Feat/release skill sites

.github/workflows/release.yml

@@ -0,0 +1,253 @@
+name: Preview release
+
+on:
+  pull_request:
+  push:
+    branches:
+      - feat/release-skill-sites
+    tags:
+      - v0.2.0-preview.4
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: preview-release-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  RELEASE_VERSION: 0.2.0-preview.4
+
+jobs:
+  native-archive:
+    name: ${{ matrix.target }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            target: aarch64-apple-darwin
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install pinned Rust toolchain
+        run: >-
+          rustup toolchain install 1.97.1 --profile minimal
+          --component rustfmt --component clippy
+          --target "${{ matrix.target }}"
+
+      - name: Check formatting
+        run: cargo +1.97.1 fmt --check
+
+      - name: Lint all targets and features
+        run: cargo +1.97.1 clippy --locked --all-targets --all-features -- -D warnings
+
+      - name: Test all targets and features
+        run: cargo +1.97.1 test --locked --all-targets --all-features
+
+      - name: Build release binary
+        run: cargo +1.97.1 build --locked --release --target "${{ matrix.target }}"
+
+      - name: Verify binary version
+        run: >-
+          test "$(target/${{ matrix.target }}/release/agenet --version)"
+          = "agenet ${RELEASE_VERSION}"
+
+      - name: Package deterministic archive
+        run: |
+          scripts/package-release.sh \
+            --binary "target/${{ matrix.target }}/release/agenet" \
+            --target "${{ matrix.target }}" \
+            --version "${RELEASE_VERSION}" \
+            --commit "${GITHUB_SHA}" \
+            --output-dir dist
+
+      - name: Verify release archive
+        run: |
+          scripts/check-release-archive.sh \
+            --archive "dist/agenet-v${RELEASE_VERSION}-${{ matrix.target }}.tar.gz" \
+            --target "${{ matrix.target }}" \
+            --version "${RELEASE_VERSION}" \
+            --commit "${GITHUB_SHA}"
+
+      - name: Upload immutable archive
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-${{ matrix.target }}
+          path: dist/agenet-v${{ env.RELEASE_VERSION }}-${{ matrix.target }}.tar.gz
+          archive: false
+          if-no-files-found: error
+          retention-days: 7
+
+  publish-prerelease:
+    name: Verify and publish immutable prerelease
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: native-archive
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Check out exact tag source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal
+
+      - name: Download all four native archives
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: agenet-v${{ env.RELEASE_VERSION }}-*.tar.gz
+          path: dist
+          merge-multiple: true
+
+      - name: Require the exact archive set
+        run: |
+          find dist -mindepth 1 -maxdepth 1 -type f -printf '%f\n' \
+            | LC_ALL=C sort > actual-archives.txt
+          cat > expected-archives.txt <<EOF
+          agenet-v${RELEASE_VERSION}-aarch64-apple-darwin.tar.gz
+          agenet-v${RELEASE_VERSION}-aarch64-unknown-linux-gnu.tar.gz
+          agenet-v${RELEASE_VERSION}-x86_64-apple-darwin.tar.gz
+          agenet-v${RELEASE_VERSION}-x86_64-unknown-linux-gnu.tar.gz
+          EOF
+          diff -u expected-archives.txt actual-archives.txt
+
+      - name: Build release metadata tools
+        run: >-
+          cargo +1.97.1 build --locked
+          --bin agenet-release-manifest
+          --bin agenet-render-installer
+
+      - name: Generate manifest and fixed installer
+        run: |
+          commit_epoch=$(git show -s --format=%ct "${GITHUB_SHA}")
+          published_at=$(date -u -d "@${commit_epoch}" +%Y-%m-%dT%H:%M:%SZ)
+          target/debug/agenet-release-manifest \
+            --version "${RELEASE_VERSION}" \
+            --commit "${GITHUB_SHA}" \
+            --published-at "${published_at}" \
+            --macos-arm64 "dist/agenet-v${RELEASE_VERSION}-aarch64-apple-darwin.tar.gz" \
+            --macos-x86-64 "dist/agenet-v${RELEASE_VERSION}-x86_64-apple-darwin.tar.gz" \
+            --linux-arm64 "dist/agenet-v${RELEASE_VERSION}-aarch64-unknown-linux-gnu.tar.gz" \
+            --linux-x86-64 "dist/agenet-v${RELEASE_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
+            --output dist/release-manifest-v1.json
+          target/debug/agenet-render-installer \
+            --manifest dist/release-manifest-v1.json \
+            --output dist/install.sh
+          chmod 0755 dist/install.sh
+
+      - name: Verify the release core offline
+        run: |
+          find dist -mindepth 1 -maxdepth 1 -type f \
+            ! -name SHA256SUMS -printf '%f\n' \
+            | LC_ALL=C sort \
+            | while IFS= read -r file; do sha256sum "dist/${file}"; done \
+            | sed 's#  dist/#  #' > SHA256SUMS.core
+          scripts/verify-release.sh \
+            --manifest dist/release-manifest-v1.json \
+            --installer dist/install.sh \
+            --checksums SHA256SUMS.core \
+            --archives-dir dist \
+            --version "${RELEASE_VERSION}" \
+            --commit "${GITHUB_SHA}" \
+            --renderer target/debug/agenet-render-installer
+
+      - name: Add guides, Skill, and release notes
+        run: |
+          cp docs/bootstrap/agent-node-setup.md dist/agent-bootstrap.md
+          cp docs/bootstrap/agent-node-setup.en.md dist/agent-bootstrap.en.md
+          scripts/package-bootstrap-skill.sh \
+            --version "${RELEASE_VERSION}" \
+            --output "dist/agenet-node-bootstrap-v${RELEASE_VERSION}.tar.gz"
+          cp "docs/releases/v${RELEASE_VERSION}.md" \
+            "dist/release-notes-v${RELEASE_VERSION}.md"
+          find dist -mindepth 1 -maxdepth 1 -type f \
+            ! -name SHA256SUMS -printf '%f\n' \
+            | LC_ALL=C sort \
+            | while IFS= read -r file; do sha256sum "dist/${file}"; done \
+            | sed 's#  dist/#  #' > dist/SHA256SUMS
+          scripts/verify-release.sh \
+            --manifest dist/release-manifest-v1.json \
+            --installer dist/install.sh \
+            --checksums dist/SHA256SUMS \
+            --archives-dir dist \
+            --version "${RELEASE_VERSION}" \
+            --commit "${GITHUB_SHA}" \
+            --renderer target/debug/agenet-render-installer \
+            --complete \
+            --release-dir dist
+
+      - name: Attest macOS arm64 archive
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-path: dist/agenet-v${{ env.RELEASE_VERSION }}-aarch64-apple-darwin.tar.gz
+
+      - name: Attest macOS x86_64 archive
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-path: dist/agenet-v${{ env.RELEASE_VERSION }}-x86_64-apple-darwin.tar.gz
+
+      - name: Attest Linux arm64 archive
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-path: dist/agenet-v${{ env.RELEASE_VERSION }}-aarch64-unknown-linux-gnu.tar.gz
+
+      - name: Attest Linux x86_64 archive
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-path: dist/agenet-v${{ env.RELEASE_VERSION }}-x86_64-unknown-linux-gnu.tar.gz
+
+      - name: Publish once or prove exact idempotency
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          if gh release view "${tag}" >/dev/null 2>&1; then
+            comparison=$(mktemp -d)
+            trap 'rm -rf -- "${comparison}"' EXIT
+            gh release download "${tag}" --dir "${comparison}"
+            find dist -mindepth 1 -maxdepth 1 -type f -printf '%f\n' \
+              | LC_ALL=C sort > expected-assets.txt
+            find "${comparison}" -mindepth 1 -maxdepth 1 -type f -printf '%f\n' \
+              | LC_ALL=C sort > existing-assets.txt
+            diff -u expected-assets.txt existing-assets.txt
+            while IFS= read -r asset; do
+              cmp "dist/${asset}" "${comparison}/${asset}"
+            done < expected-assets.txt
+            release_state=$(gh release view "${tag}" \
+              --json isPrerelease,isDraft \
+              --jq '"\(.isPrerelease) \(.isDraft)"')
+            test "${release_state}" = 'true false'
+          else
+            gh release create "${tag}" dist/* \
+              --prerelease \
+              --verify-tag \
+              --title "AgenNet ${tag} Developer Preview" \
+              --notes-file "docs/releases/v${RELEASE_VERSION}.md"
+          fi
+
+      - name: Upload complete verified release bundle
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: preview-release-${{ env.RELEASE_VERSION }}
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 30

.gitignore

@@ -6,6 +6,6 @@
 target/
 *.key
 *.pem
+*.token
 *.log
 *.jsonl
-