auto-release.yml

name: Auto Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions: {}

jobs:
  build:
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run book contract tests
        run: |
          python3 -m unittest discover -s tests -p 'test_*.py' -v
          python3 check_project_rules.py

      - name: Set up Chrome
        id: setupchrome
        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
        with:
          chrome-version: stable

      - name: Install CJK fonts and PDF inspection tools
        run: |
          sudo apt-get update
          sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra poppler-utils

      - name: Resolve latest mdPress release
        run: |
          url="$(curl -fsSL --retry 3 -o /dev/null -w '%{url_effective}' https://github.com/yeasy/mdPress/releases/latest)"
          version="${url##*/v}"
          test -n "$version" || { echo "could not resolve latest mdPress release"; exit 1; }
          echo "MDPRESS_VERSION=$version" >> "$GITHUB_ENV"
          echo "resolved mdPress $version"
      - name: Install mdPress (checksum-verified)
        run: |
          archive="$RUNNER_TEMP/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"
          curl -fsSL --retry 3 \
            "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" \
            -o "$archive"
          expected="$(curl -fsSL --retry 3 "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/checksums.txt" \
            | awk -v f="mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" '$2==f {print $1}')"
          test -n "$expected" || { echo "no published checksum for mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"; exit 1; }
          echo "${expected}  $archive" | sha256sum -c -
          tar xzf "$archive" -C "$RUNNER_TEMP" mdpress
          mkdir -p "$RUNNER_TEMP/bin"
          install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress"
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      - name: Install verified Pandoc 3.5
        env:
          PANDOC_VERSION: "3.5"
          PANDOC_SHA256: "4f41d817d262ef3d17953a3e6e0fefddb971aa4f2f121544a9a86db449d945e1"
        run: |
          package="$RUNNER_TEMP/pandoc-${PANDOC_VERSION}-1-amd64.deb"
          curl -fsSL --retry 3 \
            "https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-1-amd64.deb" \
            -o "$package"
          echo "${PANDOC_SHA256}  $package" | sha256sum -c -
          sudo dpkg -i "$package"
          pandoc --version | head -1

      - name: Install locked Mermaid CLI
        run: |
          PUPPETEER_SKIP_DOWNLOAD=true npm ci --prefix tools/mermaid --ignore-scripts
          echo "$GITHUB_WORKSPACE/tools/mermaid/node_modules/.bin" >> "$GITHUB_PATH"

      - name: Extract safe tag name
        id: tag
        shell: bash
        run: |
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            tag_name="${GITHUB_REF#refs/tags/}"
          else
            tag_name="latest"
          fi
          safe_tag_name=$(printf '%s' "$tag_name" | sed 's/[^A-Za-z0-9._-]/-/g')
          safe_tag_name="${safe_tag_name:-latest}"
          echo "SAFE_TAG_NAME=${safe_tag_name}" >> "$GITHUB_OUTPUT"

      - name: Build release PDF and HTML
        env:
          SAFE_TAG_NAME: ${{ steps.tag.outputs.SAFE_TAG_NAME }}
        run: |
          # mdPress PDF generation drives headless Chrome, which intermittently dies with
          # "websocket url timeout reached" + dbus errors. Retry the build, not the whole job.
          mdpress() { local a; for a in 1 2 3; do command mdpress "$@" && return 0;
            echo "::warning::mdpress attempt $a failed; retrying in 10s"; sleep 10; done; return 1; }
          mkdir -p dist
          title=$(python3 -c 'import json; print(json.load(open("book.json"))["title"])')
          mdpress build --format pdf \
            --output "dist/agentic_ai_guide-${SAFE_TAG_NAME}.pdf"
          python3 tools/render_mermaid.py \
            --book-dir . \
            --svg-out "$RUNNER_TEMP/mermaid-svg" \
            --strict
          python3 tools/build_html_reader.py \
            --book-dir . \
            --title "$title" \
            --svg-dir "$RUNNER_TEMP/mermaid-svg" \
            --out "dist/agentic_ai_guide-${SAFE_TAG_NAME}.html"

      - name: Verify release artifacts
        env:
          SAFE_TAG_NAME: ${{ steps.tag.outputs.SAFE_TAG_NAME }}
        run: |
          title=$(python3 -c 'import json; print(json.load(open("book.json"))["title"])')
          python3 tools/verify_artifacts.py \
            --title "$title" \
            --pdf "dist/agentic_ai_guide-${SAFE_TAG_NAME}.pdf" \
            --html "dist/agentic_ai_guide-${SAFE_TAG_NAME}.html" \
            --source-root . \
            --checksums dist/SHA256SUMS
          (cd dist && sha256sum -c SHA256SUMS)

      - name: Upload verified release bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: agentic-ai-guide-release-bundle
          path: dist/
          if-no-files-found: error

  release:
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
      id-token: write
      attestations: write
    needs: build
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Download verified release bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: agentic-ai-guide-release-bundle
          path: dist

      - name: Recheck artifact checksums
        run: (cd dist && sha256sum -c SHA256SUMS)

      - name: Attest tagged release artifacts
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            dist/agentic_ai_guide-*.pdf
            dist/agentic_ai_guide-*.html
            dist/SHA256SUMS

      - name: Create GitHub release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            dist/agentic_ai_guide-*.pdf
            dist/agentic_ai_guide-*.html
            dist/SHA256SUMS