release.yml

name: release-skill-pack

on:
  push:
    tags:
      - 'v*.*.*'

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Build and publish portable targets
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Compile Python validators
        run: |
          python -m py_compile scripts/*.py
          python -m py_compile skills/agent-rules-skill-author/scripts/*.py

      - name: Validate schemas
        run: python scripts/validate_schemas.py --strict-graph

      - name: Validate runtime target contracts
        run: python scripts/validate_target_contracts.py

      - name: Validate source version consistency
        run: python scripts/validate_version_consistency.py

      - name: Validate release tag and installation guides
        run: |
          python scripts/validate_release_tag.py --tag "${GITHUB_REF_NAME}"
          python scripts/validate_install_guides.py
          python scripts/build_release_notes.py \
            --tag "${GITHUB_REF_NAME}" \
            --check \
            --require-content

      - name: Validate tool capability metadata
        run: python scripts/validate_tool_capabilities.py

      - name: Validate source context budgets
        run: python scripts/validate_runtime_context_budget.py

      - name: Validate output economy
        run: python scripts/validate_output_economy.py

      - name: Validate policy precedence
        run: python scripts/validate_policy_precedence.py

      - name: Validate planning integrity
        run: python scripts/validate_planning_integrity.py

      - name: Validate test policy
        run: python scripts/validate_test_policy.py

      - name: Validate runtime policy layers
        run: python scripts/validate_runtime_layers.py

      - name: Validate README boundary
        run: python scripts/check_readme_boundary.py

      - name: Validate source bundle
        run: python scripts/validate_source_bundle.py

      - name: Validate skill evals
        run: python scripts/validate_skill_evals.py

      - name: Build portable targets
        run: python scripts/build_skill_targets.py

      - name: Validate generated runtime policy layers
        run: python scripts/validate_runtime_layers.py --generated

      - name: Validate generated context budgets
        run: python scripts/validate_runtime_context_budget.py --generated

      - name: Validate planning target parity
        run: python scripts/validate_planning_target_parity.py

      - name: Run cross-client planning smoke checks
        run: python scripts/validate_planning_smoke.py

      - name: Validate generated version consistency
        run: python scripts/validate_version_consistency.py --generated

      - name: Validate Codex project target
        run: python scripts/validate_codex_project_target.py

      - name: Validate Codex plugin target
        run: python scripts/validate_codex_plugin_target.py

      - name: Validate Claude Code plugin target
        run: python scripts/validate_claude_plugin_target.py

      - name: Validate Cursor project target
        run: python scripts/validate_cursor_target.py

      - name: Run full validation orchestrator
        run: python scripts/validate_skill_pack.py

      - name: Inspect generated targets
        run: |
          test -d dist/codex
          test -d dist/claude
          test -d dist/claude-code
          test -d dist/cursor
          test -d dist/vs-code-codex
          test -d dist/vs-code-claude

          for target in codex claude claude-code cursor vs-code-codex vs-code-claude; do
            test -f "dist/${target}/LICENSE"
            test -f "dist/${target}/tool-capabilities-manifest.json"
            test ! -e "dist/${target}/project"
            test ! -e "dist/${target}/bundle-manifest.json"
            test ! -e "dist/${target}/README.md"
            test ! -e "dist/${target}/CHANGELOG.md"
            test ! -e "dist/${target}/CONTRIBUTING.md"
            test ! -e "dist/${target}/SECURITY.md"
            test ! -e "dist/${target}/examples"
          done

          test -f dist/codex/AGENTS.md
          test -f dist/cursor/AGENTS.md
          test -f dist/vs-code-codex/AGENTS.md
          test -f dist/codex/.codex-plugin/plugin.json
          test -f dist/vs-code-codex/.codex-plugin/plugin.json

          test -f dist/claude-code/.claude-plugin/plugin.json
          test -f dist/claude/.claude-plugin/plugin.json
          test -f dist/vs-code-claude/.claude-plugin/plugin.json
          test -f dist/cursor/.cursor/rules/webdev-agent-kit.mdc

          test ! -e dist/claude/.codex-plugin
          test ! -e dist/claude-code/.codex-plugin
          test ! -e dist/cursor/.codex-plugin
          test ! -e dist/vs-code-claude/.codex-plugin

          if find dist \( -path '*/.obsidian/*' -o -path '*/node_modules/*' \) | grep . \
            || find dist -mindepth 2 -maxdepth 2 -type d -name project | grep .; then
            echo 'Generated targets contain excluded local or generated paths.'
            exit 1
          fi

      - name: Package release artifacts
        run: |
          mkdir -p release-artifacts
          python scripts/build_release_notes.py \
            --tag "${GITHUB_REF_NAME}" \
            --output release-artifacts/RELEASE_NOTES.md \
            --require-content
          python scripts/build_release_archives.py \
            --output release-artifacts \
            --version "${GITHUB_REF_NAME}"
          python scripts/validate_release_archive.py \
            --directory release-artifacts \
            --version "${GITHUB_REF_NAME}"

          echo 'Release artifacts:'
          find release-artifacts -maxdepth 1 -type f -print | sort

      - name: Upload release artifact bundle
        uses: actions/upload-artifact@v4
        with:
          name: webdev-agent-kit-release-${{ github.ref_name }}
          path: release-artifacts/

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          files=(
            "release-artifacts/webdev-agent-kit-codex-${GITHUB_REF_NAME}.tar.gz"
            "release-artifacts/webdev-agent-kit-claude-code-${GITHUB_REF_NAME}.tar.gz"
            "release-artifacts/webdev-agent-kit-cursor-${GITHUB_REF_NAME}.tar.gz"
            "release-artifacts/webdev-agent-kit-vs-code-codex-${GITHUB_REF_NAME}.tar.gz"
            "release-artifacts/webdev-agent-kit-vs-code-claude-${GITHUB_REF_NAME}.tar.gz"
            "release-artifacts/webdev-agent-kit-codex.tar.gz"
            "release-artifacts/webdev-agent-kit-claude-code.tar.gz"
            "release-artifacts/webdev-agent-kit-cursor.tar.gz"
            "release-artifacts/webdev-agent-kit-vs-code-codex.tar.gz"
            "release-artifacts/webdev-agent-kit-vs-code-claude.tar.gz"
            "release-artifacts/SHA256SUMS"
          )

          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
            echo "Release ${GITHUB_REF_NAME} already exists. Uploading assets with --clobber."
            gh release upload "${GITHUB_REF_NAME}" "${files[@]}" --clobber
          else
            echo "Release ${GITHUB_REF_NAME} does not exist. Creating release."
            gh release create "${GITHUB_REF_NAME}" \
              "${files[@]}" \
              --title "WebDev Agent Kit ${GITHUB_REF_NAME}" \
              --notes-file release-artifacts/RELEASE_NOTES.md \
              --verify-tag
          fi