release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  verify:
    name: Verify release (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]

    steps:
      - name: Check out release commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}

      - name: Install shell tooling (Ubuntu)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck shfmt zsh

      - name: Install shell tooling (macOS)
        if: runner.os == 'macOS'
        run: brew install shellcheck shfmt

      - name: Run verification suite
        run: bash scripts/check.sh

  publish:
    needs: verify
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      attestations: write
      id-token: write
      artifact-metadata: write

    steps:
      - name: Check out release commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.sha }}

      - name: Require release commit on main
        run: |
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            printf 'Release tag must point to a commit on main: %s\n' "$GITHUB_SHA" >&2
            exit 1
          fi

      - name: Resolve release version
        id: version
        env:
          PUSHED_TAG: ${{ github.ref_name }}
        run: |
          TAG="$PUSHED_TAG"
          version="${TAG#v}"
          source lib/common.sh
          if ! selfishell_version_is_valid "$version"; then
            printf 'Invalid release tag: %s\n' "$TAG" >&2
            exit 1
          fi
          printf 'version=%s\n' "$version" >>"$GITHUB_OUTPUT"
          printf 'tag=%s\n' "$TAG" >>"$GITHUB_OUTPUT"

      - name: Build release artifacts
        run: bash scripts/build-release.sh --version '${{ steps.version.outputs.version }}' --output dist

      - name: Generate signed build provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/*

      - name: Smoke test exact release
        env:
          SELFISHELL_BOOTSTRAP_OS: Linux
          SELFISHELL_BOOTSTRAP_ARCH: x86_64
          SELFISHELL_RELEASE_ROOT: file://${{ runner.temp }}/selfishell-releases
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          release_dir="$RUNNER_TEMP/selfishell-releases/download/v$VERSION"
          mkdir -p "$release_dir"
          cp dist/* "$release_dir/"
          prefix="$RUNNER_TEMP/selfishell-prefix"
          bash install.sh --version "$VERSION" --prefix "$prefix"
          test "$("$prefix/bin/selfishell" version)" = "selfishell $VERSION"

      - name: Publish immutable GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          release_args=()
          [[ "$TAG" != *-* ]] || release_args+=(--prerelease)
          gh release view "$TAG" >/dev/null 2>&1 && {
            printf 'Release already exists: %s\n' "$TAG" >&2
            exit 1
          }
          gh release create "$TAG" dist/* --verify-tag --generate-notes \
            --title "$TAG" "${release_args[@]}"