release-src.yml

name: release-src

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      release_tag:
        description: Tag to publish the source tarballs to
        required: true
        default: v0.0.0

jobs:
  plan:
    name: plan the per-line release units (diff-aware)
    runs-on: ubuntu-latest
    outputs:
      lines: ${{ steps.emit.outputs.lines }}
      lines_count: ${{ steps.emit.outputs.lines_count }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
        with:
          ruby-version: "3.2"
      # One release unit per line PRESENT in versions.yml: changed lines
      # build (their smoke gates their builds), unchanged lines carry
      # their assets forward as sha256-verified copies. The line's own
      # unit recomputes its rows from the shared tools (tools/build_matrix
      # --line / tools/smoke_matrix --line over Tfs::ReleaseDiff's
      # patch→scenario attribution) — no matrix logic lives in YAML.
      - id: emit
        env:
          RELEASE_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}
        run: |
          lines=$(tools/build_matrix "$RELEASE_TAG" --lines)
          {
            echo "lines=$lines"
            # The count drives the job-level if: on release (an
            # unguarded empty matrix poisons the run conclusion).
            echo "lines_count=$(jq 'length' <<< "$lines")"
          } >> "$GITHUB_OUTPUT"
          # The line list to the LOG as well (the per-line units re-plan
          # with git available; this job only lists — v0.2.24 record).
          echo "plan: tag=$RELEASE_TAG lines=$lines"

  # The per-line release units: each line's tip smoke runs FIRST and
  # gates only its own line's builds; copies run independently. A line
  # that fails blocks the publish (its changed assets must never be
  # back-filled with stale copies) but never another line's work.
  release:
    name: release ${{ matrix.line }}
    needs: plan
    if: needs.plan.outputs.lines_count != '0'
    strategy:
      fail-fast: false
      matrix:
        line: ${{ fromJSON(needs.plan.outputs.lines) }}
    uses: ./.github/workflows/_release-line.yml
    with:
      line: ${{ matrix.line }}
      tag: ${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}

  publish:
    name: publish release
    needs: [plan, release]
    # Every line unit succeeded (or there was nothing to do): a failed
    # line blocks the publish rather than shipping its stale copies.
    if: ${{ always() && needs.plan.result == 'success' && (needs.release.result == 'success' || needs.release.result == 'skipped') }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      # The provenance ledger tool lives in the repo — the publish job needs
      # the checkout (the release legs run their own; publish previously had
      # none).
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
        with:
          ruby-version: "3.2"
      # Diagnosability first: needs.<job>.result is evaluated server-side,
      # so echo exactly what the gate saw before doing anything else -- the
      # next publish-gate flake must be self-explaining in the job log.
      - name: needs results (publish gate diagnostic)
        run: |
          echo "plan.result    = ${{ needs.plan.result }}"
          echo "release.result = ${{ needs.release.result }}"
          echo "needs (full)   = ${{ toJSON(needs) }}"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: tfs-ruby-*-src*
          path: dist
          merge-multiple: true
      - name: SHA256SUMS
        working-directory: dist
        run: |
          cat *.sha256 > SHA256SUMS
          rm -f *.sha256
      # The provenance ledger (README § "Provenance ledger"): the
      # cumulative, append-only record of every src-tarball digest this
      # factory has published — what makes a runtime's recorded
      # built_from.sources[].sha256 verifiable after the fact, even after
      # the tarball re-rolls under the same version pin. Chained from the
      # newest existing release's provenance.yaml (bootstrapped from every
      # published SHA256SUMS while none carries one). Publish-gated: the
      # ledger must extend the previous one as an exact prefix and cover
      # every asset of this release, or the publish fails named.
      - name: build + check the provenance ledger
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tools/provenance --build \
            --tag "${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}" \
            --sums dist/SHA256SUMS \
            --out dist/provenance.yaml
      # Record the published tag so the workflow_run follow-up
      # (runtime-pin-bump.yml) can read it back deterministically for both
      # trigger paths (tag push and manual dispatch).
      - name: record release tag
        run: echo "${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}" > release-tag.txt
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-tag
          path: release-tag.txt
          retention-days: 1
      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          tag_name: ${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}
          files: |
            dist/*.tar.gz
            dist/SHA256SUMS
            dist/provenance.yaml