container-release.yml

name: container-release

on:
  push:
    tags:
      - "container-v*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  source:
    if: github.repository == 'openai/codex-security'
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.release.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Resolve the protected container release
        id: release
        shell: bash
        run: |
          set -euo pipefail
          version=$(jq -er .version sdk/typescript/package.json)
          [[ $version =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || exit 1
          if [[ $GITHUB_EVENT_NAME == workflow_dispatch ]]; then
            test "$GITHUB_REF" = refs/heads/main
          else
            test "$GITHUB_REF" = "refs/tags/container-v$version"
          fi
          git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main
          # A manual request on main may follow the npm release commit.
          npm_sha=$(git rev-parse --verify "refs/tags/npm-v$version^{commit}")
          if [[ $GITHUB_EVENT_NAME == push ]]; then test "$npm_sha" = "$GITHUB_SHA"; fi
          git merge-base --is-ancestor "$npm_sha" "$GITHUB_SHA"
          echo "version=$version" >> "$GITHUB_OUTPUT"

  dispatch:
    name: Start the verified npm release backfill
    needs: source
    runs-on: ubuntu-24.04
    permissions:
      actions: write
    steps:
      - name: Dispatch the coordinator on protected main
        id: dispatch
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.source.outputs.version }}
        run: |
          set -euo pipefail
          id=$(gh api --method POST -H 'X-GitHub-Api-Version: 2026-03-10' \
            "repos/$GITHUB_REPOSITORY/actions/workflows/node-github-release.yml/dispatches" \
            -f ref=main -f "inputs[tag]=npm-v$VERSION" --jq .workflow_run_id)
          [[ $id =~ ^[0-9]+$ ]] || exit 1
          printf 'run-id=%s\n' "$id" >> "$GITHUB_OUTPUT"
          printf 'Container publication for npm-v%s is tracked in the [release run](%s/%s/actions/runs/%s).\n' "$VERSION" "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$id" >> "$GITHUB_STEP_SUMMARY" || true

      - name: Start release progress observer
        if: steps.dispatch.outputs.run-id != ''
        continue-on-error: true
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_RUN_ID: ${{ steps.dispatch.outputs.run-id }}
        run: |
          timeout --kill-after=5s 10s gh workflow run release-progress.yml \
            --repo "$GITHUB_REPOSITORY" --ref main \
            -f "run-id=$RELEASE_RUN_ID" -f watch=true