release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions: {}

concurrency:
  group: release-main
  cancel-in-progress: false

env:
  PYTHONDONTWRITEBYTECODE: "1"
  UV_VERSION: "0.7.20"

jobs:
  # Release Please authors version-bump pull requests, so it may only run in the
  # private engineering upstream. Public main accepts byte-preserving export merges
  # exclusively; a bump commit authored there would break the export equivalence
  # barrier described in PUBLIC_DISTRIBUTION.md.
  release-please:
    name: Prepare or create a draft release
    if: >-
      vars.RELEASE_AUTOMATION_ENABLED == 'true' &&
      github.repository != 'picogrid/ecn-sdk-python'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      body: ${{ steps.release.outputs.body }}
      html_url: ${{ steps.release.outputs.html_url }}
      release_created: ${{ steps.release.outputs.release_created }}
      sha: ${{ steps.release.outputs.sha }}
      tag_name: ${{ steps.release.outputs.tag_name }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: Update the release PR or create a draft release
        id: release
        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
        with:
          config-file: .github/release-please-config.json
          manifest-file: .github/.release-please-manifest.json
          target-branch: main

  # Every downstream job consumes this job's outputs, never Release Please's
  # directly. In the private upstream it passes the Release Please outputs through
  # unchanged. In the public distribution repository, where Release Please is
  # deliberately disabled, it derives the same identity from the merged and
  # equivalence-verified tree: the version is read from pyproject.toml, the tag is
  # that version prefixed with "v", and release state is resolved by immutable tag
  # and numeric release ID. A merged tree that resolves to an already published
  # release stops without rebuilding or publishing.
  resolve-release:
    name: Resolve the release candidate identity
    if: >-
      !cancelled() &&
      vars.RELEASE_AUTOMATION_ENABLED == 'true' &&
      (needs.release-please.result == 'success' || needs.release-please.result == 'skipped')
    needs: release-please
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    outputs:
      html_url: ${{ steps.resolved.outputs.html_url }}
      release_created: ${{ steps.resolved.outputs.release_created }}
      release_id: ${{ steps.resolved.outputs.release_id }}
      sha: ${{ steps.resolved.outputs.sha }}
      tag_name: ${{ steps.resolved.outputs.tag_name }}
      version: ${{ steps.resolved.outputs.version }}
    steps:
      - name: Pass through the private Release Please outputs
        id: passthrough
        if: github.repository != 'picogrid/ecn-sdk-python'
        env:
          RELEASE_HTML_URL: ${{ needs.release-please.outputs.html_url }}
          RELEASE_CREATED: ${{ needs.release-please.outputs.release_created }}
          RELEASE_SHA: ${{ needs.release-please.outputs.sha }}
          RELEASE_TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
          RELEASE_VERSION: ${{ needs.release-please.outputs.version }}
        run: |
          {
            echo "html_url=$RELEASE_HTML_URL"
            echo "release_created=$RELEASE_CREATED"
            echo "sha=$RELEASE_SHA"
            echo "tag_name=$RELEASE_TAG_NAME"
            echo "version=$RELEASE_VERSION"
          } >> "$GITHUB_OUTPUT"

      - name: Check out the merged public commit
        if: github.repository == 'picogrid/ecn-sdk-python'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.sha }}

      - name: Pin the Python runtime for the version derivation
        if: github.repository == 'picogrid/ecn-sdk-python'
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Derive the release identity from the verified tree
        id: derive
        if: github.repository == 'picogrid/ecn-sdk-python'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
          test -n "$version"
          echo "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-?(a|b|rc)[0-9]+)?$'
          tag="v${version}"
          tag_sha=

          # Only an HTTP 404 means the tag is absent. Any other failure (403,
          # rate limit, 5xx) must fail the job rather than fall through to
          # release creation, so the check stays fail-closed.
          if ref_json="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${tag}" 2> tag-check.err)"; then
            tag_sha="$(printf '%s' "$ref_json" | jq -r '.object.sha')"
            if [ "$(printf '%s' "$ref_json" | jq -r '.object.type')" = "tag" ]; then
              tag_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_sha}" --jq '.object.sha')"
            fi

            # A recovery workflow may be newer than the immutable release tag,
            # but it may never release an unrelated or future commit.
            comparison="$(
              gh api \
                "repos/${GITHUB_REPOSITORY}/compare/${tag_sha}...${GITHUB_SHA}" \
                --jq '.status'
            )"
            case "$comparison" in
              ahead|identical) ;;
              *)
                echo "tag ${tag} at ${tag_sha} is not an ancestor of ${GITHUB_SHA}"
                exit 1
                ;;
            esac
          else
            grep -q "HTTP 404" tag-check.err || { cat tag-check.err; exit 1; }
          fi

          # The release-by-tag endpoint excludes drafts. List all releases so a
          # retry resumes exactly one draft instead of creating another one.
          gh api \
            --paginate \
            --slurp \
            "repos/${GITHUB_REPOSITORY}/releases?per_page=100" |
            jq 'add' > releases.json
          python3 scripts/release_resolution.py \
            --tag "$tag" \
            --current-sha "$GITHUB_SHA" \
            --tag-sha "$tag_sha" \
            --releases-json releases.json > resolution.json

          action="$(jq -r '.action' resolution.json)"
          html_url="$(jq -r '.html_url' resolution.json)"
          release_created="$(jq -r '.release_created' resolution.json)"
          release_id="$(jq -r '.release_id // empty' resolution.json)"
          release_sha="$(jq -r '.release_sha' resolution.json)"
          case "$action" in
            create-tag-and-draft|create-draft)
              if [ "$action" = "create-tag-and-draft" ]; then
                gh api "repos/${GITHUB_REPOSITORY}/git/refs" \
                  -f ref="refs/tags/${tag}" \
                  -f sha="$release_sha" > /dev/null
              fi
              release_json="$(
                gh api \
                  --method POST \
                  "repos/${GITHUB_REPOSITORY}/releases" \
                  -f tag_name="$tag" \
                  -f target_commitish="$release_sha" \
                  -f name="$tag" \
                  -f body="See CHANGELOG.md at this tag for the release history." \
                  -F draft=true
              )"
              release_id="$(printf '%s' "$release_json" | jq -r '.id')"
              html_url="$(printf '%s' "$release_json" | jq -r '.html_url')"
              ;;
            resume)
              echo "tag ${tag} carries one unpublished draft; resuming release ${release_id}"
              ;;
            published)
              echo "tag ${tag} is already published; nothing to release"
              ;;
            *)
              echo "release resolver returned unsupported action: ${action}"
              exit 1
              ;;
          esac

          test -n "$html_url"
          echo "$release_id" | grep -Eq '^[1-9][0-9]*$'
          {
            echo "html_url=$html_url"
            echo "release_created=$release_created"
            echo "release_id=$release_id"
            echo "sha=$release_sha"
            echo "tag_name=$tag"
            echo "version=$version"
          } >> "$GITHUB_OUTPUT"

      - name: Normalize the release candidate outputs
        id: resolved
        env:
          DERIVED_HTML_URL: ${{ steps.derive.outputs.html_url }}
          DERIVED_RELEASE_CREATED: ${{ steps.derive.outputs.release_created }}
          DERIVED_RELEASE_ID: ${{ steps.derive.outputs.release_id }}
          DERIVED_SHA: ${{ steps.derive.outputs.sha }}
          DERIVED_TAG_NAME: ${{ steps.derive.outputs.tag_name }}
          DERIVED_VERSION: ${{ steps.derive.outputs.version }}
          PASSTHROUGH_HTML_URL: ${{ steps.passthrough.outputs.html_url }}
          PASSTHROUGH_RELEASE_CREATED: ${{ steps.passthrough.outputs.release_created }}
          PASSTHROUGH_SHA: ${{ steps.passthrough.outputs.sha }}
          PASSTHROUGH_TAG_NAME: ${{ steps.passthrough.outputs.tag_name }}
          PASSTHROUGH_VERSION: ${{ steps.passthrough.outputs.version }}
        run: |
          if [ "$GITHUB_REPOSITORY" = "picogrid/ecn-sdk-python" ]; then
            html_url="$DERIVED_HTML_URL"
            release_created="$DERIVED_RELEASE_CREATED"
            release_id="$DERIVED_RELEASE_ID"
            sha="$DERIVED_SHA"
            tag_name="$DERIVED_TAG_NAME"
            version="$DERIVED_VERSION"
          else
            html_url="$PASSTHROUGH_HTML_URL"
            release_created="$PASSTHROUGH_RELEASE_CREATED"
            release_id=
            sha="$PASSTHROUGH_SHA"
            tag_name="$PASSTHROUGH_TAG_NAME"
            version="$PASSTHROUGH_VERSION"
          fi
          case "$release_created" in
            true)
              test -n "$html_url"
              test -n "$sha"
              test -n "$tag_name"
              test -n "$version"
              if [ "$GITHUB_REPOSITORY" = "picogrid/ecn-sdk-python" ]; then
                echo "$release_id" | grep -Eq '^[1-9][0-9]*$'
              fi
              ;;
            false|'') ;;
            *)
              echo "invalid release_created output: ${release_created}"
              exit 1
              ;;
          esac
          {
            echo "html_url=$html_url"
            echo "release_created=${release_created:-false}"
            echo "release_id=$release_id"
            echo "sha=$sha"
            echo "tag_name=$tag_name"
            echo "version=$version"
          } >> "$GITHUB_OUTPUT"

  build-candidate:
    name: Build and verify the release candidate once
    # release-please is always skipped on the public distribution repository,
    # and that skip propagates transitively down the needs graph. !cancelled()
    # overrides the propagated skip so this job is evaluated on its own merits.
    if: >-
      !cancelled() &&
      needs.resolve-release.result == 'success' &&
      fromJSON(needs.resolve-release.outputs.release_created || 'false')
    needs: resolve-release
    runs-on: ${{ github.ref == 'refs/heads/main' && vars.HEAVY_RUNNER || 'ubuntu-latest' }}
    timeout-minutes: 90
    permissions:
      contents: read
    env:
      PLAYWRIGHT_WORKERS: ${{ github.ref == 'refs/heads/main' && vars.HEAVY_RUNNER && '4' || '1' }}
      VERIFY_RELEASE_JOBS: ${{ github.ref == 'refs/heads/main' && vars.HEAVY_RUNNER && '4' || '1' }}
      LEGION_DOCS_URL: ${{ vars.LEGION_DOCS_URL }}
      LEGION_DOCS_VERSION: ${{ vars.LEGION_DOCS_VERSION }}
      RELEASE_TAG: ${{ needs.resolve-release.outputs.tag_name }}
    steps:
      - name: Check out the exact released commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ needs.resolve-release.outputs.sha }}

      - name: Make Python 3.14 available to the advertised-runtime gate
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"

      - name: Make Python 3.13 available to the advertised-runtime gate
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

      - name: Make Python 3.12 available to the advertised-runtime gate
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Select Python 3.11 for the canonical verifier
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Set up Node.js for documentation and operator-app gates
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24.19.0"
          cache: npm
          cache-dependency-path: |
            docs/package-lock.json
            operator-app/package-lock.json

      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.UV_VERSION }}
          enable-cache: true
          cache-dependency-glob: uv.lock

      - name: Bind reproducible output to the released commit
        run: echo "SOURCE_DATE_EPOCH=$(git show -s --format=%ct HEAD)" >> "$GITHUB_ENV"

      - name: Build, inspect, install, and test the exact candidate
        run: make verify-release

      - name: Upload the verified bytes without rebuilding
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-candidate-${{ needs.resolve-release.outputs.tag_name }}
          path: |
            dist/
            reports/generated/
            site-dist/
          if-no-files-found: error
          include-hidden-files: true
          compression-level: 0
          retention-days: 14

  publication-reachability:
    name: Require anonymous publication reachability
    if: >-
      !cancelled() &&
      needs.resolve-release.result == 'success' &&
      needs.build-candidate.result == 'success' &&
      fromJSON(needs.resolve-release.outputs.release_created || 'false') &&
      vars.RELEASE_PROMOTION_ENABLED == 'true' &&
      github.repository == 'picogrid/ecn-sdk-python'
    needs:
      - resolve-release
      - build-candidate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Check out the exact released commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ needs.resolve-release.outputs.sha }}

      - name: Set up the pinned documentation runtime
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24.19.0"

      - name: Download the already verified candidate and site
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-candidate-${{ needs.resolve-release.outputs.tag_name }}
          path: candidate

      - name: Bind the retained site to the released commit
        env:
          EXPECTED_SHA: ${{ needs.resolve-release.outputs.sha }}
        run: |
          test "$(jq -r '.materials.git_commit' candidate/reports/generated/provenance.json)" = "$EXPECTED_SHA"
          test "$(jq -r '.materials.git_worktree_dirty' candidate/reports/generated/provenance.json)" = "false"
          test -f candidate/site-dist/ecn-sdk/index.html

      - name: Require anonymous repository and guide reachability
        env:
          DOCS_GIT_COMMIT: ${{ needs.resolve-release.outputs.sha }}
          DOCS_GIT_TAG: ${{ needs.resolve-release.outputs.tag_name }}
          LEGION_DOCS_URL: ${{ vars.LEGION_DOCS_URL }}
          LEGION_DOCS_VERSION: ${{ vars.LEGION_DOCS_VERSION }}
        run: node docs/site/check-external-links.mjs --require-public candidate/site-dist

  promote-release:
    name: Attest, sign, and publish the exact candidate
    if: >-
      !cancelled() &&
      needs.resolve-release.result == 'success' &&
      needs.build-candidate.result == 'success' &&
      needs.publication-reachability.result == 'success' &&
      fromJSON(needs.resolve-release.outputs.release_created || 'false') &&
      vars.RELEASE_PROMOTION_ENABLED == 'true' &&
      github.repository == 'picogrid/ecn-sdk-python'
    needs:
      - resolve-release
      - build-candidate
      - publication-reachability
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      attestations: write
      contents: write
      id-token: write
    environment:
      name: github-release
      url: ${{ needs.resolve-release.outputs.html_url }}
    steps:
      - name: Download the already verified candidate
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-candidate-${{ needs.resolve-release.outputs.tag_name }}
          path: candidate

      - name: Recheck candidate identity and checksums
        env:
          EXPECTED_SHA: ${{ needs.resolve-release.outputs.sha }}
        run: |
          mapfile -t client_wheels < <(find candidate/dist -maxdepth 1 -type f -name 'picogrid_ecn_client-*.whl' -print | sort)
          mapfile -t operator_wheels < <(find candidate/dist -maxdepth 1 -type f -name 'picogrid_ecn_operator_app-*.whl' -print | sort)
          mapfile -t client_sdists < <(find candidate/dist -maxdepth 1 -type f -name 'picogrid_ecn_client-*.tar.gz' -print | sort)
          test "${#client_wheels[@]}" -eq 1
          test "${#operator_wheels[@]}" -eq 1
          test "${#client_sdists[@]}" -eq 1
          test "$(find candidate/dist -mindepth 1 -maxdepth 1 | wc -l)" -eq 3
          test "$(find candidate/dist -maxdepth 1 -type f | wc -l)" -eq 3
          test "$(wc -l < candidate/reports/generated/checksums.sha256)" -eq 3
          diff -u \
            <(find candidate/dist -maxdepth 1 -type f -printf '%f\n' | sort) \
            <(awk '{print $2}' candidate/reports/generated/checksums.sha256 | sort)
          test -f candidate/reports/generated/sbom.cdx.json
          test ! -L candidate/reports/generated/sbom.cdx.json
          test -f candidate/reports/generated/operator-sbom.cdx.json
          test ! -L candidate/reports/generated/operator-sbom.cdx.json
          test -f candidate/reports/generated/operator-frontend-sbom.cdx.json
          test ! -L candidate/reports/generated/operator-frontend-sbom.cdx.json
          test "$(jq -r '.materials.git_commit' candidate/reports/generated/provenance.json)" = "$EXPECTED_SHA"
          test "$(jq -r '.materials.git_worktree_dirty' candidate/reports/generated/provenance.json)" = "false"
          (cd candidate/dist && sha256sum --check ../reports/generated/checksums.sha256)

      - name: Create GitHub build provenance attestations
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-checksums: candidate/reports/generated/checksums.sha256

      - name: Attest the CycloneDX SBOM for the client wheel
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
        with:
          subject-path: candidate/dist/picogrid_ecn_client-*.whl
          sbom-path: candidate/reports/generated/sbom.cdx.json

      - name: Attest the CycloneDX SBOM for the operator wheel
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
        with:
          subject-path: candidate/dist/picogrid_ecn_operator_app-*.whl
          sbom-path: candidate/reports/generated/operator-sbom.cdx.json

      - name: Attest the embedded-frontend CycloneDX SBOM for the operator wheel
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
        with:
          subject-path: candidate/dist/picogrid_ecn_operator_app-*.whl
          sbom-path: candidate/reports/generated/operator-frontend-sbom.cdx.json

      - name: Attest the CycloneDX SBOM for the source distribution
        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
        with:
          subject-path: candidate/dist/*.tar.gz
          sbom-path: candidate/reports/generated/sbom.cdx.json

      - name: Sign the three exact distributions with Sigstore
        uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0
        with:
          inputs: >-
            candidate/dist/picogrid_ecn_client-*.whl
            candidate/dist/picogrid_ecn_operator_app-*.whl
            candidate/dist/picogrid_ecn_client-*.tar.gz
          release-signing-artifacts: false

      - name: Require the resolved unpublished draft
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_ID: ${{ needs.resolve-release.outputs.release_id }}
          RELEASE_TAG: ${{ needs.resolve-release.outputs.tag_name }}
        run: |
          test "$(find candidate/dist -maxdepth 1 -type f -name '*.sigstore.json' | wc -l)" -eq 3
          test -f candidate/dist/picogrid_ecn_client-*.whl.sigstore.json
          test -f candidate/dist/picogrid_ecn_operator_app-*.whl.sigstore.json
          test -f candidate/dist/picogrid_ecn_client-*.tar.gz.sigstore.json
          echo "$RELEASE_ID" | grep -Eq '^[1-9][0-9]*$'
          release_json="$(gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}")"
          test "$(printf '%s' "$release_json" | jq -r '.draft')" = "true"
          test "$(printf '%s' "$release_json" | jq -r '.tag_name')" = "$RELEASE_TAG"

      - name: Replace exact draft assets without retaining stale files
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_ID: ${{ needs.resolve-release.outputs.release_id }}
        run: |
          mapfile -d '' -t upload_files < <(
            find candidate/dist candidate/reports/generated \
              -mindepth 1 -maxdepth 1 -type f -print0 |
              sort -z
          )
          test "${#upload_files[@]}" -gt 6
          test "$(
            find candidate/dist candidate/reports/generated \
              -mindepth 1 -maxdepth 1 -type l |
              wc -l
          )" -eq 0

          declare -A expected_assets=()
          for path in "${upload_files[@]}"; do
            name="${path##*/}"
            if [[ -n "${expected_assets[$name]+present}" ]]; then
              echo "duplicate candidate asset name: ${name}"
              exit 1
            fi
            expected_assets["$name"]="$path"
          done

          gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" > draft.json
          asset_count="$(jq '.assets | length' draft.json)"
          for ((index = 0; index < asset_count; index++)); do
            asset_id="$(jq -r --argjson index "$index" '.assets[$index].id' draft.json)"
            asset_name="$(jq -r --argjson index "$index" '.assets[$index].name' draft.json)"
            if [[ -z "${expected_assets[$asset_name]+present}" ]]; then
              echo "unexpected existing draft asset: ${asset_name}"
              exit 1
            fi
            gh api \
              --method DELETE \
              "repos/${GITHUB_REPOSITORY}/releases/assets/${asset_id}"
          done

          for name in "${!expected_assets[@]}"; do
            path="${expected_assets[$name]}"
            encoded_name="$(
              python3 -c \
                'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' \
                "$name"
            )"
            curl \
              --fail-with-body \
              --silent \
              --show-error \
              --request POST \
              --header "Accept: application/vnd.github+json" \
              --header "Authorization: Bearer ${GH_TOKEN}" \
              --header "X-GitHub-Api-Version: 2022-11-28" \
              --header "Content-Type: application/octet-stream" \
              --data-binary "@${path}" \
              --output uploaded.json \
              "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets?name=${encoded_name}"
            test "$(jq -r '.name' uploaded.json)" = "$name"
          done

          printf '%s\n' "${!expected_assets[@]}" | sort > expected-assets.txt
          gh api \
            "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
            --jq '.assets[].name' |
            sort > uploaded-assets.txt
          diff -u expected-assets.txt uploaded-assets.txt

      - name: Publish the fully populated GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_ID: ${{ needs.resolve-release.outputs.release_id }}
          RELEASE_TAG: ${{ needs.resolve-release.outputs.tag_name }}
        run: |
          published="$(
            gh api \
              --method PATCH \
              "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
              -F draft=false
          )"
          test "$(printf '%s' "$published" | jq -r '.draft')" = "false"
          test "$(printf '%s' "$published" | jq -r '.tag_name')" = "$RELEASE_TAG"

  publish-pypi:
    name: Publish the exact client artifacts to PyPI with OIDC
    if: >-
      !cancelled() &&
      needs.resolve-release.result == 'success' &&
      needs.build-candidate.result == 'success' &&
      needs.promote-release.result == 'success' &&
      fromJSON(needs.resolve-release.outputs.release_created || 'false') &&
      vars.RELEASE_PROMOTION_ENABLED == 'true' &&
      vars.PYPI_PUBLISH_ENABLED == 'true' &&
      github.repository == 'picogrid/ecn-sdk-python'
    needs:
      - resolve-release
      - build-candidate
      - promote-release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
    environment:
      name: pypi
    steps:
      - name: Download the same verified candidate
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-candidate-${{ needs.resolve-release.outputs.tag_name }}
          path: candidate

      - name: Recheck exact distribution checksums and stage PyPI subjects
        run: |
          mapfile -t client_wheels < <(find candidate/dist -maxdepth 1 -type f -name 'picogrid_ecn_client-*.whl' -print | sort)
          mapfile -t operator_wheels < <(find candidate/dist -maxdepth 1 -type f -name 'picogrid_ecn_operator_app-*.whl' -print | sort)
          mapfile -t client_sdists < <(find candidate/dist -maxdepth 1 -type f -name 'picogrid_ecn_client-*.tar.gz' -print | sort)
          test "${#client_wheels[@]}" -eq 1
          test "${#operator_wheels[@]}" -eq 1
          test "${#client_sdists[@]}" -eq 1
          test "$(find candidate/dist -mindepth 1 -maxdepth 1 | wc -l)" -eq 3
          test "$(find candidate/dist -maxdepth 1 -type f | wc -l)" -eq 3
          test "$(wc -l < candidate/reports/generated/checksums.sha256)" -eq 3
          diff -u \
            <(find candidate/dist -maxdepth 1 -type f -printf '%f\n' | sort) \
            <(awk '{print $2}' candidate/reports/generated/checksums.sha256 | sort)
          (cd candidate/dist && sha256sum --check ../reports/generated/checksums.sha256)
          mkdir pypi-candidate
          cp -- "${client_wheels[0]}" "${client_sdists[0]}" pypi-candidate/
          test "$(find pypi-candidate -mindepth 1 -maxdepth 1 | wc -l)" -eq 2
          test "$(find pypi-candidate -maxdepth 1 -type f | wc -l)" -eq 2
          cmp -- "${client_wheels[0]}" "pypi-candidate/$(basename "${client_wheels[0]}")"
          cmp -- "${client_sdists[0]}" "pypi-candidate/$(basename "${client_sdists[0]}")"

      - name: Publish only the client artifacts without rebuilding or static credentials
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: pypi-candidate/