release-readiness.yml

name: Release readiness

run-name: Release readiness ${{ inputs.request_id || 'source-evidence' }} ${{ inputs.source_sha || github.sha }}

on:
  push:
    branches:
      - 'release/v*'
  workflow_dispatch:
    inputs:
      source_ref:
        description: Exact release source branch (main or release/v<VERSION>)
        required: true
        type: string
      source_sha:
        description: Exact 40-character release source commit to validate before tagging
        required: true
        type: string
      request_id:
        description: Operator-generated correlation id (rr_<24 lowercase hex>)
        required: true
        type: string
      ci_run_id:
        description: Exact successful source-branch push CI run id bound by the release operator
        required: true
        type: string
      ci_run_attempt:
        description: Exact successful source-branch push CI run attempt bound by the release operator
        required: true
        type: string
      evidence_run_id:
        description: Exact successful release-source evidence push run id; required for release/v* sources
        required: false
        default: ''
        type: string
      evidence_run_attempt:
        description: Exact successful release-source evidence push run attempt; required for release/v* sources
        required: false
        default: ''
        type: string

# This workflow has two pre-tag, non-publication modes. A release/v* push
# precomputes expensive exact-SHA native/E2E/eval/Server-image evidence in parallel
# with ordinary source CI. Later operator dispatch revalidates that successful push
# evidence plus the exact source CI instead of rebuilding it. A main-source dispatch
# retains the slower in-run evidence fallback so ordinary main pushes stay cheap.
# Formal release-profile candidates are still built exactly once after tagging.
permissions:
  contents: read
  actions: read

concurrency:
  group: release-readiness-${{ github.sha }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always

jobs:
  ci-proof:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Fence exact source and immutable evidence
        shell: bash
        env:
          INPUT_SOURCE_REF: ${{ inputs.source_ref || github.ref_name }}
          INPUT_SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
          INPUT_REQUEST_ID: ${{ inputs.request_id || format('push-{0}', github.run_id) }}
          INPUT_CI_RUN_ID: ${{ inputs.ci_run_id }}
          INPUT_CI_RUN_ATTEMPT: ${{ inputs.ci_run_attempt }}
          INPUT_EVIDENCE_RUN_ID: ${{ inputs.evidence_run_id }}
          INPUT_EVIDENCE_RUN_ATTEMPT: ${{ inputs.evidence_run_attempt }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          [[ "$INPUT_SOURCE_REF" == main || "$INPUT_SOURCE_REF" =~ ^release/v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]
          test "$GITHUB_REF" = "refs/heads/$INPUT_SOURCE_REF"
          [[ "$INPUT_SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
          test "$GITHUB_SHA" = "$INPUT_SOURCE_SHA"
          if [ "$GITHUB_EVENT_NAME" = push ]; then
            [[ "$INPUT_SOURCE_REF" =~ ^release/v ]]
            [[ "$INPUT_REQUEST_ID" =~ ^push-[1-9][0-9]*$ ]]
            {
              echo "### Release-source evidence precompute"
              echo "- source ref: \`$INPUT_SOURCE_REF\`"
              echo "- source: \`$INPUT_SOURCE_SHA\`"
              echo "- expensive evidence runs in this exact push workflow; no tag or publication occurs"
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          test "$GITHUB_EVENT_NAME" = workflow_dispatch
          [[ "$INPUT_REQUEST_ID" =~ ^rr_[0-9a-f]{24}$ ]]
          [[ "$INPUT_CI_RUN_ID" =~ ^[1-9][0-9]*$ ]]
          [[ "$INPUT_CI_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
          if [[ "$INPUT_SOURCE_REF" =~ ^release/ ]]; then
            [[ "$INPUT_EVIDENCE_RUN_ID" =~ ^[1-9][0-9]*$ ]]
            [[ "$INPUT_EVIDENCE_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
          else
            test -z "$INPUT_EVIDENCE_RUN_ID"
            test -z "$INPUT_EVIDENCE_RUN_ATTEMPT"
          fi
          python3 - <<'PY'
          import json
          import os
          import urllib.request

          repo = os.environ["GITHUB_REPOSITORY"]
          source = os.environ["INPUT_SOURCE_SHA"]
          source_ref = os.environ["INPUT_SOURCE_REF"]
          headers = {
              "Accept": "application/vnd.github+json",
              "Authorization": f"Bearer {os.environ['GH_TOKEN']}",
              "User-Agent": "webcodex-release-readiness",
              "X-GitHub-Api-Version": "2022-11-28",
          }

          def verify(label, run_id, attempt, path):
              request = urllib.request.Request(
                  f"https://api.github.com/repos/{repo}/actions/runs/{run_id}/attempts/{attempt}",
                  headers=headers,
              )
              with urllib.request.urlopen(request, timeout=30) as response:
                  payload = json.load(response)
              expected = {
                  "path": path,
                  "event": "push",
                  "head_branch": source_ref,
                  "head_sha": source,
                  "status": "completed",
                  "conclusion": "success",
                  "run_attempt": attempt,
              }
              mismatches = {
                  key: {"expected": value, "actual": payload.get(key)}
                  for key, value in expected.items()
                  if payload.get(key) != value
              }
              if payload.get("id") != run_id:
                  mismatches["id"] = {"expected": run_id, "actual": payload.get("id")}
              head_repository = payload.get("head_repository")
              if not isinstance(head_repository, dict) or head_repository.get("full_name") != repo:
                  mismatches["head_repository.full_name"] = {
                      "expected": repo,
                      "actual": head_repository.get("full_name") if isinstance(head_repository, dict) else None,
                  }
              if mismatches:
                  raise SystemExit(f"exact-source {label} proof mismatch: {json.dumps(mismatches, sort_keys=True)}")

          ci_run_id = int(os.environ["INPUT_CI_RUN_ID"])
          ci_attempt = int(os.environ["INPUT_CI_RUN_ATTEMPT"])
          verify("CI", ci_run_id, ci_attempt, ".github/workflows/ci.yml")
          evidence_run_id = os.environ["INPUT_EVIDENCE_RUN_ID"]
          evidence_attempt = os.environ["INPUT_EVIDENCE_RUN_ATTEMPT"]
          if source_ref.startswith("release/"):
              verify(
                  "release evidence",
                  int(evidence_run_id),
                  int(evidence_attempt),
                  ".github/workflows/release-readiness.yml",
              )
          print(f"verified exact-source evidence for {source_ref}@{source}")
          PY
          {
            echo "### Exact-source readiness proof"
            echo "- source ref: \`$INPUT_SOURCE_REF\`"
            echo "- source: \`$INPUT_SOURCE_SHA\`"
            echo "- CI run: \`$INPUT_CI_RUN_ID\` attempt \`$INPUT_CI_RUN_ATTEMPT\`"
            if [[ "$INPUT_SOURCE_REF" =~ ^release/ ]]; then
              echo "- release evidence run: \`$INPUT_EVIDENCE_RUN_ID\` attempt \`$INPUT_EVIDENCE_RUN_ATTEMPT\`"
            else
              echo "- release evidence: in-run fallback follows this proof"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

  extended-native:
    needs: ci-proof
    if: github.event_name == 'push' || inputs.source_ref == 'main'
    uses: ./.github/workflows/extended-native.yml
    with:
      source_sha: ${{ inputs.source_sha || github.sha }}

  e2e:
    needs: ci-proof
    if: github.event_name == 'push' || inputs.source_ref == 'main'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Fence exact reviewed release source
        shell: bash
        env:
          INPUT_SOURCE_REF: ${{ inputs.source_ref || github.ref_name }}
          INPUT_SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
        run: |
          set -euo pipefail
          test "$GITHUB_REF" = "refs/heads/$INPUT_SOURCE_REF"
          [[ "$INPUT_SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
          test "$GITHUB_SHA" = "$INPUT_SOURCE_SHA"

      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 1
          persist-credentials: false
          ref: ${{ inputs.source_sha || github.sha }}

      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          shared-key: release-readiness-e2e

      - name: Install E2E search dependency
        run: |
          if ! command -v rg >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install --no-install-recommends -y ripgrep
          fi

      - name: Build E2E runtime fixtures
        run: |
          test "$(git rev-parse HEAD)" = "${{ inputs.source_sha || github.sha }}"
          test -z "$(git status --porcelain --untracked-files=all)"
          cargo build --locked -p webcodex --bin webcodex-server
          cargo build --locked -p webcodex-runner --bin webcodex-runner

      - name: Run WebSocket zero-config E2E
        env:
          E2E_SERVER_BIN: ${{ github.workspace }}/target/debug/webcodex-server
          E2E_RUNNER_BIN: ${{ github.workspace }}/target/debug/webcodex-runner
        run: bash scripts/e2e_zero_config_ws.sh

      - name: Run polling zero-config E2E
        env:
          E2E_SERVER_BIN: ${{ github.workspace }}/target/debug/webcodex-server
          E2E_RUNNER_BIN: ${{ github.workspace }}/target/debug/webcodex-runner
          E2E_TRANSPORT: polling
        run: bash scripts/e2e_zero_config_ws.sh

      - name: Require final E2E source cleanliness
        shell: bash
        run: |
          set -euo pipefail
          git diff --check
          test -z "$(git status --porcelain --untracked-files=all)"

  eval:
    needs: ci-proof
    if: github.event_name == 'push' || inputs.source_ref == 'main'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Fence exact reviewed release source
        shell: bash
        env:
          INPUT_SOURCE_REF: ${{ inputs.source_ref || github.ref_name }}
          INPUT_SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
        run: |
          set -euo pipefail
          test "$GITHUB_REF" = "refs/heads/$INPUT_SOURCE_REF"
          [[ "$INPUT_SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
          test "$GITHUB_SHA" = "$INPUT_SOURCE_SHA"

      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 1
          persist-credentials: false
          ref: ${{ inputs.source_sha || github.sha }}

      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          shared-key: release-readiness-eval

      - name: Install eval search dependency
        run: |
          if ! command -v rg >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install --no-install-recommends -y ripgrep
          fi

      - name: Build eval runtime fixtures
        run: |
          test "$(git rev-parse HEAD)" = "${{ inputs.source_sha || github.sha }}"
          test -z "$(git status --porcelain --untracked-files=all)"
          cargo build --locked -p webcodex --bin webcodex-server
          cargo build --locked -p webcodex-runner --bin webcodex-runner

      - name: Run coding-loop eval compare
        env:
          EVAL_MODE: compare
          EVAL_SERVER_BIN: ${{ github.workspace }}/target/debug/webcodex-server
          EVAL_RUNNER_BIN: ${{ github.workspace }}/target/debug/webcodex-runner
        run: bash scripts/eval_coding_loop.sh

      - name: Require final eval source cleanliness
        shell: bash
        run: |
          set -euo pipefail
          git diff --check
          test -z "$(git status --porcelain --untracked-files=all)"

  server-image:
    needs: [ci-proof, e2e, eval]
    if: github.event_name == 'push' || inputs.source_ref == 'main'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            platform: linux/amd64
            architecture: amd64
            slug: amd64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            architecture: arm64
            slug: arm64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 75
    steps:
      - name: Fence exact reviewed release source
        shell: bash
        env:
          INPUT_SOURCE_REF: ${{ inputs.source_ref || github.ref_name }}
          INPUT_SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
        run: |
          set -euo pipefail
          if [ "$GITHUB_REF" != "refs/heads/$INPUT_SOURCE_REF" ]; then
            echo "Release readiness must use the selected exact source branch." >&2
            exit 1
          fi
          if [[ ! "$INPUT_SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
            echo "source_sha must be exactly 40 lowercase hexadecimal characters." >&2
            exit 1
          fi
          if [ "$GITHUB_SHA" != "$INPUT_SOURCE_SHA" ]; then
            echo "release source moved before evidence execution: ref=$INPUT_SOURCE_REF requested=$INPUT_SOURCE_SHA run=$GITHUB_SHA" >&2
            exit 1
          fi

      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 1
          persist-credentials: false
          ref: ${{ inputs.source_sha || github.sha }}

      - name: Build and verify disposable native Server image
        shell: bash
        env:
          INPUT_SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
          EVIDENCE_ID: ${{ inputs.request_id || format('push-{0}', github.run_id) }}
          EXPECTED_ARCH: ${{ matrix.architecture }}
          EXPECTED_PLATFORM: ${{ matrix.platform }}
          IMAGE_SLUG: ${{ matrix.slug }}
        run: |
          set -euo pipefail
          test "$(git rev-parse HEAD)" = "$INPUT_SOURCE_SHA"
          test -z "$(git status --porcelain --untracked-files=all)"
          case "$(uname -m):$EXPECTED_ARCH" in
            x86_64:amd64|aarch64:arm64) ;;
            *) echo "Unexpected native Server-image architecture: $(uname -m) for $EXPECTED_ARCH" >&2; exit 1 ;;
          esac

          version="$(python3 -c 'import json; print(json.load(open("npm/webcodex/package.json", encoding="utf-8"))["version"])')"
          built_at="$(git show -s --format=%ct HEAD)"
          short_commit="${INPUT_SOURCE_SHA:0:12}"
          image="webcodex-server-readiness:${EVIDENCE_ID#rr_}-$IMAGE_SLUG"
          name="webcodex-server-readiness-${GITHUB_RUN_ID}-$IMAGE_SLUG"
          cleanup() {
            docker rm -f "$name" >/dev/null 2>&1 || true
            docker image rm -f "$image" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT

          DOCKER_BUILDKIT=1 docker build \
            --build-arg "WEBCODEX_GIT_COMMIT=$short_commit" \
            --build-arg WEBCODEX_GIT_DIRTY=false \
            --build-arg "WEBCODEX_BUILT_AT=$built_at" \
            -t "$image" \
            -f Dockerfile \
            .

          test "$(docker image inspect --format '{{.Architecture}}' "$image")" = "$EXPECTED_ARCH"
          test "$(docker image inspect --format '{{.Os}}' "$image")/$EXPECTED_ARCH" = "$EXPECTED_PLATFORM"
          test "$(docker image inspect --format '{{.Config.User}}' "$image")" = "webcodex:webcodex"
          docker run --rm --entrypoint sh "$image" -ec '
            test "$(id -u)" = 10001
            test "$(id -g)" = 10001
            test ! -e /usr/local/bin/webcodex-runner
          '

          expected_server="webcodex-server $version (commit $short_commit, dirty=false, built_at=$built_at)"
          expected_cli="webcodex $version (commit $short_commit, dirty=false, built_at=$built_at)"
          test "$(docker run --rm "$image" --version)" = "$expected_server"
          test "$(docker run --rm --entrypoint /usr/local/bin/webcodex "$image" --version)" = "$expected_cli"

          docker run -d --name "$name" \
            -e WEBCODEX_TOKEN=0000000000000000000000000000000000000000000000000000000000000000 \
            -e WEBCODEX_PUBLIC_URL=https://webcodex.invalid \
            "$image" >/dev/null
          for _ in $(seq 1 40); do
            health="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}missing{{end}}' "$name")"
            if [ "$health" = healthy ]; then
              break
            fi
            if [ "$health" = unhealthy ] || [ "$health" = missing ]; then
              echo "Disposable Server image health check failed: $health" >&2
              docker logs --tail 80 "$name" >&2 || true
              exit 1
            fi
            sleep 2
          done
          if [ "$(docker inspect --format '{{.State.Health.Status}}' "$name")" != healthy ]; then
            echo "Disposable Server image did not become healthy before the smoke deadline." >&2
            docker logs --tail 80 "$name" >&2 || true
            exit 1
          fi

          # No registry publication is needed to validate deployment-asset generation.
          # A local image ID has the same canonical sha256 syntax expected by the
          # digest-pinning renderer, while the resulting asset remains disposable.
          digest="$(docker image inspect --format '{{.Id}}' "$image")"
          if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "Disposable Server image is missing a canonical image ID." >&2
            exit 1
          fi
          deployment_dir="$RUNNER_TEMP/server-deployment-$IMAGE_SLUG"
          deployment_summary="$RUNNER_TEMP/server-deployment-$IMAGE_SLUG.json"
          python3 scripts/prepare_server_deployment_assets.py \
            --compose compose.yaml \
            --bootstrap deploy/docker/bootstrap.sh \
            --output-dir "$deployment_dir" \
            --digest "$digest" \
            --summary "$deployment_summary" >/dev/null
          bootstrap="$deployment_dir/webcodex-server-bootstrap.sh"
          sh -n "$bootstrap"
          grep -Fq "ghcr.io/yyjeqhc/webcodex-server@$digest" "$bootstrap"
          if grep -Fq "ghcr.io/yyjeqhc/webcodex-server:latest" "$bootstrap"; then
            echo "Disposable release bootstrap retained a mutable latest image reference." >&2
            exit 1
          fi
          python3 - "$bootstrap" "$deployment_summary" <<'PY'
          import hashlib
          import json
          import pathlib
          import sys

          bootstrap = pathlib.Path(sys.argv[1])
          summary = json.loads(pathlib.Path(sys.argv[2]).read_text(encoding="utf-8"))
          assets = summary.get("assets")
          expected = hashlib.sha256(bootstrap.read_bytes()).hexdigest()
          if assets != {"webcodex-server-bootstrap.sh": expected}:
              raise SystemExit("disposable Server deployment-asset digest summary is inconsistent")
          PY

          git diff --check
          test -z "$(git status --porcelain --untracked-files=all)"

  summary:
    needs: [ci-proof, extended-native, e2e, eval, server-image]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Require and record readiness evidence
        shell: bash
        env:
          INPUT_SOURCE_REF: ${{ inputs.source_ref || github.ref_name }}
          INPUT_SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
          INPUT_REQUEST_ID: ${{ inputs.request_id || format('push-{0}', github.run_id) }}
          INPUT_CI_RUN_ID: ${{ inputs.ci_run_id }}
          INPUT_CI_RUN_ATTEMPT: ${{ inputs.ci_run_attempt }}
          INPUT_EVIDENCE_RUN_ID: ${{ inputs.evidence_run_id }}
          INPUT_EVIDENCE_RUN_ATTEMPT: ${{ inputs.evidence_run_attempt }}
          CI_PROOF_RESULT: ${{ needs.ci-proof.result }}
          EXTENDED_NATIVE_RESULT: ${{ needs.extended-native.result }}
          E2E_RESULT: ${{ needs.e2e.result }}
          EVAL_RESULT: ${{ needs.eval.result }}
          SERVER_IMAGE_RESULT: ${{ needs.server-image.result }}
        run: |
          set -euo pipefail
          test "$CI_PROOF_RESULT" = success
          if [ "$GITHUB_EVENT_NAME" = push ] || [ "$INPUT_SOURCE_REF" = main ]; then
            for result in "$EXTENDED_NATIVE_RESULT" "$E2E_RESULT" "$EVAL_RESULT" "$SERVER_IMAGE_RESULT"; do
              test "$result" = success
            done
          else
            for result in "$EXTENDED_NATIVE_RESULT" "$E2E_RESULT" "$EVAL_RESULT" "$SERVER_IMAGE_RESULT"; do
              test "$result" = skipped
            done
          fi
          {
            if [ "$GITHUB_EVENT_NAME" = push ]; then
              echo "### Release-source evidence passed"
              echo "- source ref: \`$INPUT_SOURCE_REF\`"
              echo "- source: \`$INPUT_SOURCE_SHA\`"
              echo "- extended native, E2E/eval, and disposable Server-image evidence passed"
              echo "- publication side effects: none"
            elif [ "$INPUT_SOURCE_REF" = main ]; then
              echo "### Release readiness passed"
              echo "- source ref: \`$INPUT_SOURCE_REF\`"
              echo "- source: \`$INPUT_SOURCE_SHA\`"
              echo "- request: \`$INPUT_REQUEST_ID\`"
              echo "- exact-source CI: run \`$INPUT_CI_RUN_ID\` attempt \`$INPUT_CI_RUN_ATTEMPT\`"
              echo "- main-source fallback: extended native, E2E/eval, and disposable Server-image evidence passed in this run"
            else
              echo "### Release readiness passed"
              echo "- source ref: \`$INPUT_SOURCE_REF\`"
              echo "- source: \`$INPUT_SOURCE_SHA\`"
              echo "- request: \`$INPUT_REQUEST_ID\`"
              echo "- exact-source CI: run \`$INPUT_CI_RUN_ID\` attempt \`$INPUT_CI_RUN_ATTEMPT\`"
              echo "- exact-source release evidence: run \`$INPUT_EVIDENCE_RUN_ID\` attempt \`$INPUT_EVIDENCE_RUN_ATTEMPT\`"
              echo "- expensive evidence was precomputed by the exact release-branch push and was not rebuilt"
            fi
            echo "- native release-profile candidates produced: no (authoritative release-build owns them after immutable tagging)"
          } >> "$GITHUB_STEP_SUMMARY"