docs(casebook): ecosystem audit edition — 33 verified findings, metho… #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| # Creates/updates GitHub Releases from docs/RELEASE-<tag>.md and, when an npm | |
| # token exists, publishes @agentmeasure/mcp. Uses the Actions-provided | |
| # GITHUB_TOKEN (contents: write) — no local credentials required. | |
| # | |
| # Triggers: | |
| # - push of a v* tag (e.g. v0.1.1) | |
| # - manual workflow_dispatch (defaults to v0.1.1) | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| github-release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Resolve tag | |
| run: | | |
| if [[ "$GITHUB_REF_NAME" == v* ]]; then | |
| echo "TAG=$GITHUB_REF_NAME" >> "$GITHUB_ENV" | |
| else | |
| echo "TAG=v0.1.1" >> "$GITHUB_ENV" | |
| fi | |
| echo "releasing $TAG" | |
| - name: Create or update GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| NOTES="docs/RELEASE-${TAG}.md" | |
| if [[ ! -f "$NOTES" ]]; then NOTES="docs/RELEASE-v0.1.1.md"; fi | |
| if gh release view "$TAG" --json tagName >/dev/null 2>&1; then | |
| gh release edit "$TAG" --notes-file "$NOTES" | |
| else | |
| gh release create "$TAG" --title "$TAG — AgentMeasure" --notes-file "$NOTES" | |
| fi | |
| - name: Mark v0.1.0 as superseded (history kept, not deleted) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| if gh release view v0.1.0 --json tagName >/dev/null 2>&1; then | |
| BODY="$(gh release view v0.1.0 --json body -q .body)" | |
| if ! printf '%s' "$BODY" | grep -q "Superseded by v0.1.1"; then | |
| NOTE='> **Superseded by v0.1.1.** The original release contained several measurement-model issues (reported 42/126 observations, an unverifiable "no self-reported numbers" claim, and a non-reproducible demo); all are documented and fixed in the changelog. History is kept, not deleted.' | |
| gh release edit v0.1.0 --notes "$(printf '%s\n\n%s' "$NOTE" "$BODY")" | |
| echo "v0.1.0 marked as superseded" | |
| else | |
| echo "v0.1.0 already marked" | |
| fi | |
| else | |
| echo "v0.1.0 release not found (nothing to supersede)" | |
| fi | |
| - name: Attach npm tarball as release asset | |
| working-directory: sdk | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| npm pack --pack-destination . | |
| gh release upload "$TAG" agentmeasure-mcp-0.1.1.tgz --clobber | |
| # ── process fix (live-codex-desc-clarity-001 lesson): bundles ship with the tag ── | |
| # Every bundles/<experiment-id>/ is zipped and attached as a release asset, so a | |
| # tagged release always carries its verifiable artifacts. The checklist that | |
| # populates bundles/ before tagging lives in lab/README.md ("Releasing a live run"). | |
| - name: Attach evidence bundles as release assets | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| if compgen -G "bundles/*" > /dev/null; then | |
| for d in bundles/*/; do | |
| id="$(basename "$d")" | |
| zipfile="/tmp/bundle-${id}.zip" | |
| (cd "$d" && zip -r -q "$zipfile" .) | |
| gh release upload "$TAG" "$zipfile" --clobber | |
| echo "attached $zipfile" | |
| done | |
| else | |
| echo "no bundles/ to attach" | |
| fi | |
| npm-publish: | |
| runs-on: ubuntu-latest | |
| needs: github-release | |
| # secrets cannot be referenced directly in job-level `if`; route through env | |
| env: | |
| HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| registry-url: 'https://registry.npmjs.org/' | |
| - name: Publish @agentmeasure/mcp (runs only when NPM_TOKEN secret exists) | |
| if: ${{ env.HAS_NPM_TOKEN == 'true' }} | |
| working-directory: sdk | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: | | |
| npm ci | |
| npm run build | |
| npm test | |
| npm publish --access public | |
| # ── PyPI: `pipx install agentmeasure` ── | |
| # Uses PyPI trusted publishing (OIDC): NO API token to store or leak. | |
| # One-time setup on PyPI (account owner): Publishing → Add a pending publisher | |
| # PyPI project name: agentmeasure | |
| # owner: roy-tong · repository: AgentMeasure · workflow: release.yml | |
| # environment: (leave empty) | |
| # After that, commit the empty marker file `healthcheck/.pypi-ready` and push | |
| # a vX tag — this job then builds and publishes the healthcheck CLI. | |
| pypi-publish: | |
| runs-on: ubuntu-latest | |
| needs: github-release | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Gate on PyPI readiness marker | |
| id: gate | |
| run: | | |
| if [[ -f healthcheck/.pypi-ready ]]; then | |
| echo "ready=true" >> "$GITHUB_OUTPUT" | |
| echo "PyPI publishing enabled" | |
| else | |
| echo "ready=false" >> "$GITHUB_OUTPUT" | |
| echo "PyPI publishing not enabled yet (no healthcheck/.pypi-ready marker) — skipping" | |
| fi | |
| - uses: actions/setup-python@v5 | |
| if: ${{ steps.gate.outputs.ready == 'true' }} | |
| with: | |
| python-version: '3.11' | |
| - name: Build sdist + wheel | |
| if: ${{ steps.gate.outputs.ready == 'true' }} | |
| run: | | |
| python -m pip install --user build | |
| python -m build --sdist --wheel --outdir dist/ healthcheck/ | |
| ls -l dist/ | |
| - name: Publish agentmeasure to PyPI | |
| if: ${{ steps.gate.outputs.ready == 'true' }} | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| packages-dir: dist/ |