feat(sdks): fold SDK monorepo in-tree under sdks/

.github/workflows/release-sdks.yml

@@ -0,0 +1,349 @@
+name: Release-SDKs
+
+# Consolidated, dispatch-only release pipeline for all five go-ios SDKs
+# (typescript, python, java, csharp, mcp). They are generated from ONE OpenAPI
+# spec, so they ship in lockstep: a single `version` input is stamped into every
+# package manifest and published to every registry together.
+#
+# Safety model (mirrors the CLI release.yml):
+#   * Dispatch only. There is no tag/push trigger, so nothing here ever runs off
+#     a merge. `dry_run` defaults to true.
+#   * All build/test happens BEFORE any upload. If a single package fails to
+#     build or test, no publish job runs, so a bad build ships nothing.
+#   * Every real upload is gated twice:
+#       1. `if: ${{ !inputs.dry_run }}` — a dry run does a real dry-run instead
+#          (npm --dry-run, twine check, mvn verify, dotnet pack) with NO upload.
+#       2. a secret/trust-presence guard — even a non-dry run SKIPS the upload,
+#          with a clear log line, when the registry isn't armed yet. This makes
+#          the first real run safe to do before the registries exist.
+#   * The git tag + GitHub release are created only after every publish job
+#     succeeds AND it was not a dry run.
+#
+# Auth (see sdks/docs/RELEASING.md for the registry prerequisites):
+#   * npm       — OIDC trusted publishing (id-token: write, provenance). NO token.
+#   * PyPI      — trusted publishing via pypa/gh-action-pypi-publish (id-token).
+#   * Maven     — central-publishing-maven-plugin + GPG (MAVEN_GPG_PRIVATE_KEY,
+#                 MAVEN_GPG_PASSPHRASE, CENTRAL_TOKEN_USERNAME, CENTRAL_TOKEN_PASSWORD).
+#   * NuGet     — dotnet nuget push with NUGET_API_KEY.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "SDK version to release (semver, e.g. 0.1.0). Stamped into all five package manifests."
+        required: true
+        type: string
+      dry_run:
+        description: "Dry run: build/test + real dry-run of every publish, but upload nothing and create no tag/release."
+        required: true
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  # --- Stamp the version into every manifest and hand the tree to build jobs ---
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.setv.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Stamp version into all package manifests
+        id: setv
+        run: |
+          set -euo pipefail
+          bash sdks/scripts/set-version.sh "${{ inputs.version }}"
+          echo "version=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload version-stamped sdks tree
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdks-stamped
+          path: sdks/
+          include-hidden-files: true
+          retention-days: 1
+
+  # ----------------------------- BUILD + TEST -------------------------------
+  # Mirrors sdks.yml. All five must pass before any publish job starts.
+  build-typescript:
+    needs: prepare
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - uses: actions/setup-node@v4
+        with: { node-version: "22" }
+      - name: build + test (typescript)
+        working-directory: sdks/packages/typescript
+        run: |
+          npm ci
+          npx tsc --noEmit
+          npm run build
+          npm test
+
+  build-mcp:
+    needs: prepare
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - uses: actions/setup-node@v4
+        with: { node-version: "22" }
+      - name: build + test (mcp)
+        working-directory: sdks/packages/mcp
+        run: |
+          npm ci
+          npx tsc --noEmit
+          npm run build
+          npm test
+
+  build-python:
+    needs: prepare
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+      - name: build + test (python)
+        working-directory: sdks/packages/python
+        run: |
+          uv python install 3.13
+          uv sync --all-extras --dev
+          uv run pytest
+          uv run mypy src/go_ios_sdk --exclude '_generated'
+
+  build-csharp:
+    needs: prepare
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - uses: actions/setup-dotnet@v4
+        with: { dotnet-version: "8.0.x" }
+      - name: build + test (csharp)
+        working-directory: sdks/packages/csharp
+        run: |
+          dotnet build -c Release
+          dotnet test -c Release --no-build
+
+  build-java:
+    needs: prepare
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - uses: actions/setup-java@v4
+        with: { distribution: temurin, java-version: "17" }
+      - name: build + test (java)
+        working-directory: sdks/packages/java
+        run: bash scripts/verify.sh
+
+  # ------------------------------- PUBLISH ----------------------------------
+  # Each ecosystem publishes independently, but only after ALL builds pass.
+  # dry_run -> real dry-run (no upload). Non-dry -> real upload, still guarded
+  # by a registry-armed check so it self-skips until the registry is configured.
+
+  publish-npm:
+    needs: [prepare, build-typescript, build-mcp, build-python, build-csharp, build-java]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # OIDC trusted publishing / provenance. NO token.
+    env:
+      NPM_CONFIG_PROVENANCE: "true"
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      # OIDC trusted publishing needs Node >= 22.14 and npm >= 11.5.1.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+      - name: Prepare npm + build (typescript)
+        working-directory: sdks/packages/typescript
+        run: |
+          npm install -g npm@latest
+          npm ci
+          npm run build
+      # Dry run: exercises packing/publish end to end without uploading.
+      - name: npm publish --dry-run (dry_run)
+        if: ${{ inputs.dry_run }}
+        working-directory: sdks/packages/typescript
+        run: npm publish --dry-run --access public
+      # Real publish. OIDC is only available when id-token is issued for this
+      # run (ACTIONS_ID_TOKEN_REQUEST_URL is set). If it isn't — e.g. the org /
+      # trusted publisher isn't configured yet — skip loudly instead of failing.
+      - name: npm publish (OIDC)
+        if: ${{ !inputs.dry_run }}
+        working-directory: sdks/packages/typescript
+        run: |
+          set -euo pipefail
+          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            echo "::warning::npm OIDC context not available — skipping real npm publish. Configure the @go-ios org + OIDC trusted publisher first (see sdks/docs/RELEASING.md)."
+            exit 0
+          fi
+          # No NODE_AUTH_TOKEN / .npmrc auth line: npm authenticates via OIDC
+          # trusted publishing. Any (even empty) token would break OIDC.
+          npm publish --access public
+      # @go-ios/mcp ships to npm alongside the TypeScript SDK (same OIDC trusted
+      # publishing + provenance). Guarded identically to the TS publish above.
+      - name: Prepare + build (mcp)
+        working-directory: sdks/packages/mcp
+        run: |
+          npm ci
+          npm run build
+      - name: npm publish --dry-run (mcp, dry_run)
+        if: ${{ inputs.dry_run }}
+        working-directory: sdks/packages/mcp
+        run: npm publish --dry-run --access public
+      - name: npm publish (mcp, OIDC)
+        if: ${{ !inputs.dry_run }}
+        working-directory: sdks/packages/mcp
+        run: |
+          set -euo pipefail
+          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            echo "::warning::npm OIDC context not available — skipping real @go-ios/mcp publish. Configure the @go-ios org + OIDC trusted publisher first (see sdks/docs/RELEASING.md)."
+            exit 0
+          fi
+          # No NODE_AUTH_TOKEN / .npmrc auth line: OIDC trusted publishing only.
+          npm publish --access public
+
+  publish-pypi:
+    needs: [prepare, build-typescript, build-mcp, build-python, build-csharp, build-java]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write # PyPI trusted publishing. NO token.
+    # `secrets` cannot be used in an `if:` expression, so map the trust-armed
+    # flag into env once and gate on env.* instead.
+    env:
+      PYPI_ARMED: ${{ secrets.PYPI_TRUSTED_PUBLISHER_CONFIGURED }}
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+      - name: Build sdist + wheel
+        working-directory: sdks/packages/python
+        run: |
+          uv python install 3.12
+          uv build --sdist --wheel
+      # Dry run: build + metadata validation, no upload.
+      - name: twine check (dry_run)
+        if: ${{ inputs.dry_run }}
+        working-directory: sdks/packages/python
+        run: uvx twine check dist/*
+      # Real publish via trusted publishing. Only reached when the
+      # PYPI_TRUSTED_PUBLISHER_CONFIGURED repo secret is set, so the first real
+      # run before the trusted publisher exists self-skips.
+      - name: Publish to PyPI (trusted publishing)
+        if: ${{ !inputs.dry_run && env.PYPI_ARMED != '' }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: sdks/packages/python/dist
+      - name: Note if PyPI publish skipped
+        if: ${{ !inputs.dry_run && env.PYPI_ARMED == '' }}
+        run: echo "::warning::PYPI_TRUSTED_PUBLISHER_CONFIGURED not set — skipping real PyPI publish. Create the PyPI project + trusted publisher, then set that repo secret (see sdks/docs/RELEASING.md)."
+
+  publish-maven:
+    needs: [prepare, build-typescript, build-mcp, build-python, build-csharp, build-java]
+    runs-on: ubuntu-latest
+    # `secrets` cannot be used in an `if:` expression; map the arm-check into env.
+    # MAVEN_ARMED is non-empty only when all three required secrets are present.
+    env:
+      MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+      CENTRAL_TOKEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
+      CENTRAL_TOKEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
+      MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+      MAVEN_ARMED: ${{ (secrets.MAVEN_GPG_PRIVATE_KEY != '' && secrets.CENTRAL_TOKEN_USERNAME != '' && secrets.CENTRAL_TOKEN_PASSWORD != '') && 'yes' || '' }}
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+          # Configure ~/.m2/settings.xml server "central" from these env-var
+          # secrets so the central-publishing-maven-plugin can authenticate.
+          server-id: central
+          server-username: CENTRAL_TOKEN_USERNAME
+          server-password: CENTRAL_TOKEN_PASSWORD
+          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          gpg-passphrase: MAVEN_GPG_PASSPHRASE
+      # Dry run: full verify (compile, test, package) with NO deploy.
+      - name: mvn verify (dry_run — no deploy)
+        if: ${{ inputs.dry_run }}
+        working-directory: sdks/packages/java
+        run: mvn -B -ntp verify
+      # Real deploy — only when the Central token + GPG key secrets all exist.
+      - name: mvn deploy to Maven Central
+        if: ${{ !inputs.dry_run && env.MAVEN_ARMED != '' }}
+        working-directory: sdks/packages/java
+        run: mvn -B -ntp -Prelease clean deploy
+      - name: Note if Maven publish skipped
+        if: ${{ !inputs.dry_run && env.MAVEN_ARMED == '' }}
+        run: echo "::warning::Maven Central secrets not set (need MAVEN_GPG_PRIVATE_KEY + CENTRAL_TOKEN_USERNAME/PASSWORD) — skipping real Maven deploy (see sdks/docs/RELEASING.md)."
+
+  publish-nuget:
+    needs: [prepare, build-typescript, build-mcp, build-python, build-csharp, build-java]
+    runs-on: ubuntu-latest
+    # `secrets` cannot be used in an `if:` expression; map the key into env.
+    env:
+      NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: sdks-stamped, path: sdks }
+      - uses: actions/setup-dotnet@v4
+        with: { dotnet-version: "8.0.x" }
+      - name: Pack (Release)
+        working-directory: sdks/packages/csharp
+        run: dotnet pack src/GoIos.Sdk/GoIos.Sdk.csproj --configuration Release --output ../../artifacts
+      # dotnet pack above IS the dry-run artifact build; nothing to upload on dry.
+      - name: Note (dry_run — packed, not pushed)
+        if: ${{ inputs.dry_run }}
+        run: 'echo "dry_run: packed nupkg but not pushing to NuGet."'
+      - name: Push to NuGet
+        if: ${{ !inputs.dry_run && env.NUGET_API_KEY != '' }}
+        run: |
+          dotnet nuget push "sdks/artifacts/*.nupkg" \
+            --api-key "$NUGET_API_KEY" \
+            --source https://api.nuget.org/v3/index.json \
+            --skip-duplicate
+      - name: Note if NuGet publish skipped
+        if: ${{ !inputs.dry_run && env.NUGET_API_KEY == '' }}
+        run: echo "::warning::NUGET_API_KEY not set — skipping real NuGet push. Create the package id + NUGET_API_KEY secret (see sdks/docs/RELEASING.md)."
+
+  # ------------------------- TAG + GITHUB RELEASE ---------------------------
+  # Only after every publish job succeeds AND this was not a dry run. This is the
+  # single mutating step against the repo, so an earlier failure leaves no tag.
+  tag-and-release:
+    needs: [prepare, publish-npm, publish-pypi, publish-maven, publish-nuget]
+    if: ${{ !inputs.dry_run }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create SDK tag + GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag "sdk-v${VERSION}"
+          git push origin "sdk-v${VERSION}"
+          gh release create "sdk-v${VERSION}" \
+            --title "SDKs v${VERSION}" \
+            --notes "go-ios SDKs v${VERSION} (typescript, python, java, csharp; mcp bundled). Lockstep release generated from sdks/spec/openapi/openapi.yaml."