env.COVERAGE_ENABLED == 'true' && matrix.node == env.NODE_VERSION
        with:
          name: e2e-coverage
          path: |
            ghost/*/coverage-e2e/cobertura-coverage.xml
            ghost/*/coverage-integration/cobertura-coverage.xml

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_legacy-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.changed_core == 'true'
    services:
      mysql:
        image: ${{ matrix.env.DB == 'mysql8' && 'mysql:8.0' || '' }}
        env:
          MYSQL_DATABASE: ghost_testing
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306
        options: >-
          --tmpfs /var/lib/mysql
          --health-cmd "mysqladmin ping -h 127.0.0.1 -uroot -proot"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=12
    strategy:
      matrix:
        include:
          - node: ${{ needs.job_setup.outputs.node_version }}
            env:
              DB: mysql8
              NODE_ENV: testing-mysql
          - node: ${{ needs.job_setup.outputs.node_version }}
            env:
              DB: better-sqlite3
              NODE_ENV: testing
    env:
      DB: ${{ matrix.env.DB }}
      NODE_ENV: ${{ matrix.env.NODE_ENV }}
    name: Legacy tests (Node ${{ matrix.node }}, ${{ matrix.env.DB }})
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          submodules: true
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm

      - name: Install dependencies
        # better-sqlite3 is an optionalDependency. Without --force, pnpm may skip
        # installing/linking it when restoring from a cached store. --force
        # ensures all optional deps are installed regardless.
        run: |
          if [ "${{ matrix.env.DB }}" = "better-sqlite3" ]; then
            pnpm install --frozen-lockfile --force
          else
            pnpm install --frozen-lockfile
          fi

      - name: Set env vars (SQLite)
        if: contains(matrix.env.DB, 'better-sqlite')
        run: echo "database__connection__filename=/dev/shm/ghost-test.db" >> $GITHUB_ENV

      - name: Set env vars (MySQL)
        if: contains(matrix.env.DB, 'mysql')
        run: |
          echo "database__connection__host=127.0.0.1" >> $GITHUB_ENV
          echo "database__connection__port=${{ job.services.mysql.ports['3306'] }}" >> $GITHUB_ENV
          echo "database__connection__password=root" >> $GITHUB_ENV

      - name: Legacy tests
        # Bounded so a vitest run that completes its suites but hangs in
        # teardown fails fast instead of wedging the job until the 6h runner
        # limit. A normal run takes ~2-3min; 10m leaves ample headroom.
        timeout-minutes: 10
        run: pnpm nx run ghost:test:legacy

      - name: Check for unexpected file changes
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "Tests generated unexpected file changes. Commit them before merging:"
            git status
            git diff
            exit 1
          fi

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_apps_acceptance-tests:
    runs-on: ubuntu-latest
    needs: [job_setup]
    if: needs.job_setup.outputs.affected_playwright_projects != '[]'
    name: App Playwright Acceptance Tests
    strategy:
      fail-fast: false
      matrix:
        app: ${{ fromJSON(needs.job_setup.outputs.affected_playwright_projects) }}
    env:
      CI: true
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        # Each matrix leg only Playwright-tests one app, so scope the install to that
        # app's dependency subgraph instead of the whole monorepo (which drags in
        # ghost/core, ghost-admin and unrelated apps). nx and the app's workspace deps
        # are still installed; the nx project name matches the package name.
        run: pnpm install --frozen-lockfile --filter ${{ matrix.app }}...

      - name: Setup Playwright
        uses: ./.github/actions/setup-playwright

      # The Koenig editor suite is the only one that needs apt packages on top
      # of the runner image (setup-playwright deliberately avoids apt-get, see
      # its README note about hangs — scoping this to one matrix leg contains
      # that risk):
      #  - MS core fonts: caret-position assertions depend on where text wraps,
      #    which depends on Arial's font metrics
      #  - playwright firefox deps: system media codecs so firefox can decode
      #    the H.264 fixtures in the video card tests
      - name: Install Koenig editor test dependencies (fonts + media codecs)
        if: matrix.app == '@tryghost/koenig-lexical'
        env:
          DEBIAN_FRONTEND: noninteractive
          DEBCONF_NONINTERACTIVE_SEEN: "true"
        run: |
          sudo sh -c "echo ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true | debconf-set-selections"
          sudo apt-get update -yq
          sudo apt-get install -yq msttcorefonts
          pnpm exec playwright install-deps firefox

      - name: Run Playwright tests
        run: pnpm nx run ${{ matrix.app }}:test:acceptance

      - name: Get App Name
        if: always()
        id: app_name
        # trim '@tryghost/' prefix for better readability in test report artifact names;
        # resolve the project root since apps live in apps/* and koenig/*
        run: |
          APP_NAME="${{ matrix.app }}"
          APP_ROOT=$(pnpm -s nx show project ${{ matrix.app }} --json | jq -r .root)
          {
            echo "name=${APP_NAME#@tryghost/}"
            echo "root=$APP_ROOT"
            if [ -d "$APP_ROOT/playwright-report" ]; then
              echo "has_report=true"
            else
              echo "has_report=false"
            fi
          } >> "$GITHUB_OUTPUT"

      - name: Upload test results
        if: always() && steps.app_name.outputs.has_report == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ steps.app_name.outputs.name }}-playwright-report
          path: ${{ steps.app_name.outputs.root }}/playwright-report
          retention-days: 30

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_ghost-cli:
    name: Ghost-CLI tests
    needs: [job_setup, job_pack]
    if: needs.job_setup.outputs.is_tag == 'true' || needs.job_setup.outputs.changed_core == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install Ghost-CLI
        run: npm install -g ghost-cli@latest

      # Test against the same tarball that npm-publish ships, not a parallel rebuild.
      - name: Download npm tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ghost-npm-tarball

      - run: mv ghost-*.tgz ghost.tgz

      - name: Verify packaged package.json
        run: tar -xOf ghost.tgz package/package.json | jq -e '.packageManager' >/dev/null

      - name: Save Ghost CLI Debug Logs
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ghost-cli-debug-logs
          path: /home/runner/.ghost/logs/

      - name: Clean Install
        run: |
          DIR=$(mktemp -d)
          ghost install local -d "$DIR" --archive "$(pwd)/ghost.tgz"
          URL=$(ghost config get url -d "$DIR" --no-prompt --no-color | tail -n1)
          curl --retry 10 --retry-connrefused --retry-delay 3 -fsSI "$URL"
          ghost stop -d "$DIR"

      - name: Latest Release
        # --force skips Ghost-CLI's version comparison between the archive and
        # the installed release. Without it this step is coupled to how far the
        # branch has drifted from main: a PR branched before the last release
        # carries an older ghost/core version than what's on npm, and the CLI
        # refuses with "Version in archive file ... is less than the current
        # active version". Equal versions are just as bad in the other
        # direction — the CLI logs "All up to date!", never installs the
        # archive, and the curl below silently smoke-tests the published Ghost
        # instead of this build. --force makes the update path run either way.
        run: |
          DIR=$(mktemp -d)
          ghost install local -d "$DIR"
          ghost update -d "$DIR" --force --archive "$(pwd)/ghost.tgz"
          URL=$(ghost config get url -d "$DIR" --no-prompt --no-color | tail -n1)
          curl --retry 10 --retry-connrefused --retry-delay 3 -fsSI "$URL"
          ghost stop -d "$DIR"

      - name: Print debug logs
        if: failure()
        run: |
          [ -f ~/.ghost/logs/*.log ] && cat ~/.ghost/logs/*.log

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_build_admin:
    name: Build Admin
    needs: [job_setup]
    # Root of the build + browser-E2E lane (see run_e2e in job_setup).
    if: needs.job_setup.outputs.run_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        # Admin's nx build fans out across the whole frontend graph (ghost-admin,
        # admin-x-*, shade, koenig-lexical) via nx dependsOn rather than package
        # deps, so a filtered install would miss pieces — install the full workspace.
        run: pnpm install --frozen-lockfile

      - name: Build admin
        # IS_SHIPPING enables the Sentry vite plugin in koenig-lexical: it
        # injects debug IDs into the built editor bundles and uploads their
        # sourcemaps. Only shippable builds (main + tags in the canonical
        # repo) get it — debug-ID artifact bundles are release-agnostic, so
        # per-merge uploads are deduplicated by content and create no
        # release noise in Sentry.
        env:
          IS_SHIPPING: ${{ github.repository == 'TryGhost/Ghost' && (github.ref == 'refs/heads/main' || github.ref_type == 'tag') && 'true' || '' }}
          VITE_SENTRY_AUTH_TOKEN: ${{ secrets.VITE_SENTRY_AUTH_TOKEN }}
        run: |
          # The Sentry plugin only warns when the token is missing, which
          # would silently skip the upload AND poison the Nx cache with a
          # never-uploaded debug ID — fail loudly instead.
          if [ -n "$IS_SHIPPING" ] && [ -z "$VITE_SENTRY_AUTH_TOKEN" ]; then
            echo "::error::IS_SHIPPING is set but VITE_SENTRY_AUTH_TOKEN is empty — Koenig sourcemaps would not reach Sentry"
            exit 1
          fi
          # Builds apps/admin/dist AND ghost/core/core/built/admin (asset-delivery).
          pnpm nx run @tryghost/admin:build

      # The built admin (ghost/core/core/built/admin) is consumed by both job_pack
      # (packed into the Ghost-CLI archive) and job_docker (COPYed into the full
      # image). Ship it as a tarball to preserve file modes and speed transfer.
      #
      # --exclude '*.map': admin sourcemaps (~60MB) are uploaded to Sentry during
      # the build (IS_SHIPPING), not shipped in the image. ghost/core's `files`
      # field strips them from the Ghost-CLI archive (!core/built/**/*.map), so
      # excluding them here matches that for the Docker image too.
      - name: Pack admin build
        run: tar --exclude='*.map' -czf admin-build.tar.gz -C ghost/core/core/built admin

      - name: Upload admin build artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: admin-build
          path: admin-build.tar.gz
          retention-days: 1
          if-no-files-found: error

      - name: Upload admin artifact for CD
        id: upload-admin
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: admin-build-cd
          path: apps/admin/dist
          retention-days: 7
          if-no-files-found: error

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

    outputs:
      admin-artifact-id: ${{ steps.upload-admin.outputs.artifact-id }}

  job_pack:
    name: Build Ghost-CLI archive
    needs: [job_setup, job_build_admin]
    # Same availability window as the rest of the build lane; feeds job_ghost-cli
    # and (on tags) publish_ghost.
    if: needs.job_setup.outputs.run_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
          # Themes (content/themes/casper|source) are submodules packed into the
          # archive — without them the tarball ships empty theme dirs.
          submodules: true

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        # pack only needs ghost and its dependency subgraph (dev deps included, to
        # build the prod closure below) — not the whole monorepo.
        run: pnpm install --frozen-lockfile --filter "ghost..."

      - name: Verify tag matches package.json
        if: startsWith(github.ref, 'refs/tags/v')
        working-directory: ghost/core
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Tag ${GITHUB_REF_NAME} doesn't match package.json version ${PKG_VERSION}"
            exit 1
          fi

      - name: Build production closure and server
        # pack.mjs's `pnpm pack` only tars existing build/ output; it does not build.
        # Build ghost's prod workspace closure (kg-*/adapters; i18n has no build
        # script) + ghost's own server output first. nx-free recursive filters.
        run: |
          pnpm --filter-prod "ghost^..." -r run build
          pnpm --filter ghost run build:tsc
          pnpm --filter ghost run build:assets

      - name: Download admin build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: admin-build

      - name: Extract admin build
        # The archive includes core/built/admin via ghost/core's files allowlist.
        run: |
          mkdir -p ghost/core/core/built
          tar -xzf admin-build.tar.gz -C ghost/core/core/built

      - name: Build standalone distribution
        # Invoke the pack script directly (not `nx run ghost:archive`, whose
        # dependsOn would rebuild admin/tsc/assets we already have).
        run: pnpm --filter ghost run archive

      - name: Upload npm tarball
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ghost-npm-tarball
          path: ghost/core/ghost-*.tgz
          retention-days: 7
          if-no-files-found: error

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_docker:
    name: Build Docker Images
    # NOT gated on job_build_admin or job_build_e2e_public_apps: the core image
    # needs neither. It builds concurrently and only synchronises on the admin
    # artifact (via wait-for-artifact) just before the full image, and on the
    # e2e-public-apps artifact just before the E2E image.
    needs: [job_setup]
    # Root of the build + browser-E2E lane (see run_e2e in job_setup).
    if: needs.job_setup.outputs.run_e2e == 'true'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
          # The deploy stage packs content/themes/casper|source (submodules).
          submodules: true

      - name: Determine build version
        # Baked into the images as GHOST_BUILD_VERSION (server-reported version).
        # Empty on tags → the ARG default "" is used. No node/pnpm setup in this
        # job (the build is in-container), so read the version with jq.
        run: |
          if [ "${{ github.ref_type }}" != "tag" ]; then
            PKG_VERSION=$(jq -r .version ghost/core/package.json)
            echo "GHOST_BUILD_VERSION=${PKG_VERSION}+${GITHUB_SHA:0:7}" >> $GITHUB_ENV
          fi

      - name: Determine push strategy
        id: strategy
        run: |
          # Only the canonical repo publishes to GHCR by default.
          # Direct clones, external forks, and cross-repo PRs use artifact-based image transfer instead.
          USE_ARTIFACT="false"
          if [ "${{ github.repository }}" != "TryGhost/Ghost" ]; then
            # Non-canonical repo - no GHCR push
            USE_ARTIFACT="true"
          elif [ "${{ github.event_name }}" = "pull_request" ] && \
               [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
            # Cross-repo PR (fork PR into this repo) — no GHCR push
            USE_ARTIFACT="true"
          fi

          OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')

          # Derive GHCR image names from repository name so each repo gets its own namespace
          # TryGhost/Ghost → ghost-core / ghost, TryGhost/Ghost-Security → ghost-security-core / ghost-security
          REPO_NAME=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')
          if [ "$REPO_NAME" = "ghost" ]; then
            IMAGE_CORE_NAME="ghcr.io/${OWNER}/ghost-core"
            IMAGE_FULL_NAME="ghcr.io/${OWNER}/ghost"
          else
            IMAGE_CORE_NAME="ghcr.io/${OWNER}/${REPO_NAME}-core"
            IMAGE_FULL_NAME="ghcr.io/${OWNER}/${REPO_NAME}"
          fi

          # Force push on canonical tag pushes (release images must always be published)
          IS_TAG="${{ startsWith(github.ref, 'refs/tags/v') }}"
          if [ "$IS_TAG" = "true" ] && [ "${{ github.repository }}" = "TryGhost/Ghost" ]; then
            USE_ARTIFACT="false"
          fi

          echo "use-artifact=$USE_ARTIFACT" >> $GITHUB_OUTPUT
          echo "should-push=$( [ "$USE_ARTIFACT" = "false" ] && echo "true" || echo "false" )" >> $GITHUB_OUTPUT
          echo "owner=$OWNER" >> $GITHUB_OUTPUT
          echo "image-core-name=$IMAGE_CORE_NAME" >> $GITHUB_OUTPUT
          echo "image-full-name=$IMAGE_FULL_NAME" >> $GITHUB_OUTPUT
          echo "image-e2e-name=${IMAGE_FULL_NAME}-e2e" >> $GITHUB_OUTPUT

      - name: Setup Docker Registry Mirrors
        uses: ./.github/actions/setup-docker-registry-mirrors

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to GitHub Container Registry
        if: steps.strategy.outputs.should-push == 'true'
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta (core)
        id: meta-core
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ steps.strategy.outputs.image-core-name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
            type=semver,pattern=v{{version}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=Ghost Core
            org.opencontainers.image.description=Ghost production build (server only, no admin)
            org.opencontainers.image.vendor=TryGhost

      - name: Docker meta (full)
        id: meta-full
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ steps.strategy.outputs.image-full-name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
            type=semver,pattern=v{{version}}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=Ghost
            org.opencontainers.image.description=Ghost production build (server + admin)
            org.opencontainers.image.vendor=TryGhost

      - name: Build & push core image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        env:
          BUILDKIT_PROGRESS: plain
        with:
          # Context is the repo root: the Dockerfile deploy stage runs `pnpm deploy`
          # against the workspace. core needs no admin, so it builds now while
          # job_build_admin runs concurrently.
          context: .
          file: Dockerfile.production
          target: core
          build-args: |
            NODE_VERSION=${{ env.NODE_VERSION }}
            GHOST_BUILD_VERSION=${{ env.GHOST_BUILD_VERSION }}
          push: ${{ steps.strategy.outputs.should-push }}
          load: ${{ steps.strategy.outputs.should-push == 'false' }}
          tags: ${{ steps.meta-core.outputs.tags }}
          labels: ${{ steps.meta-core.outputs.labels }}
          cache-from: type=registry,ref=${{ steps.strategy.outputs.image-core-name }}:cache-main
          cache-to: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-{1},mode=max', steps.strategy.outputs.image-core-name, github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'main') || '' }}

      # Uploaded here, before the full image is even built: on the artifact path
      # consumers (Ghost-Moya CD) need the core image — server only, no admin —
      # and would otherwise have to fall back to `docker-image-production`.
      - name: Save core image as artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta-core.outputs.tags }}" | head -n1)
          echo "Saving image: $IMAGE_TAG"
          # Written outside the repo root: a stray tarball there would change the
          # `.` context between the core and full builds and bust the deploy-stage
          # COPY cache (same reason the admin artifact lands in RUNNER_TEMP below).
          docker save "$IMAGE_TAG" | gzip > "${RUNNER_TEMP}/docker-image-core.tar.gz"
          ls -lh "${RUNNER_TEMP}/docker-image-core.tar.gz"

      - name: Upload core image artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: docker-image-core
          path: ${{ runner.temp }}/docker-image-core.tar.gz
          retention-days: 1
          if-no-files-found: error

      # Synchronise with job_build_admin only now, after core is built: the full
      # image is core + admin. No `needs` edge, so the two jobs run concurrently
      # and core builds during the wait.
      - name: Wait for admin build
        uses: ./.github/actions/wait-for-artifact
        with:
          artifact-name: admin-build
          job-name: Build Admin
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download admin build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: admin-build
          # Outside the build context: a stray admin-build.tar.gz in the repo root
          # would change the `.` context between the core and full builds and bust
          # the deploy-stage COPY cache, re-running the whole closure build.
          path: ${{ runner.temp }}/admin-artifact

      - name: Extract admin build into context
        # The full stage COPYs ghost/core/core/built/admin from the context; the
        # deploy stage excludes core/built entirely, so admin never leaks into core
        # and adding it is the only context change between the core and full builds.
        run: |
          mkdir -p ghost/core/core/built
          tar -xzf "${RUNNER_TEMP}/admin-artifact/admin-build.tar.gz" -C ghost/core/core/built

      - name: Build & push full image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        env:
          BUILDKIT_PROGRESS: plain
        with:
          # Same repo-root context as core (admin now present at
          # ghost/core/core/built/admin, excluded by the deploy stage) so the
          # deploy/install/build layers cache-hit from the core build above.
          context: .
          file: Dockerfile.production
          target: full
          build-args: |
            NODE_VERSION=${{ env.NODE_VERSION }}
            GHOST_BUILD_VERSION=${{ env.GHOST_BUILD_VERSION }}
          push: ${{ steps.strategy.outputs.should-push }}
          load: ${{ steps.strategy.outputs.should-push == 'false' }}
          tags: ${{ steps.meta-full.outputs.tags }}
          labels: ${{ steps.meta-full.outputs.labels }}
          cache-from: type=registry,ref=${{ steps.strategy.outputs.image-full-name }}:cache-main
          cache-to: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-{1},mode=max', steps.strategy.outputs.image-full-name, github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'main') || '' }}

      # The production image artifact is saved before the e2e steps below:
      # Ghost-Moya CD discovers `docker-image-production` by name in this run
      # (cd.yml / cd-server.yml on the artifact path), so an e2e-lane failure
      # must not prevent its upload.
      - name: Save full image as artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta-full.outputs.tags }}" | head -n1)
          echo "Saving image: $IMAGE_TAG"
          docker save "$IMAGE_TAG" | gzip > docker-image-production.tar.gz
          echo "Image saved as docker-image-production.tar.gz"
          ls -lh docker-image-production.tar.gz

      - name: Upload image artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: docker-image-production
          path: docker-image-production.tar.gz
          retention-days: 1

      - name: Inspect image size and layers
        if: steps.strategy.outputs.use-artifact == 'true'
        shell: bash
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta-full.outputs.tags }}" | head -n1)
          echo "Analyzing Docker image: $IMAGE_TAG"

          # Get the image size in bytes
          IMAGE_SIZE_BYTES=$(docker inspect "$IMAGE_TAG" --format='{{.Size}}')

          # Convert to human readable format
          IMAGE_SIZE_MB=$(( IMAGE_SIZE_BYTES / 1024 / 1024 ))
          IMAGE_SIZE_GB=$(echo "scale=2; $IMAGE_SIZE_BYTES / 1024 / 1024 / 1024" | bc)

          # Format size display based on magnitude
          if [ $IMAGE_SIZE_MB -ge 1024 ]; then
            IMAGE_SIZE_DISPLAY="${IMAGE_SIZE_GB} GB"
          else
            IMAGE_SIZE_DISPLAY="${IMAGE_SIZE_MB} MB"
          fi

          echo "Image size: ${IMAGE_SIZE_DISPLAY}"

          # Write to GitHub Step Summary
          {
            echo "# Docker Image Analysis"
            echo ""
            echo "**Image:** \`$IMAGE_TAG\`"
            echo ""
            echo "**Total Size:** ${IMAGE_SIZE_DISPLAY}"
            echo ""
            echo "## Image Layers"
            echo ""
            echo "| Size | Layer |"
            echo "|------|-------|"

            # Get all layers (including 0B ones)
            docker history "$IMAGE_TAG" --format "{{.Size}}@@@{{.CreatedBy}}" --no-trunc | \
            while IFS='@@@' read -r size cmd; do
              # Clean up the command for display
              cmd_clean=$(echo "$cmd" | sed 's/^\/bin\/sh -c //' | sed 's/^#(nop) //' | sed 's/^@@//' | sed 's/|/\\|/g' | cut -c1-80)
              if [ ${#cmd} -gt 80 ]; then
                cmd_clean="${cmd_clean}..."
              fi
              echo "| $size | \`${cmd_clean}\` |"
            done

          } >> $GITHUB_STEP_SUMMARY

      # ---- Build the ghost-e2e image here, while the production "full" image is
      # still warm in this job's BuildKit cache. The e2e image is FROM the full
      # image + a COPY of the public-app UMD bundles + 6 ENV vars. Building it in
      # this same job (same buildx builder) means the base resolves from the local
      # BuildKit cache instead of a 54s re-pull on a separate fresh runner.
      # ghost-e2e stays a SEPARATE tag, so the deployed production image stays clean.
      #
      # On tag runs every e2e step below is continue-on-error: this job gates the
      # release lane (publish_ghost ← job_ghost-cli), so an e2e-lane failure must
      # not strand a half-published release (GHCR images pushed, npm not) — and
      # release.js --skip-checks can bypass a red e2e lane pre-tag but has no
      # override inside this run. The e2e tests on the tag run still fail visibly
      # if the image is missing or broken.
      - name: Resolve full image tag for E2E base
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        env:
          FULL_IMAGE_TAGS: ${{ steps.meta-full.outputs.tags }}
        run: |
          # Use the first full-image tag as the FROM base for the e2e build.
          GHOST_IMAGE_TAG="${FULL_IMAGE_TAGS%%$'\n'*}"
          echo "GHOST_IMAGE_TAG=${GHOST_IMAGE_TAG}" >> "$GITHUB_ENV"

      - name: Wait for public app artifacts (e2e)
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        uses: ./.github/actions/wait-for-artifact
        with:
          artifact-name: e2e-public-apps
          job-name: Build E2E Public App Assets
          github-token: ${{ secrets.GITHUB_TOKEN }}

      # Extract into a clean staging dir and build from there: the tarball holds
      # exactly the apps/*/umd paths the Dockerfile COPYs, while the workspace at
      # this point is dirty (node_modules, dist/ outputs from build:production)
      # and the root-anchored .dockerignore patterns don't cover the nested
      # copies — using `.` as context would ship hundreds of MB into the builder
      # and let stray build:production files under apps/*/umd leak into the image.
      - name: Download public app artifacts (e2e)
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: e2e-public-apps
          path: ${{ runner.temp }}/e2e-context

      - name: Extract public app artifacts (e2e)
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: |
          tar -xzf "${RUNNER_TEMP}/e2e-context/e2e-public-apps.tar.gz" -C "${RUNNER_TEMP}/e2e-context"
          rm "${RUNNER_TEMP}/e2e-context/e2e-public-apps.tar.gz"

      # On the artifact (fork/cross-repo) path the full image is only loaded into
      # the local docker daemon (never pushed), so the default docker-container
      # buildx driver — which resolves FROM via a registry — cannot see it. Spin up
      # a second buildx builder on the host `docker` driver, which shares the
      # daemon's image store, and use it only for the e2e build on this path. The
      # production builds keep using the default builder so their registry cache
      # import/export keeps working.
      - name: Set up Docker Buildx (e2e host driver)
        if: steps.strategy.outputs.use-artifact == 'true'
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
        id: buildx-e2e-host
        with:
          driver: docker

      - name: Docker meta (e2e)
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        id: meta-e2e
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ steps.strategy.outputs.image-e2e-name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=Ghost E2E
            org.opencontainers.image.description=Ghost production build with public E2E app bundles
            org.opencontainers.image.vendor=TryGhost

      - name: Build & push E2E image
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        env:
          BUILDKIT_PROGRESS: plain
        with:
          # Artifact path: use the host `docker`-driver builder so FROM resolves the
          # locally loaded full image. Registry path: empty → default (docker-container)
          # builder, where the just-built full image's layers are warm in BuildKit cache.
          builder: ${{ steps.strategy.outputs.use-artifact == 'true' && steps.buildx-e2e-host.outputs.name || '' }}
          context: ${{ runner.temp }}/e2e-context
          file: e2e/Dockerfile.e2e
          # GHOST_IMAGE is the full image tag we just built. On the registry path
          # it was pushed moments ago by the same buildx builder, so its layers are
          # already in this builder's BuildKit cache — FROM resolves from cache, not
          # a full re-download. On the artifact path the full image was load:true'd
          # into the local daemon, so it resolves there.
          build-args: |
            GHOST_IMAGE=${{ env.GHOST_IMAGE_TAG }}
          push: ${{ steps.strategy.outputs.should-push }}
          load: ${{ steps.strategy.outputs.use-artifact == 'true' }}
          tags: ${{ steps.meta-e2e.outputs.tags }}
          labels: ${{ steps.meta-e2e.outputs.labels }}
          cache-from: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-main', steps.strategy.outputs.image-e2e-name) || '' }}
          cache-to: ${{ steps.strategy.outputs.should-push == 'true' && format('type=registry,ref={0}:cache-{1},mode=max', steps.strategy.outputs.image-e2e-name, github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'main') || '' }}

      - name: Save E2E image as artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta-e2e.outputs.tags }}" | head -n1)
          echo "Saving image: $IMAGE_TAG"
          docker save "$IMAGE_TAG" | gzip > docker-image-e2e.tar.gz
          echo "Image saved as docker-image-e2e.tar.gz"
          ls -lh docker-image-e2e.tar.gz

      - name: Upload E2E image artifact
        if: steps.strategy.outputs.use-artifact == 'true'
        continue-on-error: ${{ startsWith(github.ref, 'refs/tags/v') }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: docker-image-e2e
          path: docker-image-e2e.tar.gz
          retention-days: 1

    outputs:
      use-artifact: ${{ steps.strategy.outputs.use-artifact }}
      image-core-tags: ${{ steps.meta-core.outputs.tags }}
      image-e2e-name: ${{ steps.strategy.outputs.image-e2e-name }}
      image-e2e-tags: ${{ steps.meta-e2e.outputs.tags }}

  job_build_e2e_public_apps:
    name: Build E2E Public App Assets
    needs: [job_setup]
    # Root of the build + browser-E2E lane (see run_e2e in job_setup).
    # Doubles as public-app build verification and the gate for publish_public_apps:
    # the `pnpm --filter @tryghost/e2e build:apps` step below is exactly the
    # `nx run-many --target=build --projects='tag:public-app'` build the publish flow
    # requires, so there's no separate build_public_apps job. Intentionally has no
    # `id-token: write` — PR-controlled code (nx build) must never execute in a job
    # that can mint an npm OIDC token; the publish flows (publish_ghost here, and
    # publish-packages.yml) hold the privileged path.
    if: needs.job_setup.outputs.run_e2e == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        env:
          FORCE_COLOR: 0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build public apps for E2E
        run: pnpm --filter @tryghost/e2e build:apps

      - name: Pack public app artifacts
        run: |
          tar -czf e2e-public-apps.tar.gz \
            apps/portal/umd \
            apps/comments-ui/umd \
            apps/sodo-search/umd \
            apps/signup-form/umd \
            apps/announcement-bar/umd \
            apps/admin-toolbar/umd
          ls -lh e2e-public-apps.tar.gz

      - name: Upload public app artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: e2e-public-apps
          path: e2e-public-apps.tar.gz
          retention-days: 1

  job_e2e_tests:
    name: E2E Tests (${{ matrix.projectName }} ${{ matrix.shardIndex }}/${{ matrix.shardTotal }})
    runs-on: ubuntu-latest
    needs: [job_docker, job_setup]
    # Inherits the run_e2e gate transitively via job_docker (which builds the
    # ghost-e2e image).
    if: needs.job_docker.result == 'success'
    strategy:
      fail-fast: true
      matrix:
        include:
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 1
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 2
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 3
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 4
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 5
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 6
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 7
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 8
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 9
            shardTotal: 10
          - projectName: Main
            projects: main
            analytics: 'false'
            shardIndex: 10
            shardTotal: 10
          - projectName: Analytics
            projects: analytics
            analytics: 'true'
            shardIndex: 1
            shardTotal: 2
          - projectName: Analytics
            projects: analytics
            analytics: 'true'
            shardIndex: 2
            shardTotal: 2
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Docker Registry Mirrors
        uses: ./.github/actions/setup-docker-registry-mirrors

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Pull or build Tinybird CLI Image
        if: matrix.analytics == 'true'
        env:
          CHANGED_TB_CLI: ${{ needs.job_setup.outputs.changed_tb_cli }}
        run: |
          COMPOSE_IMAGE="${COMPOSE_PROJECT_NAME:-ghost-dev}-tb-cli"
          # GHCR's :latest is only republished from main, so it can't reflect a
          # Dockerfile change under review — build from source when this PR
          # touches it, otherwise take the prebuilt fast path.
          if [[ "$CHANGED_TB_CLI" == 'true' ]]; then
            echo "docker/tb-cli changed, building from source"
            docker buildx build --load -t "$COMPOSE_IMAGE" -f docker/tb-cli/Dockerfile .
          elif docker pull ghcr.io/tryghost/tb-cli:latest 2>/dev/null; then
            echo "Pulled tb-cli from GHCR"
            docker tag ghcr.io/tryghost/tb-cli:latest "$COMPOSE_IMAGE"
          else
            echo "GHCR image not available, building from source"
            docker buildx build --load -t "$COMPOSE_IMAGE" -f docker/tb-cli/Dockerfile .
          fi

      - name: Load Image
        uses: ./.github/actions/load-docker-image
        id: load
        with:
          use-artifact: ${{ needs.job_docker.outputs.use-artifact }}
          image-tags: ${{ needs.job_docker.outputs.image-e2e-tags }}
          artifact-name: docker-image-e2e

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        # The Playwright container runs against the host's bind-mounted node_modules,
        # but only needs @tryghost/e2e's dependency subgraph — not the whole monorepo
        # (admin, apps, ghost/core). Scope the install to cut shard setup time.
        run: pnpm install --frozen-lockfile --filter @tryghost/e2e...

      - name: Prepare E2E CI job
        env:
          GHOST_E2E_IMAGE: ${{ steps.load.outputs.image-tag }}
          GHOST_E2E_SKIP_IMAGE_BUILD: 'true'
          GHOST_E2E_ANALYTICS: ${{ matrix.analytics }}
        run: bash ./e2e/scripts/prepare-ci-e2e-job.sh

      - name: Run e2e tests in Playwright container
        env:
          TEST_WORKERS_COUNT: 1
          GHOST_E2E_MODE: build
          GHOST_E2E_IMAGE: ${{ steps.load.outputs.image-tag }}
          GHOST_E2E_ANALYTICS: ${{ matrix.analytics }}
          E2E_PLAYWRIGHT_PROJECTS: ${{ matrix.projects }}
          E2E_SHARD_INDEX: ${{ matrix.shardIndex }}
          E2E_SHARD_TOTAL: ${{ matrix.shardTotal }}
          E2E_RETRIES: 2
        run: bash ./e2e/scripts/run-playwright-container.sh

      - name: Dump E2E docker logs
        if: failure()
        run: bash ./e2e/scripts/dump-e2e-docker-logs.sh

      - name: Stop E2E infra
        if: always()
        run: pnpm --filter @tryghost/e2e infra:down

      - name: Upload blob report to GitHub Actions Artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: blob-report-${{ matrix.projectName }}-${{ matrix.shardIndex }}
          path: e2e/blob-report
          retention-days: 1

      - name: Upload test results artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-${{ matrix.projectName }}-${{ matrix.shardIndex }}
          path: e2e/test-results
          retention-days: 7

      - uses: tryghost/actions/actions/slack-build@e7a401946f91165a6426290705f501a377ec1533 # main
        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          status: ${{ job.status }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  job_merge_e2e_reports:
    name: Merge Reports
    if: always() && needs.job_e2e_tests.result == 'failure'
    needs: [job_e2e_tests, job_setup]
    runs-on: ubuntu-latest
    # Posts a comment on the PR via `gh pr comment` when E2E tests fail.
    permissions:
      contents: read
      pull-requests: write
    strategy:
      fail-fast: false
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Download blob reports from GitHub Actions Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        continue-on-error: true
        with:
          path: e2e/all-blob-reports
          pattern: blob-report-*
          merge-multiple: true

      - name: Check for blob reports
        id: check
        run: |
          if [ -d "e2e/all-blob-reports" ] && [ -n "$(ls -A e2e/all-blob-reports 2>/dev/null)" ]; then
            echo "has_reports=true" >> $GITHUB_OUTPUT
          else
            echo "has_reports=false" >> $GITHUB_OUTPUT
          fi

      - name: Download test results from GitHub Actions Artifacts
        if: steps.check.outputs.has_reports == 'true'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: e2e/all-test-results
          pattern: test-results-*
          merge-multiple: true

      - name: Merge into HTML Report
        if: steps.check.outputs.has_reports == 'true'
        run: npx playwright merge-reports --reporter html ./all-blob-reports
        working-directory: e2e

      - name: Upload HTML report
        if: steps.check.outputs.has_reports == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: playwright-report
          path: e2e/playwright-report
          retention-days: 14

      - name: Upload merged test results
        if: steps.check.outputs.has_reports == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results
          path: e2e/all-test-results
          retention-days: 7

      - name: View Test Report command
        if: steps.check.outputs.has_reports == 'true'
        run: |
          echo -e "::notice::To view the Playwright report locally, run:\n\nREPORT_DIR=\$(mktemp -d) && gh run download ${{ github.run_id }} -n playwright-report -D \"\$REPORT_DIR\" && npx playwright show-report \"\$REPORT_DIR\""

      - name: Comment on PR with test report command
        if: github.event_name == 'pull_request' && steps.check.outputs.has_reports == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh pr comment ${{ github.event.pull_request.number }} --body "## E2E Tests Failed

          To view the Playwright test report locally, run:

          \`\`\`bash
          REPORT_DIR=\$(mktemp -d) && gh run download ${{ github.run_id }} -n playwright-report -D \"\$REPORT_DIR\" && npx playwright show-report \"\$REPORT_DIR\"
          \`\`\`"

  job_coverage:
    name: Coverage
    needs: [
      job_setup,
      job_admin-tests,
      job_acceptance-tests,
      job_unit-tests
    ]
    if: always() && needs.job_setup.outputs.coverage_enabled == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Restore Admin coverage
        if: contains(needs.job_admin-tests.result, 'success')
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: admin-coverage

      - name: Move coverage
        if: contains(needs.job_admin-tests.result, 'success')
        run: |
          rsync -av --remove-source-files ember-admin/* apps/ember-admin

      - name: Upload Admin test coverage
        if: contains(needs.job_admin-tests.result, 'success')
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
        with:
          flags: admin-tests
          files: apps/ember-admin/coverage/cobertura-coverage.xml
          disable_search: true

      - name: Restore E2E coverage
        if: contains(needs.job_acceptance-tests.result, 'success')
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: e2e-coverage

      - name: Move coverage
        if: contains(needs.job_acceptance-tests.result, 'success')
        run: |
          rsync -av --remove-source-files core/* ghost/core

      - name: Upload E2E test coverage
        if: contains(needs.job_acceptance-tests.result, 'success')
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
        with:
          flags: e2e-tests
          files: ghost/core/coverage-e2e/cobertura-coverage.xml,ghost/core/coverage-integration/cobertura-coverage.xml
          disable_search: true

  job_required_tests:
    name: All required tests passed or skipped
    needs:
      [
        job_setup,
        job_app_version_bump_check,
        job_migration_integrity_check,
        job_lint,
        job_lint_docs,
        job_i18n,
        job_build_admin,
        job_pack,
        job_docker,
        job_ghost-cli,
        job_admin-tests,
        job_unit-tests,
        job_acceptance-tests,
        job_legacy-tests,
        job_apps_acceptance-tests,
        job_build_e2e_public_apps,
        job_e2e_tests,
        publish_public_apps
      ]
    if: always()
    runs-on: ubuntu-slim
    steps:
      - name: Output needs
        run: echo "${{ toJson(needs) }}"

      - name: Check if any required jobs failed or been cancelled
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "One of the dependent jobs have failed or been cancelled. You may need to re-run it." && exit 1

  # Publishes @tryghost/* public apps to npm via OIDC trusted publishing.
  # Runs only on push-to-main — never on pull_request — so the `id-token: write`
  # permission is never exposed to PR-controlled code (ref: ONC-1677).
  publish_public_apps:
    needs: [
      job_setup,
      job_lint,
      job_unit-tests,
      job_build_e2e_public_apps
    ]
    name: Publish ${{ matrix.package_name }}
    runs-on: ubuntu-latest
    # Serialize per-app publishes so two quick main merges can't both compute the
    # same next-patch number and collide on npm. Different apps still publish in
    # parallel; cancel-in-progress stays false so a queued publish isn't dropped.
    concurrency:
      group: publish-public-app-${{ matrix.package_name }}
      cancel-in-progress: false
    if: |
      github.event_name != 'pull_request'
      && github.repository == 'TryGhost/Ghost'
      && needs.job_setup.outputs.is_main == 'true'
      && needs.job_setup.result == 'success'
      && needs.job_lint.result == 'success'
      && needs.job_unit-tests.result == 'success'
      && needs.job_build_e2e_public_apps.result == 'success'
      && needs.job_setup.outputs.publish_public_apps_matrix != '[]'
    permissions:
      contents: read
      id-token: write
    strategy:
      matrix:
        include: ${{ fromJSON(needs.job_setup.outputs.publish_public_apps_matrix) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - name: Set up Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Determine release version
        id: release
        working-directory: ${{ matrix.package_path }}
        run: |
          # npm is the source of truth for the patch number: compute the next
          # patch above what's already published in this app's major.minor line
          # (or publish package.json's exact version when starting a fresh
          # minor/major line). The patch digit in package.json is otherwise
          # unused — Ghost core resolves apps via <pkg>@~<major.minor> on
          # jsDelivr, so the newest published patch is what sites receive.
          NEXT_VERSION=$(node "$GITHUB_WORKSPACE/scripts/compute-next-app-version.cjs" .)
          echo "Publishing ${{ matrix.package_name }}@${NEXT_VERSION}"

          # Write it before building so the version baked into the bundle
          # (e.g. portal's REACT_APP_VERSION) matches what we publish.
          npm pkg set version="$NEXT_VERSION"

          echo "current_minor=$(echo "$NEXT_VERSION" | awk -F. '{print $1"."$2}')" >> $GITHUB_OUTPUT
          echo "current_major=$(echo "$NEXT_VERSION" | awk -F. '{print $1}')" >> $GITHUB_OUTPUT

      - name: Build the package
        run: pnpm nx build ${{ matrix.package_name }}

      - name: Configure .npmrc
        run: |
          echo "@tryghost:registry=https://registry.npmjs.org/" >> ~/.npmrc

      # --provenance is explicit rather than relying on pnpm's auto-detection,
      # which degrades to a warning if it can't confirm visibility.
      - name: Publish to npm
        working-directory: ${{ matrix.package_path }}
        run: |
          pnpm publish --access public --provenance --no-git-checks

      - name: Replace version placeholders in cdn-paths
        id: cdn_paths
        run: |
          cdn_paths="${{ matrix.cdn_paths }}"
          echo "cdn_paths<<EOF" >> $GITHUB_OUTPUT
          echo "$cdn_paths" | sed -e 's/CURRENT_MINOR/${{ steps.release.outputs.current_minor }}/g' -e 's/CURRENT_MAJOR/${{ steps.release.outputs.current_major }}/g' >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Print cdn_paths
        run: echo "${{ steps.cdn_paths.outputs.cdn_paths }}"

      - name: Purge jsDelivr cache
        uses: gacts/purge-jsdelivr-cache@8d92aea944f1a3e8ad70505379e1a8ac72d56b73 # v1
        with:
          url: ${{ steps.cdn_paths.outputs.cdn_paths }}

  # --------------------------------------------------------------------------- #
  # Trigger Pro CD — dispatch to Ghost-Moya cd.yml (runs on main + PRs)
  # --------------------------------------------------------------------------- #
  trigger_cd:
    needs: [job_setup, job_build_admin, job_docker]
    name: Trigger Pro CD
    runs-on: ubuntu-slim
    if: |
      always()
      && github.repository == 'TryGhost/Ghost'
      && needs.job_setup.result == 'success'
      && needs.job_build_admin.result == 'success'
      && needs.job_docker.result == 'success'
      && needs.job_docker.outputs.use-artifact != 'true'
    steps:
      - name: Determine dispatch parameters
        id: params
        run: |
          if [ "${{ needs.job_setup.outputs.is_main }}" = "true" ]; then
            echo "pr_number=" >> $GITHUB_OUTPUT
            echo "deploy=" >> $GITHUB_OUTPUT
          elif [ "${{ needs.job_setup.outputs.is_tag }}" = "true" ]; then
            echo "pr_number=" >> $GITHUB_OUTPUT
            echo "deploy=" >> $GITHUB_OUTPUT
          elif [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "pr_number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT

            # DISABLED: deploy-to-staging label detection is disabled.
            # The label workflow has fundamental problems — admin deploys are global
            # (not per-site) and main merges overwrite the deployment immediately.
            # See deploy-to-staging.yml for details.
            echo "deploy=" >> $GITHUB_OUTPUT
          else
            echo "skip=true" >> $GITHUB_OUTPUT
            exit 0
          fi
          echo "skip=false" >> $GITHUB_OUTPUT

      - name: Dispatch to Ghost-Moya cd.yml
        if: steps.params.outputs.skip != 'true'
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
        with:
          token: ${{ secrets.CANARY_DOCKER_BUILD }}
          repository: TryGhost/Ghost-Moya
          event-type: ghost-artifacts-ready
          client-payload: >-
            {
              "ref": "${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || github.sha }}",
              "source_repo": "${{ github.repository }}",
              "pr_number": "${{ steps.params.outputs.pr_number }}",
              "deploy": "${{ steps.params.outputs.deploy }}",
              "admin_artifact_id": "${{ needs.job_build_admin.outputs.admin-artifact-id }}",
              "admin_artifact_run_id": "${{ github.run_id }}"
            }

  # --------------------------------------------------------------------------- #
  # Publish Ghost npm package — runs on version tags only (OIDC, no stored token)
  # --------------------------------------------------------------------------- #
  publish_ghost:
    needs: [job_ghost-cli]
    name: Publish Ghost to npm
    runs-on: ubuntu-latest
    if: |
      startsWith(github.ref, 'refs/tags/v')
      && github.repository == 'TryGhost/Ghost'
    environment: npm-release
    permissions:
      id-token: write
    steps:
      - name: Download npm tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ghost-npm-tarball

      - name: Set up Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          package-manager-cache: false

      # TODO: Remove once Node v24 ships with npm >= 11
      - name: Install npm v11 (required for OIDC publishing)
        run: npm install -g npm@11

      - name: Verify tarball contents
        run: tar -xOf ghost-*.tgz package/package.json | jq -e '.packageManager' >/dev/null

      # --provenance is explicit so a publish without an attestation fails the
      # job instead of warning. Safe with no repo checkout: the SLSA statement
      # is built from the GITHUB_* env vars plus the tarball digest, and the
      # subject comes from the packed manifest — nothing reads a working tree.
      - name: Publish to npm
        run: npm publish ghost-*.tgz --access public --provenance

  # NOTE: Publishing the other workspace packages (koenig/*, packages/*, ...) is
  # NOT a job here. The release tag triggers publish-packages.yml directly, in
  # parallel with this workflow — npm trusted publishing validates the
  # entry-point workflow, so that publish must be its own entry point rather than
  # a job reached from ci.yml. See .github/workflows/publish-packages.yml.

  # --------------------------------------------------------------------------- #
  # Trigger docker-library-ghost auto-update — runs after the npm package is
  # published so the Docker library picks up the new release.
  # --------------------------------------------------------------------------- #
  trigger_docker_library_update:
    needs: [publish_ghost]
    name: Trigger docker-library-ghost update
    runs-on: ubuntu-slim
    if: |
      startsWith(github.ref, 'refs/tags/v')
      && github.repository == 'TryGhost/Ghost'
    steps:
      - name: Dispatch to TryGhost/docker-library-ghost
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
        with:
          token: ${{ secrets.CANARY_DOCKER_BUILD }}
          repository: TryGhost/docker-library-ghost
          event-type: ghost-version-publish

  # --------------------------------------------------------------------------- #
  # Create GitHub Release — runs after successful npm publish
  # --------------------------------------------------------------------------- #
  create_github_release:
    needs: [publish_ghost]
    name: Create GitHub Release
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.CANARY_DOCKER_BUILD }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: Resolve previous tag
        id: prev_tag
        run: |
          CURRENT_TAG="${GITHUB_REF_NAME}"
          # Find the tag immediately before this one (excluding pre-releases)
          PREV_TAG=$(git tag --list 'v[0-9]*' --sort=-version:refname | grep -v '-' | grep -v "^${CURRENT_TAG}$" | head -n 1)
          if [ -z "$PREV_TAG" ]; then
            echo "::warning::No previous stable tag found — release notes will use fallback message"
          fi
          echo "tag=${PREV_TAG}" >> "$GITHUB_OUTPUT"
          echo "Previous tag: ${PREV_TAG:-<none>}"

      - name: Generate release notes
        id: notes
        run: |
          PREV_TAG="${{ steps.prev_tag.outputs.tag }}"
          if [ -n "$PREV_TAG" ]; then
            node scripts/lib/release-notes.js "$PREV_TAG" "${GITHUB_REF_NAME}" > /tmp/release-notes.md
          else
            echo "This release contains fixes for minor bugs and issues reported by Ghost users." > /tmp/release-notes.md
          fi
          cat /tmp/release-notes.md

      - name: Create GitHub Release
        id: create_release
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            --title "${GITHUB_REF_NAME}" \
            --notes-file /tmp/release-notes.md

      # Gate on create_release, not notes, so a failed release can't announce success
      - name: Notify Slack
        if: success() && steps.create_release.outcome == 'success'
        run: |
          VERSION="${GITHUB_REF_NAME}"
          RELEASE_URL="https://github.com/TryGhost/Ghost/releases/tag/${VERSION}"
          CHANGELOG=$(cat /tmp/release-notes.md | head -c 3000)

          # Build Slack payload — use --rawfile so newlines in release notes are preserved
          PAYLOAD=$(jq -n \
            --arg header ":ghost: Ghost ${VERSION} is loose! - ${RELEASE_URL}" \
            --rawfile notes /tmp/release-notes.md \
            '{text: ($header + "\n\n" + $notes)}')

          curl -sf -X POST \
            -H 'Content-type: application/json' \
            --data "${PAYLOAD}" \
            "${{ secrets.RELEASE_NOTIFICATION_URL }}" || echo "Slack notification failed (non-fatal)"

  # --------------------------------------------------------------------------- #
  # Notify on any release-path failure — fires if the tag was created but the
  # publish run (build, npm publish, or GitHub Release) failed at any point.
  # A single terminal job catches jobs skipped by an upstream failure, which a
  # per-job `if: failure()` step cannot.
  # --------------------------------------------------------------------------- #
  notify_release_failure:
    name: Notify release failure
    needs: [job_setup, job_build_admin, job_pack, job_docker, job_ghost-cli, publish_ghost, create_github_release]
    if: failure() && startsWith(github.ref, 'refs/tags/v') && github.repository == 'TryGhost/Ghost'
    runs-on: ubuntu-slim
    permissions: {}  # only posts to Slack via curl; needs no GITHUB_TOKEN scopes
    steps:
      - name: Notify Slack
        env:
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          RELEASE_NOTIFICATION_URL: ${{ secrets.RELEASE_NOTIFICATION_URL }}
        run: |
          VALUE=$(printf '<!subteam^S07ATDH3CLB|on-call-product> — check the failed run: <%s|view run>' "$RUN_URL")
          PAYLOAD=$(jq -n --arg value "$VALUE" \
            '{username: "Ghost CI", attachments: [{color: "danger", fields: [{title: "🚨 Ghost release failed", value: $value}]}]}')
          curl -sf -X POST -H 'Content-type: application/json' \
            --data "$PAYLOAD" \
            "$RELEASE_NOTIFICATION_URL" || echo "Slack notification failed (non-fatal)"