release.yml

name: Release Bundle

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Install runner dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y python3-yaml rsync ripgrep

      - name: Run repository consistency checks
        run: bash ./scripts/check-repo-consistency.sh

      - name: Run shared-agent audit
        run: bash ./scripts/audit-codex-agents.sh

      - name: Determine release version
        id: meta
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          else
            echo "version=manual-${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
          fi

      - name: Build release bundle
        run: bash ./scripts/build-release-bundle.sh --output-dir dist --version "${{ steps.meta.outputs.version }}"

      - name: Upload release bundle artifact
        uses: actions/upload-artifact@v7
        with:
          name: codex-cli-bootstrap-${{ steps.meta.outputs.version }}
          path: dist/
          if-no-files-found: error

      - name: Publish GitHub release
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tag="${GITHUB_REF_NAME}"
          if gh release view "$tag" >/dev/null 2>&1; then
            gh release upload "$tag" dist/* --clobber
          else
            gh release create "$tag" dist/* --generate-notes
          fi