hermes-relay/.github/workflows/release-plugin.yml

name: Hermes-Relay Plugin Release

on:
  push:
    tags:
      - "server-v*"

permissions:
  contents: write

jobs:
  validate:
    name: Validate Plugin release
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/server-v}" >> "$GITHUB_OUTPUT"

      - name: Verify Plugin version sync and changelog
        run: |
          python scripts/check-plugin-version-sync.py --expect "$TAG_VERSION"
          if ! grep -Eq "^## \[Plugin ${TAG_VERSION}\]" CHANGELOG.md; then
            echo "::error::CHANGELOG.md has no Plugin release heading for $TAG_VERSION"
            exit 1
          fi
        env:
          TAG_VERSION: ${{ steps.version.outputs.version }}

      - name: Verify tag belongs to the correct integration branch
        env:
          TAG_VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          tag_commit="$(git rev-parse HEAD)"
          if [[ "$TAG_VERSION" == *-* ]]; then
            git fetch origin dev --no-tags
            if ! git merge-base --is-ancestor "$tag_commit" origin/dev; then
              echo "Plugin prereleases must be tagged from dev; $tag_commit is not in origin/dev" >&2
              exit 1
            fi
          else
            git fetch origin main --no-tags
            if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
              echo "Stable Plugin releases must be tagged from main; $tag_commit is not in origin/main" >&2
              exit 1
            fi
          fi

  test:
    name: Test Plugin package
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - name: Set up Python 3.11
        uses: actions/setup-python@v7
        with:
          python-version: "3.11"

      - name: Install test dependencies
        run: |
          pip install -r relay_server/requirements.txt
          pip install pytest responses

      - name: Syntax check
        run: |
          python -m py_compile plugin/relay/server.py
          python -m py_compile plugin/relay/voice.py
          python -m py_compile plugin/relay/upstream_voice.py
          python -m py_compile plugin/relay/voice_auth.py
          python -m py_compile plugin/tools/android_tool.py
          python -m py_compile plugin/tools/desktop_tool.py
          python -m py_compile relay_server/__init__.py relay_server/__main__.py

      - name: Run focused Plugin tests
        run: |
          python -m pytest \
            plugin/tests/test_manifest_compatibility.py \
            plugin/tests/test_relay_security.py \
            plugin/tests/test_voice_routes.py \
            plugin/tests/test_session_grants.py \
            plugin/tests/test_proactive_channel.py \
            plugin/tests/test_android_phone_status.py

  package:
    name: Build and publish Plugin package
    needs: [validate, test]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - name: Set up Python 3.11
        uses: actions/setup-python@v7
        with:
          python-version: "3.11"

      - name: Build wheel and sdist
        run: |
          pip install build
          python -m build

      - name: Generate checksums
        run: |
          cd dist
          sha256sum * > SHA256SUMS.txt
          cat SHA256SUMS.txt

      # Render PLUGIN_RELEASE_NOTES.md (hand-written per release) into the GitHub
      # Release body, substituting the version token so the Install command stays
      # accurate without a manual edit. The file is the single source of the notes;
      # see RELEASE.md "Plugin / Python package release".
      - name: Render release notes
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          sed "s/__VERSION__/${VERSION}/g" PLUGIN_RELEASE_NOTES.md > release_notes_rendered.md
          echo "=== rendered release body ===" && cat release_notes_rendered.md

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          name: Hermes-Relay Plugin v${{ needs.validate.outputs.version }}
          tag_name: server-v${{ needs.validate.outputs.version }}
          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
          fail_on_unmatched_files: true
          body_path: release_notes_rendered.md
          files: |
            dist/*.whl
            dist/*.tar.gz
            dist/SHA256SUMS.txt

  request-backmerge:
    name: Request stable release backmerge
    needs: [validate, package]
    if: ${{ !contains(needs.validate.outputs.version, '-') }}
    permissions:
      actions: write
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Dispatch fail-closed release reconciliation
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: server-v${{ needs.validate.outputs.version }}
        run: |
          gh workflow run release-backmerge.yml \
            --repo "$GITHUB_REPOSITORY" \
            --ref main \
            -f release_tag="$RELEASE_TAG"