release.yml

name: GitHub Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing v-prefixed tag to publish
        required: true
        type: string
      ci_run_id:
        description: Successful CI workflow run for the exact release commit
        required: true
        type: string
      release_class:
        description: Use governance-adoption only when this release adopts or claims improved Agent behavior
        required: true
        default: deterministic
        type: choice
        options:
          - deterministic
          - governance-adoption
      gate_run_id:
        description: Required only for governance-adoption; leave empty for deterministic releases
        required: false
        default: ""
        type: string

permissions:
  contents: write
  actions: read

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v5
      - name: Bind release version and evidence path
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          VERSION="$(uv run python -c 'import aet; print(aet.__version__)')"
          RELEASE_DIR=".aet/release/$RELEASE_TAG"
          test "v$VERSION" = "$RELEASE_TAG"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "RELEASE_DIR=$RELEASE_DIR" >> "$GITHUB_ENV"
      - name: Verify tag and release classification
        env:
          RELEASE_TAG: ${{ inputs.tag }}
          RELEASE_CLASS: ${{ inputs.release_class }}
          GATE_RUN_ID: ${{ inputs.gate_run_id }}
        run: |
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          git show-ref --verify "refs/tags/$RELEASE_TAG"
          test "${RELEASE_TAG#v}" = "$(uv run python -c 'import aet; print(aet.__version__)')"
          test "$(git rev-list -n 1 "$RELEASE_TAG")" = "$GITHUB_SHA"
          case "$RELEASE_CLASS" in
            deterministic) test -z "$GATE_RUN_ID" ;;
            governance-adoption) [[ "$GATE_RUN_ID" =~ ^[0-9]+$ ]] ;;
            *) exit 1 ;;
          esac
          uv run python eval/real-agent/release_classification.py \
            --root . --manifest release-classification.json \
            --release-tag "$RELEASE_TAG" --expected-class "$RELEASE_CLASS" \
            --output "$RELEASE_DIR/classification-verification.json"
      - name: Verify CI workflow-run provenance
        env:
          GH_TOKEN: ${{ github.token }}
          CI_RUN_ID: ${{ inputs.ci_run_id }}
        run: |
          [[ "$CI_RUN_ID" =~ ^[0-9]+$ ]]
          run_json="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${CI_RUN_ID}")"
          test "$(jq -r .head_sha <<<"$run_json")" = "$GITHUB_SHA"
          test "$(jq -r .conclusion <<<"$run_json")" = "success"
          test "$(jq -r .path <<<"$run_json")" = ".github/workflows/ci.yml"
      - name: Download exact CI release candidate
        uses: actions/download-artifact@v4
        with:
          name: release-candidate-${{ github.sha }}
          path: .aet/ci-download
          run-id: ${{ inputs.ci_run_id }}
          github-token: ${{ github.token }}
      - name: Verify and smoke-test the promoted artifact
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          manifest=.aet/ci-download/ci/manifest.json
          test "$(jq -r .schema_version "$manifest")" = "aet-ci-release-candidate/v1"
          test "$(jq -r .commit "$manifest")" = "$GITHUB_SHA"
          test "$(jq -r .version "$manifest")" = "${RELEASE_TAG#v}"
          wheel=".aet/ci-download/ci/dist/$(jq -r .wheel "$manifest")"
          test "$(sha256sum "$wheel" | cut -d' ' -f1)" = "$(jq -r .wheel_sha256 "$manifest")"
          test "$(uv run --isolated --with "$wheel" aet --version)" = "${RELEASE_TAG#v}"
      - name: Verify gate workflow-run provenance
        if: inputs.release_class == 'governance-adoption'
        env:
          GH_TOKEN: ${{ github.token }}
          GATE_RUN_ID: ${{ inputs.gate_run_id }}
        run: |
          run_json="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${GATE_RUN_ID}")"
          test "$(jq -r .head_sha <<<"$run_json")" = "$GITHUB_SHA"
          test "$(jq -r .conclusion <<<"$run_json")" = "success"
          test "$(jq -r .event <<<"$run_json")" = "workflow_dispatch"
          test "$(jq -r .path <<<"$run_json")" = ".github/workflows/real-host-gate.yml"
      - name: Download commit-bound real host gate
        if: inputs.release_class == 'governance-adoption'
        uses: actions/download-artifact@v4
        with:
          name: real-host-gate
          path: ${{ env.RELEASE_DIR }}
          run-id: ${{ inputs.gate_run_id }}
          github-token: ${{ github.token }}
      - name: Reconstruct candidate and verify every bound byte
        if: inputs.release_class == 'governance-adoption'
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          uv run python eval/real-agent/build_candidate.py \
            --root . --output "$RELEASE_DIR/reconstructed-candidate"
          uv run python eval/real-agent/release_gate.py verify \
            --root . \
            --candidate "$RELEASE_DIR/reconstructed-candidate" \
            --raw-gate "$RELEASE_DIR/raw-gate.json" \
            --gate-plan "$RELEASE_DIR/gate-plan.json" \
            --commit "$GITHUB_SHA" --version "${RELEASE_TAG#v}" \
            --manifest "$RELEASE_DIR/real-host-gate.json"
          jq -e --slurpfile classification "$RELEASE_DIR/classification-verification.json" '
            .candidate_sha256 == $classification[0].governance_gate.candidate_sha256 and
            (($classification[0].governance_gate.covered_suites - (.suites | keys)) | length == 0)
          ' "$RELEASE_DIR/real-host-gate.json" >/dev/null
      - name: Record release evidence disposition
        env:
          RELEASE_CLASS: ${{ inputs.release_class }}
          GATE_RUN_ID: ${{ inputs.gate_run_id }}
        run: |
          mkdir -p "$RELEASE_DIR"
          if test "$RELEASE_CLASS" = governance-adoption; then
            gate_status=PASS
            reason="Commit-bound adoption-grade Real Host Gate verified"
            gate_manifest_sha256="$(sha256sum "$RELEASE_DIR/real-host-gate.json" | cut -d' ' -f1)"
          else
            gate_status=NOT_APPLICABLE
            reason="Diff-bound classification contract declares no covered behavior claim or governance adoption"
            gate_manifest_sha256=""
          fi
          jq -n \
            --slurpfile classification "$RELEASE_DIR/classification-verification.json" \
            --arg version "$VERSION" --arg commit "$GITHUB_SHA" \
            --arg release_class "$RELEASE_CLASS" --arg gate_status "$gate_status" \
            --arg reason "$reason" --arg gate_run_id "$GATE_RUN_ID" \
            --arg gate_manifest_sha256 "$gate_manifest_sha256" \
            '{schema_version:"release-evidence/v1",version:$version,release_commit:$commit,release_class:$release_class,classification:$classification[0],real_host_gate:({status:$gate_status,reason:$reason} + (if $gate_run_id == "" then {} else {workflow_run_id:$gate_run_id,manifest_sha256:$gate_manifest_sha256} end))}' \
            > "$RELEASE_DIR/release-evidence.json"
      - env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
          RELEASE_CLASS: ${{ inputs.release_class }}
        run: |
          assets=(.aet/ci-download/ci/dist/* release-classification.json "$RELEASE_DIR/classification-verification.json" "$RELEASE_DIR/release-evidence.json" .aet/ci-download/ci/manifest.json)
          if test "$RELEASE_CLASS" = governance-adoption; then
            assets+=("$RELEASE_DIR/real-host-gate.json")
          fi
          gh release create "$RELEASE_TAG" "${assets[@]}" --generate-notes --title "AET $RELEASE_TAG"