release.yml

name: Release

on:
  release:
    types: [released, prereleased]

jobs:
  # ── 1. Parse release event ────────────────────────────────────────────────
  parse:
    name: Parse & Validate
    runs-on: ubuntu-latest
    permissions: {}
    outputs:
      version:  ${{ steps.release.outputs.version }}
      branch:   ${{ steps.release.outputs.branch }}
      tag:      ${{ steps.release.outputs.tag }}

    steps:
      - name: Parse release event
        id: release
        run: |
          TAG="${{ github.event.release.tag_name }}"
          VERSION="${TAG#v}"
          BRANCH="${{ github.event.release.target_commitish }}"

          if [[ -z "$VERSION" || -z "$BRANCH" ]]; then
            echo "ERROR: Could not read version or branch from release event."
            exit 1
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "branch=$BRANCH"   >> "$GITHUB_OUTPUT"
          echo "tag=$TAG"         >> "$GITHUB_OUTPUT"

          echo "Parsed — version: $VERSION, branch: $BRANCH, tag: $TAG"

      - name: Validate version string
        run: |
          pip install packaging -q
          python3 -c "
          from packaging.version import Version, InvalidVersion
          try:
              v = Version('${{ steps.release.outputs.version }}')
              print(f'Version is valid PEP 440: {v}')
          except InvalidVersion as e:
              print(f'ERROR: {e}')
              raise SystemExit(1)
          "

  # ── 2. Integration tests ───────────────────────────────────────────────────
  integration-tests:
    name: Integration Tests
    needs: parse
    runs-on: ${{ contains(github.server_url, 'github.com') && 'ubuntu-latest' || fromJSON('["self-hosted"]') }}
    permissions:
      contents: read

    steps:
      - name: Checkout release branch
        if: ${{ !contains(github.event.release.body, 'skip-integration-tests') }}
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.parse.outputs.branch }}
          fetch-depth: 0

      - name: Set up Python
        if: ${{ !contains(github.event.release.body, 'skip-integration-tests') }}
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install uv
        if: ${{ !contains(github.event.release.body, 'skip-integration-tests') }}
        uses: astral-sh/setup-uv@v3

      - name: Install dependencies
        if: ${{ !contains(github.event.release.body, 'skip-integration-tests') }}
        run: uv sync --dev

      - name: Set up integration test environment
        if: ${{ !contains(github.event.release.body, 'skip-integration-tests') }}
        env:
          AICORE_CLIENT_ID: ${{ secrets.AICORE_CLIENT_ID }}
          AICORE_CLIENT_SECRET: ${{ secrets.AICORE_CLIENT_SECRET }}
          AICORE_FILTER_TEST_SELF_HARM_PROMPT: ${{ secrets.AICORE_FILTER_TEST_SELF_HARM_PROMPT }}
          CLOUD_SDK_CFG_AGW_DEFAULT_LANDSCAPE: ${{ secrets.CLOUD_SDK_CFG_AGW_DEFAULT_LANDSCAPE }}
          CLOUD_SDK_CFG_AGW_DEFAULT_TENANT_SUBDOMAIN: ${{ secrets.CLOUD_SDK_CFG_AGW_DEFAULT_TENANT_SUBDOMAIN }}
          CLOUD_SDK_CFG_AUDITLOG_DEFAULT_UAA: ${{ secrets.CLOUD_SDK_CFG_AUDITLOG_DEFAULT_UAA }}
          CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID: ${{ secrets.CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID }}
          CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET: ${{ secrets.CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET }}
          CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_UAA: ${{ secrets.CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_UAA }}
          CLOUD_SDK_CFG_OBJECTSTORE_AZURE_SAS_TOKEN: ${{ secrets.CLOUD_SDK_CFG_OBJECTSTORE_AZURE_SAS_TOKEN }}
          CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_ACCESS_KEY_ID: ${{ secrets.CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_ACCESS_KEY_ID }}
          CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SECRET_ACCESS_KEY: ${{ secrets.CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SECRET_ACCESS_KEY }}
          CLOUD_SDK_CFG_OBJECTSTORE_GCS_BASE64ENCODEDPRIVATEKEYDATA: ${{ secrets.CLOUD_SDK_CFG_OBJECTSTORE_GCS_BASE64ENCODEDPRIVATEKEYDATA }}
          CLOUD_SDK_CFG_SDM_DEFAULT_UAA: ${{ secrets.CLOUD_SDK_CFG_SDM_DEFAULT_UAA }}
          AICORE_AUTH_URL: ${{ vars.AICORE_AUTH_URL }}
          AICORE_BASE_URL: ${{ vars.AICORE_BASE_URL }}
          AICORE_FALLBACK_TEST_FALLBACK_MODEL: ${{ vars.AICORE_FALLBACK_TEST_FALLBACK_MODEL }}
          AICORE_FALLBACK_TEST_PRIMARY_MODEL: ${{ vars.AICORE_FALLBACK_TEST_PRIMARY_MODEL }}
          AICORE_FILTER_TEST_MODEL: ${{ vars.AICORE_FILTER_TEST_MODEL }}
          AICORE_RESOURCE_GROUP: ${{ vars.AICORE_RESOURCE_GROUP }}
          CLOUD_SDK_CFG_AUDITLOG_DEFAULT_URL: ${{ vars.CLOUD_SDK_CFG_AUDITLOG_DEFAULT_URL }}
          CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE: ${{ vars.CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE }}
          CLOUD_SDK_CFG_DESTINATION_DEFAULT_TENANT_SUBDOMAIN: ${{ vars.CLOUD_SDK_CFG_DESTINATION_DEFAULT_TENANT_SUBDOMAIN }}
          CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI: ${{ vars.CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI }}
          CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL: ${{ vars.CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL }}
          CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_APPLICATION_URL: ${{ vars.CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_APPLICATION_URL }}
          CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_SUBSCRIBER_TENANT: ${{ vars.CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_SUBSCRIBER_TENANT }}
          CLOUD_SDK_CFG_OBJECTSTORE_AZURE_CONTAINER_NAME: ${{ vars.CLOUD_SDK_CFG_OBJECTSTORE_AZURE_CONTAINER_NAME }}
          CLOUD_SDK_CFG_OBJECTSTORE_AZURE_CONTAINER_URI: ${{ vars.CLOUD_SDK_CFG_OBJECTSTORE_AZURE_CONTAINER_URI }}
          CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_BUCKET: ${{ vars.CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_BUCKET }}
          CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_HOST: ${{ vars.CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_HOST }}
          CLOUD_SDK_CFG_OBJECTSTORE_GCS_BUCKET: ${{ vars.CLOUD_SDK_CFG_OBJECTSTORE_GCS_BUCKET }}
          CLOUD_SDK_CFG_OBJECTSTORE_GCS_PROJECTID: ${{ vars.CLOUD_SDK_CFG_OBJECTSTORE_GCS_PROJECTID }}
          CLOUD_SDK_CFG_SDM_DEFAULT_URI: ${{ vars.CLOUD_SDK_CFG_SDM_DEFAULT_URI }}
        run: |
          env | grep -E '^(CLOUD_SDK_CFG_|AICORE_)' >> "$GITHUB_ENV"
          echo "Integration test environment set up."

      - name: Run integration tests
        if: ${{ !contains(github.event.release.body, 'skip-integration-tests') }}
        run: uv run pytest tests/*/integration/ -v --tb=short

  # ── 3. Publish ────────────────────────────────────────────────────────────
  publish:
    name: Publish
    needs: [parse, integration-tests]
    if: always() && needs.parse.result == 'success' && needs.integration-tests.result == 'success'
    runs-on: ubuntu-latest
    environment: 'pypi:sap-cloud-sdk'
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Checkout release branch
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.parse.outputs.branch }}
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v3

      - name: Build release distribution
        run: uv build

      - name: Verify build artifacts
        run: |
          wheel_count=$(ls -1 dist/*.whl 2>/dev/null | wc -l)
          tar_count=$(ls -1 dist/*.tar.gz 2>/dev/null | wc -l)
          [[ "$wheel_count" -ge 1 && "$tar_count" -ge 1 ]] || \
            { echo "ERROR: Missing build artifacts (wheels: $wheel_count, sdists: $tar_count)"; exit 1; }
          echo "Build artifacts: $wheel_count wheel(s), $tar_count sdist(s)"
          ls -lh dist/

      - name: Check version does not already exist on PyPI
        run: |
          PKG_NAME=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['name'])")
          VERSION="${{ needs.parse.outputs.version }}"
          HTTP=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/$PKG_NAME/$VERSION/json")
          if [[ "$HTTP" == "200" ]]; then
            echo "ERROR: $PKG_NAME $VERSION already exists on PyPI."
            exit 1
          fi
          echo "$PKG_NAME $VERSION is not yet on PyPI — proceeding."

      - name: Upload artifacts to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ needs.parse.outputs.tag }}" \
            --repo "${{ github.repository }}" \
            dist/*.whl dist/*.tar.gz

          echo "Artifacts uploaded to release ${{ needs.parse.outputs.tag }}"

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@v1.14.2

  # ── 4. Notify on failure ──────────────────────────────────────────────────
  notify-failure:
    name: Notify Failure
    needs: [parse, integration-tests, publish]
    if: always() && (needs.parse.result == 'failure' || needs.integration-tests.result == 'failure' || needs.publish.result == 'failure')
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Comment on release — failure
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release edit "${{ github.event.release.tag_name }}" \
            --repo "${{ github.repository }}" \
            --notes "$(gh release view "${{ github.event.release.tag_name }}" --repo "${{ github.repository }}" --json body -q .body)

          ---
          ❌ **Release workflow failed.** Check the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details. The tag may need to be deleted before retrying."