release.yml

# ======================================================================
# 🌸 Project ORCHID: Continuous Integration & Automated Release Pipeline
# Ownership: https://github.com/DigitalServerHost/ORCHID (Org Account)
# ======================================================================

name: "🌸 Project ORCHID CI/CD Release"

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  pull_request:
    branches:
      - main

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  # Job 1: Comprehensive multi-language linting, testing, and compilation quality gates
  quality-gates:
    name: "🛡️ Quality Gates & Diagnostics"
    runs-on: ubuntu-latest

    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v4

      - name: "Set up Go Environment"
        uses: actions/setup-go@v5
        with:
          go-version: "1.20"
          cache: true

      - name: "Execute Concurrent Go Scheduler Tests"
        run: |
          go test -v ./scheduler/...

      - name: "Set up Python Environment"
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: "Set up UV"
        uses: astral-sh/setup-uv@v3
        with:
          version: "latest"
          enable-cache: true # Optimized: Enabled caching for dependencies

      - name: "Bootstrap Python SDK Environment & Run Simulator/Timing Benchmark"
        run: |
          chmod +x scripts/*.sh
          make setup
          make test

  # Job 2: Compile cross-platform binaries, build Python package, and publish releases
  build-and-release:
    name: "📦 Packaging, Signed Release & Container Publishing"
    needs: quality-gates
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || (startsWith(github.ref, 'refs/tags/v') && github.actor != 'mcpwest'))
    runs-on: ubuntu-latest

    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }} # No longer needs MCP_PAT here since we aren't pushing code

      - name: "Set up Go Environment"
        uses: actions/setup-go@v5
        with:
          go-version: "1.20"
          cache: true

      - name: "Compile Go Scheduler Daemon"
        run: |
          make build

      - name: "Set up Python Environment"
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: "Set up UV"
        uses: astral-sh/setup-uv@v3
        with:
          version: "latest"
          enable-cache: true

      - name: "Generate Automated Release Version Tag"
        id: versioning
        env:
          GH_TOKEN: ${{ secrets.MCP_PAT }} # Keep for PR API evaluation if necessary
        run: |
          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
            echo "VERSION=${{ github.ref_name }}" >> $GITHUB_OUTPUT
            echo "Triggered by tag. Using version ${{ github.ref_name }}"
          else
            git fetch --tags --force --unshallow || git fetch --tags --force
            
            LATEST_TAG=$(git tag -l "v[0-9]*" | sort -V | tail -n1)
            if [ -z "$LATEST_TAG" ]; then
              LATEST_TAG="v0.1.0"
              echo "No tags found. Initializing base version to $LATEST_TAG"
            else
              echo "Latest semantic tag found: $LATEST_TAG"
            fi
            
            VERSION_NUM=${LATEST_TAG#v}
            CLEAN_VERSION=$(echo "$VERSION_NUM" | cut -d'-' -f1)
            
            IFS='.' read -r MAJOR MINOR PATCH <<< "$CLEAN_VERSION"
            MAJOR=${MAJOR:-0}
            MINOR=${MINOR:-1}
            PATCH=${PATCH:-0}
            
            INCREMENT="patch"
            
            if [ -n "${{ github.sha }}" ]; then
              echo "Querying GitHub API for merged PR labels associated with commit ${{ github.sha }}..."
              PR_LIST=$(gh pr list --commit "${{ github.sha }}" --state merged --json labels --jq '.[0].labels[].name' 2>/dev/null || true)
              
              if [ -n "$PR_LIST" ]; then
                echo "Found PR labels:"
                echo "$PR_LIST"
                if echo "$PR_LIST" | grep -iq "major"; then
                  INCREMENT="major"
                elif echo "$PR_LIST" | grep -iq "minor"; then
                  INCREMENT="minor"
                elif echo "$PR_LIST" | grep -iq "patch"; then
                  INCREMENT="patch"
                fi
              else
                echo "No Pull Request labels detected."
              fi
            fi
            
            echo "Semantic increment strategy: $INCREMENT"
            
            if [ "$INCREMENT" = "major" ]; then
              NEXT_MAJOR=$((MAJOR + 1))
              NEXT_MINOR=0
              NEXT_PATCH=0
            elif [ "$INCREMENT" = "minor" ]; then
              NEXT_MAJOR=$MAJOR
              NEXT_MINOR=$((MINOR + 1))
              NEXT_PATCH=0
            else
              NEXT_MAJOR=$MAJOR
              NEXT_MINOR=$MINOR
              NEXT_PATCH=$((PATCH + 1))
            fi
            
            NEXT_VERSION="v$NEXT_MAJOR.$NEXT_MINOR.$NEXT_PATCH"
            echo "Calculated next version: $NEXT_VERSION"
            echo "VERSION=$NEXT_VERSION" >> $GITHUB_OUTPUT
          fi

      - name: "Synchronize Package Version with Release Tag"
        id: version_clean
        run: |
          TAG_VERSION="${{ steps.versioning.outputs.VERSION }}"
          CLEAN_VERSION="${TAG_VERSION#v}"
          echo "CLEAN_VERSION=$CLEAN_VERSION" >> $GITHUB_OUTPUT

          # This change modifies the runner workspace context only. It never modifies history.
          python3 -c "import re; p = 'pyproject.toml'; c = open(p).read(); c = re.sub(r'version\s*=\s*\"[^\"]+\"', f'version = \"$CLEAN_VERSION\"', c); open(p, 'w').write(c)"
          echo "Updated workspace pyproject.toml to version $CLEAN_VERSION"

      - name: "Build Distributable Python SDK Packages"
        run: |
          make dist

      - name: "Set up Docker Buildx"
        uses: docker/setup-buildx-action@v3

      - name: "Log into GitHub Container Registry"
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: mcpwest
          password: ${{ secrets.MCP_PAT }} # Attributes container image package to mcpwest account

      - name: "Extract Production Docker Metadata"
        id: meta-prod
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/digitalserverhost/orchid
          tags: |
            type=ref,event=branch
            type=ref,event=tag
            type=match,pattern=v(.*),group=1
            type=sha,format=short
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}

      - name: "Build and Push Hardened Production Container"
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          target: release-hardened
          push: true
          tags: ${{ steps.meta-prod.outputs.tags }}
          labels: ${{ steps.meta-prod.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: "Extract Developer Docker Metadata"
        id: meta-dev
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/digitalserverhost/orchid
          tags: |
            type=ref,event=branch,suffix=-dev
            type=ref,event=tag,suffix=-dev
            type=match,pattern=v(.*),group=1,suffix=-dev
            type=sha,format=short,suffix=-dev
            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/main' }}

      - name: "Build and Push Developer Sandbox Container"
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          target: developer
          push: true
          tags: ${{ steps.meta-dev.outputs.tags }}
          labels: ${{ steps.meta-dev.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: "Create GitHub Release and Bind Immutable Tag"
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.versioning.outputs.VERSION }}
          target_commitish: ${{ github.sha }} # Crucial: Anchors the tag cleanly to your verified commit
          name: "Project ORCHID Release ${{ steps.versioning.outputs.VERSION }}"
          body: |
            ## 🌸 Project ORCHID Automated Release - ${{ steps.versioning.outputs.VERSION }}

            This release was automatically generated by the automated CI/CD release pipeline following quality gate passing.

            ### 🏛️ Repository Info
            - **Organization Account:** [DigitalServerHost/ORCHID](https://github.com/DigitalServerHost/ORCHID)
            - **Built From Verified Commit:** ${{ github.sha }} (@${{ github.actor }})
            - **Core Architecture & Maintainer:** (@westkevin12)
            - **Concept originator:** Teppei Oohira (@gatchimuchio)

            ### 📦 Released Artifacts
            - **Go Concurrent Daemon Binary:** `orchid-daemon`
            - **Python SDK Wheel:** `orchid-${{ steps.version_clean.outputs.CLEAN_VERSION }}-py3-none-any.whl`
            - **Python SDK Tarball:** `orchid-${{ steps.version_clean.outputs.CLEAN_VERSION }}.tar.gz`
            - **Container Image:** `ghcr.io/digitalserverhost/orchid:${{ steps.versioning.outputs.VERSION }}`

            ---
            _Automated under GNU GPLv3 License coverage._
          files: |
            build/orchid-daemon
            dist/orchid-*.whl
            dist/orchid-*.tar.gz
          draft: false
          prerelease: false
          token: ${{ secrets.MCP_PAT }}