release.yml

name: release

# Publishes legis to PyPI when a GitHub Release is published.
# Authentication is PyPI Trusted Publishing (OIDC) — no API token is stored.
# The matching trusted publisher on PyPI is keyed to this repo, the `release.yml`
# workflow, and the `pypi` environment below — keep those three in sync with it.

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  build:
    name: Build & verify distribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Install dependencies
        run: uv sync --dev

      - name: Verify lockfile
        run: uv lock --check

      - name: Run lint
        run: uv run ruff check src

      - name: Test gate (never publish a red build)
        run: uv run pytest --cov=legis --cov-report=term-missing --cov-report=json --cov-fail-under=88

      - name: Enforce per-package coverage floors
        run: uv run python scripts/check_coverage_floors.py

      - name: Run SEI conformance oracle
        run: uv run pytest tests/conformance/test_sei_oracle.py

      - name: Run type check
        run: uv run mypy src/legis

      - name: Run policy-boundary honesty gate
        run: uv run legis policy-boundary-check --root src --repo-root .

      - name: Verify release tag matches project version
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          project_version="$(uv run python -c 'import tomllib,pathlib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
          tag_version="${RELEASE_TAG#v}"
          echo "project version: ${project_version}"
          echo "release tag:     ${RELEASE_TAG} (normalized: ${tag_version})"
          if [ "${project_version}" != "${tag_version}" ]; then
            echo "::error::Release tag '${tag_version}' does not match pyproject version '${project_version}'. Bump the version or fix the tag."
            exit 1
          fi

      - name: Build sdist + wheel
        run: uv build

      - name: Check distribution metadata
        run: uvx twine check dist/*

      - name: Upload distribution artifact
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  live-loomweave-conformance:
    name: Live Loomweave SEI conformance
    needs: [build]
    runs-on: ubuntu-latest
    env:
      LOOMWEAVE_URL: ${{ vars.LOOMWEAVE_URL }}
      LOOMWEAVE_LIVE_ORACLE_LOCATOR: ${{ vars.LOOMWEAVE_LIVE_ORACLE_LOCATOR }}
    steps:
      - uses: actions/checkout@v4

      # Skip-not-fail: live Loomweave conformance is NOT run in remote CI
      # (owner decision 2026-06-25 — Legis does not stand up a CI-reachable
      # Loomweave oracle). When the live oracle config is absent this job passes
      # as a fast no-op so it never blocks the PyPI publish. When the config IS
      # present (e.g. a provisioned/self-hosted runner), the oracle runs for
      # real and a conformance failure blocks publish — the gate still bites
      # where it can. Do NOT reintroduce a fail-on-missing-config check here
      # (that was the rc4 publish blocker; re-added in 1.1.1, reverted again
      # here per the owner decision above).
      - name: Detect live oracle configuration
        id: oracle_config
        env:
          LEGIS_LOOMWEAVE_HMAC_KEY: ${{ secrets.LEGIS_LOOMWEAVE_HMAC_KEY }}
        run: |
          missing=()
          for name in LOOMWEAVE_URL LOOMWEAVE_LIVE_ORACLE_LOCATOR LEGIS_LOOMWEAVE_HMAC_KEY; do
            if [ -z "${!name}" ]; then
              missing+=("${name}")
            fi
          done
          if [ "${#missing[@]}" -ne 0 ]; then
            joined="$(IFS=', '; echo "${missing[*]}")"
            echo "::notice::Live Loomweave oracle not provisioned (${joined} unset) — skipping conformance, not blocking publish."
            echo "configured=false" >> "$GITHUB_OUTPUT"
          else
            echo "configured=true" >> "$GITHUB_OUTPUT"
          fi

      - uses: astral-sh/setup-uv@v5
        if: steps.oracle_config.outputs.configured == 'true'
        with:
          enable-cache: true

      - name: Install dependencies
        if: steps.oracle_config.outputs.configured == 'true'
        run: uv sync --dev

      - name: Run live Loomweave oracle
        if: steps.oracle_config.outputs.configured == 'true'
        env:
          LEGIS_LOOMWEAVE_HMAC_KEY: ${{ secrets.LEGIS_LOOMWEAVE_HMAC_KEY }}
        run: uv run pytest tests/conformance/test_live_loomweave_oracle.py

  publish:
    name: Publish to PyPI
    needs: [build, live-loomweave-conformance]
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/legis
    permissions:
      id-token: write   # required for Trusted Publishing (OIDC)
    steps:
      - name: Download distribution artifact
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1