publish.yml

# THREAT[TM-INF-027]: build the immutable validated release SHA, including recovery from main.
# Verify packages without registry credentials; upload skips compilation.
name: Publish

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing stable release tag to recover from current main (optional on a tag ref)'
        required: false
        default: ''
        type: string

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  validate-tag:
    name: Validate release tag
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.validate.outputs.tag }}
      sha: ${{ steps.source.outputs.sha }}
    steps:
      - name: Validate workflow input
        id: validate
        env:
          EVENT_NAME: ${{ github.event_name }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          if [ "$EVENT_NAME" = "release" ]; then
            TAG="$RELEASE_TAG"
          elif [ -n "$INPUT_TAG" ]; then
            TAG="$INPUT_TAG"
          else
            TAG="${GITHUB_REF#refs/tags/}"
          fi
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: tag must match vMAJOR.MINOR.PATCH." >&2
            exit 1
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.validate.outputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Verify tag source
        id: source
        env:
          RELEASE_TAG: ${{ steps.validate.outputs.tag }}
        run: |
          git fetch --force origin main:refs/remotes/origin/main \
            "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
          TAG_SHA=$(git rev-list -n 1 "$RELEASE_TAG")
          # Validate and build the same immutable tree even during workflow recovery.
          git checkout --detach "$TAG_SHA"
          VERSION="${RELEASE_TAG#v}"
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ "$VERSION" != "$CARGO_VERSION" ]; then
            echo "Error: tag $RELEASE_TAG does not match Cargo.toml $CARGO_VERSION" >&2
            exit 1
          fi
          MAIN_SHA=$(git rev-parse origin/main)
          if { [ "$GITHUB_REF" != "refs/tags/$RELEASE_TAG" ] || [ "$GITHUB_SHA" != "$TAG_SHA" ]; } &&
             { [ "$GITHUB_REF" != "refs/heads/main" ] || [ "$GITHUB_SHA" != "$MAIN_SHA" ]; }; then
            echo "Error: workflow ref must be $RELEASE_TAG or current main" >&2
            exit 1
          fi
          if ! git merge-base --is-ancestor "$TAG_SHA" origin/main; then
            echo "Error: $RELEASE_TAG is not reachable from origin/main" >&2
            exit 1
          fi
          echo "sha=$TAG_SHA" >> "$GITHUB_OUTPUT"

  # Publish bashkit-cpython-wasm (optional dependency of bashkit's `cpython`
  # feature; must exist on crates.io before bashkit can be verified)
  publish-bashkit-cpython-wasm:
    name: Publish bashkit-cpython-wasm
    needs: validate-tag
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.validate-tag.outputs.sha }}
          persist-credentials: false

      - name: Verify publish source is on main
        run: |
          git fetch --no-tags origin main:refs/remotes/origin/main
          SOURCE_SHA=$(git rev-parse HEAD)
          if ! git merge-base --is-ancestor "$SOURCE_SHA" origin/main; then
            echo "Error: publish source $SOURCE_SHA is not reachable from origin/main"
            exit 1
          fi

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0

      - name: Verify bashkit-cpython-wasm package without credentials
        run: |
          cargo publish --dry-run -p bashkit-cpython-wasm
          # Cargo 1.95 publish dry-runs retain a temporary archive. Finalize
          # the verified package at Cargo's package output before measuring it.
          cargo package -p bashkit-cpython-wasm
          # crates.io rejects crates over 10 MiB; the embedded snapshot and
          # stdlib keep this one close to that limit.
          crate_version=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          archive="${CARGO_TARGET_DIR:-target}/package/bashkit-cpython-wasm-${crate_version}.crate"
          size=$(wc -c < "$archive")
          echo "crate size: $size bytes"
          if [ "$size" -ge 10485760 ]; then
            echo "Error: bashkit-cpython-wasm crate exceeds the crates.io 10 MiB limit"
            exit 1
          fi

      - name: Publish bashkit-cpython-wasm to crates.io
        run: cargo publish --no-verify -p bashkit-cpython-wasm
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  # Publish bashkit (core library) to crates.io
  publish-bashkit:
    name: Publish bashkit
    runs-on: ubuntu-latest
    needs: [validate-tag, publish-bashkit-cpython-wasm]
    environment: release
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.validate-tag.outputs.sha }}
          persist-credentials: false

      - name: Verify publish source is on main
        run: |
          git fetch --no-tags origin main:refs/remotes/origin/main
          SOURCE_SHA=$(git rev-parse HEAD)
          if ! git merge-base --is-ancestor "$SOURCE_SHA" origin/main; then
            echo "Error: publish source $SOURCE_SHA is not reachable from origin/main"
            exit 1
          fi
          echo "Publish source verified on origin/main: $SOURCE_SHA"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0

      - name: Verify version matches tag
        env:
          RELEASE_TAG: ${{ needs.validate-tag.outputs.tag }}
        run: |
          TAG_VERSION="${RELEASE_TAG#v}"
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "Error: Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
            exit 1
          fi
          echo "Version verified: $TAG_VERSION"

      - name: Wait for crates.io index update
        run: sleep 30

      - name: Verify bashkit package without credentials
        run: cargo publish --dry-run -p bashkit

      - name: Publish bashkit to crates.io
        run: cargo publish --no-verify -p bashkit
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  # Publish bashkit-cli (depends on bashkit)
  publish-bashkit-cli:
    name: Publish bashkit-cli
    runs-on: ubuntu-latest
    needs: [validate-tag, publish-bashkit]
    environment: release
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.validate-tag.outputs.sha }}
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0

      - name: Wait for crates.io index update
        run: sleep 30

      - name: Verify bashkit-cli package without credentials
        run: cargo publish --dry-run -p bashkit-cli

      - name: Publish bashkit-cli to crates.io
        run: cargo publish --no-verify -p bashkit-cli
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  # Publish bashkit-scripted-tool (depends on bashkit)
  publish-bashkit-scripted-tool:
    name: Publish bashkit-scripted-tool
    runs-on: ubuntu-latest
    needs: [validate-tag, publish-bashkit]
    environment: release
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.validate-tag.outputs.sha }}
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0

      - name: Wait for crates.io index update
        run: sleep 30

      - name: Verify bashkit-scripted-tool package without credentials
        run: cargo publish --dry-run -p bashkit-scripted-tool

      - name: Publish bashkit-scripted-tool to crates.io
        run: cargo publish --no-verify -p bashkit-scripted-tool
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  # ============================================================================
  # Verify all packages were published successfully
  # ============================================================================
  verify-publish:
    name: Verify published versions
    runs-on: ubuntu-latest
    needs: [validate-tag, publish-bashkit-cpython-wasm, publish-bashkit, publish-bashkit-cli, publish-bashkit-scripted-tool]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Verification code belongs to the trusted workflow revision.
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: Wait for crates.io propagation
        run: sleep 60

      - name: Verify crates.io versions
        env:
          RELEASE_TAG: ${{ needs.validate-tag.outputs.tag }}
        run: |
          EXPECTED="${RELEASE_TAG#v}"
          echo "Expected version: $EXPECTED"
          python3 scripts/verify_crates_publish.py --expected "$EXPECTED" bashkit-cpython-wasm bashkit bashkit-cli bashkit-scripted-tool