release.yml

name: release

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:
    inputs:
      version:
        description: Existing numeric release tag X.Y.Z; manual dispatch only verifies an existing tag.
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Build and publish release bundle
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Resolve and verify existing release tag
        shell: bash
        env:
          RELEASE_INPUT_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
        run: |
          set -euo pipefail
          case "$GITHUB_EVENT_NAME" in
            push)
              version="$GITHUB_REF_NAME"
              ;;
            workflow_dispatch)
              # manual dispatch only verifies an existing tag
              version="$RELEASE_INPUT_VERSION"
              ;;
            *)
              echo "unsupported release event '$GITHUB_EVENT_NAME'" >&2
              exit 1
              ;;
          esac
          if [ -z "$version" ]; then
            echo "release version is empty; tag push or workflow_dispatch input required" >&2
            exit 1
          fi
          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "release version '$version' is not numeric SemVer X.Y.Z" >&2
            exit 1
          fi

          remote_tag_ref="refs/tags/${version}"
          remote_tag_rows="$(git ls-remote --refs origin "$remote_tag_ref")"
          remote_tag_count="$(printf '%s\n' "$remote_tag_rows" | awk -v ref="$remote_tag_ref" '$2 == ref { count += 1 } END { print count + 0 }')"
          if [ "$remote_tag_count" -ne 1 ]; then
            echo "release tag '$remote_tag_ref' must already exist exactly once on origin" >&2
            exit 1
          fi
          remote_tag_oid="$(printf '%s\n' "$remote_tag_rows" | awk -v ref="$remote_tag_ref" '$2 == ref { print $1 }')"

          git fetch --no-tags origin "+refs/heads/main:refs/remotes/origin/main"
          git fetch --no-tags origin "+${remote_tag_ref}:${remote_tag_ref}"
          local_tag_oid="$(git rev-parse "$remote_tag_ref")"
          if [ "$local_tag_oid" != "$remote_tag_oid" ]; then
            echo "local tag object '$local_tag_oid' does not match origin '$remote_tag_oid'" >&2
            exit 1
          fi
          tag_commit="$(git rev-parse "${remote_tag_ref}^{commit}")"

          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
            if [ "$GITHUB_SHA" != "$remote_tag_oid" ] && [ "$GITHUB_SHA" != "$tag_commit" ]; then
              echo "push SHA '$GITHUB_SHA' matches neither tag object '$remote_tag_oid' nor peeled commit '$tag_commit'" >&2
              exit 1
            fi
            if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
              echo "tag push SHA '$GITHUB_SHA' is not contained in origin/main" >&2
              exit 1
            fi
          else
            if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
              echo "existing tag '$version' is not contained in origin/main" >&2
              exit 1
            fi
            git checkout --detach "$tag_commit"
          fi

          if [ "$(git rev-parse HEAD)" != "$tag_commit" ]; then
            echo "checked out HEAD does not match peeled release tag commit '$tag_commit'" >&2
            exit 1
          fi
          echo "RELEASE_VERSION=$version" >> "$GITHUB_ENV"
          echo "RELEASE_COMMIT=$tag_commit" >> "$GITHUB_ENV"

      - name: Set up validation runtime
        uses: ./.github/actions/setup-codex-runtime
        with:
          install-codex: "false"
          install-dart: "false"

      - name: Validate release version
        shell: bash
        run: |
          set -euo pipefail
          file_version="$(tr -d '[:space:]' < VERSION)"
          if [ "$RELEASE_VERSION" != "$file_version" ]; then
            echo "release version '$RELEASE_VERSION' does not match VERSION '$file_version'" >&2
            exit 1
          fi
          if [ "$(git rev-parse HEAD)" != "$RELEASE_COMMIT" ]; then
            echo "release checkout drifted from verified tag commit '$RELEASE_COMMIT'" >&2
            exit 1
          fi
          if ! grep -q "^## \\[$RELEASE_VERSION\\]" CHANGELOG.md; then
            echo "CHANGELOG.md has no release entry for $RELEASE_VERSION" >&2
            exit 1
          fi

      - name: Run release validation
        run: |
          python3 scripts/validate_plugin_versions.py
          python3 scripts/validate_skill_routing.py
          python3 scripts/validate_instruction_docs.py
          uv run --with pyyaml python scripts/validate_agent_tools.py
          uv run --with pytest --with pytest-cov --with pyyaml python -m pytest

      - name: Build deterministic bundle and evidence
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist
          release_paths=(
            .agents
            .devcontainer
            .github
            config
            docs
            plugins
            scripts
            system
            tests
            CODE_OF_CONDUCT.md
            CONTRIBUTING.md
            README.md
            SECURITY.md
            CHANGELOG.md
            VERSION
            LICENSE
            pyproject.toml
            pyrightconfig.json
            uv.lock
          )
          existing_paths=()
          for path in "${release_paths[@]}"; do
            if [ -e "$path" ]; then
              existing_paths+=("$path")
            fi
          done
          source_date="$(git log -1 --format=%cI)"
          tar --sort=name \
            --mtime="$source_date" \
            --owner=0 \
            --group=0 \
            --numeric-owner \
            --exclude='.git' \
            --exclude='.pytest_cache' \
            --exclude='.venv' \
            -cf - "${existing_paths[@]}" \
            | gzip -n > "dist/rldyour-codex-${RELEASE_VERSION}.tar.gz"
          python3 scripts/release_manifest.py > dist/release-manifest.json
          python3 scripts/release_sbom.py > dist/sbom.spdx.json
          awk -v version="$RELEASE_VERSION" '
            $0 ~ "^## \\[" version "\\]" { flag = 1; next }
            flag && /^## \[/ { exit }
            flag { print }
          ' CHANGELOG.md > dist/release-notes.md
          # dist/gates holds CI bootstrap receipts, not release artifacts. Drop the
          # directory so the dist/* asset operations (checksums, release upload) only
          # ever see regular files and never fail on a subdirectory.
          rm -rf dist/gates

      - name: Export GitHub dependency graph SBOM when available
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if gh api \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2026-03-10" \
            "/repos/${GITHUB_REPOSITORY}/dependency-graph/sbom" \
            --jq '.sbom' \
            > dist/github-dependency-graph-sbom.spdx.json; then
            jq -e '.spdxVersion == "SPDX-2.3" and (.packages | length > 0)' \
              dist/github-dependency-graph-sbom.spdx.json >/dev/null
          else
            rm -f dist/github-dependency-graph-sbom.spdx.json
          fi

      - name: Generate release checksums
        run: |
          set -euo pipefail
          rm -f dist/SHA256SUMS
          sha256sum dist/* > dist/SHA256SUMS

      - name: Attest release bundle
        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
        with:
          subject-path: dist/rldyour-codex-${{ env.RELEASE_VERSION }}.tar.gz

      - name: Attest generated SBOM
        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
        with:
          subject-path: dist/sbom.spdx.json

      - name: Attest GitHub dependency graph SBOM
        if: hashFiles('dist/github-dependency-graph-sbom.spdx.json') != ''
        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
        with:
          subject-path: dist/github-dependency-graph-sbom.spdx.json

      - name: Upload release artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-${{ env.RELEASE_VERSION }}
          path: dist
          retention-days: 30

      - name: Publish GitHub Release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if gh release view "$RELEASE_VERSION" >/dev/null 2>&1; then
            gh release upload "$RELEASE_VERSION" dist/* --clobber
          else
            gh release create "$RELEASE_VERSION" --verify-tag \
              --title "$RELEASE_VERSION" \
              --notes-file dist/release-notes.md \
              dist/*
          fi