release-safety.yml

name: Release Safety Rails

on:
  release:
    types: [published, edited]

jobs:
  validate-release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Fetch Release Data
        id: release
        env:
          GITHUB_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          set -euo pipefail
          release_json="$(mktemp)"
          curl -fsSL \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG_NAME}" \
            -o "${release_json}"
          echo "release_json=${release_json}" >> "${GITHUB_OUTPUT}"

      - name: Validate Metadata
        env:
          TAG_NAME: ${{ github.event.release.tag_name }}
          RELEASE_JSON: ${{ steps.release.outputs.release_json }}
        run: |
          set -euo pipefail
          notes_file="$(mktemp)"
          title="$(jq -r '.name // empty' "${RELEASE_JSON}")"
          jq -r '.body // empty' "${RELEASE_JSON}" > "${notes_file}"
          prerelease="$(jq -r '.prerelease' "${RELEASE_JSON}")"
          target_branch="$(jq -r '.target_commitish // empty' "${RELEASE_JSON}")"
          title="${title:-${TAG_NAME}}"
          ./scripts/validate_release_metadata.sh \
            "${TAG_NAME}" \
            "${title}" \
            "${notes_file}" \
            "${prerelease}" \
            "${target_branch}"

      - name: Validate Release Assets
        env:
          TAG_NAME: ${{ github.event.release.tag_name }}
          RELEASE_JSON: ${{ steps.release.outputs.release_json }}
        run: |
          set -euo pipefail
          version="${TAG_NAME#XtreamPlayerv}"
          apk_count="$(jq '[.assets[] | select(.name | endswith(".apk"))] | length' "${RELEASE_JSON}")"
          if [[ "${apk_count}" -lt 1 ]]; then
            echo "Release must include at least one APK asset."
            exit 1
          fi
          bad_assets="$(jq -r '.assets[] | .name' "${RELEASE_JSON}" | awk -v v="${version}" 'index($0, v)==0')"
          if [[ -n "${bad_assets}" ]]; then
            echo "Every release asset name must include version ${version}."
            echo "${bad_assets}"
            exit 1
          fi