release.yml

name: Release

# Cortex's SUPPORTED install path is Anthropic's plugin marketplace
# (`/plugin install cortex@cortex-plugins`). The marketplace consumes the
# git tree directly via ``${CLAUDE_PLUGIN_ROOT}``. See ADR-0050.
#
# PyPI is a DEPRECATED secondary channel, kept best-effort for legacy
# `pip install` / `uvx` users. It is NOT the supported path and may lag
# or be removed. The publish-pypi job below is intentionally
# non-blocking: if PyPI rejects the upload (e.g. the Trusted Publisher
# entry was removed), the GitHub Release + marketplace propagation still
# succeed. Publishing uses PEP 740 Trusted Publishing (OIDC) against the
# trusted-publisher entry configured for this workflow + environment
# `pypi` — the same one that published versions up to 3.14.7.
#
# This workflow runs the tests on tag push, creates a GitHub Release with
# auto-generated notes, and (best-effort) publishes to the deprecated
# PyPI channel.

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  test:
    name: Test before release
    runs-on: ubuntu-latest

    env:
      DATABASE_URL: postgresql://cortex:cortex@localhost:5432/cortex

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # Runner-local PostgreSQL + pgvector (no Docker Hub pull). See ci.yml for
      # the rationale: anonymous registry-1.docker.io pulls are rate-limited and
      # outage-prone; PGDG apt is the canonical, unmetered pgvector source.
      - name: Set up PostgreSQL + pgvector (runner-local, no registry pull)
        run: |
          set -euxo pipefail
          sudo systemctl start postgresql
          PG_VER="$(pg_lsclusters -h | awk 'NR==1 {print $1}')"
          sudo install -d /usr/share/postgresql-common/pgdg
          sudo curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
            -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc
          echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" \
            | sudo tee /etc/apt/sources.list.d/pgdg.list
          for i in 1 2 3; do sudo apt-get update && break || sleep 5; done
          for i in 1 2 3; do sudo apt-get install -y "postgresql-${PG_VER}-pgvector" && break || sleep 5; done
          sudo -u postgres psql -v ON_ERROR_STOP=1 \
            -c "CREATE ROLE cortex LOGIN SUPERUSER PASSWORD 'cortex';"
          sudo -u postgres createdb -O cortex cortex
          sudo -u postgres psql -v ON_ERROR_STOP=1 -d cortex \
            -c "CREATE EXTENSION IF NOT EXISTS vector; CREATE EXTENSION IF NOT EXISTS pg_trgm;"
          for i in $(seq 1 30); do
            PGPASSWORD=cortex pg_isready -h localhost -U cortex -d cortex && break || sleep 1
          done
          PGPASSWORD=cortex psql -h localhost -U cortex -d cortex -c "SELECT version();"

      - name: Cache HuggingFace models
        uses: actions/cache@v4
        with:
          path: ~/.cache/huggingface
          key: ${{ runner.os }}-hf-all-MiniLM-L6-v2

      - name: Install dependencies
        run: pip install -e ".[dev,postgresql]"

      - name: Pre-download embedding model
        run: python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('all-MiniLM-L6-v2', device='cpu')"
        continue-on-error: true

      - name: Run tests
        run: pytest --tb=short -q

  github-release:
    name: GitHub Release
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Generate changelog
        id: changelog
        run: |
          # Get previous tag
          PREV_TAG=$(git tag --sort=-version:refname | head -2 | tail -1)
          if [ -z "$PREV_TAG" ]; then
            CHANGELOG=$(git log --pretty=format:"- %s" HEAD)
          else
            CHANGELOG=$(git log --pretty=format:"- %s" ${PREV_TAG}..HEAD)
          fi
          # Write to file to avoid escaping issues
          echo "$CHANGELOG" > changelog.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          body_path: changelog.txt
          generate_release_notes: true

  # ── DEPRECATED PyPI channel (best-effort) ──────────────────────────────
  # Restored after being dropped in a2dc7e3. Marketplace (ADR-0050) is the
  # supported path; these jobs keep the legacy `pip install` / `uvx` users
  # on a non-vulnerable version. Decoupled from github-release so a PyPI
  # failure never blocks the supported channel.
  build:
    name: Build sdist + wheel (deprecated PyPI channel)
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install build tools
        run: pip install build

      - name: Build sdist and wheel
        run: python -m build

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish-pypi:
    name: Publish to PyPI (deprecated channel)
    needs: build
    runs-on: ubuntu-latest
    # OIDC Trusted Publishing — no stored secret. Verified by PyPI against
    # the trusted-publisher entry for (cdeust/Cortex, release.yml,
    # environment=pypi). This is the same entry that published <= 3.14.7.
    environment:
      name: pypi
      url: https://pypi.org/p/hypermnesia-mcp
    permissions:
      id-token: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI (best-effort — must not fail the release)
        uses: pypa/gh-action-pypi-publish@release/v1
        # Deprecated channel: a rejected upload (already-exists, or the
        # Trusted Publisher entry was removed) must NOT red-X the release.
        continue-on-error: true
        with:
          verbose: true
          # skip-existing so a retag against an already-published version
          # is a no-op instead of a hard failure — this was the exact
          # failure mode that motivated removing PyPI in a2dc7e3.
          skip-existing: true