publish.yml

name: Build and publish

on:
  workflow_call:
    inputs:
      ref:
        description: "Release tag to build and publish (for example v4.2.1)"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      ref:
        description: "Release tag to build and publish (for example v4.2.1)"
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: publish-${{ inputs.ref }}
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 75
    permissions:
      contents: read
      checks: read
    outputs:
      release_tag: ${{ steps.release_ref.outputs.tag }}

    steps:
      - name: Resolve release tag input
        id: release_ref
        shell: bash
        env:
          RELEASE_REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          ref="${RELEASE_REF}"
          case "$ref" in
            refs/tags/v[0-9]*)
              tag="${ref#refs/tags/}"
              ;;
            v[0-9]*)
              tag="$ref"
              ;;
            *)
              echo "Expected a release tag like v4.2.1, got: $ref" >&2
              exit 1
              ;;
          esac
          semver_re='^v(0|[1-9][0-9]*)[.](0|[1-9][0-9]*)[.](0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)([.](0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*))?([+]([0-9A-Za-z-]+([.][0-9A-Za-z-]+)*))?$'
          if [[ ! "$tag" =~ $semver_re ]]; then
            echo "Expected a semantic release tag like v4.2.1, got: $tag" >&2
            exit 1
          fi
          echo "tag=$tag" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/tags/${{ steps.release_ref.outputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Verify release provenance
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ steps.release_ref.outputs.tag }}
        run: |
          set -euo pipefail
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
          git fetch --force origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"

          tag_commit="$(git rev-list -n 1 "refs/tags/${RELEASE_TAG}")"
          checkout_commit="$(git rev-parse HEAD)"
          if [[ "$tag_commit" != "$checkout_commit" ]]; then
            echo "Checked-out commit does not match ${RELEASE_TAG}" >&2
            exit 1
          fi

          if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
            echo "${RELEASE_TAG} does not point to a commit reachable from origin/main" >&2
            exit 1
          fi

          gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null

          version="${RELEASE_TAG#v}"
          python - "$version" <<'PY'
          import json
          import pathlib
          import sys
          import tomllib

          expected = sys.argv[1]
          pyproject = tomllib.loads(pathlib.Path("pyproject.toml").read_text(encoding="utf-8"))
          actual = pyproject["project"]["version"]
          if actual != expected:
              raise SystemExit(f"pyproject version {actual!r} does not match release tag {expected!r}")

          manifest = json.loads(
              pathlib.Path("tools/release/.release-please-manifest.json").read_text(encoding="utf-8")
          )
          manifest_version = manifest.get(".")
          if manifest_version != expected:
              raise SystemExit(
                  f"release-please manifest version {manifest_version!r} does not match release tag {expected!r}"
              )
          PY

      - name: Verify required release checks
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          REQUIRED_RELEASE_CHECKS: '["test", "analyzer-speed", "corpus", "quality-benchmark", "scan"]'
        run: |
          set -euo pipefail
          release_sha="$(git rev-parse HEAD)"

          # The push test suite currently takes over 25 minutes. A manual
          # dispatch may start before it finishes, so allow a full hour.
          for attempt in {1..180}; do
            gh api --paginate --slurp \
              -H "Accept: application/vnd.github+json" \
              "/repos/${GITHUB_REPOSITORY}/commits/${release_sha}/check-runs?per_page=100&filter=all" |
              jq '{check_runs: [.[].check_runs[]]}' > /tmp/skylos-release-checks.json

            set +e
            python - "$REQUIRED_RELEASE_CHECKS" /tmp/skylos-release-checks.json <<'PY'
          import json
          import sys

          required = json.loads(sys.argv[1])
          data_path = sys.argv[2]
          data = json.load(open(data_path, encoding="utf-8"))
          runs = data.get("check_runs", [])

          failures = []
          pending = []
          for name in required:
              matches = [
                  run for run in runs
                  if run.get("name") == name
                  and (run.get("app") or {}).get("slug") == "github-actions"
              ]
              if not matches:
                  pending.append(f"{name}: missing")
                  continue
              latest = max(matches, key=lambda run: run["id"])
              if latest.get("status") != "completed":
                  pending.append(f"{name}: {latest.get('status') or 'pending'}")
                  continue
              if latest.get("conclusion") != "success":
                  failures.append(f"{name}: {latest.get('conclusion') or 'unknown'}")

          if failures:
              print("Required release checks failed:")
              for item in failures:
                  print(f"- {item}")
              sys.exit(1)
          if pending:
              print("Required release checks are not complete yet:")
              for item in pending:
                  print(f"- {item}")
              sys.exit(2)

          print("Required release checks passed.")
          PY
            status=$?
            set -e

            if [ "$status" -eq 0 ]; then
              exit 0
            fi
            if [ "$status" -ne 2 ] || [ "$attempt" -eq 180 ]; then
              exit "$status"
            fi

            echo "Required release checks pending; retrying in 20s (attempt ${attempt}/180)."
            sleep 20
          done

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install build tools
        run: |
          python -m pip install --upgrade pip
          python -m pip install "build>=1.2.2" "packaging>=24.2" "twine>=6.1.0"

      - name: Pin README links to the release tag for PyPI
        env:
          RELEASE_TAG: ${{ steps.release_ref.outputs.tag }}
        run: |
          # Tags cut before this script existed build with the README as is.
          if [ -f tools/release/pypi_readme.py ]; then
            python tools/release/pypi_readme.py --ref "$RELEASE_TAG" README.md
          else
            echo "tools/release/pypi_readme.py not in ${RELEASE_TAG}; README links stay relative"
          fi

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: "1.22.x"
          cache: false

      # The sdist, the pure py3-none-any wheel, and one wheel per platform
      # with the skylos-go engine inside, so `pip install skylos` gets Go
      # dead-code and security checks. tools/release/build_dist.py is shared
      # with .github/workflows/dist-check.yml, which runs this same build on
      # pull requests that touch packaging.
      - name: Build sdist and wheels
        run: |
          set -euo pipefail
          # Tags cut before the script existed build the sdist and pure wheel only.
          if [ -f tools/release/build_dist.py ]; then
            python tools/release/build_dist.py build --out dist
          else
            python -m build --sdist --wheel --outdir dist
          fi

      - name: Smoke test the bundled Go engine
        run: |
          set -euo pipefail
          if [ -f tools/release/build_dist.py ]; then
            python tools/release/build_dist.py smoke --dist dist
          else
            echo "No platform wheels for this tag; nothing to smoke test"
          fi

      - name: Check dist contents
        run: |
          ls -lah dist
          python -m twine check dist/*

      - name: Upload dist artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: dist
          path: dist
          if-no-files-found: error

  # PyPI Trusted Publishing (OIDC): no stored upload token. PyPI does not
  # accept a reusable workflow as a trusted publisher, so this job runs only
  # when this file is the top-level workflow (manual dispatch). Releases from
  # release-please.yml upload in that workflow's own pypi-publish job.
  publish:
    needs: build
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/project/skylos/

    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          skip-existing: true

  container:
    name: container (Python ${{ matrix.python-version }})
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
    permissions:
      contents: read
      packages: write
    env:
      IMAGE_NAME: ghcr.io/duriantaco/skylos
      RELEASE_TAG: ${{ needs.build.outputs.release_tag }}
      PYTHON_VERSION: ${{ matrix.python-version }}
      DEFAULT_PYTHON_VERSION: "3.14"

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/tags/${{ env.RELEASE_TAG }}
          persist-credentials: false

      - name: Derive image metadata
        id: meta
        shell: bash
        run: |
          version="${RELEASE_TAG#v}"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          if [[ "$version" == *-* ]]; then
            echo "stable=false" >> "$GITHUB_OUTPUT"
          else
            echo "stable=true" >> "$GITHUB_OUTPUT"
            IFS='.' read -r major minor patch <<< "$version"
            echo "major=$major" >> "$GITHUB_OUTPUT"
            echo "minor=$minor" >> "$GITHUB_OUTPUT"
          fi

      - name: Build smoke image
        run: docker build --build-arg "PYTHON_VERSION=${PYTHON_VERSION}" -t skylos:smoke . # skylos: ignore[SKY-D296] local smoke-test image

      - name: Smoke test CLI entrypoint
        run: docker run --rm skylos:smoke --version # skylos: ignore[SKY-D296] local smoke-test image

      - name: Smoke test Go engine
        run: |
          docker run --rm skylos:smoke doctor --format json |
            python -c 'import json, sys; assert json.load(sys.stdin)["checks"]["go_engine"]["status"] == "available"'

      - name: Verify image Python runtime
        shell: bash
        run: |
          actual="$(docker run --rm --entrypoint python skylos:smoke -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')" # skylos: ignore[SKY-D296] local smoke-test image
          test "$actual" = "$PYTHON_VERSION"

      - name: Smoke test real scan
        run: |
          docker run --rm -v "$PWD/benchmarks/quality/fixtures/argument_overload:/work" -w /work skylos:smoke . --json --no-provenance > /tmp/skylos-smoke.json # skylos: ignore[SKY-D296] local smoke-test image
          grep -q '"unused_functions"' /tmp/skylos-smoke.json

      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Build and push multi-arch image
        shell: bash
        env:
          VERSION: ${{ steps.meta.outputs.version }}
          STABLE: ${{ steps.meta.outputs.stable }}
          MAJOR: ${{ steps.meta.outputs.major }}
          MINOR: ${{ steps.meta.outputs.minor }}
        run: |
          revision="$(git rev-parse HEAD)"
          runtime_tag="python${PYTHON_VERSION}"
          tags=(
            "--tag" "${IMAGE_NAME}:${VERSION}-${runtime_tag}"
          )
          if [[ "$STABLE" == "true" ]]; then
            tags+=(
              "--tag" "${IMAGE_NAME}:${MAJOR}.${MINOR}-${runtime_tag}"
              "--tag" "${IMAGE_NAME}:${MAJOR}-${runtime_tag}"
              "--tag" "${IMAGE_NAME}:latest-${runtime_tag}"
            )
          fi
          if [[ "$PYTHON_VERSION" == "$DEFAULT_PYTHON_VERSION" ]]; then
            tags+=("--tag" "${IMAGE_NAME}:${VERSION}")
            if [[ "$STABLE" == "true" ]]; then
              tags+=(
                "--tag" "${IMAGE_NAME}:${MAJOR}.${MINOR}"
                "--tag" "${IMAGE_NAME}:${MAJOR}"
                "--tag" "${IMAGE_NAME}:latest"
              )
            fi
          fi

          build_and_push() {
            docker buildx build \
              --platform linux/amd64,linux/arm64 \
              --build-arg "PYTHON_VERSION=${PYTHON_VERSION}" \
              "${tags[@]}" \
              --label "org.opencontainers.image.title=skylos" \
              --label "org.opencontainers.image.description=Open-source AI code security and static analysis for Python, TypeScript, and Go." \
              --label "org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
              --label "org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
              --label "org.opencontainers.image.version=${VERSION}" \
              --label "org.opencontainers.image.revision=${revision}" \
              --label "org.opencontainers.image.python.version=${PYTHON_VERSION}" \
              --push \
              .
          }

          for attempt in 1 2 3; do
            if build_and_push; then
              exit 0
            fi

            if [[ "$attempt" == "3" ]]; then
              echo "Docker image push failed after ${attempt} attempts" >&2
              exit 1
            fi

            sleep_seconds=$((attempt * 30))
            echo "Docker image push failed; retrying in ${sleep_seconds}s" >&2
            sleep "$sleep_seconds"
          done