release.yml

name: Release

# One workflow per v* tag:
#
#   ci -> verify-tag + gate -> build-dist + build-binary-{linux,macos} -> github-release
#      -> publish (PyPI)
#
# github-release and publish run only in the upstream repository. The GitHub
# Release is created before the PyPI upload, so a version on PyPI always has
# its binaries; if the upload fails, re-run the publish job.
# No workflow_dispatch trigger: a manual run upstream would reach publish.

on:
  push:
    tags: ['v*']

permissions:
  contents: read

jobs:
  ci:
    name: CI on the tagged commit
    uses: ./.github/workflows/ci.yml

  verify-tag:
    name: Tag is on main and matches the version
    needs: ci
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          fetch-depth: 0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.11"

      # GITHUB_SHA is the commit this run checked out and tested. The tag ref
      # can be moved after the push, so it is not what gets checked.
      - name: Tested commit is on main
        run: |
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "::error::${GITHUB_REF_NAME} (${GITHUB_SHA}) is not on main; merge first, then tag"
            exit 1
          fi

      - name: Install packaging
        run: pip install packaging

      - name: Tag matches the package version
        run: python scripts/check_version.py --tag "${GITHUB_REF_NAME}"

  # The gate's lint, type, test, Rust and secret-scan checks already ran in
  # the ci job on this commit, so only the release-only checks run here.
  # --require-all makes a check that cannot run fail the release.
  gate:
    name: Release gate
    needs: ci
    runs-on: ubuntu-24.04
    steps:
      # Full history: the freeze and expected-results checks compare commits.
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          fetch-depth: 0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: pip install -e ".[dev]"

      # The package guard runs gitleaks over the built members; without it
      # that part is SKIP, which --require-all fails.
      - name: Install gitleaks
        env:
          GITLEAKS_VERSION: "8.28.0"
          GITLEAKS_SHA256: a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb
        run: |
          mkdir -p "$RUNNER_TEMP/bin"
          cd "$RUNNER_TEMP"
          curl -sSfL -o gitleaks.tgz \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          echo "${GITLEAKS_SHA256}  gitleaks.tgz" | sha256sum -c -
          tar xzf gitleaks.tgz -C "$RUNNER_TEMP/bin" gitleaks
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      - name: Release gate (release-only checks)
        run: >-
          python scripts/release_gate.py --tag "${GITHUB_REF_NAME}" --require-all
          --only examples,version,changelog,prose,package-guard

  build-dist:
    name: Build wheel and sdist
    needs: [verify-tag, gate]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.11"

      - name: Build
        run: pip install build && python -m build

      - name: Verify wheel installs
        run: pip install dist/*.whl && lakebench version

      - name: Install gitleaks
        env:
          GITLEAKS_VERSION: "8.28.0"
          GITLEAKS_SHA256: a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb
        run: |
          mkdir -p "$RUNNER_TEMP/bin"
          cd "$RUNNER_TEMP"
          curl -sSfL -o gitleaks.tgz \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          echo "${GITLEAKS_SHA256}  gitleaks.tgz" | sha256sum -c -
          tar xzf gitleaks.tgz -C "$RUNNER_TEMP/bin" gitleaks
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      # The files this job uploads are the ones published, so they are the
      # ones guarded; any SKIP or PENDING-OA5 stops the release here too.
      - name: Package guard (published artifacts)
        run: python scripts/package_guard.py --dist dist --require-all

      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: dist
          path: dist/

  # RHEL 8 (glibc 2.28) is the oldest platform lakebench supports, and a
  # binary runs only on a glibc at least as new as the one it was built
  # against, so the Linux binary is built on Rocky Linux 8 rather than on the
  # runner's Ubuntu (glibc 2.39). RHEL 8's python3.11 is built with a shared
  # libpython, which PyInstaller needs; the manylinux images' Pythons are not.
  build-binary-linux:
    name: Build binary (linux-amd64, glibc 2.28)
    needs: [verify-tag, gate]
    runs-on: ubuntu-24.04
    container: rockylinux:8
    steps:
      - name: Install build tools
        run: dnf install -y python3.11 python3.11-pip python3.11-devel git binutils

      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

      - name: Install dependencies
        run: python3.11 -m pip install -e ".[build]"

      - name: Build binary
        run: python3.11 -m PyInstaller lakebench.spec

      # objdump sees the PyInstaller bootloader; the libraries it unpacks at
      # run time come from this same Rocky 8 build root.
      - name: Smoke test and glibc ceiling
        run: |
          ./dist/lakebench version
          ./dist/lakebench --help
          ./dist/lakebench init --name smoketest -o /tmp/smoke.yaml
          test -f /tmp/smoke.yaml
          need="$(objdump -T dist/lakebench | grep -o 'GLIBC_[0-9.]*' | sed 's/GLIBC_//' | sort -V | tail -1)"
          if [ -z "$need" ]; then
            echo "::error::could not read GLIBC symbol versions from the binary"
            exit 1
          fi
          echo "binary requires glibc ${need}"
          if [ "$(printf '%s\n2.28\n' "$need" | sort -V | tail -1)" != "2.28" ]; then
            echo "::error::binary needs glibc ${need}, newer than RHEL 8's 2.28"
            exit 1
          fi

      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: lakebench-linux-amd64
          path: dist/lakebench

  build-binary-macos:
    name: Build binary (${{ matrix.os }})
    needs: [verify-tag, gate]
    runs-on: ${{ matrix.runner }}
    strategy:
      # Build both macOS binaries even if one fails, so a release attempt
      # shows every broken platform at once.
      fail-fast: false
      matrix:
        include:
          # macos-latest is arm64; the Intel binary needs an Intel runner.
          - os: macos-amd64
            runner: macos-15-intel
            arch: x86_64
          - os: macos-arm64
            runner: macos-15
            arch: arm64
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: pip install -e ".[build]"

      - name: Build binary
        run: pyinstaller lakebench.spec

      - name: Smoke test and architecture
        env:
          WANT_ARCH: ${{ matrix.arch }}
        run: |
          ./dist/lakebench version
          ./dist/lakebench --help
          ./dist/lakebench init --name smoketest -o /tmp/smoke.yaml
          test -f /tmp/smoke.yaml
          got="$(lipo -archs dist/lakebench)"
          echo "binary architectures: ${got}"
          if [ "$got" != "$WANT_ARCH" ]; then
            echo "::error::expected a ${WANT_ARCH}-only binary, got: ${got}"
            exit 1
          fi

      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: lakebench-${{ matrix.os }}
          path: dist/lakebench

  github-release:
    name: Create GitHub Release
    needs: [build-dist, build-binary-linux, build-binary-macos]
    if: github.repository == 'PureStorage-OpenConnect/lakebench-k8s'
    runs-on: ubuntu-24.04
    permissions:
      contents: write  # create the release
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          pattern: lakebench-*
          path: artifacts

      - name: Rename binaries
        run: |
          for dir in artifacts/lakebench-*; do
            os=$(basename "$dir" | sed 's/lakebench-//')
            mv "$dir/lakebench" "lakebench-${os}"
          done
          ls -la lakebench-*

      # install.sh downloads this file from the same release and refuses a
      # binary whose checksum does not match it.
      - name: Write SHA256SUMS
        run: |
          sha256sum lakebench-* > SHA256SUMS
          cat SHA256SUMS
          test "$(wc -l < SHA256SUMS)" -eq 3 || { echo "::error::SHA256SUMS does not list 3 binaries"; exit 1; }

      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          files: |
            lakebench-*
            SHA256SUMS
          generate_release_notes: true

  publish:
    name: Publish to PyPI
    needs: github-release
    if: github.repository == 'PureStorage-OpenConnect/lakebench-k8s'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write  # trusted publishing
    environment:
      name: pypi
      url: https://pypi.org/p/lakebench-k8s
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: dist
          path: dist

      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 (the release/v1 branch on 2026-09-30)