release.yml

name: Release Dhall Frozen Package

on:
  workflow_dispatch:
    inputs:
      version:
        description: Release version in SemVer format (e.g. 1.2.3)
        required: true
        type: string
  workflow_call:
    inputs:
      version:
        description: Release version in SemVer format (e.g. 1.2.3)
        required: true
        type: string

permissions:
  contents: write

jobs:
  validate:
    name: Validate release
    runs-on: ubuntu-latest

    steps:
      - name: Validate SemVer format
        shell: bash
        run: |
          if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Version '${{ inputs.version }}' is not valid SemVer (expected X.Y.Z)."
            exit 1
          fi

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.ref }}
          fetch-depth: 0

      - name: Validate changelog contains Upcoming section
        shell: bash
        run: |
          if ! grep -q '^# Upcoming$' CHANGELOG.md; then
            echo "::error::CHANGELOG.md must contain a '# Upcoming' section before releasing."
            exit 1
          fi

      - name: Check changelog release header
        shell: bash
        run: |
          expected_heading="# v${{ inputs.version }}"
          top_heading="$(head -n 1 CHANGELOG.md)"

          if [[ "$top_heading" != '# Upcoming' && "$top_heading" != "$expected_heading" ]]; then
            echo "::error::CHANGELOG.md must start with either '# Upcoming' or '$expected_heading' before releasing."
            exit 1
          fi

      - name: Check tag does not already exist
        shell: bash
        run: |
          if git ls-remote --tags origin "refs/tags/v${{ inputs.version }}" | grep -q .; then
            echo "::error::Tag v${{ inputs.version }} already exists. Choose a different version."
            exit 1
          fi

  ci:
    name: Run CI
    needs: validate
    uses: ./.github/workflows/ci.yml
    secrets: inherit

  release:
    name: Prepare and create release
    needs: [validate, ci]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.ref }}
          fetch-depth: 0

      - name: Resolve Dhall
        id: resolve
        uses: nikita-volkov/dhall-resolve.github-action@b7a346816b48a0f58282855a56e19b2a2c77f35d # v3
        with:
          file: src/package.dhall
          minify: true

      - name: Prepare changelog for release
        id: commit
        shell: bash
        run: |
          set -euo pipefail

          expected_heading="# v${{ inputs.version }}"
          top_heading="$(head -n 1 CHANGELOG.md)"
          needs_commit=false

          if [[ "$top_heading" == '# Upcoming' ]]; then
            perl -0pi -e 's/^# Upcoming$/# v${{ inputs.version }}/m' CHANGELOG.md
            needs_commit=true
          elif [[ "$top_heading" != "$expected_heading" ]]; then
            echo "::error::CHANGELOG.md must start with either '# Upcoming' or '$expected_heading' before releasing."
            exit 1
          fi

          asset_pattern="https://github.com/${{ github.repository }}/releases/download/v[0-9]+\.[0-9]+\.[0-9]+/resolved\.dhall"
          if grep -qE "$asset_pattern" README.md; then
            sed -i -E "s|$asset_pattern|https://github.com/${{ github.repository }}/releases/download/v${{ inputs.version }}/resolved.dhall|g" README.md
            needs_commit=true
          fi

          if [[ "$needs_commit" == true ]]; then
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git add CHANGELOG.md README.md
            git commit -m "Prepare v${{ inputs.version }} release"
            git push origin HEAD:"${{ github.ref }}"
          fi

          echo "commit-sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          tag_name: v${{ inputs.version }}
          name: "v${{ inputs.version }}"
          body: |
            ## Dhall Frozen Package Release

            This release contains the frozen Dhall package with all remote imports resolved and compacted via CSE.

            **Commit**: ${{ steps.commit.outputs.commit-sha }}
            **Workflow Run**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

            The frozen package is CORS-compliant and self-contained, suitable for direct use without network dependencies.
          files: |
            ${{ steps.resolve.outputs.path }}
          draft: false
          prerelease: false
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Deployment summary
        run: |
          echo "Successfully created release v${{ inputs.version }}"
          echo "Release tag: v${{ inputs.version }}"
          echo "Artifact: resolved.dhall"

  wheel:
    name: Build and verify the wheel channel
    needs: [validate, ci, release]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.ref }}
          fetch-depth: 0

      - name: Download the released resolved.dhall asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail

          gh release download "v${{ inputs.version }}" \
            --repo "${{ github.repository }}" \
            --pattern resolved.dhall \
            --dir release-asset

      - name: Stamp wheel metadata and stage the generator
        shell: bash
        run: |
          set -euo pipefail

          cat > wheel/src/pgenie_python_gen/_meta.py <<'EOF'
          version = "${{ inputs.version }}"
          repo: str | None = "${{ github.repository }}"
          release_url: str | None = "${{ github.server_url }}/${{ github.repository }}/releases/download/v${{ inputs.version }}/resolved.dhall"
          EOF

          cp release-asset/resolved.dhall wheel/src/pgenie_python_gen/resolved.dhall

          # The artifact ships under GPL-3.0-or-later (wheel/NOTICE explains
          # the composition), so the GPLv3 text must travel inside it. The
          # repository itself is MIT and deliberately carries no GPL text,
          # hence the pinned fetch at build time. The repo LICENSE (MIT) is
          # NOT copied in: it would misstate the artifact's license.
          curl -fsSL https://www.gnu.org/licenses/gpl-3.0.txt -o wheel/COPYING
          echo "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986  wheel/COPYING" | sha256sum -c -

      - name: Byte-assert the staged generator matches the released asset
        shell: bash
        run: |
          set -euo pipefail
          cmp release-asset/resolved.dhall wheel/src/pgenie_python_gen/resolved.dhall

      - name: Install mise-managed tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0

      - name: Build sdist and wheel
        run: mise x -- uv build --sdist --wheel --out-dir wheel/dist wheel

      - name: Assert resolved.dhall ships in both archives
        shell: bash
        run: |
          set -euo pipefail

          wheel_file="$(ls wheel/dist/*.whl)"
          sdist_file="$(ls wheel/dist/*.tar.gz)"

          if ! unzip -l "$wheel_file" | grep -q 'pgenie_python_gen/resolved.dhall'; then
            echo "::error::resolved.dhall missing from the wheel ($wheel_file)."
            exit 1
          fi
          if ! tar tzf "$sdist_file" | grep -q 'src/pgenie_python_gen/resolved.dhall'; then
            echo "::error::resolved.dhall missing from the sdist ($sdist_file)."
            exit 1
          fi

          # GPL compliance: the license text and the composition notice must
          # ship inside the artifact (dist-info/licenses in the wheel).
          for f in COPYING NOTICE; do
            if ! unzip -l "$wheel_file" | grep -q "licenses/$f"; then
              echo "::error::$f missing from the wheel ($wheel_file)."
              exit 1
            fi
            if ! tar tzf "$sdist_file" | grep -q "/$f"; then
              echo "::error::$f missing from the sdist ($sdist_file)."
              exit 1
            fi
          done

      - name: Install into a clean venv and verify the CLI
        shell: bash
        run: |
          set -euo pipefail

          wheel_file="$(ls wheel/dist/*.whl)"
          mise x -- uv venv /tmp/wheel-venv
          mise x -- uv pip install --python /tmp/wheel-venv/bin/python "$wheel_file"

          got_version="$(/tmp/wheel-venv/bin/pgenie-python-gen version)"
          if [[ "$got_version" != "${{ inputs.version }}" ]]; then
            echo "::error::CLI version '$got_version' != release version '${{ inputs.version }}'."
            exit 1
          fi

          bundled="$(/tmp/wheel-venv/bin/pgenie-python-gen path)"
          cmp "$bundled" release-asset/resolved.dhall

      - name: Upload the built distributions as workflow artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pgenie-python-gen-dist
          path: wheel/dist/*
          if-no-files-found: error

  publish-pypi:
    # Publication is DISABLED. `if: false` is the kill switch: this job never
    # runs. Enable it only after registering a PyPI Trusted Publisher for this
    # workflow, then replace `if: false` with a real gate (a publish input or a
    # tag filter). Do not add a pending publisher on PyPI until then.
    name: Publish to PyPI (disabled; flip if:false to enable)
    if: false
    needs: wheel
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Download the built distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: pgenie-python-gen-dist
          path: dist

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          packages-dir: dist