# Build the `omnigent` release distributions (core wheel with the web
# UI bundled in, plus the `omnigent-client` and `omnigent-ui-sdk` SDK
# wheels it depends on), run the readiness gates, and publish all three to
# (Test)PyPI via OIDC Trusted Publishing. The three version-lock together,
# so every release publishes all three at the same version. Self-contained:
# publishes straight from this repo on `ubuntu-latest` for clean public
# PyPI/npm access (never a mirror/proxy).
#
# Release flow:
#   1. Push a version tag (vX.Y.Z / vX.Y.ZrcN) -> build + gate + publish to
#      TestPyPI automatically.
#   2. Validate the TestPyPI release (install + smoke).
#   3. Manually dispatch ON THE SAME TAG with destination=pypi -> publish
#      the identical version to PyPI, behind the protected `pypi` env.
#
# One-time setup (per index, pypi.org AND test.pypi.org): Trusted Publishers
# for all three project names pointing at omnigent-ai/omnigent +
# release-omnigent.yml + the test-pypi/pypi environment (unclaimed names
# reserved via a pending publisher); GitHub envs test-pypi (unprotected)
# and pypi (required reviewer). Actions are SHA-pinned per repo convention.
name: Release omnigent (PyPI)

on:
  # PyPI publishing moved to the central secure-release repo; the tag-push
  # trigger is REMOVED so a tag no longer double-publishes. Kept as a manual
  # fallback only, to be deleted once the secure path has done a prod release.
  # Manual run: build + gates always run; destination picks the index, with
  # `pypi` binding the protected environment.
  workflow_dispatch:
    inputs:
      destination:
        description: "Index to publish to."
        type: choice
        default: test-pypi
        options:
          - test-pypi
          - pypi
  # CI-test the workflow on change: build + gates run on the PR; publish
  # steps are condition-gated off PR events.
  pull_request:
    paths:
      - ".github/workflows/release-omnigent.yml"

permissions:
  contents: read
  id-token: write # OIDC Trusted Publishing — consumed by the publish steps

# Serialize releases on the same ref so two triggers can't race the same tag.
concurrency:
  group: release-omnigent-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-and-publish:
    # Gated to this repository; inert in forks and mirrors.
    if: github.repository == 'omnigent-ai/omnigent'
    runs-on: ubuntu-latest
    # Bound a hung run under GitHub's 6-hour default (real work takes minutes).
    timeout-minutes: 30
    # Environment binds the Trusted Publisher config: test-pypi unprotected,
    # pypi gated by a required-reviewer rule for real releases.
    environment:
      name: ${{ (github.event_name == 'workflow_dispatch' && inputs.destination == 'pypi') && 'pypi' || 'test-pypi' }}

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up uv (clean public resolution, no proxy cache)
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "20"

      # 1. Build the web UI FIRST into the package tree, clean. Ordering is
      #    load-bearing: the wheel packages on-disk files, so the bundle must
      #    exist before `uv build`. `rm -rf` backstops Vite's emptyOutDir
      #    against stale bundles; `npm ci` installs the exact locked deps.
      #    `--legacy-peer-deps` matches how web's lockfile is generated and
      #    validated everywhere else (lint, e2e-ui, web-tests, the regen
      #    jobs) — required for the React 19 peer conflict; without it `npm ci`
      #    rejects the lockfile ("Missing: yaml@1.10.3 from lock file").
      - name: Build web UI (clean, fresh)
        run: |
          rm -rf omnigent/server/static/web-ui
          npm --prefix web ci --legacy-peer-deps
          npm --prefix web run build # Vite outDir -> omnigent/server/static/web-ui

      # 2. Tag-driven: the tag must match the version in all three pyprojects
      #    and the core package's `==` sibling-SDK pins, so the lockstep
      #    contract holds. Skipped on a non-tag ref (nothing to compare).
      - name: Verify tag matches package versions
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          uv run --no-project python - "${GITHUB_REF_NAME#v}" <<'PY'
          import sys
          import tomllib

          tag = sys.argv[1]
          # Every package carries the tag's version; every cross-package
          # dep is an exact `==tag` pin (the lockstep contract).
          packages = {
              "pyproject.toml": ("omnigent-client", "omnigent-ui-sdk"),
              "sdks/python-client/pyproject.toml": ("omnigent",),
              "sdks/ui/pyproject.toml": ("omnigent-client",),
          }
          errors = []
          for path, sibling_pins in packages.items():
              with open(path, "rb") as f:
                  project = tomllib.load(f)["project"]
              print(f"{path}: version={project['version']}")
              if project["version"] != tag:
                  errors.append(f"{path} version {project['version']} does not match tag v{tag}")
              for name in sibling_pins:
                  pin = f"{name}=={tag}"
                  if pin not in project["dependencies"]:
                      errors.append(f"{path} dependencies missing exact pin {pin!r}")
          if errors:
              for e in errors:
                  print(f"::error::{e}")
              sys.exit(1)
          PY

      # 3. Build sdist + wheel for all three into one dist/. The SDKs are
      #    path-deps (not a uv workspace), so each needs its own build.
      - name: Build sdists + wheels
        run: |
          uv build --out-dir dist
          uv build sdks/python-client --out-dir dist
          uv build sdks/ui --out-dir dist
          ls -la dist/

      # 4. Metadata sanity check (long-description renders, fields valid).
      - name: twine check
        run: uvx twine check dist/*

      # 5. GATE: the UI bundle must be inside the core wheel; fail loud if
      #    missing/empty. The glob matches only the core wheel (SDK wheels
      #    are omnigent_client-* / omnigent_ui_sdk-*).
      - name: Assert web-UI bundle shipped in the wheel
        run: |
          uv run --no-project python - <<'PY'
          import glob
          import sys
          import zipfile

          whls = sorted(glob.glob("dist/omnigent-*.whl"))
          if not whls:
              sys.exit("no core omnigent wheel found in dist/")
          whl = whls[-1]
          names = zipfile.ZipFile(whl).namelist()
          ui = [n for n in names if "server/static/web-ui/" in n]
          has_index = any(n.endswith("server/static/web-ui/index.html") for n in ui)
          print(f"{whl}: {len(ui)} web-ui files, index.html present = {has_index}")
          sys.exit(0 if (ui and has_index) else "WEB-UI BUNDLE MISSING FROM WHEEL")
          PY

      # 6. GATE: the wheels install together and the CLI entry point imports,
      #    resolving deps from public PyPI (catches proxy-only deps).
      - name: Smoke-install the built wheels
        run: |
          uv venv --python 3.12 /tmp/omnigent-smoke
          uv pip install --python /tmp/omnigent-smoke/bin/python dist/*.whl
          /tmp/omnigent-smoke/bin/omnigent --version

      # 7. Persist the built artifacts for inspection.
      - name: Upload built distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist-omnigent
          path: dist/

      # PUBLISH via OIDC Trusted Publishing (no token; id-token: write granted
      # above). Attestations stay ON (PEP 740 provenance for a public project).
      - name: Publish to TestPyPI
        # Tag pushes + explicit test-pypi dispatches; PR runs never publish.
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.destination == 'test-pypi')
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/
          # Let a re-run skip already-landed files after a partial publish;
          # the real-PyPI step omits this so a prod collision fails loud.
          skip-existing: true

      - name: Publish to PyPI
        # Real PyPI only via deliberate dispatch with destination=pypi,
        # behind the protected `pypi` environment.
        if: github.event_name == 'workflow_dispatch' && inputs.destination == 'pypi'
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        # default repository-url is pypi.org