gmail-channel-molecule/.gitea/workflows/auto-release.yml

name: auto-release

# Publish-on-merge: pyproject.toml [project].version is the source of truth
# (bumped IN the PR); a green merge to main cuts the tag `v<that version>` if it
# does not exist yet, and publish.yml takes the tag from there. CI never pushes a
# commit to main (tag-ref writes bypass branch push protection), and an
# already-tagged version is a loud no-op, so re-runs / non-bump merges are safe.
#
# Gitea has no `workflow_run` trigger, so the merge-blocking unit gate is re-run
# inline here and the tag is cut only on green. The gate mirrors ci.yml — stdlib
# tests, public-PyPI-only deps — so it never couples the release to the private
# Gitea index / Infisical.

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: auto-release
  cancel-in-progress: false

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Install test deps (public PyPI only)
        run: pip install --quiet pytest pyyaml
      - name: Byte-compile
        run: python -m py_compile gmail_channel_molecule/*.py
      - name: Re-run the merge-blocking gate (unit tests)
        run: pytest tests/ -q

  release:
    runs-on: ubuntu-latest
    needs: gate
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Cut tag v<pyproject version> if untagged
        env:
          RELEASE_BOT_TOKEN: ${{ secrets.RELEASE_BOT_TOKEN }}
          GITEA_URL: https://git.moleculesai.app
          REPO: molecule-ai/gmail-channel-molecule
        run: |
          set -eu
          if [ -z "${RELEASE_BOT_TOKEN:-}" ]; then
            echo "::error::RELEASE_BOT_TOKEN org secret is not available -- cannot cut the release tag"
            exit 1
          fi
          VERSION=$(python3 - <<'PY'
          import tomllib
          with open("pyproject.toml", "rb") as f:
              print(tomllib.load(f)["project"]["version"])
          PY
          )
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+([a-z0-9.+-]+)?$'; then
            echo "::error::pyproject version $VERSION does not look like a PEP 440 release"
            exit 1
          fi
          TAG="v$VERSION"
          STATUS=$(curl -sS -o /dev/null -w "%{http_code}" \
            -H "Authorization: token $RELEASE_BOT_TOKEN" -H "User-Agent: curl/8.4.0" \
            "$GITEA_URL/api/v1/repos/$REPO/tags/$TAG")
          if [ "$STATUS" = "200" ]; then
            # The tag exists. That is only benign when main is STILL AT that tag.
            # If main has moved on, every commit since is unreleased — and this
            # step used to exit 0 green and say "nothing to release", which is how
            # the Cloudflare User-Agent fix (PR #2) sat unpublished on main while
            # every install kept pulling the broken v0.1.0 wheel. That silence cost
            # a production channel outage and a misdirected investigation
            # (runtime#360). Bumping the version in pyproject.toml is the release
            # action; not bumping it must be loud, not green.
            TAGGED_SHA=$(curl -sS -H "Authorization: token $RELEASE_BOT_TOKEN" \
              -H "User-Agent: curl/8.4.0" \
              "$GITEA_URL/api/v1/repos/$REPO/tags/$TAG" \
              | python3 -c 'import sys,json; d=json.load(sys.stdin); print((d.get("commit") or {}).get("sha",""))')
            if [ "$TAGGED_SHA" = "$GITHUB_SHA" ]; then
              echo "::notice::$TAG already exists at this exact commit -- nothing to release"
              exit 0
            fi
            echo "::error::$TAG already exists but points at ${TAGGED_SHA:-<unknown>}, while main is at $GITHUB_SHA."
            echo "::error::Every commit since $TAG is UNRELEASED: the published wheel does not contain it."
            echo "::error::Bump [project].version in pyproject.toml (currently $VERSION) so a new tag can be cut."
            exit 1
          fi
          BODY=$(printf '{"tag_name":"%s","target":"%s","message":"auto-release %s (green merge to main)"}' \
            "$TAG" "$GITHUB_SHA" "$TAG")
          CODE=$(curl -sS -o /tmp/tag-out.json -w "%{http_code}" -X POST \
            -H "Authorization: token $RELEASE_BOT_TOKEN" -H "User-Agent: curl/8.4.0" \
            -H "Content-Type: application/json" \
            "$GITEA_URL/api/v1/repos/$REPO/tags" -d "$BODY")
          if [ "$CODE" != "201" ]; then
            echo "::error::tag creation failed (HTTP $CODE): $(cat /tmp/tag-out.json)"
            exit 1
          fi
          echo "::notice::cut $TAG at $GITHUB_SHA -- publish.yml takes it from here"