validate-release.yml

name: Validate Release

on:
  pull_request:
    branches:
      - prod
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  validate-versions:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Extract Node version
        id: node-version
        run: |
          VERSION=$(node -p "require('./node/package.json').version")
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "Node version: $VERSION"

      - name: Extract Python version
        id: python-version
        run: |
          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' python/pyproject.toml)
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "Python version: $VERSION"

      - name: Ensure versions match
        run: |
          NODE_VERSION="${{ steps.node-version.outputs.VERSION }}"
          PYTHON_VERSION="${{ steps.python-version.outputs.VERSION }}"
          if [ "$NODE_VERSION" != "$PYTHON_VERSION" ]; then
            echo "Version mismatch: Node=$NODE_VERSION Python=$PYTHON_VERSION"
            exit 1
          fi
          echo "Versions match: $NODE_VERSION"

      - name: Ensure ClawHub skill version matches package version
        # rf-zgwj — the SKILL.md frontmatter version is what ClawHub publishes
        # under. Drift here would silently ship a stale version on the next
        # `clawhub skill publish` (publish.yaml). Both the Node and Python
        # resource copies must match the package version exactly.
        run: |
          PACKAGE_VERSION="${{ steps.node-version.outputs.VERSION }}"
          for skill_file in node/resources/rafter-security-skill.md python/rafter_cli/resources/rafter-security-skill.md; do
            SKILL_VERSION=$(sed -n 's/^version: *\(.*\)$/\1/p' "$skill_file" | head -1 | tr -d ' ')
            if [ -z "$SKILL_VERSION" ]; then
              echo "FAIL: $skill_file has no top-level 'version:' field"
              exit 1
            fi
            if [ "$SKILL_VERSION" != "$PACKAGE_VERSION" ]; then
              echo "FAIL: $skill_file version=$SKILL_VERSION but package=$PACKAGE_VERSION"
              echo "Update the version: line in $skill_file to match."
              exit 1
            fi
            echo "OK: $skill_file version matches ($SKILL_VERSION)"
          done

      - name: Check CHANGELOG updated
        run: |
          VERSION="${{ steps.node-version.outputs.VERSION }}"
          if ! grep -q "\[$VERSION\]" CHANGELOG.md; then
            echo "Warning: CHANGELOG.md missing entry for $VERSION"
          else
            echo "CHANGELOG.md updated for $VERSION"
          fi

  test-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Build Node package
        run: |
          cd node
          corepack enable
          corepack prepare pnpm@10 --activate
          pnpm install --frozen-lockfile
          pnpm run build
          pnpm test

      # sable-cazq — this job ran `pnpm test` for Node and nothing but a
      # wheel build for Python, so the pre-release gate asserted that the
      # Python package *compiles*, never that it works. ~80s of pytest is
      # the difference between those two claims.
      - name: Build and test Python package
        run: |
          cd python
          python -m pip install --upgrade build
          python -m build
          pip install -e .
          pip install pytest pytest-mock pytest-asyncio
          python -m pytest tests/ -q

      - name: Verify all artifacts
        run: |
          test -f node/dist/index.js || exit 1
          test -f python/dist/*.whl || exit 1
          test -f python/dist/*.tar.gz || exit 1
          echo "All build artifacts verified"

  test-package:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./node
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Enable pnpm
        run: corepack enable && corepack prepare pnpm@10 --activate

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm run build

      - name: Pack
        run: npm pack

      - name: Verify resources/pre-commit-hook.sh in tarball
        run: |
          TARBALL=$(ls rafter-security-cli-*.tgz | head -1)
          echo "Inspecting: $TARBALL"
          tar -tzf "$TARBALL" | grep "resources/pre-commit-hook.sh" \
            || (echo "FAIL: resources/pre-commit-hook.sh not found in tarball" && exit 1)
          echo "OK: resources/pre-commit-hook.sh present in tarball"

      - name: Test install-hook end-to-end from packed tarball
        run: |
          TARBALL=$(ls rafter-security-cli-*.tgz | head -1)
          npm install -g "./$TARBALL"
          rafter --version
          TMPDIR=$(mktemp -d)
          git init "$TMPDIR"
          git -C "$TMPDIR" config user.email "ci@test.local"
          git -C "$TMPDIR" config user.name "CI Test"
          (cd "$TMPDIR" && rafter agent install-hook)
          test -f "$TMPDIR/.git/hooks/pre-commit" \
            || (echo "FAIL: pre-commit hook not installed" && exit 1)
          echo "OK: pre-commit hook installed end-to-end"