release-published.yml

name: Release Published Pipeline

on:
  release:
    types: [published]

permissions:
  contents: write
  id-token: write

concurrency:
  group: release-published
  cancel-in-progress: false

jobs:
  prepare:
    name: Bump versions and align tag
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.ctx.outputs.tag }}
      version: ${{ steps.resolve.outputs.version }}
      sha: ${{ steps.ctx.outputs.sha }}
      build_sha: ${{ steps.build_sha.outputs.sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read context
        id: ctx
        shell: bash
        run: |
          TAG="${{ github.event.release.tag_name }}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          # Resolve current tag SHA (lightweight or annotated)
          if git rev-parse -q --verify "refs/tags/$TAG^{commit}" >/dev/null; then
            SHA=$(git rev-parse "refs/tags/$TAG^{commit}")
          else
            echo "Cannot resolve commit for tag $TAG" >&2
            exit 1
          fi
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
          echo "Tag=$TAG TagSHA=$SHA"

      - name: Resolve version (tag or next)
        id: resolve
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ steps.ctx.outputs.tag }}"
          if [ "$TAG" != "next" ]; then
            # Use the tag's version directly (strip optional leading v)
            VER="${TAG#v}"
            # Accept release and prerelease semver, e.g. 1.2.3 or 1.2.3-beta.1
            if [[ ! "$VER" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
              echo "Release tag '$TAG' is not valid semver (x.y.z or x.y.z-prerelease)." >&2
              exit 1
            fi
            echo "mode=explicit" >> "$GITHUB_OUTPUT"
            echo "version=$VER" >> "$GITHUB_OUTPUT"
            echo "Using explicit release version: $VER"
            exit 0
          fi
          # Compute next version from conventional commits when tag == 'next'
          DEFAULT_BRANCH="${{ github.event.repository.default_branch }}"
          git fetch origin "$DEFAULT_BRANCH" --depth=1000
          LAST_TAG=$(git describe --tags --match 'v[0-9]*' --abbrev=0 2>/dev/null || true)
          if [ -n "$LAST_TAG" ]; then
            RANGE="$LAST_TAG..origin/$DEFAULT_BRANCH"
          else
            RANGE="origin/$DEFAULT_BRANCH"
          fi
          log=$(git log --pretty=%B $RANGE)
          bump="patch"
          if echo "$log" | grep -E '(^|\n)(feat|feat\(.+\))(!)?:' -q; then bump="minor"; fi
          if echo "$log" | grep -E 'BREAKING CHANGE|(^|\n)([^\n!]+)!:' -q; then bump="major"; fi
          if [ -n "$LAST_TAG" ]; then cur=${LAST_TAG#v}; else cur="0.0.0"; fi
          IFS='.' read -r MA MI PA <<< "$cur"
          case "$bump" in
            major) MA=$((MA+1)); MI=0; PA=0 ;;
            minor) MI=$((MI+1)); PA=0 ;;
            patch) PA=$((PA+1)) ;;
          esac
          NEXT="$MA.$MI.$PA"
          echo "mode=bump" >> "$GITHUB_OUTPUT"
          echo "version=$NEXT" >> "$GITHUB_OUTPUT"
          echo "Computed bump: $bump from $cur -> $NEXT"

      - name: Configure bot user
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Update versions in sources
        shell: bash
        run: |
          set -euo pipefail
          VER="${{ steps.resolve.outputs.version }}"
          # Update Python __version__
          # Use ${1}/${2} style backrefs to avoid `\11` ambiguity when VER starts with digits.
          perl -0777 -pe 's/(\n__version__\s*=\s*\")[^"]*(\")/${1}'"${VER}"'${2}/s' -i codex/__init__.py
          echo "Updated versions to ${VER}"

      - name: Commit version bump
        shell: bash
        run: |
          VER="${{ steps.resolve.outputs.version }}"
          if git diff --quiet; then
            echo "No changes to commit (versions already ${VER})."
          else
            git add codex/__init__.py
            git commit -m "chore(release): v${VER} [skip ci]"
            DEFAULT_BRANCH="${{ github.event.repository.default_branch }}"
            git push origin HEAD:"${DEFAULT_BRANCH}"
          fi

      - name: Resolve build SHA
        id: build_sha
        shell: bash
        run: |
          set -euo pipefail
          SHA=$(git rev-parse HEAD)
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
          echo "Using build SHA: $SHA"

      - name: Create new semver tag and repoint release
        if: ${{ steps.resolve.outputs.mode == 'bump' }}
        shell: bash
        env:
          PLACEHOLDER_TAG: ${{ steps.ctx.outputs.tag }}
          VERSION: ${{ steps.resolve.outputs.version }}
          BUILD_SHA: ${{ steps.build_sha.outputs.sha }}
        run: |
          REAL_TAG="v${VERSION}"
          git tag -fa "$REAL_TAG" "$BUILD_SHA" -m "Release $REAL_TAG"
          git push origin "refs/tags/${REAL_TAG}" --force
          # Delete placeholder tag if it exists
          if git rev-parse -q --verify "refs/tags/${PLACEHOLDER_TAG}" >/dev/null; then
            git push origin :"refs/tags/${PLACEHOLDER_TAG}" || true
          fi
          echo "real_tag=$REAL_TAG" >> "$GITHUB_ENV"

      - name: Update GitHub Release to new tag
        if: ${{ steps.resolve.outputs.mode == 'bump' }}
        uses: actions/github-script@v7
        with:
          script: |
            const releaseId = context.payload.release.id;
            const realTag = process.env.real_tag || process.env.REAL_TAG || process.env.real_tag;
            const version = process.env.VERSION || '';
            if (!realTag) core.setFailed('real_tag env missing');
            const { data: rel } = await github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: releaseId,
              tag_name: realTag,
              name: realTag,
              target_commitish: context.payload.repository.default_branch,
            });
            core.info(`Updated release ${rel.id} to tag ${realTag}`);

  build:
    name: Build distributions
    needs: prepare
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.build_sha }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Verify Codex runtime pin is published
        shell: bash
        run: |
          set -euo pipefail
          pin=$(python -c 'import tomllib; deps = tomllib.load(open("pyproject.toml", "rb"))["project"]["dependencies"]; print(next(d.split("==")[1] for d in deps if d.startswith("openai-codex-cli-bin==")))')
          curl -sfo /dev/null "https://pypi.org/pypi/openai-codex-cli-bin/${pin}/json" \
            || { echo "openai-codex-cli-bin==${pin} is not published on PyPI" >&2; exit 1; }

      - name: Build sdist and wheel
        run: uv build

      - name: Verify pure-Python wheel
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          wheels=(dist/*.whl)
          universal=(dist/*-py3-none-any.whl)
          test ${#wheels[@]} -eq 1 && test ${#universal[@]} -eq 1
          ls -al dist

      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/*

  publish:
    name: Publish to PyPI (Trusted Publishing)
    needs: [prepare, build]
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Flatten artifacts into dist/
        shell: bash
        run: |
          shopt -s globstar nullglob
          mkdir -p dist_flat
          for f in dist/**/*.whl dist/**/*.tar.gz; do
            mv "$f" dist_flat/
          done
          rm -rf dist
          mv dist_flat dist

      - name: Verify artifacts present
        shell: bash
        run: |
          shopt -s nullglob
          files=(dist/*.whl dist/*.tar.gz)
          if [ ${#files[@]} -eq 0 ]; then
            echo "No distribution files found in dist/" >&2
            exit 1
          fi
          echo "Found ${#files[@]} files:" && ls -al dist

      - name: Verify PyPI file size limit
        shell: bash
        run: |
          set -euo pipefail
          max_bytes=$((100 * 1024 * 1024))
          for file in dist/*.whl dist/*.tar.gz; do
            size=$(wc -c < "$file")
            if [ "$size" -gt "$max_bytes" ]; then
              echo "$file is $size bytes, exceeding PyPI's 100 MB file limit" >&2
              exit 1
            fi
          done

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          skip-existing: true