release.yml

name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v0.1.2)"
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}

jobs:
  build:
    name: Build (sdist + wheel)
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.10"

      - name: Install frontend dependencies
        run: cd frontend && bun install --frozen-lockfile

      - name: Build frontend assets
        run: cd frontend && bun run build

      - name: Set up uv
        uses: astral-sh/setup-uv@v8.0.0
        with:
          python-version: "3.13"
          enable-cache: true

      - name: Verify tag matches pyproject version
        shell: bash
        run: |
          python - <<'PY'
          import os
          import re
          import sys
          from pathlib import Path
          try:
              import tomllib  # py3.11+
          except Exception:  # pragma: no cover
              import tomli as tomllib

          tag = os.environ.get("RELEASE_TAG", "")
          if not tag:
              print("Missing RELEASE_TAG")
              sys.exit(1)
          m = re.fullmatch(r"v(\d+\.\d+\.\d+)", tag)
          if not m:
              print(f"Invalid tag format: {tag!r}")
              sys.exit(1)
          tag_ver = m.group(1)

          data = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
          proj_ver = data["project"]["version"]
          if proj_ver != tag_ver:
              print(f"pyproject.toml version ({proj_ver}) does not match tag ({tag_ver})")
              sys.exit(1)
          print(f"OK: {tag} matches pyproject.toml version {proj_ver}")
          PY

      - name: Build sdist + wheel
        run: uvx --from build python -m build

      - name: Verify wheel contains frontend assets
        shell: bash
        run: |
          python - <<'PY'
          import glob
          import zipfile

          wheels = glob.glob("dist/*.whl")
          if not wheels:
              raise SystemExit("no wheel found in dist/")

          wheel = wheels[0]
          with zipfile.ZipFile(wheel) as zf:
              names = set(zf.namelist())
              has_index = "app/static/index.html" in names
              has_js = any(name.startswith("app/static/assets/") and name.endswith(".js") for name in names)
              has_css = any(name.startswith("app/static/assets/") and name.endswith(".css") for name in names)

          if not (has_index and has_js and has_css):
              raise SystemExit(
                  f"frontend assets missing in wheel: index={has_index} js={has_js} css={has_css}"
              )
          print(f"frontend assets verified in wheel: {wheel}")
          PY

      - name: Upload dist artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/*

  publish-to-pypi:
    name: Publish to PyPI
    needs: [build]
    runs-on: ubuntu-24.04

    permissions:
      id-token: write

    environment:
      name: pypi
      url: https://pypi.org/project/codex-lb/

    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist

      - name: List dist files
        run: ls -la dist/

      - name: Publish to PyPI (Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          verbose: true
          print-hash: true

  docker-image:
    name: Build and push Docker image
    needs: [build]
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.2
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Set lowercase image ref
        id: image
        run: echo "ref=ghcr.io/${GITHUB_REPOSITORY,,}:${{ steps.meta.outputs.version }}" >> "$GITHUB_OUTPUT"

      - name: Scan Docker image with Trivy (SARIF)
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: ${{ steps.image.outputs.ref }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          ignore-unfixed: true

      - name: Upload Trivy scan results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        with:
          sarif_file: trivy-results.sarif

  helm-chart:
    name: Publish Helm chart to GHCR
    needs: [build]
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.2
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Helm
        uses: azure/setup-helm@v5

      - name: Build Helm dependencies
        run: helm dependency build deploy/helm/codex-lb/

      - name: Log in to GHCR (Helm)
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" \
            | helm registry login ghcr.io \
              --username ${{ github.actor }} \
              --password-stdin

      - name: Package Helm chart
        run: |
          mkdir -p .helm-pkg
          helm package deploy/helm/codex-lb/ -d .helm-pkg/

      - name: Push Helm chart to GHCR
        run: |
          OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}"
          helm push .helm-pkg/codex-lb-*.tgz "oci://ghcr.io/${OWNER_LC}/charts"

  create-github-release:
    name: Create GitHub Release
    needs: [publish-to-pypi, docker-image, helm-chart]
    runs-on: ubuntu-24.04

    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0
          ref: ${{ env.RELEASE_TAG }}

      - name: Download dist artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist

      - name: Resolve previous tag
        id: prev_tag
        shell: bash
        run: |
          set -euo pipefail
          TAG_NAME="${RELEASE_TAG}"
          PREV_TAG=""
          if git describe --tags --abbrev=0 "${TAG_NAME}^" >/dev/null 2>&1; then
            PREV_TAG="$(git describe --tags --abbrev=0 "${TAG_NAME}^")"
          fi
          if [ -n "${PREV_TAG}" ]; then
            RANGE="${PREV_TAG}..${TAG_NAME}"
          else
            RANGE="${TAG_NAME}"
          fi
          {
            echo "tag_name=${TAG_NAME}"
            echo "prev_tag=${PREV_TAG}"
            echo "range=${RANGE}"
          } >> "$GITHUB_OUTPUT"

      - name: Generate release notes (GitHub)
        id: notes
        uses: actions/github-script@v7
        env:
          TAG_NAME: ${{ steps.prev_tag.outputs.tag_name }}
          PREV_TAG: ${{ steps.prev_tag.outputs.prev_tag }}
        with:
          script: |
            const fs = require("fs");
            const tag = process.env.TAG_NAME;
            const prev = process.env.PREV_TAG || undefined;
            if (!tag) {
              core.setFailed("Missing TAG_NAME");
              return;
            }
            const { data } = await github.rest.repos.generateReleaseNotes({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: tag,
              previous_tag_name: prev,
            });
            fs.writeFileSync("release_notes.md", `${data.body.trimEnd()}\n`);
            core.setOutput("tag_name", tag);

      - name: Append install and contributors
        shell: bash
        env:
          TAG_NAME: ${{ steps.prev_tag.outputs.tag_name }}
        run: |
          set -euo pipefail
          TAG_VERSION="${TAG_NAME#v}"
          {
            echo
            echo "## Install / Run"
            echo '```bash'
            echo 'uvx codex-lb'
            echo "docker pull ghcr.io/${GITHUB_REPOSITORY}:${TAG_VERSION}"
            echo "helm install codex-lb oci://ghcr.io/soju06/charts/codex-lb --version ${TAG_VERSION}"
            echo '```'
          } >> release_notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.notes.outputs.tag_name }}
          name: Release ${{ steps.notes.outputs.tag_name }}
          body_path: release_notes.md
          files: "dist/*"
          draft: false
          prerelease: false