release.yml

name: release

# Builds booking-agent-cli from booking-agent/ on master and publishes it with PyPI
# Trusted Publishing (OIDC). Both publishers are wix / booking-agent / release.yml, so
# publishing must stay in this file.
#
# - push to master: if the version in booking-agent/packages/cli/pyproject.toml has no
#   v<version> tag and is not on PyPI yet, test, build, publish to PyPI (environment
#   pypi), then create the v<version> tag and a GitHub Release for that commit. Otherwise
#   do nothing. .devN versions are never published from a push.
# - release published (manual): the tag must equal v<version> and point at master.
#   .devN tags go to TestPyPI (environment testpypi), every other tag goes to PyPI.
#
# The wix org allows only GitHub-owned actions pinned by SHA, so uploads use
# `uv publish`, not pypa/gh-action-pypi-publish.
#
# Every published file carries a PEP 740 publish attestation: `pypi-attestations sign`
# signs each dist with a Sigstore certificate for this workflow's OIDC identity and
# writes `<dist>.publish.attestation`, which `uv publish` uploads with the dist. The
# installed CLI verifies those attestations before it installs an update or takes a
# payment, so publishing must stay in this file (the identity it checks is
# wix/booking-agent/.github/workflows/release.yml). The `attest` job also records a
# GitHub build provenance attestation (`gh attestation verify <file> --repo wix/booking-agent`).
# No job that runs tests holds `id-token: write`.
# Lives on master only; never add it to main (the Pages branch allow-list rejects it).

on:
  push:
    branches: [master]
  release:
    types: [published]

permissions:
  contents: read

# One release per index at a time, so two quick merges cannot race to publish.
concurrency:
  group: release-${{ (github.event_name == 'push' || !contains(github.ref_name, '.dev')) && 'pypi' || 'testpypi' }}
  cancel-in-progress: false

env:
  UV_VERSION: "0.13.0"
  PYPI_ATTESTATIONS_VERSION: "0.0.30"
  PYTHON_VERSION: "3.12"
  PACKAGE: booking-agent-cli

jobs:
  decide:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      version: ${{ steps.decide.outputs.version }}
      skill_version: ${{ steps.decide.outputs.skill_version }}
      dev: ${{ steps.decide.outputs.dev }}
      publish: ${{ steps.decide.outputs.publish }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Decide whether to publish
        id: decide
        run: |
          version="$(python -c 'import tomllib; print(tomllib.load(open("booking-agent/packages/cli/pyproject.toml", "rb"))["project"]["version"])')"
          # The skill is released as skill-v<its own frontmatter version>, separately from the CLI version.
          skill_version="$(python -c 'import pathlib, re; t = pathlib.Path("booking-agent/skills/booking-agent/SKILL.md").read_text(encoding="utf-8").replace("\r\n", "\n"); fm = t[4:t.index("\n---", 4)] if t.startswith("---\n") else ""; print(re.search(r"^version:\s*[\x22\x27]?([^\s\x22\x27]+)[\x22\x27]?\s*$", fm, re.M).group(1))')"
          case "$skill_version" in ""|*[!0-9A-Za-z.]*)
            echo "::error::No usable version in booking-agent/skills/booking-agent/SKILL.md frontmatter"
            exit 1
            ;;
          esac
          case "$version" in *.dev*) dev=true ;; *) dev=false ;; esac
          {
            echo "version=${version}"
            echo "skill_version=${skill_version}"
            echo "dev=${dev}"
          } >> "$GITHUB_OUTPUT"

          skip() {
            echo "::notice::Not publishing ${PACKAGE} ${version}: $1"
            echo "publish=false" >> "$GITHUB_OUTPUT"
            exit 0
          }

          if [ "$GITHUB_EVENT_NAME" = "release" ]; then
            if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/master; then
              echo "::error::$GITHUB_REF_NAME ($GITHUB_SHA) is not on master"
              exit 1
            fi
            if [ "v${version}" != "$GITHUB_REF_NAME" ]; then
              echo "::error::Tag $GITHUB_REF_NAME does not match ${PACKAGE} version ${version} (expected v${version})"
              exit 1
            fi
          else
            if [ "$dev" = true ]; then
              skip "development versions are published to TestPyPI by publishing a GitHub release"
            fi
            if git rev-parse -q --verify "refs/tags/v${version}" >/dev/null; then
              skip "tag v${version} already exists"
            fi
          fi

          if [ "$dev" = true ]; then index=https://test.pypi.org; else index=https://pypi.org; fi
          status="$(curl -sS -o /dev/null -w '%{http_code}' "${index}/pypi/${PACKAGE}/${version}/json")"
          case "$status" in
            200) skip "${version} is already on ${index}" ;;
            404) echo "publish=true" >> "$GITHUB_OUTPUT" ;;
            *)
              echo "::error::${index} answered HTTP ${status} for ${PACKAGE} ${version}"
              exit 1
              ;;
          esac

  build:
    needs: decide
    if: needs.decide.outputs.publish == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        run: python -m pip install "uv==${UV_VERSION}"

      - name: Test against a fresh resolution (no lockfile, like end users)
        working-directory: booking-agent
        run: |
          uv sync --all-packages --all-extras
          uv run pytest -q -p no:cacheprovider

      - name: Build
        working-directory: booking-agent
        run: uv build --package booking-agent-cli --out-dir "$GITHUB_WORKSPACE/dist"

      - name: Dist must be exactly one wheel and one sdist for the version
        env:
          VERSION: ${{ needs.decide.outputs.version }}
        run: |
          ls -la dist
          # uv build writes dist/.gitignore so the artifacts are not committed. It is not an artifact.
          test "$(find dist -mindepth 1 ! -name '.*' -print | wc -l | tr -d '[:space:]')" -eq 2
          test -f "dist/booking_agent_cli-${VERSION}-py3-none-any.whl"
          test -f "dist/booking_agent_cli-${VERSION}.tar.gz"

      - name: Upload dist
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dist
          path: dist/
          if-no-files-found: error

      # Its own artifact: the check above holds dist to exactly two files, and the publish
      # jobs offer everything in dist/ to PyPI.
      - name: Upload the skill
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: skill-src
          path: booking-agent/skills/booking-agent/SKILL.md
          if-no-files-found: error

  # Separate from build so the test run never holds an OIDC token.
  attest:
    needs: [decide, build]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
      attestations: write
    steps:
      - name: Download dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/

      - name: Download the skill
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: skill-src
          path: skill-src/

      - name: GitHub build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            dist/*.whl
            dist/*.tar.gz

      # Its own invocation, because one invocation emits one bundle: adding SKILL.md to the
      # subject-path above would produce a single multi-subject bundle and no per-file one to
      # ship as SKILL.md.sigstore.json. The skill arrives as an artifact rather than a
      # checkout: this job's permissions grant no contents scope, by design.
      - name: GitHub build provenance for the skill
        id: attest-skill
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: skill-src/SKILL.md

      - name: Stage the signed skill
        env:
          BUNDLE_PATH: ${{ steps.attest-skill.outputs.bundle-path }}
        run: |
          mkdir -p skill-dist
          cp skill-src/SKILL.md skill-dist/SKILL.md
          cp "$BUNDLE_PATH" skill-dist/SKILL.md.sigstore.json
          test -s skill-dist/SKILL.md
          test -s skill-dist/SKILL.md.sigstore.json

      - name: Upload the signed skill
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: skill-dist
          path: skill-dist/
          if-no-files-found: error

  publish-testpypi:
    needs: [decide, build, attest]
    if: needs.decide.outputs.dev == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: testpypi
      url: https://test.pypi.org/project/booking-agent-cli/
    permissions:
      id-token: write
    steps:
      - name: Download dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv and pypi-attestations
        run: python -m pip install "uv==${UV_VERSION}" "pypi-attestations==${PYPI_ATTESTATIONS_VERSION}"

      # TestPyPI, like PyPI, checks attestations against production Sigstore.
      - name: Sign PEP 740 publish attestations
        run: python -m pypi_attestations sign dist/*.whl dist/*.tar.gz

      - name: Publish to TestPyPI
        run: uv publish --trusted-publishing always --publish-url https://test.pypi.org/legacy/ dist/*

  publish-pypi:
    needs: [decide, build, attest]
    if: needs.decide.outputs.dev == 'false'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: pypi
      url: https://pypi.org/project/booking-agent-cli/
    permissions:
      id-token: write
    steps:
      - name: Download dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv and pypi-attestations
        run: python -m pip install "uv==${UV_VERSION}" "pypi-attestations==${PYPI_ATTESTATIONS_VERSION}"

      - name: Sign PEP 740 publish attestations
        run: python -m pypi_attestations sign dist/*.whl dist/*.tar.gz

      - name: Publish to PyPI
        run: uv publish --trusted-publishing always dist/*

  # A release created with GITHUB_TOKEN triggers no workflows, so it cannot re-run this
  # one; the decide job would skip it anyway because the version is on PyPI by then.
  github-release:
    needs: [decide, publish-pypi]
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download dist
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/

      - name: Download the signed skill
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: skill-dist
          path: skill-dist/

      # A published skill must stay readable at its tag forever, so skill-v<version> is only
      # ever created, never moved: the release tag ruleset refuses an update anyway. The
      # checkout here carries no credentials and no tags, so the ref goes through the API.
      - name: Tag skill-v<skill version>
        env:
          GH_TOKEN: ${{ github.token }}
          SKILL_VERSION: ${{ needs.decide.outputs.skill_version }}
        run: |
          if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/skill-v${SKILL_VERSION}" >/dev/null 2>&1; then
            echo "::notice::skill-v${SKILL_VERSION} already exists; leaving it where it is"
            exit 0
          fi
          gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" \
            -f "ref=refs/tags/skill-v${SKILL_VERSION}" \
            -f "sha=${GITHUB_SHA}"

      # The rollout decision lives in release-notes/<version>.json on master and may
      # change after release; the attached copy records what it said at release time.
      - name: Tag v<version> and create the GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.decide.outputs.version }}
        run: |
          gh release create "v${VERSION}" dist/* "booking-agent/release-notes/${VERSION}.json" \
            skill-dist/SKILL.md skill-dist/SKILL.md.sigstore.json \
            --repo "$GITHUB_REPOSITORY" \
            --target "$GITHUB_SHA" \
            --title "v${VERSION}" \
            --generate-notes