release.yml

name: Release

# Cuts a release for the version recorded in version.meta.json (next_version):
# regenerate the manifests stamped with it, commit the bumped tree + tag to main,
# cut the GitHub release, and (via the bump script) advance version.meta.json.
# Manual dispatch only; the version is auto-numbered from version.meta.json, so
# there is no version input. The version commit and tag are the writes to main,
# pushed as the DECO-SDK-Tagging App (on the branch + tag ruleset bypass lists).
on:
  workflow_dispatch: {}

# Serialize writes to main against self-heal-manifest.yml (same group), so a
# release commit and a self-heal commit can never push concurrently and race the
# branch ruleset. Queued, not cancelled: a release must always complete.
concurrency:
  group: skills-main-write
  cancel-in-progress: false

jobs:
  release:
    runs-on:
      group: databricks-protected-runner-group
      labels: linux-ubuntu-latest
    # release-is holds the DECO-SDK-Tagging GitHub App credentials below.
    environment: "release-is"
    permissions:
      contents: write
    steps:
      # Push as the DECO-SDK-Tagging App, not github-actions[bot]. main's rulesets
      # require PR + merge queue and reject a direct bot push; the App is on the
      # bypass list (branch + tag creation), so it can push the version commit and
      # the tag directly. Same pattern as databricks-sdk-go.
      - name: Generate GitHub App token
        id: generate-token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
        with:
          app-id: ${{ secrets.DECO_SDK_TAGGING_APP_ID }}
          private-key: ${{ secrets.DECO_SDK_TAGGING_PRIVATE_KEY }}

      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: main
          # Persist the App token so the pushes below carry its credentials.
          token: ${{ steps.generate-token.outputs.token }}

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.11'

      - name: Read release version from version.meta.json
        id: version
        # next_version is the version to release. Read it BEFORE the bump (the
        # bump advances it), so the tag below matches what we release.
        run: |
          V="v$(python3 -c 'import json; print(json.load(open("metaplugin/version.meta.json"))["next_version"])')"
          if [[ ! "$V" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: version.meta.json next_version is not X.Y.Z: $V"; exit 1
          fi
          echo "version=$V" >> "$GITHUB_OUTPUT"

      - name: Abort if already published
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          # next_version should never already be tagged. If it is, version.meta.json
          # is stale (a prior release did not advance it). Fail loudly rather than
          # silently skip, since this is a deliberate manual release.
          if git ls-remote --exit-code --tags origin "refs/tags/$VERSION" >/dev/null 2>&1; then
            echo "Error: $VERSION is already published. Advance next_version in version.meta.json."
            exit 1
          fi

      - name: Bump to the release version and regenerate
        # Stamps next_version into the manifests + bundle, then advances
        # version.meta.json (current_version = released, next_version = next patch).
        run: python3 scripts/bump_version.py

      - name: Validate generated manifests before publishing
        # Aborts the release if anything is inconsistent BEFORE the commit and tag
        # are pushed, instead of failing post-push CI after the release is live.
        run: python3 scripts/skills.py validate

      - name: Commit the release version
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Commit as the App (the email must be its noreply address or the commit
          # is unverified). The bump regenerates version.meta.json + the four
          # plugin.json (with the new version) + the catalogs/wiring/manifest +
          # the plugins/databricks/ bundle.
          git config user.name "Databricks SDK Release Bot"
          git config user.email "DECO-SDK-Tagging[bot]@users.noreply.github.com"
          # Stage everything the bump produced. We rely on .gitignore (which covers
          # __pycache__/, *.pyc, .DS_Store, and dev-only dirs) rather than a
          # hard-coded allowlist, so any newly generated artifact is committed
          # automatically instead of being silently dropped from the tagged release.
          git add -A
          # Guard: a release must produce a committable diff (at minimum the version
          # bump). An empty index here means generation did not run -- fail rather
          # than tag a no-op release.
          if git diff --cached --quiet; then
            echo "Error: nothing staged after bump + generate; generation may have failed."
            exit 1
          fi
          git commit -s -m "chore(release): $VERSION"
          git push origin HEAD:main

      - name: Create annotated tag
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          # git identity is configured by the commit step above and persists for
          # the job. Annotated tag (records tagger metadata), pushed at the version
          # commit just created.
          git tag -a "$VERSION" -m "$VERSION"
          git push origin "$VERSION"

      - name: Create release
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: gh release create "$VERSION" --title "$VERSION" --generate-notes --verify-tag