release-qualification.yml

name: Release qualification

on:
  pull_request:
    branches: [main]

permissions:
  # The reusable release workflow also serves the prepare/publish entrypoint
  # and declares contents: write. GitHub requires callers to grant at least the
  # permissions declared by a called workflow, even when qualification itself
  # only checks out source and uploads artifacts.
  contents: write
  packages: write
  id-token: write

jobs:
  detect:
    runs-on: depot-ubuntu-24.04-arm
    outputs:
      is_release: ${{ steps.release.outputs.is_release }}
      source_ref: ${{ steps.release.outputs.source_ref }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Detect version-only release pull request
        id: release
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_REF_INPUT: ${{ github.event.pull_request.head.sha }}
          PR_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          SOURCE_REF="$SOURCE_REF_INPUT"
          if ! grep -qE '^[0-9a-f]{40}$' <<< "$SOURCE_REF"; then
            echo "::error::Release qualification requires an exact 40-character commit"
            exit 1
          fi
          HEAD_REPOSITORY="$PR_HEAD_REPOSITORY"
          HEAD_REF="$PR_HEAD_REF"
          BASE_SHA="$PR_BASE_SHA"

          CURRENT_VERSION=$(sed -n '/^\[workspace.package\]/,/^\[/s/^version = "\(.*\)"/\1/p' Cargo.toml)
          BASE_VERSION=$(git show "${BASE_SHA}:Cargo.toml" |
            sed -n '/^\[workspace.package\]/,/^\[/s/^version = "\(.*\)"/\1/p')
          if [ "$CURRENT_VERSION" != "$BASE_VERSION" ]; then
            if [ "$HEAD_REPOSITORY" != "$GITHUB_REPOSITORY" ]; then
              echo "::error::Release qualification only runs for repository-owned branches"
              exit 1
            fi
            if ! grep -qE '^[a-z0-9][a-z0-9._-]*/alien-[0-9]+-[a-z0-9]+(-[a-z0-9]+)*$' <<< "$HEAD_REF"; then
              echo "::error::Release qualification requires a Linear-derived branch"
              exit 1
            fi
            allowed='^(Cargo.toml|Cargo.lock|packages/(core|permissions|commands|sdk|testing|bindings|ai-gateway)/package.json|packages/permissions/generated/(bytes\.js|compiler\.js|compiler\.d\.ts)|crates/alien-bindings-node/package.json|client-sdks/(platform|manager)/typescript/(package.json|jsr.json|package-lock.json|src/lib/config.ts|\.speakeasy/(gen.yaml|gen.lock))|packages/bindings/npm/(darwin-arm64|darwin-x64|linux-x64-gnu|linux-arm64-gnu)/package.json|infra/helm/alien-manager/Chart.yaml|infra/aws-ecs-manager/variables.tf)$'
            unexpected=$(git diff --name-only "$BASE_SHA" "$SOURCE_REF" | grep -Ev "$allowed" || true)
            if [ -n "$unexpected" ]; then
              echo "::error::Release PR contains non-version files:"
              echo "$unexpected"
              exit 1
            fi
            BASE_SHA="$BASE_SHA" SOURCE_REF="$SOURCE_REF" RELEASE_VERSION="$CURRENT_VERSION" node --input-type=module <<'NODE'
            import { execFileSync } from 'node:child_process';
            import { withSDKReleaseVersion } from './scripts/sdk-release-metadata.mjs';

            const changed = execFileSync(
              'git',
              ['diff', '--name-only', process.env.BASE_SHA, process.env.SOURCE_REF],
              { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 },
            ).trim().split('\n').filter(Boolean);
            const fromRef = (ref, path) => execFileSync(
              'git',
              ['show', ref + ':' + path],
              { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 },
            );
            const stable = (value) => {
              if (Array.isArray(value)) return value.map(stable);
              if (value && typeof value === 'object') {
                return Object.fromEntries(
                  Object.keys(value).sort().map((key) => [key, stable(value[key])]),
                );
              }
              return value;
            };
            const normalizeJson = (path, content) => {
              const value = JSON.parse(content);
              value.version = '__RELEASE_VERSION__';
              if (path.endsWith('/package-lock.json') && value.packages?.['']) {
                value.packages[''].version = '__RELEASE_VERSION__';
              }
              return JSON.stringify(stable(value));
            };
            const normalizeSpeakeasy = (path, content) => path.endsWith('/gen.yaml')
              ? content.replace(/(typescript:\n  version: )[^\n]+/, '$1__RELEASE_VERSION__')
              : content.replace(/(  releaseVersion: )[^\n]+/, '$1__RELEASE_VERSION__');

            const releaseVersion = process.env.RELEASE_VERSION.replaceAll('.', '\\.');
            const requireVersion = (path, content, pattern) => {
              if (!pattern.test(content)) {
                console.error('::error::' + path + ' does not carry release version ' + process.env.RELEASE_VERSION);
                process.exit(1);
              }
            };

            for (const path of changed) {
              let base;
              let head;
              if (path.endsWith('/package.json') || path.endsWith('/jsr.json') ||
                  path.endsWith('/package-lock.json')) {
                base = normalizeJson(path, fromRef(process.env.BASE_SHA, path));
                head = normalizeJson(path, fromRef(process.env.SOURCE_REF, path));
              } else if (path.endsWith('/.speakeasy/gen.yaml') ||
                         path.endsWith('/.speakeasy/gen.lock')) {
                base = normalizeSpeakeasy(path, fromRef(process.env.BASE_SHA, path));
                head = normalizeSpeakeasy(path, fromRef(process.env.SOURCE_REF, path));
              } else if (path.endsWith('/src/lib/config.ts')) {
                base = withSDKReleaseVersion(fromRef(process.env.BASE_SHA, path), '0.0.0');
                head = withSDKReleaseVersion(fromRef(process.env.SOURCE_REF, path), '0.0.0');
              } else if (path === 'infra/helm/alien-manager/Chart.yaml') {
                const normalizeChart = (content) => content
                  .replace(/^version: .*$/m, 'version: __RELEASE_VERSION__')
                  .replace(/^appVersion: .*$/m, 'appVersion: __RELEASE_VERSION__');
                const chart = fromRef(process.env.SOURCE_REF, path);
                requireVersion(path, chart, new RegExp('^version: ' + releaseVersion + '$', 'm'));
                requireVersion(path, chart, new RegExp('^appVersion: "' + releaseVersion + '"$', 'm'));
                base = normalizeChart(fromRef(process.env.BASE_SHA, path));
                head = normalizeChart(chart);
              } else if (path === 'infra/aws-ecs-manager/variables.tf') {
                const imagePattern = /(ghcr\.io\/alienplatform\/alien-manager:v)[0-9][^"]*/;
                const normalizeModule = (content) => content.replace(imagePattern, '$1__RELEASE_VERSION__');
                const module = fromRef(process.env.SOURCE_REF, path);
                requireVersion(path, module, new RegExp('ghcr\\.io/alienplatform/alien-manager:v' + releaseVersion + '"'));
                base = normalizeModule(fromRef(process.env.BASE_SHA, path));
                head = normalizeModule(module);
              } else {
                continue;
              }
              if (base !== head) {
                console.error('::error::Release PR changes non-version metadata in ' + path);
                process.exit(1);
              }
            }
          NODE
            echo "is_release=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_release=false" >> "$GITHUB_OUTPUT"
          fi
          echo "source_ref=$SOURCE_REF" >> "$GITHUB_OUTPUT"

  qualify:
    needs: detect
    if: needs.detect.outputs.is_release == 'true'
    uses: ./.github/workflows/release.yml
    with:
      mode: stable
      stable_action: qualification
      source_ref: ${{ needs.detect.outputs.source_ref }}
    secrets: inherit

  release-qualification:
    name: Release qualification
    needs: [detect, qualify]
    if: always()
    runs-on: depot-ubuntu-24.04-arm
    steps:
      - name: Require qualification for release pull requests
        env:
          DETECT_RESULT: ${{ needs.detect.result }}
          IS_RELEASE: ${{ needs.detect.outputs.is_release }}
          QUALIFY_RESULT: ${{ needs.qualify.result }}
        run: |
          if [ "$DETECT_RESULT" != "success" ]; then
            echo "::error::Release qualification detection failed"
            exit 1
          fi
          if [ "$IS_RELEASE" = "true" ] && [ "$QUALIFY_RESULT" != "success" ]; then
            echo "::error::Release qualification did not complete successfully"
            exit 1
          fi