native-release.yml

name: Prepare accepted native SDK releases

on:
  workflow_dispatch:
    inputs:
      channel:
        description: Acceptance channel
        type: choice
        options: [nightly, stable]
        default: nightly
      version:
        description: Exact x.y.z for stable; leave empty for nightly
        type: string

permissions: {}
concurrency:
  group: native-sdk-release
  cancel-in-progress: false

jobs:
  gate:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: ${{ inputs.channel == 'stable' && 'native-sdk-stable' || 'native-sdk-nightly' }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - id: acceptance-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ secrets.SDK_COVERAGE_CLIENT_ID }}
          private-key: ${{ secrets.SDK_COVERAGE_APP_PRIVATE_KEY }}
          owner: polymorfa
          repositories: polymorfa
          permission-contents: read
          permission-actions: read
      - name: Require exact deployed API acceptance and complete native coverage
        env:
          GH_TOKEN: ${{ steps.acceptance-token.outputs.token }}
          RELEASE_CHANNEL: ${{ inputs.channel }}
          STABLE_VERSION: ${{ inputs.version }}
          RELEASE_OUTPUT: .release/native
        run: node scripts/native-release.mjs
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: .release/native/release-contract.json
          if-no-files-found: error
  pack:
    needs: gate
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        language: [go, python, php, rust, dotnet]
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - uses: actions/setup-go@v6
        if: matrix.language == 'go'
        with:
          go-version: "1.24.x"
          cache: false
      - uses: actions/setup-python@v6
        if: matrix.language == 'python'
        with:
          python-version: "3.10"
      - if: matrix.language == 'python'
        run: python -m pip install uv twine
      - uses: shivammathur/setup-php@v2
        if: matrix.language == 'php'
        with:
          php-version: "8.2"
          tools: composer:v2
          extensions: curl, openssl, mbstring
          coverage: none
      - uses: actions/setup-dotnet@v6
        if: matrix.language == 'dotnet'
        with:
          dotnet-version: "8.0.x"
      - if: matrix.language == 'rust'
        run: |
          rustup toolchain install 1.85.0 --profile minimal --component rustfmt,clippy
          rustup default 1.85.0
          rustup target add wasm32-unknown-unknown --toolchain 1.85.0
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: .release/native
      - name: Build existing browser components for framework examples
        run: |
          npm ci
          npm run build:workspaces
      - name: Verify native package and examples
        env:
          SDK_LANGUAGE: ${{ matrix.language }}
          SDK_PYTHON_VERSION: "3.10"
        run: node scripts/verify-native-sdk.mjs "$SDK_LANGUAGE"
      - name: Stamp registry versions and embedded provenance
        env:
          SDK_LANGUAGE: ${{ matrix.language }}
        run: |
          node scripts/stamp-native-release.mjs "$SDK_LANGUAGE"
          node scripts/pack-native-release.mjs "$SDK_LANGUAGE"
      - if: matrix.language == 'python'
        run: python -m twine check .release/native/packs/python/*.whl .release/native/packs/python/*.tar.gz
      - name: Prepare the accepted PHP root source mirror
        if: matrix.language == 'php'
        run: |
          python3 scripts/prepare-php-mirror.py .release/native/packs/php .release/native/release-contract.json .release/native/php-mirror
          composer validate --strict --no-check-publish .release/native/php-mirror/source/composer.json
      - if: matrix.language == 'php'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: native-php-accepted-mirror
          path: .release/native/php-mirror/
          if-no-files-found: error
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: native-${{ matrix.language }}-accepted-packs
          include-hidden-files: true
          path: .release/native/packs/${{ matrix.language }}/*
          if-no-files-found: error
  # Publication runs only after every accepted pack exists. Each registry job
  # re-verifies the plan against the downloaded receipt and artifact hashes
  # before any effect, refuses to overwrite a different existing version and
  # stops dependents when a dependency is not confirmed. Environments hold the
  # registry trust policies and required reviewers; see docs/native-release.md.
  plan:
    needs: pack
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: native-*-accepted-packs
          path: .release/native/download
      - name: Bind every accepted artifact to one publication plan
        run: |
          for language in go python php rust dotnet; do
            mkdir -p ".release/native/packs/$language"
            cp -a ".release/native/download/native-$language-accepted-packs/." ".release/native/packs/$language/"
            python3 scripts/inspect-native-artifacts.py "$language" ".release/native/packs/$language" .release/native/release-contract.json
          done
          node scripts/native-publish.mjs plan .release/native/packs .release/native/release-contract.json .release/native/publish-plan.json
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: native-publish-plan
          path: .release/native/publish-plan.json
          if-no-files-found: error
  publish-crates:
    needs: [gate, plan]
    runs-on: ubuntu-latest
    environment: ${{ inputs.channel == 'stable' && 'native-sdk-stable' || 'native-sdk-nightly' }}
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - run: rustup toolchain install 1.85.0 --profile minimal && rustup default 1.85.0
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-publish-plan
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-rust-accepted-packs
          include-hidden-files: true
          path: .release/native/packs/rust
      - name: Exchange the OIDC token for a short-lived crates.io token
        id: crates-auth
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
      - name: Publish storage-core, then the SDK and IndexedDB crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}
        run: node scripts/native-publish.mjs publish crates .release/native/publish-plan.json
  publish-nuget:
    needs: [gate, plan]
    runs-on: ubuntu-latest
    environment: ${{ inputs.channel == 'stable' && 'native-sdk-stable' || 'native-sdk-nightly' }}
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-publish-plan
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-dotnet-accepted-packs
          include-hidden-files: true
          path: .release/native/packs/dotnet
      - name: Exchange the OIDC token for a one-hour NuGet key
        id: nuget-login
        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
        with:
          user: ${{ vars.NUGET_USER }}
      - name: Push Polymorfa.Sdk, then storage packages in dependency order
        env:
          NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
        run: node scripts/native-publish.mjs publish nuget .release/native/publish-plan.json
  publish-pypi:
    needs: [gate, plan]
    runs-on: ubuntu-latest
    environment: ${{ inputs.channel == 'stable' && 'native-sdk-stable' || 'native-sdk-nightly' }}
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-publish-plan
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-python-accepted-packs
          include-hidden-files: true
          path: .release/native/packs/python
      - name: Refuse different existing files before uploading
        run: node scripts/native-publish.mjs check pypi .release/native/publish-plan.json
      - name: Isolate the accepted distributions
        run: |
          mkdir -p .release/native/pypi-dist
          cp .release/native/packs/python/*.whl .release/native/packs/python/*.tar.gz .release/native/pypi-dist/
      - name: Upload through PyPI trusted publishing
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: .release/native/pypi-dist
          skip-existing: true
      - name: Confirm PyPI serves the accepted digests
        run: node scripts/native-publish.mjs confirm pypi .release/native/publish-plan.json
  publish-go:
    needs: [gate, plan]
    runs-on: ubuntu-latest
    environment: ${{ inputs.channel == 'stable' && 'native-sdk-stable' || 'native-sdk-nightly' }}
    # The only write: one new packages/go/v<version> tag on this repository.
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - uses: actions/setup-go@v6
        with:
          go-version: "1.24.x"
          cache: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: ${{ runner.temp }}/accepted
      - name: Create the tag-only release commit and prove its module zip
        run: node scripts/go-release-tag.mjs prepare "$RUNNER_TEMP/accepted/release-contract.json" "$RUNNER_TEMP/go-release.json"
      - name: Push only the new tag
        env:
          GO_TAG_TOKEN: ${{ github.token }}
        run: node scripts/go-release-tag.mjs push "$RUNNER_TEMP/go-release.json"
      - name: Require the Go proxy to serve the same module hash
        run: node scripts/go-release-tag.mjs verify "$RUNNER_TEMP/go-release.json"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: native-go-release
          path: ${{ runner.temp }}/go-release.json
  publish-php:
    needs: [gate, plan]
    runs-on: ubuntu-latest
    environment: ${{ inputs.channel == 'stable' && 'native-sdk-stable' || 'native-sdk-nightly' }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: accepted-native-contract
          include-hidden-files: true
          path: .release/native
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: native-php-accepted-mirror
          path: .release/native/php-mirror
      - name: Require the dedicated mirror repository setting
        env:
          PHP_MIRROR_REPOSITORY: ${{ vars.PHP_MIRROR_REPOSITORY }}
        run: test -n "$PHP_MIRROR_REPOSITORY"
      - name: Mint a token for only the mirror repository
        id: mirror-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ vars.PHP_MIRROR_APP_CLIENT_ID }}
          private-key: ${{ secrets.PHP_MIRROR_APP_PRIVATE_KEY }}
          owner: polymorfa
          repositories: ${{ vars.PHP_MIRROR_REPOSITORY }}
          permission-contents: write
      - name: Commit the accepted archive files to the mirror without forcing
        id: mirror
        env:
          PHP_MIRROR_TOKEN: ${{ steps.mirror-token.outputs.token }}
          PHP_MIRROR_REPOSITORY: ${{ vars.PHP_MIRROR_REPOSITORY }}
          PHP_MIRROR_RECEIPT: .release/native/release-contract.json
        run: |
          node scripts/php-mirror-publish.mjs push .release/native/php-mirror "https://github.com/polymorfa/$PHP_MIRROR_REPOSITORY.git" > "$RUNNER_TEMP/php-mirror.json"
          echo "commit=$(node -p 'JSON.parse(require("fs").readFileSync(process.argv[1])).commit' "$RUNNER_TEMP/php-mirror.json")" >> "$GITHUB_OUTPUT"
      - name: Require Packagist to reference the mirror commit
        env:
          MIRROR_COMMIT: ${{ steps.mirror.outputs.commit }}
        run: node scripts/php-mirror-publish.mjs verify .release/native/php-mirror "$MIRROR_COMMIT"