release.yml

name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v1.19.0 or v1.19.0-beta.1)"
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}

jobs:
  release-metadata:
    name: Resolve release metadata
    runs-on: ubuntu-24.04

    outputs:
      tag: ${{ steps.metadata.outputs.tag }}
      version: ${{ steps.metadata.outputs.version }}
      base_version: ${{ steps.metadata.outputs.base_version }}
      channel: ${{ steps.metadata.outputs.channel }}
      is_prerelease: ${{ steps.metadata.outputs.is_prerelease }}
      pypi_version: ${{ steps.metadata.outputs.pypi_version }}
      make_latest: ${{ steps.metadata.outputs.make_latest }}

    steps:
      - name: Checkout release tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          ref: ${{ env.RELEASE_TAG }}

      - name: Resolve tag metadata
        id: metadata
        shell: bash
        run: python -m scripts.release_metadata --tag "${RELEASE_TAG}"

  build:
    name: Build (sdist + wheel)
    needs: [release-metadata]
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: "1.3.14"
          no-cache: true

      - name: Install frontend dependencies
        run: cd frontend && bun install --frozen-lockfile

      - name: Build frontend assets
        run: cd frontend && bun run build

      - name: Set up uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
        with:
          python-version: "3.13"
          enable-cache: false

      - name: Verify tag matches release-managed versions
        shell: bash
        run: python -m scripts.verify_release_version --tag "${RELEASE_TAG}"

      - name: Build sdist + wheel
        run: uvx --from build==1.3.0 python -m build

      - name: Verify wheel contains frontend assets
        shell: bash
        run: |
          python - <<'PY'
          import glob
          import zipfile

          wheels = glob.glob("dist/*.whl")
          if not wheels:
              raise SystemExit("no wheel found in dist/")

          wheel = wheels[0]
          with zipfile.ZipFile(wheel) as zf:
              names = set(zf.namelist())
              has_index = "app/static/index.html" in names
              has_js = any(name.startswith("app/static/assets/") and name.endswith(".js") for name in names)
              has_css = any(name.startswith("app/static/assets/") and name.endswith(".css") for name in names)

          if not (has_index and has_js and has_css):
              raise SystemExit(
                  f"frontend assets missing in wheel: index={has_index} js={has_js} css={has_css}"
              )
          print(f"frontend assets verified in wheel: {wheel}")
          PY

      - name: Upload dist artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: dist
          path: dist/*

  publish-to-pypi:
    name: Publish to PyPI
    needs: [build]
    runs-on: ubuntu-24.04

    permissions:
      id-token: write

    environment:
      name: pypi
      url: https://pypi.org/project/codex-lb/

    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@fc02353415da80201a0da48ab47022efd7725d11
        with:
          name: dist
          path: dist

      - name: List dist files
        run: ls -la dist/

      - name: Publish to PyPI (Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
        with:
          verbose: true
          print-hash: true

  docker-image:
    name: Build and push Docker image
    needs: [build, release-metadata]
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}},enable=${{ needs.release-metadata.outputs.is_prerelease == 'false' }}
            type=semver,pattern={{major}},enable=${{ needs.release-metadata.outputs.is_prerelease == 'false' }}
            type=raw,value=latest,enable=${{ needs.release-metadata.outputs.is_prerelease == 'false' }}
            type=raw,value=${{ needs.release-metadata.outputs.channel }},enable=${{ needs.release-metadata.outputs.is_prerelease == 'true' }}

      - name: Build and push Docker image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=codex-lb-release
          cache-to: type=gha,mode=max,scope=codex-lb-release

      - name: Set lowercase image ref
        id: image
        env:
          IMAGE_VERSION: ${{ steps.meta.outputs.version }}
        run: echo "ref=ghcr.io/${GITHUB_REPOSITORY,,}:${IMAGE_VERSION}" >> "$GITHUB_OUTPUT"

      - name: Scan Docker image with Trivy (SARIF)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
        with:
          image-ref: ${{ steps.image.outputs.ref }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH,MEDIUM,LOW
          ignore-unfixed: true

      - name: Upload Trivy scan results to GitHub Security
        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd
        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        with:
          sarif_file: trivy-results.sarif
          # Use the same Trivy category as CI so PR Code Scanning only has
          # one default-branch Docker baseline to compare against.
          category: .github/workflows/ci.yml:docker

  helm-chart:
    name: Publish Helm chart to GHCR
    needs: [build]
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310

      - name: Build Helm dependencies
        run: helm dependency build deploy/helm/codex-lb/

      - name: Log in to GHCR (Helm)
        env:
          REGISTRY_USERNAME: ${{ github.actor }}
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" \
            | helm registry login ghcr.io \
              --username "${REGISTRY_USERNAME}" \
              --password-stdin

      - name: Package Helm chart
        run: |
          mkdir -p .helm-pkg
          helm package deploy/helm/codex-lb/ -d .helm-pkg/

      - name: Push Helm chart to GHCR
        run: |
          OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}"
          helm push .helm-pkg/codex-lb-*.tgz "oci://ghcr.io/${OWNER_LC}/charts"

  create-github-release:
    name: Create GitHub Release
    needs: [publish-to-pypi, docker-image, helm-chart, release-metadata]
    runs-on: ubuntu-24.04

    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ env.RELEASE_TAG }}

      - name: Download dist artifacts
        uses: actions/download-artifact@fc02353415da80201a0da48ab47022efd7725d11
        with:
          name: dist
          path: dist

      - name: Resolve previous tag
        id: prev_tag
        shell: bash
        env:
          IS_PRERELEASE: ${{ needs.release-metadata.outputs.is_prerelease }}
        run: |
          set -euo pipefail
          python - <<'PY'
          import os
          import re
          import subprocess

          tag_name = os.environ["RELEASE_TAG"]
          is_prerelease = os.environ.get("IS_PRERELEASE") == "true"
          prev_tag = ""

          if is_prerelease:
              proc = subprocess.run(
                  ["git", "describe", "--tags", "--abbrev=0", f"{tag_name}^"],
                  check=False,
                  text=True,
                  stdout=subprocess.PIPE,
                  stderr=subprocess.DEVNULL,
              )
              if proc.returncode == 0:
                  prev_tag = proc.stdout.strip()
          else:
              proc = subprocess.run(
                  ["git", "tag", "--merged", f"{tag_name}^", "--sort=-v:refname"],
                  check=True,
                  text=True,
                  stdout=subprocess.PIPE,
              )
              stable_tag = re.compile(r"^v\d+\.\d+\.\d+$")
              prev_tag = next((tag for tag in proc.stdout.splitlines() if stable_tag.fullmatch(tag)), "")

          release_range = f"{prev_tag}..{tag_name}" if prev_tag else tag_name
          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
              fh.write(f"tag_name={tag_name}\n")
              fh.write(f"prev_tag={prev_tag}\n")
              fh.write(f"range={release_range}\n")
          PY

      - name: Generate release notes (GitHub)
        id: notes
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
        env:
          TAG_NAME: ${{ steps.prev_tag.outputs.tag_name }}
          PREV_TAG: ${{ steps.prev_tag.outputs.prev_tag }}
        with:
          script: |
            const fs = require("fs");
            const tag = process.env.TAG_NAME;
            const prev = process.env.PREV_TAG || undefined;
            if (!tag) {
              core.setFailed("Missing TAG_NAME");
              return;
            }
            const { data } = await github.rest.repos.generateReleaseNotes({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: tag,
              previous_tag_name: prev,
            });
            fs.writeFileSync("release_notes.md", `${data.body.trimEnd()}\n`);
            core.setOutput("tag_name", tag);

      - name: Append install and contributors
        shell: bash
        env:
          TAG_NAME: ${{ steps.prev_tag.outputs.tag_name }}
          IS_PRERELEASE: ${{ needs.release-metadata.outputs.is_prerelease }}
          PYPI_VERSION: ${{ needs.release-metadata.outputs.pypi_version }}
        run: |
          set -euo pipefail
          TAG_VERSION="${TAG_NAME#v}"
          {
            echo
            echo "## Install / Run"
            echo '```bash'
            if [ "${IS_PRERELEASE}" = "true" ]; then
              echo "uvx --from \"codex-lb==${PYPI_VERSION}\" codex-lb"
              echo "docker pull ghcr.io/${GITHUB_REPOSITORY}:${TAG_VERSION}"
              echo "helm install codex-lb oci://ghcr.io/soju06/charts/codex-lb --version ${TAG_VERSION} --devel"
            else
              echo 'uvx codex-lb'
              echo "docker pull ghcr.io/${GITHUB_REPOSITORY}:${TAG_VERSION}"
              echo "helm install codex-lb oci://ghcr.io/soju06/charts/codex-lb --version ${TAG_VERSION}"
            fi
            echo '```'
          } >> release_notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228
        with:
          tag_name: ${{ steps.notes.outputs.tag_name }}
          name: Release ${{ steps.notes.outputs.tag_name }}
          body_path: release_notes.md
          files: "dist/*"
          draft: false
          prerelease: ${{ needs.release-metadata.outputs.is_prerelease == 'true' }}
          make_latest: ${{ needs.release-metadata.outputs.make_latest }}

  withdraw-failed-release:
    name: Withdraw failed public release
    needs: [release-metadata, build, publish-to-pypi, docker-image, helm-chart, create-github-release]
    runs-on: ubuntu-24.04
    if: >-
      ${{
        always() &&
        github.event_name == 'release' &&
        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
      }}

    permissions:
      contents: write

    steps:
      - name: Make incomplete release draft again
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release edit "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --draft