release.yml

name: Pre-release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

concurrency:
  group: prerelease-${{ github.repository }}-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  build_audit:
    runs-on: macos-26
    timeout-minutes: 45
    env:
      DEVELOPER_DIR: /Applications/Xcode_26.6.app/Contents/Developer
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"
          cache: pip
          cache-dependency-path: requirements-build.txt
      - name: Verify immutable GitHub Action pins
        run: python3 scripts/verify_action_pins.py
      - name: Bootstrap pinned build dependencies
        run: scripts/bootstrap.sh
      - name: Verify immutable tag and release metadata
        run: .build-venv/bin/python scripts/verify_release_metadata.py
      - name: Verify product and version consistency
        run: .build-venv/bin/python scripts/verify_product_version_truth.py
      - name: Audit locked Python dependencies
        run: scripts/audit_dependencies.sh
      - name: Scan the complete Git history for credentials
        run: scripts/release_secret_scan.py --history
      - name: Test and build
        run: scripts/build_app.sh
      - name: Package
        run: scripts/package_release.sh
      - name: Audit packaged artifact
        run: |
          .build-venv/bin/python scripts/release_artifact_audit.py dist/OpenUsage-Bar-*.zip
          scripts/release_dmg_audit.sh dist/OpenUsage-Bar-*.dmg
      - name: Prove isolated install, upgrade, rollback, and uninstall
        run: scripts/release_smoke.sh
      - name: Upload audited release candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: openusage-release-candidate
          path: |
            dist/OpenUsage-Bar-*.dmg
            dist/OpenUsage-Bar-*.dmg.sha256
            dist/OpenUsage-Bar-*.zip
            dist/OpenUsage-Bar-*.zip.sha256
            dist/OpenUsage-Bar-*-manifest.json
            dist/OpenUsage-Bar-*-sbom.spdx.json
          if-no-files-found: error
          retention-days: 7

  publish:
    needs: build_audit
    environment: release
    runs-on: macos-26
    timeout-minutes: 20
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"
      - name: Verify immutable GitHub Action pins
        run: python3 scripts/verify_action_pins.py
      - name: Create standard-library verification environment
        run: python3 -m venv .build-venv
      - name: Download audited release candidate
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: openusage-release-candidate
          path: release-candidate
          digest-mismatch: error
      - name: Reverify downloaded checksums and artifact policy
        run: |
          cd release-candidate
          test "$(find . -mindepth 1 -maxdepth 1 -type f | wc -l | tr -d ' ')" = 6
          test "$(find . -mindepth 1 -maxdepth 1 -type l | wc -l | tr -d ' ')" = 0
          test "$(find . -maxdepth 1 -type f -name 'OpenUsage-Bar-*.dmg.sha256' | wc -l | tr -d ' ')" = 1
          test "$(find . -maxdepth 1 -type f -name 'OpenUsage-Bar-*.zip.sha256' | wc -l | tr -d ' ')" = 1
          shasum -a 256 -c OpenUsage-Bar-*.dmg.sha256
          shasum -a 256 -c OpenUsage-Bar-*.zip.sha256
          cd ..
          .build-venv/bin/python scripts/release_artifact_audit.py release-candidate/OpenUsage-Bar-*.zip
          scripts/release_dmg_audit.sh release-candidate/OpenUsage-Bar-*.dmg
      - name: Verify release identity and eligibility barrier
        run: |
          .build-venv/bin/python scripts/verify_release_metadata.py \
            --tag "$GITHUB_REF_NAME" \
            --expected-commit "$GITHUB_SHA"
          .build-venv/bin/python scripts/verify_product_version_truth.py --require-release-eligible \
            --expected-tag "$GITHUB_REF_NAME" \
            --expected-source-sha "$GITHUB_SHA"
      - name: Attest release assets
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
        with:
          subject-path: |
            release-candidate/OpenUsage-Bar-*.dmg
            release-candidate/OpenUsage-Bar-*.dmg.sha256
            release-candidate/OpenUsage-Bar-*.zip
            release-candidate/OpenUsage-Bar-*.zip.sha256
            release-candidate/OpenUsage-Bar-*-manifest.json
            release-candidate/OpenUsage-Bar-*-sbom.spdx.json
      - name: Verify release asset attestations
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          for asset in release-candidate/OpenUsage-Bar-*; do
            gh attestation verify "$asset" \
              --repo tttboy123/openusage-bar \
              --signer-workflow tttboy123/openusage-bar/.github/workflows/release.yml \
              --source-ref "refs/tags/$GITHUB_REF_NAME" \
              --deny-self-hosted-runners
          done
      - name: Probe pre-release existence
        id: probe_prerelease
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release_endpoint="$(python3 -c 'import os, urllib.parse; print("repos/tttboy123/openusage-bar/releases/tags/" + urllib.parse.quote(os.environ["GITHUB_REF_NAME"], safe=""))')"
          probe_headers="$RUNNER_TEMP/openusage-release-publish-probe.txt"
          if gh api --include --silent "$release_endpoint" \
            > "$probe_headers" 2>/dev/null; then
            probe_exit=0
          else
            probe_exit=$?
          fi
          probe_http_status="$(awk '/^HTTP\// { status = $2 } END { print status }' "$probe_headers")"

          if [ "$probe_exit" -eq 0 ] && [ "$probe_http_status" = "200" ]; then
            echo "state=existing" >> "$GITHUB_OUTPUT"
          elif [ "$probe_http_status" = "404" ]; then
            echo "state=absent" >> "$GITHUB_OUTPUT"
          else
            echo "Unable to establish pre-release existence safely; publication was not attempted." >&2
            exit 1
          fi
      - name: Create pre-release when absent
        id: create_prerelease
        if: steps.probe_prerelease.outputs.state == 'absent'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            release-candidate/OpenUsage-Bar-*.dmg \
            release-candidate/OpenUsage-Bar-*.dmg.sha256 \
            release-candidate/OpenUsage-Bar-*.zip \
            release-candidate/OpenUsage-Bar-*.zip.sha256 \
            release-candidate/OpenUsage-Bar-*-manifest.json \
            release-candidate/OpenUsage-Bar-*-sbom.spdx.json \
            --repo tttboy123/openusage-bar \
            --prerelease \
            --generate-notes \
            --title "OpenUsage Bar $GITHUB_REF_NAME"
      - name: Read back release and form publication receipt
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p release-receipt
          gh release view "$GITHUB_REF_NAME" \
            --repo tttboy123/openusage-bar \
            --json databaseId,isPrerelease,publishedAt,tagName,assets \
            > release-receipt/github-release.json
          .build-venv/bin/python scripts/github_release_receipt.py \
            --schema-version github-release-receipt/v1 \
            --release-json release-receipt/github-release.json \
            --assets-dir release-candidate \
            --repository tttboy123/openusage-bar \
            --tag "$GITHUB_REF_NAME" \
            --source-sha "$GITHUB_SHA" \
            --output release-receipt/github-release-receipt-v1.json
      - name: Preserve public publication receipt
        id: preserve_publication_receipt
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: openusage-github-release-receipt
          path: release-receipt/github-release-receipt-v1.json
          if-no-files-found: error
          retention-days: 90
      - name: Delete receiptless pre-release created by this run
        if: failure() && steps.create_prerelease.outcome == 'success'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release_endpoint="$(python3 -c 'import os, urllib.parse; print("repos/tttboy123/openusage-bar/releases/tags/" + urllib.parse.quote(os.environ["GITHUB_REF_NAME"], safe=""))')"
          probe_headers="$RUNNER_TEMP/openusage-release-cleanup-probe.txt"
          if gh api --include --silent "$release_endpoint" \
            > "$probe_headers" 2>/dev/null; then
            probe_exit=0
          else
            probe_exit=$?
          fi
          probe_http_status="$(awk '/^HTTP\// { status = $2 } END { print status }' "$probe_headers")"

          if [ "$probe_http_status" = "404" ]; then
            echo "No pre-release exists for this tag; cleanup is already complete."
          elif [ "$probe_exit" -ne 0 ]; then
            echo "Unable to verify the pre-release cleanup target safely." >&2
            exit 1
          elif gh release delete "$GITHUB_REF_NAME" \
            --repo tttboy123/openusage-bar \
            --yes 2>"$RUNNER_TEMP/openusage-release-delete.err"; then
            echo "Receiptless pre-release created by this run was deleted; the tag was retained."
          else
            delete_exit=$?
            if gh api --include --silent "$release_endpoint" \
              > "$probe_headers" 2>/dev/null; then
              post_delete_probe_exit=0
            else
              post_delete_probe_exit=$?
            fi
            post_delete_http_status="$(awk '/^HTTP\// { status = $2 } END { print status }' "$probe_headers")"
            if [ "$post_delete_http_status" = "404" ]; then
              echo "The pre-release is already absent; cleanup is complete."
            else
              echo "Pre-release deletion failed and absence could not be verified." >&2
              if [ "$post_delete_probe_exit" -ne 0 ]; then
                exit "$post_delete_probe_exit"
              fi
              exit "$delete_exit"
            fi
          fi
      - name: Report recovery for unconfirmed pre-release ownership
        if: failure() && steps.probe_prerelease.outputs.state == 'absent' && steps.create_prerelease.outcome != 'success'
        run: |
          cat <<'EOF' | tee -a "$GITHUB_STEP_SUMMARY"
          ### Recovery: pre-release ownership unconfirmed

          The existence probe reported no pre-release, but the creation step did not record a successful outcome.
          A race or network failure can leave remote state uncertain, so this workflow will not delete a pre-release it cannot prove it created.
          Inspect the GitHub pre-release for this tag, then resolve any mismatch and rerun the protected workflow.
          Product truth must remain unchanged until a successful rerun preserves and validates the publication receipt.
          EOF
      - name: Report recovery for retained pre-existing pre-release
        if: failure() && steps.probe_prerelease.outputs.state == 'existing'
        run: |
          cat <<'EOF' | tee -a "$GITHUB_STEP_SUMMARY"
          ### Recovery: pre-existing pre-release retained

          The pre-existing pre-release was retained because this run did not create it.
          Rerun this workflow for the same tag after resolving the receipt failure.
          Do not advance product truth to `prerelease_published` unless a successful rerun preserves the public receipt artifact.
          EOF
      - name: Record product truth publication evidence
        if: success() && steps.preserve_publication_receipt.outcome == 'success'
        run: |
          cat <<'EOF' | tee -a "$GITHUB_STEP_SUMMARY"
          ### Publication evidence preserved

          The public receipt artifact is available for an audited product truth update.
          Only that receipt artifact may support advancing product truth to `prerelease_published`; this summary is not a substitute for the receipt.
          EOF