release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  build:
    name: Build and validate release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Check out tagged commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Require tagged commit to be integrated in the default branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          git fetch --no-tags origin "${DEFAULT_BRANCH}"
          git merge-base --is-ancestor \
            "${GITHUB_SHA}" \
            "origin/${DEFAULT_BRANCH}"

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
          cache: pip

      - name: Install pipeline and validation dependencies
        run: >-
          python -m pip install
          -r requirements.txt
          -r requirements-dev.txt
          -r requirements-geography.txt

      - name: Require tag to match project metadata
        run: >-
          test
          "$(python -c 'import json; print(json.load(open("project.json"))["dataset_version"])')"
          = "${GITHUB_REF_NAME}"

      - name: Validate tagged data
        run: python scripts/validate_dataset.py

      - name: Verify declared source snapshots and checksums
        run: >-
          python -c
          "import sys; sys.path.insert(0, 'scripts');
          from source_data import validate_declared_sources;
          validate_declared_sources()"

      - name: Run tests
        run: python -m unittest discover -s tests -v

      - name: Rebuild and verify committed geographic base
        run: python scripts/build_geography.py --check --require-rebuild

      - name: Validate the schema 4 typed preview
        run: python scripts/validate_typed_contract.py

      - name: Build release directory
        run: >-
          python scripts/build_release.py
          --version "${GITHUB_REF_NAME}"

      - name: Validate release directory
        run: >-
          python scripts/validate_release.py
          --directory "dist/${GITHUB_REF_NAME}"

      - name: Preserve release package as workflow artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: "Italian_Cities-${{ github.ref_name }}"
          path: "dist/${{ github.ref_name }}/"
          if-no-files-found: error
          retention-days: 30

  publish:
    name: Attest and publish release
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      attestations: write
      contents: write
      id-token: write
    steps:
      - name: Check out release metadata
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download validated release package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: "Italian_Cities-${{ github.ref_name }}"
          path: "dist/${{ github.ref_name }}"

      - name: Verify release checksums
        working-directory: "dist/${{ github.ref_name }}"
        run: shasum -a 256 -c SHA256SUMS

      - name: Attest release assets
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: "dist/${{ github.ref_name }}/*"

      - name: Refuse to overwrite an existing release
        env:
          GH_TOKEN: ${{ github.token }}
        run: >-
          ! gh release view "${GITHUB_REF_NAME}"
          --repo "${GITHUB_REPOSITORY}"

      - name: Create draft GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release_status="$(python -c 'import json; print(json.load(open("project.json"))["release_status"])')"
          if [ "${release_status}" = "prerelease" ]; then
            gh release create "${GITHUB_REF_NAME}" \
              --repo "${GITHUB_REPOSITORY}" \
              --verify-tag \
              --draft \
              --prerelease \
              --title "Italian Cities ${GITHUB_REF_NAME}" \
              --notes-file "release/${GITHUB_REF_NAME}.md"
          else
            gh release create "${GITHUB_REF_NAME}" \
              --repo "${GITHUB_REPOSITORY}" \
              --verify-tag \
              --draft \
              --title "Italian Cities ${GITHUB_REF_NAME}" \
              --notes-file "release/${GITHUB_REF_NAME}.md"
          fi

      - name: Upload release assets to the draft
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${GITHUB_REF_NAME}" \
            "dist/${GITHUB_REF_NAME}/municipalities.csv" \
            "dist/${GITHUB_REF_NAME}/localities.csv" \
            "dist/${GITHUB_REF_NAME}/postal_codes.csv" \
            "dist/${GITHUB_REF_NAME}/italian_locations.csv" \
            "dist/${GITHUB_REF_NAME}/italian_locations.json" \
            "dist/${GITHUB_REF_NAME}/italian_locations.xlsx" \
            "dist/${GITHUB_REF_NAME}/italian_locations.sqlite" \
            "dist/${GITHUB_REF_NAME}/italian_locations.sql" \
            "dist/${GITHUB_REF_NAME}/SHA256SUMS" \
            --repo "${GITHUB_REPOSITORY}"

      - name: Verify draft assets before publication
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          expected_assets="$(
            find "dist/${GITHUB_REF_NAME}" -maxdepth 1 -type f \
              -exec basename {} \; |
              LC_ALL=C sort
          )"
          published_assets="$(
            gh release view "${GITHUB_REF_NAME}" \
              --repo "${GITHUB_REPOSITORY}" \
              --json assets \
              --jq '.assets[].name' |
              LC_ALL=C sort
          )"
          test "${expected_assets}" = "${published_assets}"

      - name: Publish the complete release
        env:
          GH_TOKEN: ${{ github.token }}
        run: >-
          gh release edit "${GITHUB_REF_NAME}"
          --repo "${GITHUB_REPOSITORY}"
          --draft=false