release-version-client-sync.yml

name: Regenerate versioned clients

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]
    branches: [main]

permissions:
  contents: write
  actions: write

concurrency:
  group: release-version-client-sync-${{ github.ref }}
  cancel-in-progress: false

env:
  RIVET_PIN: 288c81f547eb64ec043546acc4df07efc19aceec
  KEEL_PIN: 0740fdfbdab7bf5dab32232c82f07dd98aa6a196

jobs:
  regenerate:
    if: >-
      github.event_name == 'pull_request' &&
      github.event.action != 'closed' &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      startsWith(github.event.pull_request.head.ref, 'release/version-')
    name: Regenerate and validate versioned clients
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0

      - name: Set up Racket CS 9.3
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: x64
          distribution: full
          variant: CS
          version: '9.3'

      - name: Install native build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install --yes cmake ninja-build pkg-config \
            libgtk-4-dev libadwaita-1-dev libjson-glib-dev \
            libsecret-1-dev libglib2.0-dev

      - name: Set up embeddable Racket CS
        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@288c81f547eb64ec043546acc4df07efc19aceec

      - name: Install pinned Racket dependencies
        run: |
          raco pkg install --auto --no-docs "https://github.com/turinglambdaai/keel.git#${KEEL_PIN}"
          raco pkg install --auto --no-docs "https://github.com/turinglambdaai/rivet.git#${RIVET_PIN}"
          raco pkg install --auto --no-docs db crypto

      - name: Regenerate clients from the canonical RPC contract
        run: |
          set -euo pipefail
          raco rivet build
          bash scripts/check-release-version.sh

      - name: Commit generated client version identities
        env:
          RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add \
            macos-host/Sources/RivetHost/GeneratedBackend.swift \
            windows/GeneratedBackend.hpp \
            linux/GeneratedBackend.hpp
          if git diff --cached --quiet; then
            echo "Generated client files are already aligned."
          else
            git commit -m "chore(release): regenerate versioned clients"
            git push origin "HEAD:${RELEASE_BRANCH}"
          fi

      - name: Dispatch full CI and product acceptance on generated commit
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
        run: |
          set -euo pipefail
          gh workflow run ci.yml --ref "${RELEASE_BRANCH}"
          gh workflow run acceptance.yml --ref "${RELEASE_BRANCH}"

  publish-verified-release:
    name: Tag and publish after merged version PR
    if: >-
      github.event_name == 'pull_request' &&
      github.event.action == 'closed' &&
      github.event.pull_request.merged == true &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      startsWith(github.event.pull_request.head.ref, 'release/version-')
    runs-on: ubuntu-latest
    timeout-minutes: 180
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}
          fetch-depth: 0

      - name: Verify version, release notes, and signing secret
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
          UPDATE_ED25519_PRIVATE_KEY: ${{ secrets.UPDATE_ED25519_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          VERSION="$(tr -d '[:space:]' < VERSION)"
          TAG="v${VERSION}"
          [[ "$RELEASE_BRANCH" == "release/version-v$VERSION" ]] || {
            echo "::error::Release branch $RELEASE_BRANCH does not match VERSION $VERSION"
            exit 1
          }
          bash scripts/check-release-version.sh
          NOTES="$(awk -v header="## [${VERSION}]" '
            index($0, header) == 1 {on=1; next}
            on && /^## / {exit}
            on {print}
          ' CHANGELOG.md)"
          [[ -n "$(printf '%s' "$NOTES" | tr -d '[:space:]')" ]] || {
            echo "::error::Missing release notes for $VERSION"
            exit 1
          }
          [[ -n "${UPDATE_ED25519_PRIVATE_KEY:-}" ]] || {
            echo "::error::UPDATE_ED25519_PRIVATE_KEY is not configured; no tag will be created"
            exit 1
          }
          # Confirm the configured private key matches both embedded public
          # keys before creating an immutable tag. Never print the private key.
          KEY_PEM="$(mktemp)"
          trap 'rm -f "$KEY_PEM"' EXIT
          printf '%s\n' "$UPDATE_ED25519_PRIVATE_KEY" > "$KEY_PEM"
          DER_PUBLIC="$(openssl pkey -in "$KEY_PEM" -pubout -outform DER 2>/dev/null | base64 -w0)"
          RAW_PUBLIC="$(openssl pkey -in "$KEY_PEM" -pubout -outform DER 2>/dev/null | tail -c 32 | base64 -w0)"
          EXPECTED_DER="$(sed -n '/(define update-public-key-b64/{n;s/^[[:space:]]*"\([^"]*\)".*/\1/p;}' racket/taskly/updater.rkt)"
          EXPECTED_RAW="$(sed -n 's/.*public static let publicKeyBase64 = "\([^"]*\)".*/\1/p' macos-host/Sources/RivetHost/UpdateService.swift)"
          [[ -n "$EXPECTED_DER" && "$DER_PUBLIC" == "$EXPECTED_DER" ]] || {
            echo "::error::Signing secret does not match the backend Ed25519 public key"
            exit 1
          }
          [[ -n "$EXPECTED_RAW" && "$RAW_PUBLIC" == "$EXPECTED_RAW" ]] || {
            echo "::error::Signing secret does not match the macOS Ed25519 public key"
            exit 1
          }
          if [[ -n "$(git ls-remote --tags origin "refs/tags/$TAG")" ]]; then
            # A failed publish can be retried without moving the immutable tag,
            # but only if it is annotated and points at this exact merge commit.
            git fetch --force origin "refs/tags/$TAG:refs/tags/$TAG"
            [[ "$(git cat-file -t "$TAG")" == "tag" ]] || {
              echo "::error::Existing tag $TAG is lightweight; refusing to use it"
              exit 1
            }
            [[ "$(git rev-parse "$TAG^{commit}")" == "$(git rev-parse HEAD)" ]] || {
              echo "::error::Existing tag $TAG points at a different commit"
              exit 1
            }
            echo "Reusing existing annotated tag $TAG for a safe release retry"
          fi
          echo "Verified release candidate $TAG at $(git rev-parse HEAD)"

      - name: Wait for CI and product acceptance on the merge commit
        env:
          GH_TOKEN: ${{ github.token }}
          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
        run: |
          set -euo pipefail
          ci_ok=false
          acceptance_ok=false
          for attempt in $(seq 1 180); do
            runs="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${MERGE_SHA}&per_page=100")"
            ci="$(jq -c --arg sha "$MERGE_SHA" '[.workflow_runs[] | select(.name == "CI" and .event == "push" and .head_sha == $sha)] | sort_by(.created_at) | last // empty' <<< "$runs")"
            acceptance="$(jq -c --arg sha "$MERGE_SHA" '[.workflow_runs[] | select(.name == "Product Acceptance" and .event == "push" and .head_sha == $sha)] | sort_by(.created_at) | last // empty' <<< "$runs")"
            if [[ -n "$ci" ]]; then
              status="$(jq -r '.status' <<< "$ci")"
              conclusion="$(jq -r '.conclusion // ""' <<< "$ci")"
              if [[ "$status" == "completed" && "$conclusion" != "success" ]]; then
                echo "::error::CI did not pass for merge commit $MERGE_SHA: $conclusion"
                exit 1
              fi
              [[ "$status" == "completed" && "$conclusion" == "success" ]] && ci_ok=true
            fi
            if [[ -n "$acceptance" ]]; then
              status="$(jq -r '.status' <<< "$acceptance")"
              conclusion="$(jq -r '.conclusion // ""' <<< "$acceptance")"
              if [[ "$status" == "completed" && "$conclusion" != "success" ]]; then
                echo "::error::Product Acceptance did not pass for merge commit $MERGE_SHA: $conclusion"
                exit 1
              fi
              [[ "$status" == "completed" && "$conclusion" == "success" ]] && acceptance_ok=true
            fi
            if [[ "$ci_ok" == true && "$acceptance_ok" == true ]]; then
              echo "CI and Product Acceptance passed for $MERGE_SHA"
              break
            fi
            if [[ "$attempt" -eq 180 ]]; then
              echo "::error::Timed out waiting for CI and Product Acceptance on $MERGE_SHA"
              exit 1
            fi
            sleep 15
          done

      - name: Create immutable annotated tag and dispatch release build
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          VERSION="$(tr -d '[:space:]' < VERSION)"
          TAG="v${VERSION}"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git show-ref --verify --quiet "refs/tags/$TAG"; then
            echo "Reusing immutable tag $TAG"
          else
            git tag -a "$TAG" -m "Taskly $TAG"
            git push origin "$TAG"
          fi
          gh workflow run release.yml --ref "$TAG"

      - name: Wait for the release workflow
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
        run: |
          set -euo pipefail
          for attempt in $(seq 1 360); do
            runs="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${RELEASE_SHA}&per_page=100")"
            release="$(jq -c --arg sha "$RELEASE_SHA" '[.workflow_runs[] | select(.name == "Release" and .event == "workflow_dispatch" and .head_sha == $sha)] | sort_by(.created_at) | last // empty' <<< "$runs")"
            if [[ -n "$release" ]]; then
              status="$(jq -r '.status' <<< "$release")"
              conclusion="$(jq -r '.conclusion // ""' <<< "$release")"
              url="$(jq -r '.html_url' <<< "$release")"
              if [[ "$status" == "completed" ]]; then
                if [[ "$conclusion" != "success" ]]; then
                  echo "::error::Release workflow failed: $url"
                  exit 1
                fi
                echo "Release completed successfully: $url"
                exit 0
              fi
            fi
            if [[ "$attempt" -eq 360 ]]; then
              echo "::error::Timed out waiting for release workflow"
              exit 1
            fi
            sleep 15
          done