release.yml

# Tag-triggered PRERELEASE workflow for fable-session (e.g. tag
# v0.3.0-beta.1 for distribution version 0.3.0b1). Deliberately
# owner/URL-free and pinned to verified tag SHAs.
#
# What it does: re-run the local release gates on the exact tagged commit,
# build the wheel and sdist, generate SHA256SUMS, attest build provenance
# with GitHub artifact attestation (no maintainer key material exists, and
# none is invented), and create a GitHub PRERELEASE carrying the artifacts.
#
# Out of scope by decision: any package-index publication — that is a
# later, explicit step, not part of this prerelease.
name: prerelease

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  prerelease:
    runs-on: ubuntu-latest
    steps:
      # checkout v4 (pinned tag SHA); full depth for the history scan.
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      # setup-python v5 (pinned tag SHA).
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      # Fail-closed consistency gate BEFORE anything else: the checked-out
      # package version admits exactly one release tag (0.3.0b1 only from
      # v0.3.0-beta.1); any other tag name, or an unmapped version shape,
      # refuses the whole run.
      - name: Tag / package-version consistency gate (fail closed)
        run: python3 tests/release_tag_check.py --tag "${GITHUB_REF_NAME}"

      - name: Release gates on the exact tagged commit
        run: |
          python3 -m compileall -q src tests
          python3 -m pip install --quiet PyYAML==6.0.2
          python3 -m unittest discover -s tests -v
          python3 tests/public_readiness_check.py
          python3 tests/full_history_readiness_check.py
          git diff --check "$(git hash-object -t tree /dev/null)" HEAD

      - name: Pre-seed the offline-smoke wheelhouse (network allowed HERE only)
        run: |
          mkdir -p /tmp/fable-wheelhouse
          python3 -m pip download --quiet --dest /tmp/fable-wheelhouse --no-deps "setuptools==83.0.0"

      - name: Offline install smoke (no index during the install phase)
        run: FABLE_SESSION_WHEELHOUSE=/tmp/fable-wheelhouse python3 tests/offline_install_smoke.py

      # Pinned, tested build toolchain (the seed above satisfies the
      # pyproject `setuptools>=77` floor); --no-isolation keeps the build
      # on exactly these versions instead of a floating isolated env.
      - name: Build the wheel and sdist (pinned toolchain)
        run: |
          python3 -m pip install --quiet build==1.5.1 setuptools==83.0.0 wheel==0.47.0
          python3 -m build --no-isolation

      - name: Smoke the built wheel
        run: |
          python3 -m pip install --quiet dist/*.whl
          fable-session --version

      - name: Generate SHA256SUMS
        run: |
          cd dist
          sha256sum * > SHA256SUMS
          cat SHA256SUMS

      # upload-artifact v4 (pinned tag SHA): CI-side copy of the artifacts.
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: dist
          path: dist/

      # attest-build-provenance v3 (pinned tag SHA): GitHub artifact
      # attestation instead of a maintainer key that does not exist.
      - uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3
        with:
          subject-path: |
            dist/*.whl
            dist/*.tar.gz

      # softprops/action-gh-release v2 (pinned tag SHA): always a
      # PRERELEASE — flipping a release to "latest" is a separate human
      # decision, never automated here.
      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          prerelease: true
          files: |
            dist/*.whl
            dist/*.tar.gz
            dist/SHA256SUMS