method-kit/.github/workflows/release.yml at main · David-BS/method-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
# release.yml — triggered ONLY on a v* tag push. Builds the .skill deliverable
# and attaches it to a GitHub Release.
#
# Caveat (METHOD §7): a green PR does NOT exercise this workflow — it runs only
# at the next v* tag. Validate the release path at that tag, never assume it.
#
# The version is never typed here: package_skill.py reads it from the suite's
# metadata.version (SKILL.md frontmatter) and names the archive from it. The
# guard below refuses to publish when the pushed tag and that version disagree —
# so a release cannot advertise a version its artifact does not carry.
name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write  # required to create a Release and upload assets

jobs:
  release:
    name: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
      - name: Build the .skill and verify it matches the tag
        run: |
          set -euo pipefail
          # package_skill.py validates the suite, reads metadata.version from
          # SKILL.md (never typed), and writes the stamped archive into dist/
          # (git-ignored, so a clean checkout starts empty and exactly one
          # artifact is produced). It prints the archive path on stdout.
          artifact="$(python skills/project-pilot/modules/skill-packaging/scripts/package_skill.py skills/project-pilot --out-dir dist)"
          echo "Built: ${artifact}"
          # Guard (closes the channel S42 retires): the pushed tag must name the
          # same version the artifact carries. ${GITHUB_REF_NAME} is the tag,
          # e.g. v0.17.0; the artifact is project-pilot_v<version>_<date>.skill.
          # The quoted prefix is literal (tag metacharacters cannot glob); only
          # the date wildcard floats. On disagreement, abort BEFORE the release.
          case "$(basename "${artifact}")" in
            "project-pilot_${GITHUB_REF_NAME}_"*.skill) ;;
            *)
              echo "ERROR: tag ${GITHUB_REF_NAME} does not match built artifact $(basename "${artifact}")" >&2
              exit 1
              ;;
          esac
      - name: Create release and attach the artifact
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${GITHUB_REF_NAME}" dist/* --generate-notes