release.yml

name: Build release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Package version to publish, for example 0.1.0 or v0.1.0"
        required: true
        type: string

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref_name }}
  cancel-in-progress: false

defaults:
  run:
    shell: bash

jobs:
  release_ref:
    name: Resolve release tag
    runs-on: ubuntu-24.04
    outputs:
      tag: ${{ steps.release.outputs.tag }}
      version: ${{ steps.release.outputs.version }}

    steps:
      - name: Resolve release tag
        id: release
        env:
          RELEASE_INPUT: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref_name }}
        run: |
          release_input="${RELEASE_INPUT}"
          if [[ ! "${release_input}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error title=Invalid release version::Use MAJOR.MINOR.PATCH or vMAJOR.MINOR.PATCH, got '${release_input}'."
            exit 1
          fi

          release_version="${release_input#v}"
          release_tag="v${release_version}"
          echo "tag=${release_tag}" >> "${GITHUB_OUTPUT}"
          echo "version=${release_version}" >> "${GITHUB_OUTPUT}"

  validate:
    name: Validate
    needs: release_ref
    uses: ./.github/workflows/validate.yml
    with:
      ref: ${{ needs.release_ref.outputs.tag }}
      build-package: false

  wheelhouse:
    name: ${{ matrix.platform }}-py311 wheelhouse
    needs: release_ref
    runs-on: ${{ matrix.runs_on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-x86_64
            runs_on: ubuntu-24.04
            asset_basename: src-auth-perms-sync-linux-x64
            target_description: Linux x64
            expected_machine: x86_64
          - platform: macos-arm64
            runs_on: macos-26
            asset_basename: src-auth-perms-sync-macos-arm64
            target_description: macOS arm64
            expected_machine: arm64
    env:
      ASSET_BASENAME: ${{ matrix.asset_basename }}
      PACKAGE_NAME: src-auth-perms-sync
      PYTHON_VERSION: "3.11"
      TARGET_DESCRIPTION: ${{ matrix.target_description }}
      UV_VERSION: "0.11.7"

    steps:
      - name: Check out release ref
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ needs.release_ref.outputs.tag }}

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Cache uv
        uses: actions/cache@v5
        with:
          path: ~/.cache/uv
          key: uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock') }}
          restore-keys: |
            uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-

      - name: Install build tools
        run: python -m pip install "uv==${UV_VERSION}"

      - name: Validate release inputs
        id: release
        env:
          RELEASE_TAG: ${{ needs.release_ref.outputs.tag }}
        run: |
          release_tag="${RELEASE_TAG}"
          if [[ ! "${release_tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error title=Invalid release tag::Use a vMAJOR.MINOR.PATCH tag, got '${release_tag}'."
            exit 1
          fi
          if ! git rev-parse --verify --quiet "refs/tags/${release_tag}" >/dev/null; then
            echo "::error title=Missing tag::Tag '${release_tag}' was not fetched. Create and push it before running this workflow."
            exit 1
          fi
          tag_revision="$(git rev-list -n 1 "${release_tag}")"
          git fetch --no-tags origin main
          main_revision="$(git rev-parse origin/main)"
          if ! git merge-base --is-ancestor "${tag_revision}" "${main_revision}"; then
            echo "::error title=Tag is not on main::Tag '${release_tag}' points at ${tag_revision}, which is not reachable from origin/main."
            echo "::error::Merge the release PR first, then tag the main commit."
            exit 1
          fi

          echo "tag=${release_tag}" >> "${GITHUB_OUTPUT}"
          echo "version=${release_tag#v}" >> "${GITHUB_OUTPUT}"

      - name: Validate runner architecture
        run: |
          actual_machine=$(uv run --frozen python - <<'PY'
          import platform

          print(platform.machine())
          PY
          )
          if [[ "${actual_machine}" != "${{ matrix.expected_machine }}" ]]; then
            echo "::error title=Wrong runner architecture::Expected ${{ matrix.expected_machine }}, got ${actual_machine}."
            exit 1
          fi

      - name: Build wheelhouse tarball
        id: build
        run: |
          release_tag="${{ steps.release.outputs.tag }}"
          release_version="${{ steps.release.outputs.version }}"
          release_dir="build/release/${ASSET_BASENAME}"
          wheelhouse_dir="${release_dir}/wheelhouse"
          dist_dir="build/release/dist"
          requirements_file="build/release/requirements.txt"
          runtime_requirements_file="build/release/runtime-requirements.txt"
          asset_path="build/release/${ASSET_BASENAME}.tar.gz"
          checksum_path="${asset_path}.sha256"

          rm -rf build/release
          mkdir -p "${wheelhouse_dir}" "${dist_dir}"
          shopt -s nullglob

          uv build --wheel --sdist --out-dir "${dist_dir}" --no-create-gitignore
          project_wheels=("${dist_dir}"/*.whl)
          if [[ "${#project_wheels[@]}" -ne 1 ]]; then
            echo "::error title=Unexpected wheel count::Expected one project wheel, found ${#project_wheels[@]}."
            exit 1
          fi
          project_source_distributions=("${dist_dir}"/*.tar.gz)
          if [[ "${#project_source_distributions[@]}" -ne 1 ]]; then
            echo "::error title=Unexpected source distribution count::Expected one project source distribution, found ${#project_source_distributions[@]}."
            exit 1
          fi
          project_wheel_path="${project_wheels[0]}"
          project_wheel_name="$(basename "${project_wheel_path}")"
          project_source_distribution_path="${project_source_distributions[0]}"
          project_source_distribution_name="$(basename "${project_source_distribution_path}")"
          case "${project_wheel_name}" in
            src_auth_perms_sync-"${release_version}"-*.whl)
              ;;
            *)
              echo "::error title=Wheel version mismatch::Expected wheel version ${release_version}, got '${project_wheel_name}'."
              exit 1
              ;;
          esac
          case "${project_source_distribution_name}" in
            src_auth_perms_sync-"${release_version}".tar.gz)
              ;;
            *)
              echo "::error title=Source distribution version mismatch::Expected source distribution version ${release_version}, got '${project_source_distribution_name}'."
              exit 1
              ;;
          esac
          project_wheel_checksum_path="${project_wheel_path}.sha256"
          project_source_distribution_checksum_path="${project_source_distribution_path}.sha256"
          if [[ ! -f "${project_wheel_path}" ]]; then
            echo "::error title=Missing project wheel::Expected ${project_wheel_path} to exist."
            exit 1
          fi

          dependency_metadata_dir="$(mktemp -d)"
          git clone --no-hardlinks . "${dependency_metadata_dir}" >/dev/null
          (
            cd "${dependency_metadata_dir}"
            git checkout --detach "${release_tag}" >/dev/null
            mkdir -p "$(dirname "${requirements_file}")"
            uv export \
              --no-sources \
              --no-dev \
              --no-emit-project \
              --no-hashes \
              --no-header \
              --no-annotate \
              --output-file "${requirements_file}"
          )

          cp "${dependency_metadata_dir}/${requirements_file}" "${requirements_file}"
          cp "${requirements_file}" "${runtime_requirements_file}"
          if grep -Eq '(^-e[[:space:]]|^(\.\.?/)|(^|[[:space:]])file:| @ (\.\.?/|file:))' "${runtime_requirements_file}"; then
            echo "::error title=Unexpected local dependency::Runtime requirements must resolve from PyPI."
            cat "${runtime_requirements_file}"
            exit 1
          fi

          python -m pip wheel \
            --only-binary=:all: \
            --wheel-dir "${wheelhouse_dir}" \
            --requirement "${runtime_requirements_file}"

          cp "${project_wheel_path}" "${wheelhouse_dir}/"
          src_py_lib_wheels=("${wheelhouse_dir}"/src_py_lib-*.whl)
          if [[ "${#src_py_lib_wheels[@]}" -ne 1 ]]; then
            echo "::error title=Unexpected src-py-lib wheel count::Expected one src-py-lib wheel, found ${#src_py_lib_wheels[@]}."
            exit 1
          fi

          cat > "${wheelhouse_dir}/INSTALL.txt" <<EOF
          # src-auth-perms-sync ${release_tag} offline install

          This wheelhouse targets ${TARGET_DESCRIPTION} with Python 3.11.

          tar -xzf ${ASSET_BASENAME}.tar.gz
          python3.11 -m venv .venv
          . .venv/bin/activate
          pip install --no-index --find-links ./wheelhouse ${PACKAGE_NAME}
          src-auth-perms-sync --help

          Connected install from PyPI:

          pip install ${PACKAGE_NAME}

          GitHub release asset install, using the same project wheel uploaded to PyPI:

          pip install "https://github.com/sourcegraph/src-auth-perms-sync/releases/download/${release_tag}/${project_wheel_name}"
          EOF

          (cd "${wheelhouse_dir}" && shasum -a 256 ./*.whl > WHEELS.sha256)

          test -f "${project_wheel_path}"
          test -f "${wheelhouse_dir}"/src_auth_perms_sync-*.whl
          test -f "${wheelhouse_dir}"/src_py_lib-*.whl
          if find "${wheelhouse_dir}" -type f \
            ! -name '*.whl' \
            ! -name INSTALL.txt \
            ! -name WHEELS.sha256 \
            | grep .; then
            echo "::error title=Unexpected wheelhouse content::Wheelhouse contains non-wheel payloads."
            exit 1
          fi

          (
            cd "$(dirname "${project_wheel_path}")"
            shasum -a 256 "${project_wheel_name}" > "$(basename "${project_wheel_checksum_path}")"
            shasum -a 256 "${project_source_distribution_name}" > "$(basename "${project_source_distribution_checksum_path}")"
          )

          tar -C "${release_dir}" -czf "${asset_path}" wheelhouse
          (
            cd "$(dirname "${asset_path}")"
            shasum -a 256 "$(basename "${asset_path}")" > "$(basename "${checksum_path}")"
          )

          {
            echo "asset_path=${asset_path}"
            echo "checksum_path=${checksum_path}"
            echo "project_wheel_path=${project_wheel_path}"
            echo "project_wheel_name=${project_wheel_name}"
            echo "project_source_distribution_path=${project_source_distribution_path}"
            echo "project_source_distribution_name=${project_source_distribution_name}"
            echo "project_wheel_checksum_path=${project_wheel_checksum_path}"
            echo "project_source_distribution_checksum_path=${project_source_distribution_checksum_path}"
          } >> "${GITHUB_OUTPUT}"

      - name: Validate offline install from tarball
        run: |
          validation_dir=$(mktemp -d)
          tar -xzf "${{ steps.build.outputs.asset_path }}" -C "${validation_dir}"

          python3.11 -m venv "${validation_dir}/.venv"
          . "${validation_dir}/.venv/bin/activate"

          PIP_CACHE_DIR="${validation_dir}/pip-cache" \
            GIT_ALLOW_PROTOCOL=file \
            pip install \
            --no-cache-dir \
            --no-index \
            --find-links "${validation_dir}/wheelhouse" \
            "${PACKAGE_NAME}"
          src-auth-perms-sync --help >/tmp/src-auth-perms-sync-release-help.txt

      - name: Write release notes
        id: notes
        run: |
          release_tag="${{ steps.release.outputs.tag }}"
          project_wheel_name="${{ steps.build.outputs.project_wheel_name }}"
          project_source_distribution_name="${{ steps.build.outputs.project_source_distribution_name }}"
          notes_path="build/release/release-notes.md"
          cat > "${notes_path}" <<EOF
          ## Customer install

          ### Restricted/offline Linux x64 + Python 3.11 install

          Download \`src-auth-perms-sync-linux-x64.tar.gz\`, then run:

          \`\`\`sh
          tar -xzf src-auth-perms-sync-linux-x64.tar.gz
          python3.11 -m venv .venv
          . .venv/bin/activate
          pip install --no-index --find-links ./wheelhouse ${PACKAGE_NAME}
          src-auth-perms-sync --help
          \`\`\`

          ### Restricted/offline macOS arm64 + Python 3.11 install

          Download \`src-auth-perms-sync-macos-arm64.tar.gz\`, then run:

          \`\`\`sh
          tar -xzf src-auth-perms-sync-macos-arm64.tar.gz
          python3.11 -m venv .venv
          . .venv/bin/activate
          pip install --no-index --find-links ./wheelhouse ${PACKAGE_NAME}
          src-auth-perms-sync --help
          \`\`\`

          The tarball includes this project, \`src-py-lib\`, and all runtime wheels.
          Verify the tarball downloads with the matching \`.sha256\` files.
          The GitHub release also includes the same \`${project_wheel_name}\` and
          \`${project_source_distribution_name}\` files uploaded to PyPI, plus matching checksums.

          ### Connected PyPI install

          \`\`\`sh
          pip install ${PACKAGE_NAME}
          \`\`\`

          ### GitHub release asset install

          \`\`\`sh
          pip install "https://github.com/sourcegraph/src-auth-perms-sync/releases/download/${release_tag}/${project_wheel_name}"
          \`\`\`
          EOF
          echo "path=${notes_path}" >> "${GITHUB_OUTPUT}"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.ASSET_BASENAME }}
          path: |
            ${{ steps.build.outputs.asset_path }}
            ${{ steps.build.outputs.checksum_path }}

      - name: Upload project distribution release artifact
        if: matrix.platform == 'linux-x86_64'
        uses: actions/upload-artifact@v7
        with:
          name: src-auth-perms-sync-project-distributions
          path: |
            ${{ steps.build.outputs.project_wheel_path }}
            ${{ steps.build.outputs.project_source_distribution_path }}
            ${{ steps.build.outputs.project_wheel_checksum_path }}
            ${{ steps.build.outputs.project_source_distribution_checksum_path }}

      - name: Upload release notes artifact
        if: matrix.platform == 'linux-x86_64'
        uses: actions/upload-artifact@v7
        with:
          name: release-notes
          path: ${{ steps.notes.outputs.path }}

      - name: Upload PyPI artifact
        if: matrix.platform == 'linux-x86_64'
        uses: actions/upload-artifact@v7
        with:
          name: pypi-distributions
          path: |
            ${{ steps.build.outputs.project_wheel_path }}
            ${{ steps.build.outputs.project_source_distribution_path }}

  github-release:
    name: Publish GitHub release assets
    needs: [release_ref, validate, wheelhouse]
    runs-on: ubuntu-24.04
    permissions:
      contents: write

    steps:
      - name: Download wheelhouse artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: src-auth-perms-sync-*
          path: release-assets
          merge-multiple: true

      - name: Download release notes
        uses: actions/download-artifact@v8
        with:
          name: release-notes
          path: release-notes

      - name: Publish GitHub release assets
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ needs.release_ref.outputs.tag }}
        run: |
          release_tag="${RELEASE_TAG}"
          notes_path="$(find release-notes -name release-notes.md -print -quit)"
          mapfile -t release_assets < <(find release-assets -type f | sort)

          if [[ -z "${notes_path}" ]]; then
            echo "::error title=Missing release notes::release-notes.md was not found in release artifact."
            exit 1
          fi
          if [[ "${#release_assets[@]}" -eq 0 ]]; then
            echo "::error title=Missing release assets::No release assets were downloaded."
            exit 1
          fi

          if gh release view "${release_tag}" >/dev/null 2>&1; then
            gh release edit "${release_tag}" --title "${release_tag}" --notes-file "${notes_path}"
            gh release upload "${release_tag}" "${release_assets[@]}" --clobber
          else
            gh release create "${release_tag}" \
              "${release_assets[@]}" \
              --title "${release_tag}" \
              --notes-file "${notes_path}" \
              --verify-tag
          fi

  pypi:
    name: Publish PyPI package
    needs: [validate, wheelhouse]
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/project/src-auth-perms-sync/

    steps:
      - name: Download built distribution
        uses: actions/download-artifact@v8
        with:
          name: pypi-distributions
          path: dist

      - name: Publish PyPI package
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          skip-existing: true