release.yml

name: Copilot managed release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      channel:
        description: Update channel (prereleases must use preview)
        type: choice
        options: [stable, preview]
        default: stable

permissions:
  contents: write

# Publication order also determines the signed monotonic feed sequence.
concurrency:
  group: copilot-release-publication
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install release tools
        run: python -m pip install "uv==0.11.8" "cryptography>=42" "packaging>=24"
      - name: Install test dependencies
        run: python -m pip install -e ".[dev,mcp,kb,updater]"
      - name: Verify release source before signing
        run: python -m pytest -q
      - name: Select immutable release and channel
        env:
          REQUESTED_CHANNEL: ${{ inputs.channel }}
        run: |
          python - <<'PY'
          import os, re
          from pathlib import Path
          from packaging.version import Version
          version = re.search(r'^__version__ = "([^"]+)"', Path("src/infermatrix_copilot/__init__.py").read_text(), re.M).group(1)
          parsed = Version(version)
          channel = os.environ.get("REQUESTED_CHANNEL") or ("preview" if parsed.is_prerelease or parsed.is_devrelease else "stable")
          tag = f"v{version}"
          if os.environ["GITHUB_REF_TYPE"] == "tag" and os.environ["GITHUB_REF_NAME"] != tag:
              raise SystemExit("Git tag and package version must match")
          with open(os.environ["GITHUB_ENV"], "a") as env:
              env.write(f"RELEASE_TAG={tag}\nRELEASE_CHANNEL={channel}\n")
          PY
      - name: Build signed immutable bundle
        env:
          COPILOT_RELEASE_SIGNING_KEY: ${{ secrets.COPILOT_RELEASE_SIGNING_KEY }}
          COPILOT_RELEASE_KEY_ID: ${{ vars.COPILOT_RELEASE_KEY_ID }}
        run: |
          python scripts/build_copilot_release.py \
            --commit "$GITHUB_SHA" \
            --channel "$RELEASE_CHANNEL" \
            --sequence "$GITHUB_RUN_NUMBER" \
            --key-id "$COPILOT_RELEASE_KEY_ID" \
            --artifact-base-url "https://github.com/$GITHUB_REPOSITORY/releases/download/$RELEASE_TAG"
      - name: Verify clean installation and startup
        run: |
          uv venv /tmp/copilot-release-smoke
          uv pip install --python /tmp/copilot-release-smoke/bin/python \
            --require-hashes --only-binary :all: -r dist/release/requirements.txt
          uv pip install --python /tmp/copilot-release-smoke/bin/python \
            --no-deps dist/release/*.whl
          python - <<'PY'
          import json, os, subprocess
          from pathlib import Path
          manifest = json.loads(Path("dist/release/release.json").read_text())["manifest"]
          env = os.environ.copy()
          env["COPILOT_RELEASE_ID"] = manifest["release_id"]
          subprocess.run([
              "/tmp/copilot-release-smoke/bin/python", "-m", "infermatrix_copilot.upgrade.health",
              "--expected-version", manifest["version"],
              "--expected-release", manifest["release_id"],
          ], check=True, cwd="/tmp", env=env, timeout=60)
          PY
      - name: Publish immutable release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # No --clobber: publishing the same version twice must fail.
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            echo "Release already exists; publish a new version instead." >&2
            exit 1
          fi
          flags=(--latest)
          if [ "$RELEASE_CHANNEL" = preview ]; then flags=(--prerelease --latest=false); fi
          gh release create "$RELEASE_TAG" dist/release/* \
            --target "$GITHUB_SHA" --title "InferMatrixCopilot $RELEASE_TAG" \
            --generate-notes "${flags[@]}"
      - name: Advance signed channel feed
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          feed_tag="auto-update-$RELEASE_CHANNEL"
          if ! gh release view "$feed_tag" >/dev/null 2>&1; then
            gh release create "$feed_tag" --target "$GITHUB_SHA" \
              --title "Copilot $RELEASE_CHANNEL update feed" \
              --notes "Signed channel pointer for managed installations." \
              --prerelease --latest=false
          fi
          gh release upload "$feed_tag" "dist/release/copilot-$RELEASE_CHANNEL.json" --clobber