name: Release
# Tag-based release workflow.
# Triggers when an annotated tag matching v*.*.* is pushed.
# Runs tests as a gate, validates version consistency, then creates/updates
# a GitHub Release with notes extracted from CHANGELOG.md.
#
# Pattern: tag push -> test gate -> version gate -> GitHub Release
# See: Pepper KB "tag-based-release-sop.md" for full SOP.
on:
push:
tags:
- "v*.*.*" # semantic version tags only
permissions:
contents: write # create/update releases
concurrency:
group: release-${{ github.ref_name }}
cancel-in-progress: false # never cancel an in-progress release
jobs:
# Gate 1: Run the full test suite on the tagged commit
test-gate:
name: Test gate
runs-on: ubuntu-latest
strategy:
fail-fast: true
matrix:
python-version: ["3.10", "3.12"]
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- name: Set up uv
uses: astral-sh/setup-uv@v7
with:
enable-cache: true
- name: Run tests
run: make test
# Gate 2: Validate tag matches pyproject.toml and CHANGELOG exists
version-gate:
name: Version gate
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Validate release readiness
env:
GITHUB_REF_NAME: ${{ github.ref_name }}
run: python scripts/check_release_ready.py
# Create GitHub Release (only after both gates pass)
create-release:
name: Create GitHub Release
runs-on: ubuntu-latest
needs: [test-gate, version-gate]
steps:
- uses: actions/checkout@v4
- name: Create/Update GitHub Release from CHANGELOG
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_REF_NAME: ${{ github.ref_name }}
run: python scripts/create_github_release_from_changelog.py
