release.yml

name: Release

# When a v* tag is pushed:
#   1. build the sdist + wheel, sign each artifact with Sigstore (keyless — using
#      the workflow's OIDC identity, no long-lived key), and publish a GitHub
#      Release with the artifacts and their .sigstore bundles attached;
#   2. publish the same sdist + wheel to PyPI via Trusted Publishing (OIDC — no
#      API token to store or leak), so `pip install coderag` just works.
# Signed release artifacts are what OpenSSF Scorecard's Signed-Releases check
# verifies; the bundles let anyone run `sigstore verify` to confirm provenance.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

# Least privilege at the top level; each job escalates to exactly what it needs.
permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Build, sign & publish (GitHub)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write   # create the GitHub Release and upload assets
      id-token: write   # OIDC identity for keyless Sigstore signing
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Set up uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: "3.12"

      - name: Build sdist + wheel
        run: uv build

      - name: Validate package metadata (twine check)
        run: uvx twine check dist/*

      # Keyless Sigstore signing: one .sigstore bundle per artifact, authenticated
      # by the workflow's OIDC identity (no secret key to manage or leak).
      - name: Sign artifacts with Sigstore
        run: |
          uv pip install --system sigstore
          for artifact in dist/*.tar.gz dist/*.whl; do
            python -m sigstore sign --bundle "${artifact}.sigstore" "${artifact}"
          done

      - name: Publish GitHub Release with signed artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            dist/*.tar.gz dist/*.whl dist/*.sigstore \
            --title "${GITHUB_REF_NAME}" \
            --generate-notes \
            --verify-tag

  pypi-publish:
    name: Publish to PyPI (Trusted Publishing)
    needs: release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # The `pypi` environment is where the Trusted Publisher is configured on PyPI
    # (and where you can add a manual approval gate if you want one).
    environment:
      name: pypi
      url: https://pypi.org/p/coderag
    permissions:
      id-token: write   # OIDC identity for PyPI Trusted Publishing (no token/secret)
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Set up uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          python-version: "3.12"

      # Rebuild from the same tagged source the GitHub Release was cut from, so the
      # uploaded sdist/wheel match the signed artifacts above.
      - name: Build sdist + wheel
        run: uv build

      - name: Validate package metadata (twine check)
        run: uvx twine check dist/*

      # Trusted Publishing: PyPI mints a short-lived token from the workflow's OIDC
      # identity — nothing to store in repo secrets.
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0