release.yml

# SPDX-License-Identifier: Apache-2.0

# Releases the SDK when a stable core pin lands on main: tag and draft release,
# build, publish to PyPI, then attach the files and publish the GitHub release.
# PyPI trusts this file, release.yml, in the pypi environment (trusted
# publishing), so the publish job needs no token. Pushed tags never trigger it.
name: release

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      sha:
        description: Commit on main to release (default the tip); the pin there must be stable
        required: false
        default: ""

permissions:
  contents: read

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  tag:
    name: tag
    # Only main releases, also when the workflow is started by hand.
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write # create the tag and the draft release
      pull-requests: read # read the merged PR's body for the release notes
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - id: tag
        name: Tag the release and create a draft
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT: ${{ github.event_name }}
          INPUT_SHA: ${{ inputs.sha }}
          BEFORE: ${{ github.event.before }}
        run: |
          set -euo pipefail
          if [ "$EVENT" = workflow_dispatch ]; then
            sha=${INPUT_SHA:-$GITHUB_SHA}
            git merge-base --is-ancestor "$sha" "$GITHUB_SHA" || {
              echo "::error::$sha is not on main"
              exit 1
            }
            scripts/release/tag-release.sh --force --sha "$sha" >>"$GITHUB_OUTPUT"
          else
            # Compare against the commit before the push, so a pin change
            # that isn't the pushed tip still counts.
            scripts/release/tag-release.sh --since "$BEFORE" >>"$GITHUB_OUTPUT"
          fi

  build:
    name: build
    needs: tag
    if: needs.tag.outputs.tag != ''
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.tag.outputs.tag }}
          persist-credentials: false

      # No tool cache: what gets published is built from fresh downloads.
      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          cache: false

      # Builds the wheel and sdist at the tag's version, verifies the wheel,
      # and installs both on the oldest supported Python.
      - name: Build
        env:
          TAG: ${{ needs.tag.outputs.tag }}
        run: OPENSHELL_SDK_VERSION="${TAG#v}" mise run build

      - name: Write checksums
        run: (cd dist && sha256sum -- *) >openshell-checksums-sha256.txt

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release
          path: |
            dist/
            openshell-checksums-sha256.txt
          if-no-files-found: error

  publish-pypi:
    name: publish-pypi
    needs: [tag, build]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: pypi
      url: https://pypi.org/project/openshell/
    permissions:
      id-token: write # trusted publishing to PyPI
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release
          path: release

      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
        with:
          packages-dir: release/dist/

  # Publishing comes last, so the release never shows without its files. If
  # this job fails after PyPI accepted the upload, re-run only the failed jobs.
  github-release:
    name: github-release
    needs: [tag, publish-pypi]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write # attach the files and publish the release
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release
          path: release

      - name: Attach the files and publish the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.tag.outputs.tag }}
        run: |
          set -euo pipefail
          gh release upload "$TAG" -R "$GITHUB_REPOSITORY" --clobber \
            release/dist/* release/openshell-checksums-sha256.txt
          gh release edit "$TAG" -R "$GITHUB_REPOSITORY" --draft=false --latest