release.yml

name: release

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # The patch component of __version__ is the number of the PR that introduces
  # the change (0.2.<PR>), so it cannot be known until the PR is opened. This
  # job is what stops the scheme silently rotting.
  version:
    name: version matches the PR number
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check 0.2.<PR>
        env:
          PR: ${{ github.event.pull_request.number }}
        run: |
          have=$(python3 -c "import re;print(re.search(r'__version__ = \"([^\"]+)\"', open('glean_code/__init__.py').read()).group(1))")
          want="0.2.$PR"
          if [ "$have" != "$want" ]; then
            echo "::error::__version__ is $have but this is PR #$PR, so it must be $want"
            echo "Fix it with:  python3 tools/set_version.py $PR"
            exit 1
          fi
          echo "__version__ = $have, matching PR #$PR"

  test:
    name: python ${{ matrix.python }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # 3.9 is the documented floor (ships with macOS); 3.13 is the ceiling we claim.
        os: [ubuntu-latest]
        python: ["3.9", "3.10", "3.11", "3.12", "3.13"]
        include:
          # The installer's macOS app-bundle path only really exercises on macOS.
          - os: macos-latest
            python: "3.12"

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}

      - name: Confirm zero runtime dependencies
        run: |
          test ! -f pyproject.toml && test ! -f setup.py && test ! -f requirements.txt \
            && echo "no dependency manifests, as intended"

      - name: Run the test suite
        env:
          PYTHONPYCACHEPREFIX: ${{ runner.temp }}/pycache
        run: python -m unittest discover tests/ -v

      - name: Build and smoke-test the installer artifact
        env:
          PYTHONPYCACHEPREFIX: ${{ runner.temp }}/pycache
        run: |
          python install.py --cli-only --prefix "$RUNNER_TEMP/bin"
          echo '/status' | "$RUNNER_TEMP/bin/glean" | grep -q "mode" \
            && echo "installed CLI responds"

      - name: Confirm the build left no artifacts in the tree
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "::error::working tree dirty after build"; git status --short; exit 1
          fi

      # One leg only — actions/upload-artifact@v4 rejects a second upload under
      # the same name, and the zipapp is identical across the matrix anyway.
      - name: Build the downloadable zipapp
        if: matrix.os == 'ubuntu-latest' && matrix.python == '3.13'
        env:
          PYTHONPYCACHEPREFIX: ${{ runner.temp }}/pycache
        run: |
          python -c "
          import pathlib, install
          out = install.build_zipapp(pathlib.Path('$RUNNER_TEMP/glean-code.pyz'))
          print(f'built {out} ({out.stat().st_size / 1024:.0f} KB)')
          "

      - name: Upload glean-code.pyz
        if: matrix.os == 'ubuntu-latest' && matrix.python == '3.13'
        uses: actions/upload-artifact@v4
        with:
          name: glean-code-pyz
          path: ${{ runner.temp }}/glean-code.pyz
          if-no-files-found: error

  # A tag is the release marker; __version__ is the per-PR build identity. This
  # job turns `git push origin vX.Y.Z` into a GitHub Release with the zipapp
  # attached, so there is something to download that is not a CI artifact
  # expiring in 90 days.
  publish:
    name: publish ${{ github.ref_name }}
    if: startsWith(github.ref, 'refs/tags/v')
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write        # required to create a release
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Refuse to publish a tag that disagrees with __version__
        env:
          TAG: ${{ github.ref_name }}
        run: |
          have=$(python3 -c "import re;print(re.search(r'__version__ = \"([^\"]+)\"', open('glean_code/__init__.py').read()).group(1))")
          want="${TAG#v}"
          if [ "$have" != "$want" ]; then
            echo "::error::tag $TAG does not match __version__ $have"
            exit 1
          fi
          echo "tag $TAG matches __version__ $have"

      - name: Build the zipapp
        env:
          PYTHONPYCACHEPREFIX: ${{ runner.temp }}/pycache
        run: |
          python -c "
          import pathlib, install
          out = install.build_zipapp(pathlib.Path('glean-code.pyz'))
          print(f'built {out} ({out.stat().st_size / 1024:.0f} KB)')
          "

      - name: Create the release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          gh release create "$TAG" glean-code.pyz \
            --title "Glean Code $TAG" \
            --generate-notes \
            --verify-tag