Move release trigger guard into mdsmith-release

Agent-Logs-Url: https://github.com/jeduden/mdsmith/sessions/963e287d-3f99-463e-8224-0d9ebb1d4d93

Co-authored-by: jeduden <1117699+jeduden@users.noreply.github.com>

Author: Copilot

.github/workflows/release.yml

@@ -12,14 +12,20 @@ permissions:
 env:
   VERSION: ${{ github.event_name == 'create' && github.event.ref || github.ref_name }}
 
-# Serialize every release run so two publish jobs cannot mint OIDC
-# tokens against the same registry at the same time. The group is
-# tag-agnostic — different tags pushed close together queue rather
-# than overlap. `cancel-in-progress: false` keeps the first run
-# going (cancelling mid-publish would leave the scoped platform
-# packages out of sync with the root package).
+# Serialize only release-intent runs so two publish jobs cannot mint
+# OIDC tokens against the same registry at the same time. Ordinary
+# branch-creation `create` events get a per-run group and never queue
+# behind a real release. `cancel-in-progress: false` keeps the first
+# release going (cancelling mid-publish would leave the scoped
+# platform packages out of sync with the root package).
 concurrency:
-  group: release
+  group: >-
+    ${{
+      (github.event_name != 'create' ||
+      (github.event.ref_type == 'tag' && startsWith(github.event.ref, 'v'))) &&
+      'release' ||
+      format('release-nonrelease-{0}-{1}', github.run_id, github.run_attempt)
+    }}
   cancel-in-progress: false
 
 jobs:
@@ -32,77 +38,15 @@ jobs:
       - name: Decide whether this trigger should publish
         id: decide
         env:
+          EVENT_NAME: ${{ github.event_name }}
+          CREATE_REF_TYPE: ${{ github.event.ref_type }}
+          RELEASE_TAG: ${{ env.VERSION }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_TAG: ${{ github.event_name == 'create' && github.event.ref || github.ref_name }}
-          RELEASE_LOOKUP_RETRY_ATTEMPTS: "3"
-          RELEASE_LOOKUP_RETRY_DELAY_SECONDS: "2"
-        run: |
-          if [ "${{ github.event_name }}" != "create" ]; then
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-            echo "create_release_is_draft=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [ "${{ github.event.ref_type }}" != "tag" ]; then
-            echo "should_run=false" >> "$GITHUB_OUTPUT"
-            echo "create_release_is_draft=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          case "${RELEASE_TAG}" in
-            v*) ;;
-            *)
-              echo "should_run=false" >> "$GITHUB_OUTPUT"
-              echo "create_release_is_draft=false" >> "$GITHUB_OUTPUT"
-              exit 0
-              ;;
-          esac
-
-          status=404
-          for attempt in $(seq 1 "${RELEASE_LOOKUP_RETRY_ATTEMPTS}"); do
-            status=$(
-              curl \
-                --silent \
-                --show-error \
-                --location \
-                --output /tmp/release.json \
-                --write-out '%{http_code}' \
-                -H "Accept: application/vnd.github+json" \
-                -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-                -H "X-GitHub-Api-Version: 2022-11-28" \
-                "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
-            )
-            if [ "${status}" != "404" ] || \
-              [ "${attempt}" = "${RELEASE_LOOKUP_RETRY_ATTEMPTS}" ]; then
-              break
-            fi
-            sleep "${RELEASE_LOOKUP_RETRY_DELAY_SECONDS}"
-          done
-
-          case "${status}" in
-            200)
-              draft=$(jq -r '(.draft // false) | tostring' /tmp/release.json)
-              if [ "${draft}" = "true" ]; then
-                echo "should_run=true" >> "$GITHUB_OUTPUT"
-                echo "create_release_is_draft=true" >> "$GITHUB_OUTPUT"
-                exit 0
-              fi
-
-              echo "should_run=false" >> "$GITHUB_OUTPUT"
-              echo "create_release_is_draft=false" >> "$GITHUB_OUTPUT"
-              exit 0
-              ;;
-            404)
-              echo "should_run=false" >> "$GITHUB_OUTPUT"
-              echo "create_release_is_draft=false" >> "$GITHUB_OUTPUT"
-              exit 0
-              ;;
-            *)
-              echo "failed to inspect release for ${RELEASE_TAG}; api status ${status}" >&2
-              cat /tmp/release.json >&2
-              exit 1
-              ;;
-          esac
+        # The runtime logic lives in mdsmith-release per
+        # docs/development/release-tooling.md. The step itself stays a
+        # fixed one-liner so no event payload is interpolated into an
+        # inline shell script (zizmor template-injection finding).
+        run: go run ./cmd/mdsmith-release check-release-trigger
 
   build:
     needs: [trigger-guard]

cmd/mdsmith-release/main.go

@@ -13,6 +13,7 @@
 //	mdsmith-release build-wheels <artifacts-dir> <out-dir>
 //	mdsmith-release sync-docs <src-dir> <dst-dir>
 //	mdsmith-release build-website [--no-fix] [src-dir] [dst-dir]
+//	mdsmith-release check-release-trigger
 //	mdsmith-release check-secret-rotations
 //	mdsmith-release record-rotation <ENTRY_TITLE> <YYYY-MM-DD>
 //
@@ -42,6 +43,7 @@ Commands:
   sync-docs <src> <dst>           Snapshot docs/ into a Hugo content tree.
   build-website [--no-fix] [src] [dst]
                                   mdsmith fix (unless --no-fix) + sync-docs.
+  check-release-trigger           Emit release trigger guard outputs.
   check-secret-rotations          Open GitHub issues for secrets due for rotation.
   record-rotation <title> <date>  Update lastRotated in a per-secret rotation file.
 `
@@ -77,6 +79,8 @@ func run(args []string) int {
 		return runSyncDocs(root, rest)
 	case "build-website":
 		return runBuildWebsite(root, rest)
+	case "check-release-trigger":
+		return runCheckReleaseTrigger(root, rest)
 	case "check-secret-rotations":
 		return runCheckSecretRotations(root, rest)
 	case "record-rotation":

cmd/mdsmith-release/main_test.go

@@ -59,6 +59,7 @@ func TestRunRejectsBadArity(t *testing.T) {
 		{"build-wheels without args", []string{"build-wheels"}},
 		{"build-wheels with one arg", []string{"build-wheels", "art"}},
 		{"build-website with three positionals", []string{"build-website", "a", "b", "c"}},
+		{"check-release-trigger with extra arg", []string{"check-release-trigger", "extra"}},
 	}
 	for _, c := range cases {
 		assert.Equal(t, 2, run(c.args), c.name)
@@ -95,15 +96,21 @@ func TestReportFlagParseErrNilReturnsContinue(t *testing.T) {
 // of reportFlagParseErr per subcommand. pflag prints the Usage
 // itself, so the dispatcher just needs to surface exit code 0.
 func TestSubcommandHelpExitsZero(t *testing.T) {
-	for _, sub := range []string{"stamp", "check", "build-npm", "build-wheels", "sync-docs", "build-website"} {
+	for _, sub := range []string{
+		"stamp", "check", "build-npm", "build-wheels",
+		"sync-docs", "build-website", "check-release-trigger",
+	} {
 		assert.Equal(t, 0, run([]string{sub, "--help"}), "%s --help", sub)
 	}
 }
 
 // TestSubcommandRejectsUnknownFlag exercises the non-help, non-nil
 // branch of reportFlagParseErr.
 func TestSubcommandRejectsUnknownFlag(t *testing.T) {
-	for _, sub := range []string{"stamp", "check", "build-npm", "build-wheels", "sync-docs", "build-website"} {
+	for _, sub := range []string{
+		"stamp", "check", "build-npm", "build-wheels",
+		"sync-docs", "build-website", "check-release-trigger",
+	} {
 		assert.Equal(t, 2, run([]string{sub, "--bogus"}), "%s --bogus", sub)
 	}
 }

cmd/mdsmith-release/triggerguard.go

@@ -0,0 +1,69 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	flag "github.com/spf13/pflag"
+
+	"github.com/jeduden/mdsmith/internal/release"
+)
+
+func runCheckReleaseTrigger(_ string, args []string) int {
+	fs := flag.NewFlagSet("check-release-trigger", flag.ContinueOnError)
+	fs.Usage = func() {
+		fmt.Fprintf(os.Stderr, "Usage: mdsmith-release check-release-trigger\n\n"+
+			"Inspect the current GitHub Actions event and write\n"+
+			"`should_run` / `create_release_is_draft` outputs for\n"+
+			"release.yml's create-event guard. Reads EVENT_NAME,\n"+
+			"CREATE_REF_TYPE, RELEASE_TAG, GITHUB_REPOSITORY,\n"+
+			"GITHUB_TOKEN, GITHUB_API_URL, and GITHUB_OUTPUT from\n"+
+			"the environment.\n")
+	}
+	if err := fs.Parse(args); err != nil {
+		if code := reportFlagParseErr(err, os.Stderr, "mdsmith-release: check-release-trigger"); code >= 0 {
+			return code
+		}
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
+		return 2
+	}
+
+	res, err := release.CheckReleaseTrigger(release.TriggerGuardOptions{
+		EventName:  os.Getenv("EVENT_NAME"),
+		Repository: os.Getenv("GITHUB_REPOSITORY"),
+		RefName:    os.Getenv("RELEASE_TAG"),
+		RefType:    os.Getenv("CREATE_REF_TYPE"),
+		Token:      os.Getenv("GITHUB_TOKEN"),
+		APIBaseURL: os.Getenv("GITHUB_API_URL"),
+	})
+	if err != nil {
+		return reportError(err)
+	}
+	if err := writeReleaseTriggerGuardOutput(os.Getenv("GITHUB_OUTPUT"), res); err != nil {
+		return reportError(err)
+	}
+	return 0
+}
+
+func writeReleaseTriggerGuardOutput(path string, res release.TriggerGuardResult) error {
+	lines := fmt.Sprintf(
+		"should_run=%t\ncreate_release_is_draft=%t\n",
+		res.ShouldRun,
+		res.CreateReleaseIsDraft,
+	)
+	if path == "" {
+		_, err := fmt.Print(lines)
+		return err
+	}
+
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = f.Close() }()
+
+	_, err = f.WriteString(lines)
+	return err
+}

cmd/mdsmith-release/triggerguard_test.go

@@ -0,0 +1,34 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunCheckReleaseTriggerWritesGitHubOutput(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"draft":true}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	out := filepath.Join(t.TempDir(), "github-output.txt")
+	t.Setenv("EVENT_NAME", "create")
+	t.Setenv("CREATE_REF_TYPE", "tag")
+	t.Setenv("RELEASE_TAG", "v1.2.3")
+	t.Setenv("GITHUB_REPOSITORY", "jeduden/mdsmith")
+	t.Setenv("GITHUB_TOKEN", "test-token")
+	t.Setenv("GITHUB_API_URL", srv.URL)
+	t.Setenv("GITHUB_OUTPUT", out)
+
+	assert.Equal(t, 0, run([]string{"check-release-trigger"}))
+
+	body, err := os.ReadFile(out)
+	require.NoError(t, err)
+	assert.Equal(t, "should_run=true\ncreate_release_is_draft=true\n", string(body))
+}

docs/development/release-tooling.md

@@ -50,6 +50,7 @@ setup step.
 | Subcommand                 | Invoked by                     |
 |----------------------------|--------------------------------|
 | `stamp <version>`          | `release.yml` publishing jobs  |
+| `check-release-trigger`    | `release.yml` trigger-guard    |
 | `check`                    | `ci.yml` version-guard         |
 | `build-npm <art> <out>`    | `release.yml` npm job          |
 | `build-wheels <art> <out>` | `release.yml` pypi job         |

docs/development/release.md

@@ -51,9 +51,11 @@ path. `release.yml` also listens to the repo's
 a draft release creates a new `v*` tag. GitHub does
 not fire `release` workflows for draft creation. On
 `create` runs, a preflight job checks
-`github.event.ref_type=tag`, `github.event.ref`
-starting with `v`, and the GitHub Releases API for
-an existing draft release on that tag. A normal
+`github.event.ref_type == 'tag'`, `github.event.ref`
+starting with `v`, and — via
+`mdsmith-release check-release-trigger` — the GitHub
+Releases API for an existing draft release on that
+tag. A normal
 `git push origin vX.Y.Z` still fires both `create`
 and `push`, but only the `push` run proceeds because
 the `create` preflight sees no draft release yet.
@@ -69,9 +71,11 @@ normal tag push keeps the current
 published-release behavior.
 
 `concurrency: { group: release, cancel-in-progress: false }`
-serializes every run tag-agnostically. A second
-push or tag-creation event queues. The flag lets
-the in-flight publish finish; cancelling
+still serializes real releases tag-agnostically.
+Non-release `create` events get a per-run concurrency
+group, so they do not queue behind the release lock.
+
+The flag lets the in-flight publish finish. Cancelling
 mid-publish would desync the platform packages from
 the root.