release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version, with or without the leading v (example: 2.13.1)"
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  test:
    name: Test Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install
        run: |
          python -m pip install -U pip
          python -m pip install -e ".[test]"
      - name: Pytest
        env:
          ABSTRACTCORE_RUN_LOCAL_PROVIDER_TESTS: "0"
          ABSTRACTCORE_RUN_LIVE_API_TESTS: "0"
          ABSTRACTCORE_RUN_MLX_TESTS: "0"
          ABSTRACTCORE_RUN_HUGGINGFACE_TESTS: "0"
          ABSTRACTCORE_TEST_HERMETIC_MODEL_DISCOVERY: "1"
        run: python -m pytest

  # The local-model tests (Transformers, llama.cpp, torch) skip in the job
  # above, whose `[test]` extra installs none of those engines. This job
  # installs them for CPU and runs the whole suite, so a test that only runs
  # with the engines present is seen on every push. No model is downloaded:
  # the tests drive tiny stand-ins and fakes.
  local-models:
    name: Local-model tests (CPU torch, transformers, llama.cpp)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
      - name: Install (CPU wheels)
        run: |
          python -m pip install -U pip
          python -m pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu
          python -m pip install "llama-cpp-python>=0.3.23,<1.0.0" --extra-index-url https://abetlen.github.io/llama-cpp-python/whl/cpu
          python -m pip install -e ".[test,huggingface]"
          python -c "import torch, transformers, llama_cpp; print('torch', torch.__version__, 'transformers', transformers.__version__, 'llama_cpp', llama_cpp.__version__)"
      - name: Pytest
        env:
          ABSTRACTCORE_RUN_LOCAL_PROVIDER_TESTS: "0"
          ABSTRACTCORE_RUN_LIVE_API_TESTS: "0"
          ABSTRACTCORE_RUN_MLX_TESTS: "0"
          ABSTRACTCORE_RUN_HUGGINGFACE_TESTS: "0"
          ABSTRACTCORE_TEST_HERMETIC_MODEL_DISCOVERY: "1"
        run: python -m pytest

  docs:
    name: Build docs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
      - name: Install
        run: |
          python -m pip install -U pip
          python -m pip install -e ".[docs]"
      - name: MkDocs build
        run: mkdocs build -q

  build:
    name: Build distributions
    runs-on: ubuntu-latest
    needs: [test, local-models, docs]
    outputs:
      version: ${{ steps.release-meta.outputs.version }}
      tag: ${{ steps.release-meta.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip
      - name: Install build tools
        run: |
          python -m pip install -U pip
          python -m pip install build twine
      - name: Validate tag, version, and changelog
        id: release-meta
        env:
          RELEASE_INPUT_VERSION: ${{ github.event.inputs.version || '' }}
        run: |
          python - <<'PY'
          import os
          import re
          from pathlib import Path

          version_input = os.environ.get("RELEASE_INPUT_VERSION", "").strip()
          ref_name = os.environ["GITHUB_REF_NAME"].strip()
          raw_version = version_input or ref_name
          version = raw_version[1:] if raw_version.startswith("v") else raw_version
          if not re.fullmatch(r"\d+\.\d+\.\d+(?:[a-zA-Z0-9.-]+)?", version):
              raise SystemExit(f"Invalid release version: {raw_version!r}")
          tag = f"v{version}"

          version_text = Path("abstractcore/utils/version.py").read_text()
          version_match = re.search(r'__version__\s*=\s*"([^"]+)"', version_text)
          if not version_match:
              raise SystemExit("Could not find __version__ in abstractcore/utils/version.py")
          package_version = version_match.group(1)
          if version != package_version:
              raise SystemExit(
                  f"Tag version {version!r} does not match package version {package_version!r}"
              )

          changelog = Path("CHANGELOG.md").read_text()
          header = re.search(rf"^## \[{re.escape(version)}\] - .+$", changelog, re.MULTILINE)
          if not header:
              raise SystemExit(f"CHANGELOG.md has no entry for {version}")

          rest = changelog[header.end():]
          next_header = re.search(r"^## \[", rest, re.MULTILINE)
          notes = rest[: next_header.start() if next_header else len(rest)].strip()
          if not notes:
              raise SystemExit(f"CHANGELOG.md entry for {version} is empty")

          Path("release-notes.md").write_text(notes + "\n")
          github_output = Path(os.environ["GITHUB_OUTPUT"])
          with github_output.open("a", encoding="utf-8") as fh:
              print(f"version={version}", file=fh)
              print(f"tag={tag}", file=fh)
          PY
      - name: Build
        run: python -m build
      - name: Check distributions
        run: python -m twine check dist/*
      - uses: actions/upload-artifact@v4
        with:
          name: release-dist
          path: dist/*
      - uses: actions/upload-artifact@v4
        with:
          name: release-notes
          path: release-notes.md

  ensure-tag:
    name: Ensure release tag
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Create annotated tag for manual releases
        if: github.event_name == 'workflow_dispatch'
        run: |
          tag="${{ needs.build.outputs.tag }}"
          if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
            echo "Tag ${tag} already exists on origin."
            exit 1
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "${tag}" -m "AbstractCore ${tag}"
          git push origin "${tag}"
      - name: Tag already supplied by push trigger
        if: github.event_name != 'workflow_dispatch'
        run: echo "Using existing tag ${{ needs.build.outputs.tag }}"

  publish-pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: [build, ensure-tag]
    environment:
      name: pypi
      url: https://pypi.org/project/abstractcore/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: release-dist
          path: dist
      - uses: pypa/gh-action-pypi-publish@release/v1

  publish-ghcr:
    name: Publish GHCR server image
    runs-on: ubuntu-latest
    needs: [build, ensure-tag, publish-pypi]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Wait for PyPI release
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          python - <<'PY'
          import json
          import os
          import time
          import urllib.request

          version = os.environ["VERSION"]
          url = f"https://pypi.org/pypi/abstractcore/{version}/json"
          for attempt in range(1, 31):
              try:
                  with urllib.request.urlopen(url, timeout=10) as response:
                      if response.status == 200:
                          json.loads(response.read().decode("utf-8"))
                          print(f"abstractcore {version} is available on PyPI")
                          raise SystemExit(0)
              except Exception as exc:
                  print(f"PyPI not ready yet (attempt {attempt}/30): {exc}")
              time.sleep(10)
          raise SystemExit(f"Timed out waiting for abstractcore {version} on PyPI")
          PY
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/abstractcore-server/Dockerfile
          platforms: linux/amd64,linux/arm64
          provenance: false
          push: true
          build-args: |
            ABSTRACTCORE_VERSION=${{ needs.build.outputs.version }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/abstractcore-server:${{ needs.build.outputs.version }}
            ghcr.io/${{ github.repository_owner }}/abstractcore-server:latest

  console-tui:
    name: Test console-tui crate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: console-tui
      - name: Format
        working-directory: console-tui
        run: cargo fmt --check
      - name: Clippy
        working-directory: console-tui
        run: cargo clippy --locked --all-targets -- -D warnings
      - name: Test
        working-directory: console-tui
        run: cargo test --locked
      - name: Package
        working-directory: console-tui
        run: cargo package --locked

  # The terminal console ships as its own crate (`abstractcore-console`),
  # versioned in console-tui/Cargo.toml independently of the Python package.
  # abstractgateway-console depends on it, so it publishes with the core
  # release (lower first). A crates.io version is permanent, so an
  # already-published version is skipped instead of failing the release.
  publish-console-crate:
    name: Publish console-tui to crates.io
    runs-on: ubuntu-latest
    needs: [build, ensure-tag, console-tui]
    environment: crates-io
    permissions:
      contents: read
      # Trusted Publishing: crates.io mints a short-lived token from this
      # workflow's OIDC identity; no long-lived secret lives in the repo.
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Is this version already published?
        id: check
        run: |
          set -euo pipefail
          VERSION="$(sed -n 's/^version = "\(.*\)"/\1/p' console-tui/Cargo.toml | head -1)"
          CODE="$(curl -sS -o /dev/null -w '%{http_code}' \
            -H 'User-Agent: abstractcore-release' \
            "https://crates.io/api/v1/crates/abstractcore-console/${VERSION}")"
          if [ "$CODE" = "200" ]; then
            echo "abstractcore-console ${VERSION} is already on crates.io; skipping publish"
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Authenticate to crates.io
        if: steps.check.outputs.published == 'false'
        uses: rust-lang/crates-io-auth-action@v1
        id: auth
      - name: Publish
        if: steps.check.outputs.published == 'false'
        run: cargo publish --manifest-path console-tui/Cargo.toml --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [build, ensure-tag, publish-pypi, publish-ghcr]
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: release-dist
          path: dist
      - uses: actions/download-artifact@v4
        with:
          name: release-notes
          path: .
      - uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.build.outputs.tag }}
          name: AbstractCore ${{ needs.build.outputs.tag }}
          body_path: release-notes.md
          files: dist/*
          fail_on_unmatched_files: true