release.yml

name: Release

on:
  workflow_dispatch:
  pull_request:
    types: [opened, reopened, synchronize, labeled, unlabeled]
    branches:
      - "master"
      - "ci"
      - "[0-9]+.[0-9]+.[0-9x]+*"

permissions:
  contents: read

# Serialize releases of the same PR; never cancel a publishing job.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: false

jobs:
  classify-release:
    runs-on: ubuntu-24.04
    permissions:
      pull-requests: read
    outputs:
      mode: ${{ steps.mode.outputs.mode }}
    steps:
    - name: Select release mode
      id: mode
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
      with:
        script: |
          let mode = 'skip';

          if (context.eventName === 'workflow_dispatch') {
            mode = 'dry_run';
          } else {
            const { action, label, pull_request: pr } = context.payload;
            if (action === 'labeled' || action === 'unlabeled') {
              // Ignore unrelated label changes and do not release on removal.
              if (action === 'labeled' && label.name === 'release-dry-run') {
                mode = 'dry_run';
              }
            } else if (pr.labels.some(({ name }) => name === 'release-dry-run')) {
              mode = 'dry_run';
            } else {
              // Preserve the previous version-file filter for ordinary PRs.
              const files = await github.paginate(github.rest.pulls.listFiles, {
                ...context.repo,
                pull_number: pr.number,
                per_page: 100,
              });
              if (files.some(({ filename }) => filename === 'httptools/_version.py')) {
                mode = 'release';
              }
            }
          }

          core.setOutput('mode', mode);
          core.info(`Release mode: ${mode}`);

  build-sdist:
    needs: classify-release
    if: needs.classify-release.outputs.mode != 'skip'
    runs-on: ubuntu-24.04

    env:
      PIP_DISABLE_PIP_VERSION_CHECK: 1

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        fetch-depth: 50
        submodules: true
        persist-credentials: false

    - name: Set up Python
      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
      with:
        python-version: "3.14"
        activate-environment: true

    - name: Build source distribution
      run: |
        uv build --sdist

    - name: Store release version
      run: |
        python - <<'PY'
        import re
        from pathlib import Path

        source = Path('httptools/_version.py').read_text()
        match = re.search(
            r'''^__version__(?:\s*:\s*typing\.Final)?\s*=\s*['"]([^'"]+)['"]''',
            source,
            re.MULTILINE,
        )
        if match is None:
            raise RuntimeError('Could not read the release version')
        Path('dist/VERSION').write_text(match.group(1) + '\n')
        PY

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
      with:
        name: dist-sdist
        path: dist/

  build-wheels-matrix:
    needs: classify-release
    if: needs.classify-release.outputs.mode != 'skip'
    runs-on: ubuntu-24.04
    outputs:
      include: ${{ steps.set-matrix.outputs.include }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
        with:
          python-version: "3.14"
          activate-environment: true
      - name: Install cibuildwheel
        run: uv pip install cibuildwheel==4.2.1
      - name: Build cibuildwheel matrix
        id: set-matrix
        env:
          WHEEL_TARGETS: |
            [
              {"platform": "linux", "archs": "x86_64", "os": "ubuntu-24.04"},
              {"platform": "linux", "archs": "aarch64", "os": "ubuntu-24.04-arm"},
              {"platform": "linux", "archs": "ppc64le", "os": "ubuntu-24.04"},
              {"platform": "linux", "archs": "riscv64", "os": "ubuntu-24.04"},
              {"platform": "macos", "archs": "x86_64", "os": "macos-26-intel"},
              {"platform": "macos", "archs": "arm64", "os": "macos-26"},
              {"platform": "windows", "archs": "x86,AMD64", "os": "windows-2025"},
              {"platform": "windows", "archs": "ARM64", "os": "windows-11-arm"}
            ]
        run: |
          python - <<'PY'
          import json
          import os
          import subprocess

          include = []
          for target in json.loads(os.environ['WHEEL_TARGETS']):
              identifiers = subprocess.check_output([
                  'cibuildwheel', '--print-build-identifiers',
                  '--platform', target['platform'], '--archs', target['archs'],
              ], text=True).splitlines()
              include.extend({'only': identifier, 'os': target['os']} for identifier in identifiers)

          print(f'Wheel matrix entries: {len(include)}')
          if not 0 < len(include) <= 256:
              raise RuntimeError('Wheel matrix must contain between 1 and 256 entries')
          if len({entry['only'] for entry in include}) != len(include):
              raise RuntimeError('Wheel matrix contains duplicate build identifiers')

          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
              output.write(f'include={json.dumps(include, separators=(",", ":"))}\n')
          PY

  build-wheels:
    needs: build-wheels-matrix
    if: ${{ !cancelled() && needs.build-wheels-matrix.result == 'success' }}
    runs-on: ${{ matrix.os }}
    name: Build ${{ matrix.only }}

    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.build-wheels-matrix.outputs.include) }}

    defaults:
      run:
        shell: bash

    env:
      PIP_DISABLE_PIP_VERSION_CHECK: 1

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        fetch-depth: 50
        submodules: true
        persist-credentials: false

    - name: Set up QEMU
      if: endsWith(matrix.only, '_ppc64le') || endsWith(matrix.only, '_riscv64')
      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4.4.0
      with:
        platforms: ppc64le,riscv64

    - uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae  # v4.2.1
      with:
        only: ${{ matrix.only }}
      env:
        CIBW_BUILD_VERBOSITY: 1

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
      with:
        name: dist-wheels-${{ matrix.only }}
        path: wheelhouse/*.whl

  merge-artifacts:
    runs-on: ubuntu-24.04
    needs: [build-sdist, build-wheels]
    if: >-
      ${{ !cancelled() && needs.build-sdist.result == 'success' &&
          needs.build-wheels.result == 'success' }}
    steps:
      - name: Merge Artifacts
        uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dist
          pattern: dist-*
          delete-merged: true

  dry-run-refs:
    needs: [classify-release, merge-artifacts]
    if: >-
      ${{ !cancelled() && needs.classify-release.outputs.mode == 'dry_run' &&
          needs.merge-artifacts.result == 'success' }}
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout release commit
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        fetch-depth: 2
        persist-credentials: false

    - name: Sign release tag locally
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
      with:
        script: |
          const fs = require('node:fs');
          const os = require('node:os');
          const path = require('node:path');
          const {execFileSync} = require('node:child_process');
          const cwd = process.env.GITHUB_WORKSPACE;
          const pr = context.payload.pull_request;
          // PR workflows check out GitHub's merge commit. Its second parent
          // is the exact PR head selected for this dry run.
          const head = (await exec.getExecOutput('git', [
            'rev-parse', pr ? 'HEAD^2' : 'HEAD',
          ], {
            cwd, silent: true,
          })).stdout.trim();
          if (pr && head !== pr.head.sha) {
            throw new Error(`Checked out ${head}, expected PR head ${pr.head.sha}`);
          }

          const source = (await exec.getExecOutput('git', [
            'show', `${head}:httptools/_version.py`,
          ], {cwd, silent: true})).stdout;
          const version = source.match(/^__version__(?:\s*:\s*typing\.Final)?\s*=\s*['"]([^'"]+)['"]/m)?.[1];
          if (!version) throw new Error('Could not read the release version');
          const tag = `v${version}`;
          const message = pr
            ? `${pr.title}\n\n${pr.body || ''}`
            : `Dry run for ${context.ref}`;

          // Live releases sign the merged commit with the release key. Generate
          // a disposable key here so fork PRs can exercise signing too.
          const gnupgHome = fs.mkdtempSync(path.join(os.tmpdir(), 'release-dry-run-gpg-'));
          fs.chmodSync(gnupgHome, 0o700);
          const originalGnupgHome = process.env.GNUPGHOME;
          try {
            const env = {...process.env, GNUPGHOME: gnupgHome};
            execFileSync('gpg', [
              '--batch', '--pinentry-mode', 'loopback', '--passphrase', '',
              '--quick-generate-key', 'Release dry run <release-dry-run@users.noreply.github.com>',
              'ed25519', 'sign', '0',
            ], {env});
            const keys = execFileSync('gpg', ['--list-secret-keys', '--with-colons'], {
              env, encoding: 'utf8',
            });
            const key = keys.split('\n').find(line => line.startsWith('fpr:'))?.split(':')[9];
            if (!key) throw new Error('Could not identify the disposable signing key');
            await exec.exec('git', ['config', 'user.name', 'Release dry run'], {cwd});
            await exec.exec('git', ['config', 'user.email',
              'release-dry-run@users.noreply.github.com'], {cwd});
            await exec.exec('git', ['config', 'user.signingkey', key], {cwd});
            process.env.GNUPGHOME = gnupgHome;
            await exec.exec('git', ['tag', '--sign', '--file=-', tag, head], {
              cwd, input: Buffer.from(message),
            });
            await exec.exec('git', ['tag', '--verify', tag], {cwd});
            await exec.exec('git', ['show', '--no-patch', tag], {cwd});
          } finally {
            await exec.exec('gpgconf', ['--kill', 'gpg-agent'], {
              env: {...process.env, GNUPGHOME: gnupgHome},
              ignoreReturnCode: true,
            });
            if (originalGnupgHome === undefined) {
              delete process.env.GNUPGHOME;
            } else {
              process.env.GNUPGHOME = originalGnupgHome;
            }
            fs.rmSync(gnupgHome, {recursive: true, force: true});
          }
          core.info(`Dry run: signed ${tag} at ${head} locally; no refs were pushed.`);

  publish:
    needs: [classify-release, merge-artifacts]
    if: >-
      ${{ !cancelled() && needs.classify-release.outputs.mode == 'release' &&
          needs.merge-artifacts.result == 'success' }}
    runs-on: ubuntu-24.04

    environment:
      name: pypi
      url: https://pypi.org/p/httptools
    permissions:
      id-token: write
      attestations: write
      contents: write
      deployments: write
      pull-requests: write

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        fetch-depth: 2
        persist-credentials: false

    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
      with:
        name: dist
        path: dist/

    - name: Extract release version
      id: relver
      run: |
        echo "version=$(cat dist/VERSION)" >> "$GITHUB_OUTPUT"
        rm dist/VERSION

    - name: Merge release PR
      id: merge
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
      with:
        github-token: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
        script: |
          const expected = context.payload.pull_request;
          const args = {...context.repo, pull_number: expected.number};
          const {data: pr} = await github.rest.pulls.get(args);
          if (pr.head.sha !== expected.head.sha) {
            throw new Error('PR head changed since the distributions were built');
          }

          let sha;
          if (pr.merged) {
            sha = pr.merge_commit_sha;
            core.info('Release PR is already merged.');
          } else {
            const {data: result} = await github.rest.pulls.merge({
              ...args,
              sha: expected.head.sha,
              merge_method: 'merge',
            });
            if (!result.merged || !result.sha) {
              throw new Error('Could not merge release PR: ' + result.message);
            }
            sha = result.sha;
          }
          if (!sha) throw new Error('Could not identify the merge commit');
          core.setOutput('sha', sha);

    - name: Sign and push release tag
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
      env:
        RELEASE_VERSION: ${{ steps.relver.outputs.version }}
        RELEASE_SHA: ${{ steps.merge.outputs.sha }}
        RELEASE_BOT_GPG_KEY: ${{ secrets.RELEASE_BOT_GPG_KEY }}
        RELEASE_BOT_GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
      with:
        github-token: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
        script: |
          const fs = require('node:fs');
          const os = require('node:os');
          const path = require('node:path');
          const cwd = process.env.GITHUB_WORKSPACE;
          const tag = 'v' + process.env.RELEASE_VERSION;
          const sha = process.env.RELEASE_SHA;
          const keyId = '5C468778062D87BF';
          const pr = context.payload.pull_request;
          if (!process.env.RELEASE_BOT_GPG_KEY) {
            throw new Error('Release signing key is not configured');
          }
          await exec.exec('git', ['check-ref-format', 'refs/tags/' + tag], {cwd});

          const gnupgHome = fs.mkdtempSync(path.join(os.tmpdir(), 'release-gpg-'));
          fs.chmodSync(gnupgHome, 0o700);
          const auth = Buffer.from('x-access-token:' + process.env.RELEASE_BOT_GITHUB_TOKEN)
            .toString('base64');
          core.setSecret(auth);
          const env = {
            ...process.env,
            GNUPGHOME: gnupgHome,
            GIT_CONFIG_COUNT: '1',
            GIT_CONFIG_KEY_0: 'http.https://github.com/.extraheader',
            GIT_CONFIG_VALUE_0: 'AUTHORIZATION: basic ' + auth,
          };
          const options = {cwd, env, silent: true};
          try {
            await exec.exec('gpg', ['--batch', '--no-tty', '--import'], {
              ...options, input: Buffer.from(process.env.RELEASE_BOT_GPG_KEY),
            });
            const keys = await exec.getExecOutput('gpg', [
              '--batch', '--with-colons', '--list-secret-keys', keyId + '!',
            ], options);
            const fingerprint = keys.stdout.split('\n')
              .filter(line => line.startsWith('fpr:'))
              .map(line => line.split(':')[9])
              .find(value => value.endsWith(keyId));
            if (!fingerprint) throw new Error('Could not identify the release signing key');

            const verify = async () => {
              const target = (await exec.getExecOutput('git', [
                'rev-parse', tag + '^{commit}',
              ], options)).stdout.trim();
              if (target !== sha) throw new Error('Existing tag points to a different commit');
              const signature = await exec.getExecOutput('git', [
                '-c', 'gpg.format=openpgp', 'verify-tag', '--raw', tag,
              ], {...options, ignoreReturnCode: true});
              const signer = signature.stderr.match(/^\[GNUPG:\] VALIDSIG ([0-9A-F]+)/m)?.[1];
              if (signature.exitCode !== 0 || signer !== fingerprint) {
                throw new Error('Tag does not have a valid signature from the release key');
              }
            };
            const fetchTag = () => exec.exec('git', [
              'fetch', '--force', '--no-tags', 'origin',
              'refs/tags/' + tag + ':refs/tags/' + tag,
            ], options);
            const tagExists = async () => {
              try {
                await github.rest.git.getRef({...context.repo, ref: 'tags/' + tag});
                return true;
              } catch (error) {
                if (error.status !== 404) throw error;
                return false;
              }
            };

            if (await tagExists()) {
              await fetchTag();
              await verify();
              core.info('Release tag already exists and has the expected commit and signature.');
              return;
            }

            await exec.exec('git', ['fetch', '--no-tags', 'origin', sha], options);
            const {data: bot} = await github.rest.users.getAuthenticated();
            const email = bot.email || bot.id + '+' + bot.login + '@users.noreply.github.com';
            await exec.exec('git', [
              '-c', 'user.name=' + (bot.name || bot.login),
              '-c', 'user.email=' + email,
              '-c', 'gpg.format=openpgp',
              'tag', '--sign', '--local-user', fingerprint + '!', '--file=-', tag, sha,
            ], {...options, input: Buffer.from(pr.title + '\n\n' + (pr.body || ''))});
            await verify();
            const push = await exec.getExecOutput('git', [
              'push', 'origin', 'refs/tags/' + tag,
            ], {...options, ignoreReturnCode: true});
            if (push.exitCode !== 0) {
              // Accept a concurrent push only when it created the same signed tag target.
              if (!(await tagExists())) throw new Error('Could not push release tag');
              await fetchTag();
              await verify();
            }
            core.info('Signed and pushed ' + tag + ' at ' + sha);
          } finally {
            await exec.exec('gpgconf', ['--kill', 'gpg-agent'], {
              ...options, ignoreReturnCode: true,
            });
            fs.rmSync(gnupgHome, {recursive: true, force: true});
          }

    - name: Create GitHub release
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
      env:
        RELEASE_VERSION: ${{ steps.relver.outputs.version }}
        RELEASE_SHA: ${{ steps.merge.outputs.sha }}
        RELEASE_BODY: ${{ github.event.pull_request.body }}
      with:
        script: |
          const tag = 'v' + process.env.RELEASE_VERSION;
          const args = {...context.repo, tag};
          const existingRelease = async () => {
            try {
              return (await github.rest.repos.getReleaseByTag(args)).data;
            } catch (error) {
              if (error.status !== 404) throw error;
              return null;
            }
          };
          if (await existingRelease()) {
            core.info('Release ' + tag + ' already exists, skipping.');
            return;
          }
          try {
            await github.rest.repos.createRelease({
              ...context.repo,
              tag_name: tag,
              name: tag,
              target_commitish: process.env.RELEASE_SHA,
              body: process.env.RELEASE_BODY,
              draft: false,
              prerelease: false,
            });
          } catch (error) {
            if (error.status !== 422 || !(await existingRelease())) throw error;
            core.info('Release ' + tag + ' was created concurrently, skipping.');
          }

    - name: Upload to PyPI
      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
      with:
        attestations: true
        skip-existing: true