release-finalize.yml

name: Finalize Yield release

on:
  workflow_run:
    workflows: ["Publish Yield packages"]
    types: [completed]
  workflow_dispatch:
    inputs:
      version:
        description: Existing stable version without the leading v
        type: string
        required: true

permissions:
  actions: read
  contents: read

concurrency:
  group: finalize-yield-release
  cancel-in-progress: false

jobs:
  resolve:
    if: >-
      github.repository == 'operatorstack/yield' &&
      (github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'workflow_dispatch'))
    runs-on: ubuntu-latest
    outputs:
      finalize: ${{ steps.release.outputs.finalize }}
      tag: ${{ steps.release.outputs.tag }}
      source_sha: ${{ steps.release.outputs.source_sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - id: release
        env:
          REQUESTED_VERSION: ${{ inputs.version }}
          WORKFLOW_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
            [[ "$REQUESTED_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
            tag="v${REQUESTED_VERSION}"
            sha="$(git rev-list -n 1 "$tag")"
          else
            sha="$WORKFLOW_HEAD_SHA"
            tag="$(git tag --points-at "$sha" --list 'v[0-9]*' --sort=-v:refname | head -n 1)"
            if [[ -z "$tag" ]]; then
              echo "finalize=false" >> "$GITHUB_OUTPUT"
              echo "Publisher run has no stable tag; nothing to finalize."
              exit 0
            fi
          fi
          echo "finalize=true" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "source_sha=$sha" >> "$GITHUB_OUTPUT"

  finalize:
    needs: resolve
    if: needs.resolve.outputs.finalize == 'true'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ needs.resolve.outputs.source_sha }}
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
          registry-url: https://registry.npmjs.org
          package-manager-cache: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: false
      - name: Require matching successful publisher receipts
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.resolve.outputs.tag }}
          SOURCE_SHA: ${{ needs.resolve.outputs.source_sha }}
        shell: bash
        run: |
          set -euo pipefail
          version="${TAG#v}"
          package_receipt="packages-${version}-${SOURCE_SHA}"
          crates_receipt="crates-${version}-${SOURCE_SHA}"
          private_receipt="private-mirror-${version}-${SOURCE_SHA}"
          run_id=""
          while read -r candidate; do
            test -n "$candidate" || continue
            artifact_names="$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${candidate}/artifacts?per_page=100" --jq '.artifacts[].name')"
            if grep -Fqx "$package_receipt" <<< "$artifact_names" && \
               grep -Fqx "$crates_receipt" <<< "$artifact_names" && \
               grep -Fqx "$private_receipt" <<< "$artifact_names"; then
              run_id="$candidate"
              break
            fi
          done < <(gh api "/repos/${GITHUB_REPOSITORY}/actions/workflows/npm-publish.yml/runs?status=completed&per_page=100" \
            --jq '.workflow_runs[] | select(.event == "workflow_dispatch" and .conclusion == "success") | .id')
          test -n "$run_id"
          gh run download "$run_id" --repo "$GITHUB_REPOSITORY" \
            --name "$package_receipt" --dir "$RUNNER_TEMP/release-unit"
          gh run download "$run_id" --repo "$GITHUB_REPOSITORY" \
            --name "$crates_receipt" --dir "$RUNNER_TEMP/crates-receipt"
          gh run download "$run_id" --repo "$GITHUB_REPOSITORY" \
            --name "$private_receipt" --dir "$RUNNER_TEMP/private-mirror"
          jq -e \
            --arg version "$version" --arg source_sha "$SOURCE_SHA" \
            '.schema_version == 1 and .version == $version and .source_sha == $source_sha and
             (.targets | length == 6) and
             (.packages.npm | length == 8) and (.packages.python | length == 6) and
             (.packages.go | length == 1) and (.packages.rust | length == 7) and
             ([.states[]] | all(. == "matched")) and
             ([.endpoints.npm, .endpoints.python, .endpoints.go,
               .endpoints.rust_index, .endpoints.rust_download] | all(type == "string"))' \
            "$RUNNER_TEMP/private-mirror/private-mirror.json"
          for package in \
            @operatorstack/yield \
            @operatorstack/create-yield \
            @operatorstack/yield-darwin-amd64 @operatorstack/yield-darwin-arm64 \
            @operatorstack/yield-linux-amd64 @operatorstack/yield-linux-arm64 \
            @operatorstack/yield-windows-amd64 @operatorstack/yield-windows-arm64; do
            test "$(npm view "${package}@${version}" version)" = "$version"
          done
          node packaging/pypi-release.mjs verify \
            --version "$version" \
            --dist "$RUNNER_TEMP/release-unit/pypi" \
            --attempts 3 \
            --delay-ms 10000
          node packaging/crates-release.mjs verify \
            --version "$version" \
            --archives "$RUNNER_TEMP/crates-receipt" \
            --attempts 3 \
            --delay-ms 10000
          node packaging/go-release.mjs \
            --version "$version" \
            --source-sha "$SOURCE_SHA" \
            --attempts 3 \
            --delay-ms 10000
          test "$(git rev-list -n 1 "$TAG")" = "$SOURCE_SHA"
          assets="$RUNNER_TEMP/release-assets"
          mkdir -p "$assets"
          node packaging/package-contract.mjs \
            --version "$version" \
            --source-sha "$SOURCE_SHA" \
            --npm-release "$RUNNER_TEMP/release-unit/npm/npm-release.json" \
            --evaluation evals/results/latest.json \
            --release-url "https://github.com/${GITHUB_REPOSITORY}/releases/tag/${TAG}" \
            --output "$assets"
          gh release upload "$TAG" "$assets/yield-package-contract.json" "$assets/yield-website-promotion.json" --repo "$GITHUB_REPOSITORY" --clobber
          gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --draft=false