release.yml

name: release

# An annotated tag vX.Y.Z aliases the already tested and attested sha-<commit> digests of both
# images to vX.Y.Z and stable. Nothing is rebuilt, so the attestations still apply.
on:
  push:
    tags: ["v*.*.*"]

permissions:
  contents: read

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
      packages: write
    env:
      IMAGES: ghcr.io/cortexlm/hypertrain ghcr.io/cortexlm/hypertrain-gpu
      TAG: ${{ github.ref_name }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Check tag, version and main ancestry
        id: check
        run: |
          git fetch --no-tags origin "+refs/tags/${TAG}:refs/tags/${TAG}"
          [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "tag must be vX.Y.Z"; exit 1; }
          [ "$(git cat-file -t "refs/tags/${TAG}")" = tag ] || { echo "tag must be annotated"; exit 1; }
          version=$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')
          [ "v${version}" = "$TAG" ] || { echo "pyproject version ${version} != ${TAG}"; exit 1; }
          commit=$(git rev-parse "${TAG}^{commit}")
          git merge-base --is-ancestor "$commit" origin/main || { echo "tag is not on main"; exit 1; }
          echo "commit=${commit}" >> "$GITHUB_OUTPUT"
      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
      - name: Build wheel and sign update manifest
        env:
          COMMIT: ${{ steps.check.outputs.commit }}
          HYPERTRAIN_RELEASE_KEY: ${{ secrets.HYPERTRAIN_RELEASE_KEY }}
        run: |
          [ -n "$HYPERTRAIN_RELEASE_KEY" ] || { echo "HYPERTRAIN_RELEASE_KEY is not set"; exit 1; }
          uv build --wheel --out-dir dist
          wheel=$(ls dist/*.whl)
          key="$RUNNER_TEMP/release.key"
          (umask 077 && printf '%s' "$HYPERTRAIN_RELEASE_KEY" > "$key")
          uv run --frozen python scripts/sign_release.py --key-file "$key" --tag "$TAG" \
            --commit "$COMMIT" --wheel "$wheel" --out dist/manifest.json \
            --wheel-url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/$(basename "$wheel")"
          rm -f "$key"
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Alias the tested digests
        env:
          COMMIT: ${{ steps.check.outputs.commit }}
        run: |
          : > digests.txt
          for image in $IMAGES; do
            source="${image}:sha-${COMMIT}"
            digest=$(docker buildx imagetools inspect "$source" --format '{{json .Manifest}}' | jq -r .digest)
            [[ "$digest" == sha256:* ]] || { echo "no image for ${source}; wait for images.yml"; exit 1; }
            docker buildx imagetools create --prefer-index=false \
              --tag "${image}:${TAG}" --tag "${image}:stable" "${image}@${digest}"
            for tag in "$TAG" stable; do
              moved=$(docker buildx imagetools inspect "${image}:${tag}" --format '{{json .Manifest}}' | jq -r .digest)
              [ "$moved" = "$digest" ] || { echo "${image}:${tag} is ${moved}, expected ${digest}"; exit 1; }
            done
            echo "- ${image}@${digest} (tags ${TAG} and stable)" >> digests.txt
          done
      - name: GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "$TAG" --verify-tag --repo "$GITHUB_REPOSITORY" \
            --title "$TAG" --notes-file digests.txt dist/*.whl dist/manifest.json