chore(release): v1.3.0 (#19) #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| # Tag-time gate + artifact publication. checks.yml builds both distributable | |
| # editions once, verifies them, records checksums, and exposes the immutable | |
| # Actions artifact ID. This workflow publishes those exact bytes without a | |
| # second build. | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: | |
| actions: read | |
| contents: write | |
| jobs: | |
| checks: | |
| uses: ./.github/workflows/checks.yml | |
| release: | |
| needs: checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Release-only gates | |
| run: python3 scripts/check_version_consistency.py --release --tag "${GITHUB_REF_NAME}" | |
| - name: Download the verified artifact by immutable ID | |
| uses: actions/download-artifact@v8 | |
| with: | |
| artifact-ids: ${{ needs.checks.outputs.release_artifact_id }} | |
| path: dist | |
| digest-mismatch: error | |
| - name: Verify downloaded artifact bytes | |
| run: | | |
| unzip -tqq dist/critical-thinking-for-humans-claude-ai.zip | |
| cd dist | |
| sha256sum --check SHA256SUMS | |
| - name: Extract release notes from CHANGELOG | |
| # The lint above already guarantees this exact section exists with a | |
| # non-empty body for this exact tag; test -s makes any drift loud. | |
| run: | | |
| awk -v ver="${GITHUB_REF_NAME#v}" ' | |
| index($0, "## [" ver "]") == 1 { on = 1; next } | |
| on && /^## \[/ { exit } | |
| on { print } | |
| ' CHANGELOG.md > release-notes.md | |
| test -s release-notes.md || { echo "no CHANGELOG entry for ${GITHUB_REF_NAME}" >&2; exit 1; } | |
| - name: Create or refresh a draft release from the verified bytes | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| if release_state="$(gh release view "${GITHUB_REF_NAME}" --json isDraft --jq .isDraft 2>/dev/null)"; then | |
| if [ "${release_state}" = "true" ]; then | |
| gh release upload "${GITHUB_REF_NAME}" \ | |
| dist/critical-thinking-for-humans-claude-ai.zip \ | |
| dist/critical-thinking-for-humans-portable.md \ | |
| dist/SHA256SUMS \ | |
| --clobber | |
| gh release edit "${GITHUB_REF_NAME}" \ | |
| --draft \ | |
| --verify-tag \ | |
| --title "${GITHUB_REF_NAME}" \ | |
| --notes-file release-notes.md | |
| else | |
| echo "${GITHUB_REF_NAME} is already published; verifying its existing assets" | |
| fi | |
| else | |
| gh release create "${GITHUB_REF_NAME}" \ | |
| dist/critical-thinking-for-humans-claude-ai.zip \ | |
| dist/critical-thinking-for-humans-portable.md \ | |
| dist/SHA256SUMS \ | |
| --draft \ | |
| --verify-tag \ | |
| --title "${GITHUB_REF_NAME}" \ | |
| --notes-file release-notes.md | |
| fi | |
| - name: Verify remote asset bytes and publish the draft | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| mkdir published-assets | |
| gh release download "${GITHUB_REF_NAME}" --dir published-assets | |
| cmp dist/SHA256SUMS published-assets/SHA256SUMS | |
| cd published-assets | |
| sha256sum --check SHA256SUMS | |
| cd .. | |
| if [ "$(gh release view "${GITHUB_REF_NAME}" --json isDraft --jq .isDraft)" = "true" ]; then | |
| gh release edit "${GITHUB_REF_NAME}" --draft=false | |
| fi |