_release.yml

# Reusable release implementation. Not dispatchable on its own — called by
# release.yml (production repos) and test-release.yml (the shared test
# repo), which supply `source_sha`, `dist_repo`, and `record`.
#
# Always: build and `make publish` to <dist_repo> from the selected source SHA.
# Production verifies the reviewed versions and release marker, then tags
# v<version>-<plugin> and creates a GitHub Release on the monorepo without
# changing its branches. After deployment, the distribution repo gets an
# unsuffixed v<version> tag and matching GitHub Release. Test runs stamp
# versions on the runner and skip both sets of release records.

name: _release

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string
      plugin:
        required: true
        type: string
      source_sha:
        required: true
        type: string
      dist_repo:
        required: true
        type: string
      record:
        description: "Tag+release the approved monorepo commit (production) vs. deploy-only (test)."
        required: true
        type: boolean
    secrets:
      BRAINTRUST_BOT_APP_ID:
        description: "braintrust-bot GitHub App id; mints the distribution-repo token."
        required: true
      BRAINTRUST_BOT_PRIVATE_KEY:
        description: "braintrust-bot GitHub App private key."
        required: true
      OPENAI_API_KEY:
        description: "For the post-deploy codex smoke test; skipped if unset."
        required: false

permissions:
  contents: write

concurrency:
  group: release-${{ inputs.plugin }}-${{ inputs.dist_repo }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    outputs:
      version: ${{ steps.vars.outputs.version }}
      dist_owner: ${{ steps.vars.outputs.dist_owner }}
      dist_name: ${{ steps.vars.outputs.dist_name }}
    steps:
      - name: Checkout monorepo
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: ${{ inputs.source_sha }}
          fetch-depth: 0

      - name: Validate inputs
        id: vars
        env:
          VERSION: ${{ inputs.version }}
          PLUGIN: ${{ inputs.plugin }}
          SOURCE_SHA: ${{ inputs.source_sha }}
          DIST_REPO: ${{ inputs.dist_repo }}
          RECORD: ${{ inputs.record }}
          EVENT_NAME: ${{ github.event_name }}
          SOURCE_REPO: ${{ github.repository }}
          PR_MERGED: ${{ github.event.pull_request.merged }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
          PR_MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
        run: |
          set -euo pipefail
          version="${VERSION#v}"
          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::version '$VERSION' is not semver (MAJOR.MINOR.PATCH)."; exit 1
          fi
          case "$PLUGIN" in
            antigravity|claude|codex|cursor|grok) ;;
            *) echo "::error::Unsupported plugin '$PLUGIN'."; exit 1 ;;
          esac
          if ! printf '%s' "$SOURCE_SHA" | grep -Eq '^[0-9a-f]{40}$'; then
            echo "::error::source_sha must be a full lowercase commit SHA."; exit 1
          fi
          if [ "$(git rev-parse HEAD)" != "$SOURCE_SHA" ]; then
            echo "::error::Checkout does not match source_sha."; exit 1
          fi
          tag="v$version-$PLUGIN"
          dist_tag="v$version"
          if [ "$RECORD" = "true" ]; then
            if [ "$EVENT_NAME" != "pull_request" ] ||
               [ "$PR_MERGED" != "true" ] ||
               [ "$PR_HEAD_REPO" != "$SOURCE_REPO" ] ||
               [ "$PR_BASE_REF" != "main" ] ||
               [ "$PR_MERGE_SHA" != "$SOURCE_SHA" ]; then
              echo "::error::Production releases require a merged same-repository PR targeting main at source_sha."; exit 1
            fi
            git fetch --tags --quiet
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "dist_tag=$dist_tag" >> "$GITHUB_OUTPUT"
          if ! printf '%s' "$DIST_REPO" | grep -Eq '^[^/[:space:]]+/[^/[:space:]]+$'; then
            echo "::error::dist_repo '$DIST_REPO' must be owner/name."; exit 1
          fi
          echo "dist_owner=${DIST_REPO%%/*}" >> "$GITHUB_OUTPUT"
          echo "dist_name=${DIST_REPO#*/}" >> "$GITHUB_OUTPUT"
          echo "Releasing $tag -> $DIST_REPO@$dist_tag (record=$RECORD)"

      # Cross-repo work runs as the braintrust-bot GitHub App instead of a
      # long-lived PAT: the token is minted per run, expires in an hour, and is
      # scoped to contents:write on the one distribution repo. Monorepo tags
      # still use the built-in GITHUB_TOKEN. This step fails loudly if
      # braintrust-bot is not installed on <dist_repo>.
      - name: Generate distribution-repo token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.BRAINTRUST_BOT_APP_ID }}
          private-key: ${{ secrets.BRAINTRUST_BOT_PRIVATE_KEY }}
          owner: ${{ steps.vars.outputs.dist_owner }}
          repositories: ${{ steps.vars.outputs.dist_name }}
          permission-contents: write

      - name: Validate distribution release tag
        id: dist-preflight
        if: ${{ inputs.record }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          DIST_REPO: ${{ inputs.dist_repo }}
          DIST_TAG: ${{ steps.vars.outputs.dist_tag }}
        run: |
          set -euo pipefail
          if output="$(gh api "repos/$DIST_REPO/git/ref/tags/$DIST_TAG" 2>&1)"; then
            echo "::error::tag $DIST_TAG already exists in $DIST_REPO."
            exit 1
          elif [[ "$output" == *"Git Repository is empty."* && "$output" == *"HTTP 409"* ]]; then
            echo "::notice::$DIST_REPO is empty; no distribution release tag exists yet."
          elif [[ "$output" != *"HTTP 404"* ]]; then
            printf '%s\n' "$output" >&2
            exit 1
          fi

      - name: Stamp or verify reviewed release versions
        id: stamp
        env:
          PLUGIN: ${{ inputs.plugin }}
          VERSION: ${{ steps.vars.outputs.version }}
          RECORD: ${{ inputs.record }}
        run: |
          set -euo pipefail
          if [ "$PLUGIN" != "antigravity" ]; then
            python3 scripts/set-plugin-version.py "$PLUGIN" "$VERSION"
            if [ "$RECORD" = "true" ]; then
              git diff --exit-code -- "src/plugins/$PLUGIN"
            fi
          fi
          if [ "$RECORD" = "true" ]; then
            if ! printf '%s\n' "$VERSION" | cmp -s - ".github/release-versions/$PLUGIN"; then
              echo "::error::Release marker must contain exactly $VERSION followed by a newline."; exit 1
            fi
          fi

      - name: Build and validate Codex submission from selected source
        if: inputs.plugin == 'codex'
        env:
          RELEASE_VERSION: ${{ steps.vars.outputs.version }}
        run: |
          set -euo pipefail
          make test-codex-packaging codex-submission
          test -f "dist/submissions/braintrust-$RELEASE_VERSION.zip"

      - name: Save Codex submission ZIP
        if: inputs.plugin == 'codex'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: braintrust-mcp-${{ inputs.source_sha }}-${{ steps.vars.outputs.version }}
          path: dist/submissions/braintrust-${{ steps.vars.outputs.version }}.zip*
          if-no-files-found: error
          overwrite: true

      - name: Record monorepo release
        id: source-release
        if: ${{ inputs.record }}
        env:
          GH_TOKEN: ${{ github.token }}
          PLUGIN: ${{ inputs.plugin }}
          TAG: ${{ steps.vars.outputs.tag }}
          SOURCE_SHA: ${{ inputs.source_sha }}
        run: |
          set -euo pipefail
          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
            tag_sha="$(git rev-list -n 1 "refs/tags/$TAG")"
            if [ "$tag_sha" != "$SOURCE_SHA" ]; then
              echo "::error::tag $TAG points to $tag_sha, not the approved source SHA $SOURCE_SHA."
              exit 1
            fi
            echo "Monorepo tag $TAG already points to the selected release commit; resuming."
          else
            git tag "$TAG" "$SOURCE_SHA"
            git push origin "refs/tags/$TAG"
          fi
          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "Monorepo release $TAG already exists; resuming."
          else
            if notes_start_tag="$(git describe --tags --abbrev=0 --match "v[0-9]*-$PLUGIN" "$SOURCE_SHA^" 2>/dev/null)"; then
              echo "Generating $TAG notes from the previous $PLUGIN release $notes_start_tag."
              gh release create "$TAG" \
                --title "$TAG" \
                --generate-notes \
                --notes-start-tag "$notes_start_tag"
            else
              echo "No previous $PLUGIN release tag found; recording this as the initial plugin release."
              gh release create "$TAG" \
                --title "$TAG" \
                --notes "Initial release of the $PLUGIN plugin."
            fi
          fi

      - name: Deploy to distribution repo
        id: publish
        env:
          PUBLISH_TARGETS: "${{ inputs.plugin }}:${{ inputs.dist_repo }}"
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: make publish

      - name: Tag and release distribution repo
        id: dist-release
        if: ${{ inputs.record }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          DIST_REPO: ${{ inputs.dist_repo }}
          DIST_TAG: ${{ steps.vars.outputs.dist_tag }}
        run: |
          set -euo pipefail
          target_sha="$(gh api "repos/$DIST_REPO/git/ref/heads/main" --jq '.object.sha')"
          gh release create "$DIST_TAG" \
            --repo "$DIST_REPO" \
            --target "$target_sha" \
            --title "$DIST_TAG" \
            --generate-notes

  # Separate job: if asset upload fails after release creation, Re-run failed
  # jobs retries attachment without repeating deployment/tag preflight.
  attach-codex-submission:
    needs: release
    if: inputs.plugin == 'codex' && inputs.record
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Download validated submission from release build
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: braintrust-mcp-${{ inputs.source_sha }}-${{ needs.release.outputs.version }}
          path: submission

      - name: Generate distribution-repo token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.BRAINTRUST_BOT_APP_ID }}
          private-key: ${{ secrets.BRAINTRUST_BOT_PRIVATE_KEY }}
          owner: ${{ needs.release.outputs.dist_owner }}
          repositories: ${{ needs.release.outputs.dist_name }}
          permission-contents: write

      - name: Attach MCP-only ZIP to distribution release
        working-directory: submission
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          DIST_REPO: ${{ inputs.dist_repo }}
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          set -euo pipefail
          python3 - "$VERSION" <<'PY'
          import hashlib
          from pathlib import Path
          import sys
          archive = Path(f"braintrust-{sys.argv[1]}.zip")
          expected = f"{hashlib.sha256(archive.read_bytes()).hexdigest()}  {archive.name}\n"
          if archive.with_suffix(".zip.sha256").read_text() != expected:
              sys.exit("Submission ZIP checksum mismatch")
          PY
          gh release upload "v$VERSION" "braintrust-$VERSION.zip" "braintrust-$VERSION.zip.sha256" \
            --repo "$DIST_REPO" --clobber

  # Post-deploy end-to-end smoke test (codex only): install the just-deployed
  # plugin from the marketplace on Linux + both macOS arches and assert a real
  # session traces. It's a verification, not a gate — the deploy already happened.
  smoke:
    needs: release
    if: ${{ inputs.plugin == 'codex' }}
    uses: ./.github/workflows/smoke-codex.yml
    with:
      dist_repo: ${{ inputs.dist_repo }}
    secrets: inherit

  smoke-antigravity:
    needs: release
    if: ${{ inputs.plugin == 'antigravity' }}
    uses: ./.github/workflows/smoke-antigravity.yml
    with:
      dist_repo: ${{ inputs.dist_repo }}

  smoke-cursor:
    needs: release
    if: ${{ inputs.plugin == 'cursor' }}
    uses: ./.github/workflows/smoke-cursor.yml
    with:
      dist_repo: ${{ inputs.dist_repo }}
    secrets: inherit