release.yml

name: Release

# Tag-triggered distribution. On a `vX.Y.Z` tag this publishes the user-facing
# install channels; docker.yml (gateway image) and release-airgap.yml (offline
# bundle) fire on the same tag, so one tag fans out to every channel.
on:
  push:
    tags: ["v*.*.*"]
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Build artifacts but skip publishing"
        type: boolean
        default: true

permissions:
  contents: read

env:
  REGISTRY: ghcr.io

jobs:
  pypi:
    name: PyPI (rag-platform + SDK)
    runs-on: ubuntu-22.04
    permissions:
      id-token: write # PyPI Trusted Publishing (OIDC) — no API token
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install build
      - name: Build meta-distribution + SDK
        run: |
          python -m build --outdir dist-pypi packaging/rag-platform
          python -m build --outdir dist-pypi sdks/python
      - name: Publish to PyPI
        if: ${{ github.event_name == 'push' || !inputs.dry_run }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist-pypi

  npm:
    name: npm (@agentcontextos/sdk)
    runs-on: ubuntu-22.04
    permissions:
      id-token: write # npm provenance
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: "https://registry.npmjs.org"
      - working-directory: sdks/typescript
        run: |
          npm ci
          npm run build
      - name: Publish (with provenance)
        if: ${{ github.event_name == 'push' || !inputs.dry_run }}
        working-directory: sdks/typescript
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  admin-ui-image:
    name: Container — admin-ui (sign + SBOM)
    runs-on: ubuntu-22.04
    permissions:
      packages: write
      id-token: write # cosign keyless OIDC
    env:
      IMAGE_NAME: ${{ github.repository_owner }}/agentcontextos/admin-ui
    steps:
      - uses: actions/checkout@v6
      - run: echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-
      - id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: apps/admin-ui/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - uses: sigstore/cosign-installer@v3
      - name: Sign (keyless)
        run: cosign sign --yes "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}"
      - name: SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
          artifact-name: admin-ui.spdx.json
          format: spdx-json

  helm-oci:
    name: Helm chart → OCI (sign)
    runs-on: ubuntu-22.04
    permissions:
      packages: write
      id-token: write # cosign keyless OIDC
    steps:
      - uses: actions/checkout@v6
      - uses: azure/setup-helm@v4
      - uses: sigstore/cosign-installer@v3
      - name: Package + push + sign
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login "${REGISTRY}" -u "${{ github.actor }}" --password-stdin
          repo="oci://${REGISTRY}/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/agentcontextos/charts"
          helm package infra/helm/rag-platform --destination .
          chart="$(ls rag-platform-*.tgz)"
          out="$(helm push "${chart}" "${repo}" 2>&1)"; echo "${out}"
          digest="$(echo "${out}" | awk '/Digest:/ {print $2}')"
          name="$(helm show chart infra/helm/rag-platform | awk '/^name:/{print $2}')"
          cosign sign --yes "${REGISTRY}/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/agentcontextos/charts/${name}@${digest}"