build.yml

name: Build CLI
on:
  pull_request:
  push:
    branches: [main]
    tags: ['v*']
    paths-ignore: ['docs/**', '**/*.md']
  workflow_dispatch:
    inputs:
      hardware_tag:
        description: Hardware version to pair with this CLI
        required: true
        default: v0.1.11
      hardware_run_id:
        description: Optional hardware workflow run providing the tested wheel before its first release
        required: false
      reuse_cli_run_id:
        description: Exact prior run supplying the unchanged CLI distribution
        required: false
permissions:
  contents: read
  actions: read
jobs:
  package:
    runs-on: ubuntu-24.04
    env:
      HARDWARE_TAG: ${{ inputs.hardware_tag || 'v0.1.11' }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          python-version: '3.14'
      # Hardware 0.1.11 is required by the CLI but has not been released yet.
      # Development checks use a fixed upstream revision until it is published.
      - name: Check out pinned hardware source for development checks
        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_type == 'branch')
        uses: actions/checkout@v4
        with:
          repository: OrchardLinux/hardware
          ref: ae1457edee7d2e52213e4d979aee02dbbeb90ce0
          path: out/hardware-source
          persist-credentials: false
      - name: Build the pinned hardware wheel for development checks
        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_type == 'branch')
        run: |
          python -m pip install build
          python -m build --wheel --outdir "$PWD/out/hardware" out/hardware-source
      - name: Download pinned released hardware dependency
        if: github.event_name != 'pull_request' && (github.event_name != 'push' || github.ref_type != 'branch') && inputs.hardware_run_id == ''
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          [[ "$HARDWARE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          mkdir -p out/hardware
          gh release download "$HARDWARE_TAG" --repo OrchardLinux/hardware \
            --pattern '*.whl' --pattern SHA256SUMS --dir out/hardware
          (cd out/hardware && sha256sum --check --ignore-missing SHA256SUMS)
      - name: Reuse the already-built hardware wheel during first-release bring-up
        if: inputs.hardware_run_id != ''
        uses: actions/download-artifact@v4
        with:
          name: hardware-packages
          path: out/hardware
          repository: OrchardLinux/hardware
          run-id: ${{ inputs.hardware_run_id }}
          github-token: ${{ github.token }}
      - name: Reuse the unchanged CLI distribution
        if: inputs.reuse_cli_run_id != ''
        uses: actions/download-artifact@v4
        with:
          name: cli-wheel-pair
          path: out/reused
          run-id: ${{ inputs.reuse_cli_run_id }}
          github-token: ${{ github.token }}
      - name: Stage the reused CLI distribution
        if: inputs.reuse_cli_run_id != ''
        run: mkdir -p dist && cp out/reused/orchard_cli-*.whl out/reused/orchard_cli-*.tar.gz dist/
      - name: Build the CLI distribution once
        if: inputs.reuse_cli_run_id == ''
        run: python -m pip install build && python -m build
      - name: Verify the exact wheel pair
        run: |
          python -m pip install dist/*.whl out/hardware/*.whl
          python -m pip check
          python -c 'import os, importlib.metadata as m; assert os.environ["HARDWARE_TAG"] == "v" + m.version("orchard-hardware")'
          mkdir -p out/pair
          cp dist/*.whl dist/*.tar.gz out/hardware/*.whl out/pair/
      - name: Check tag matches package version
        if: github.ref_type == 'tag'
        env:
          TAG: ${{ github.ref_name }}
        run: python -c 'import os, importlib.metadata as m; assert os.environ["TAG"] == "v" + m.version("orchard-cli")'
      - uses: actions/upload-artifact@v4
        with:
          name: cli-wheel-pair
          path: out/pair/*
          if-no-files-found: error
          retention-days: 2
  test:
    needs: package
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        python: ['3.11', '3.14']
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
      - uses: actions/download-artifact@v4
        with:
          name: cli-wheel-pair
          path: out/pair
      - run: python -m pip install out/pair/*.whl && python -m pip check
      - run: python -m unittest discover -s tests -v
  assets:
    if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
    needs: test
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          python-version: '3.14'
      - uses: actions/download-artifact@v4
        with:
          name: cli-wheel-pair
          path: out/pair
      - name: Stage release requirements without rebuilding
        run: |
          python tools/prepare_release.py --cli-wheel out/pair/orchard_cli-*.whl \
            --hardware-wheel out/pair/orchard_hardware-*.whl --output out/stage
          mkdir -p out/publication
          cp out/stage/cli/* out/pair/orchard_cli-*.tar.gz out/publication/
          (cd out/publication && sha256sum ./* > ../SHA256SUMS && mv ../SHA256SUMS .)
      - name: Attest public build
        if: toJSON(github.event.repository.private) == 'false'
        id: attest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-path: out/publication/*
      - name: Include public attestation bundle
        if: toJSON(github.event.repository.private) == 'false'
        env:
          BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
        run: cp "$BUNDLE_PATH" "out/publication/cli-build.sigstore.jsonl"
      - uses: actions/upload-artifact@v4
        with:
          name: cli-release-assets
          path: out/publication/*
          if-no-files-found: error
          retention-days: 2
  draft:
    if: github.ref_type == 'tag'
    needs: assets
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: cli-release-assets
          path: assets
      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          gh release create "$TAG" assets/* --draft --verify-tag --title "$TAG" \
            --notes 'Compatible CLI/hardware wheels and hashed installer requirements. Review before publication.'