auto-release.yml

name: Auto Release

on:
  workflow_dispatch:
    inputs:
      candidate_sha:
        description: Exact 40-character branch-head commit SHA to release
        required: true
        type: string
      dry_run:
        description: Validate full CI and build artifacts without tagging or publishing
        required: false
        default: false
        type: boolean

# Never cancelled and never coalesced: every publish runs to completion.
concurrency:
  group: ${{ github.workflow }}-${{ github.run_id }}
  cancel-in-progress: false

permissions:
  contents: write
  pull-requests: write
  actions: read

jobs:
  full-coverage:
    runs-on: ubuntu-24.04
    permissions:
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.candidate_sha }}
      - name: Verify candidate and full release CI
        env:
          EXPECTED_SHA: ${{ inputs.candidate_sha }}
          GH_TOKEN: ${{ github.token }}
        run: |
          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
          test "$EXPECTED_SHA" = "$GITHUB_SHA"
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
          python ci/verify_full_coverage.py --sha "$EXPECTED_SHA"

  detect-version:
    needs: [full-coverage]
    if: needs.full-coverage.result == 'success'
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version_check.outputs.current }}
      should_release: ${{ steps.version_check.outputs.should_release }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.candidate_sha }}

      - name: Check if version needs release
        id: version_check
        env:
          DRY_RUN: ${{ inputs.dry_run }}
        run: |
          VERSION=$(python -c 'import tomllib; from pathlib import Path; manifest = tomllib.loads(Path("Cargo.toml").read_text(encoding="utf-8")); print(manifest["workspace"]["package"]["version"])')
          echo "current=$VERSION" >> $GITHUB_OUTPUT
          TAG="v${VERSION}"
          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            git fetch --no-tags origin "refs/tags/${TAG}:refs/tags/${TAG}"
            test "$(git rev-parse "${TAG}^{commit}")" = "$GITHUB_SHA" || {
              echo "Existing tag ${TAG} points to another commit" >&2
              exit 1
            }
          fi
          STATUS=$(curl --silent --show-error -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/fastled/$VERSION/json")
          if [ "$STATUS" = "200" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "Cannot prove publish readiness: version $VERSION already exists on PyPI" >&2
              exit 1
            fi
            echo "should_release=false" >> $GITHUB_OUTPUT
            echo "Version $VERSION already on PyPI, skipping release"
          elif [ "$STATUS" = "404" ]; then
            echo "should_release=true" >> $GITHUB_OUTPUT
            echo "Version $VERSION not on PyPI, will release"
          else
            echo "PyPI version lookup failed with HTTP $STATUS" >&2
            exit 1
          fi

  # Release builds produce all six artifact pairs at this workflow's SHA.
  # Ordinary main CI no longer provides per-platform release artifacts.
  build-linux-x86:
    needs: [detect-version]
    if: needs.detect-version.outputs.should_release == 'true'
    uses: ./.github/workflows/_build.yml
    with:
      runs-on: ubuntu-24.04
      rust-target: x86_64-unknown-linux-gnu

  build-linux-arm:
    needs: [detect-version]
    if: needs.detect-version.outputs.should_release == 'true'
    uses: ./.github/workflows/_build.yml
    with:
      runs-on: ubuntu-24.04-arm
      rust-target: aarch64-unknown-linux-gnu

  build-windows-x86:
    needs: [detect-version]
    if: needs.detect-version.outputs.should_release == 'true'
    uses: ./.github/workflows/_build.yml
    with:
      runs-on: windows-2025
      rust-target: x86_64-pc-windows-msvc

  build-windows-arm:
    needs: [detect-version]
    if: needs.detect-version.outputs.should_release == 'true'
    uses: ./.github/workflows/_build.yml
    with:
      runs-on: windows-2025
      rust-target: aarch64-pc-windows-msvc

  build-macos-x86:
    needs: [detect-version]
    if: needs.detect-version.outputs.should_release == 'true'
    uses: ./.github/workflows/_build.yml
    with:
      runs-on: macos-15-intel
      rust-target: x86_64-apple-darwin

  build-macos-arm:
    needs: [detect-version]
    if: needs.detect-version.outputs.should_release == 'true'
    uses: ./.github/workflows/_build.yml
    with:
      runs-on: macos-15
      rust-target: aarch64-apple-darwin

  artifact-preflight:
    needs:
      - detect-version
      - build-linux-x86
      - build-linux-arm
      - build-windows-x86
      - build-windows-arm
      - build-macos-x86
      - build-macos-arm
    if: >-
      !cancelled() &&
      needs.detect-version.outputs.should_release == 'true' &&
      needs.build-linux-x86.result == 'success' &&
      needs.build-linux-arm.result == 'success' &&
      needs.build-windows-x86.result == 'success' &&
      needs.build-windows-arm.result == 'success' &&
      needs.build-macos-x86.result == 'success' &&
      needs.build-macos-arm.result == 'success'
    runs-on: ubuntu-24.04
    permissions:
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.candidate_sha }}
      - uses: actions/download-artifact@v4
        with:
          pattern: wheel-*
          path: dist
          merge-multiple: true
      - uses: actions/download-artifact@v4
        with:
          pattern: binary-*
          path: binaries
      - name: Check wheel and binary artifacts before tagging
        env:
          VERSION: ${{ needs.detect-version.outputs.version }}
        run: |
          python ci/release_artifact_lint.py --wheels dist --binaries binaries --version "$VERSION"
          echo "Artifact preflight passed for ${{ inputs.candidate_sha }}. PyPI project quota and registry availability remain unverified." >> "$GITHUB_STEP_SUMMARY"

  create-tag:
    needs:
      - full-coverage
      - detect-version
      - artifact-preflight
      - build-linux-x86
      - build-linux-arm
      - build-windows-x86
      - build-windows-arm
      - build-macos-x86
      - build-macos-arm
    # Every build must succeed before tagging. No ordinary CI artifact is reused.
    if: >-
      !cancelled() &&
      needs.full-coverage.result == 'success' &&
      needs.detect-version.outputs.should_release == 'true' &&
      needs.artifact-preflight.result == 'success' &&
      inputs.dry_run != true &&
      needs.build-linux-x86.result == 'success' &&
      needs.build-linux-arm.result == 'success' &&
      needs.build-windows-x86.result == 'success' &&
      needs.build-windows-arm.result == 'success' &&
      needs.build-macos-x86.result == 'success' &&
      needs.build-macos-arm.result == 'success'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.candidate_sha }}

      - name: Verify tag source SHA
        env:
          EXPECTED_SHA: ${{ inputs.candidate_sha }}
        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"

      - name: Create tag if not present
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          TAG="v${{ needs.detect-version.outputs.version }}"
          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            git fetch --no-tags origin "refs/tags/${TAG}:refs/tags/${TAG}"
            test "$(git rev-parse "${TAG}^{commit}")" = "$GITHUB_SHA" || {
              echo "Existing tag ${TAG} points to another commit" >&2
              exit 1
            }
            echo "Tag ${TAG} already points to the verified SHA."
          else
            git tag -a "${TAG}" -m "Release ${{ needs.detect-version.outputs.version }}"
            git push origin "${TAG}"
          fi

  publish-pypi:
    needs: [detect-version, create-tag]
    # Gate explicitly on the tag job result.
    if: >-
      !cancelled() &&
      inputs.dry_run != true &&
      needs.detect-version.outputs.should_release == 'true' &&
      needs.create-tag.result == 'success'
    runs-on: ubuntu-24.04
    environment:
      name: release
      url: https://pypi.org/p/fastled
    permissions:
      id-token: write
    steps:
      - name: Download all wheels
        uses: actions/download-artifact@v4
        with:
          pattern: wheel-*
          path: dist
          merge-multiple: true

      - name: List artifacts
        run: ls -la dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  create-release:
    needs: [detect-version, create-tag]
    # Gate explicitly on the tag job result.
    if: >-
      !cancelled() &&
      inputs.dry_run != true &&
      needs.detect-version.outputs.should_release == 'true' &&
      needs.create-tag.result == 'success'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
    steps:
      # With merge-multiple unset, each artifact lands in its own
      # binaries/<artifact-name>/ directory, so the case match below on the
      # target-suffixed artifact name identifies each release build.
      - name: Download all binaries
        uses: actions/download-artifact@v4
        with:
          pattern: binary-*
          path: binaries

      - name: Prepare release files
        shell: bash
        run: |
          mkdir release
          cd binaries
          for d in binary-*; do
            case "$d" in
              *x86_64-unknown-linux-gnu)  zip -j "../release/fastled-linux-x86_64.zip"    "$d"/fastled ;;
              *aarch64-unknown-linux-gnu) zip -j "../release/fastled-linux-aarch64.zip"   "$d"/fastled ;;
              *x86_64-pc-windows-msvc)    zip -j "../release/fastled-windows-x86_64.zip"  "$d"/fastled.exe ;;
              *aarch64-pc-windows-msvc)   zip -j "../release/fastled-windows-aarch64.zip" "$d"/fastled.exe ;;
              *x86_64-apple-darwin)       zip -j "../release/fastled-macos-x86_64.zip"    "$d"/fastled ;;
              *aarch64-apple-darwin)      zip -j "../release/fastled-macos-aarch64.zip"   "$d"/fastled ;;
            esac
          done
          cd ..
          ls -la release/

      - name: Sign release artifacts with sigstore
        uses: sigstore/gh-action-sigstore-python@v3.3.0
        with:
          inputs: ./release/*.zip
          release-signing-artifacts: true

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.detect-version.outputs.version }}
          files: |
            release/*.zip
            release/*.sigstore
          draft: false
          prerelease: false