draft-release.yml

name: Create Draft Release
run-name: "Draft release v${{ github.event.inputs.version }}"

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. 0.1.0)"
        required: true

permissions:
  contents: write

jobs:
  validate:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ vars.SGPCTL_SYNC_APP_ID }}
          private-key: ${{ secrets.SGPCTL_SYNC_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          fetch-tags: true
          fetch-depth: 0

      - name: Validate version format
        run: |
          VERSION="${{ github.event.inputs.version }}"
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::Invalid version format '$VERSION'. Must be semver (e.g. 1.2.3)"
            exit 1
          fi

      - name: Check tag does not already exist
        run: |
          TAG="v${{ github.event.inputs.version }}"
          if git tag -l | grep -qx "$TAG"; then
            echo "::error::Tag $TAG already exists"
            exit 1
          fi

      - name: Check version is newer than latest release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ github.event.inputs.version }}"
          LATEST=$(gh release list --repo "${{ github.repository }}" --limit 1 --json tagName -q '.[0].tagName // empty' 2>/dev/null || echo "")
          LATEST="${LATEST#v}"

          if [ -n "$LATEST" ]; then
            # Compare versions using sort -V
            HIGHER=$(printf '%s\n%s' "$LATEST" "$VERSION" | sort -V | tail -1)
            if [ "$HIGHER" = "$LATEST" ]; then
              echo "::error::Version $VERSION is not newer than latest release $LATEST"
              exit 1
            fi
          fi

          echo "Tagging v${VERSION} (latest: ${LATEST:-none})"

      - name: Create and push tag
        run: |
          TAG="v${{ github.event.inputs.version }}"
          git tag "$TAG"
          git push origin "$TAG"

  check:
    needs: validate
    runs-on: ubuntu-latest
    outputs:
      should-build: ${{ steps.compare.outputs.should-build }}
      sgp-commit: ${{ steps.sgp-sha.outputs.sha }}
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ vars.SGPCTL_SYNC_APP_ID }}
          private-key: ${{ secrets.SGPCTL_SYNC_PRIVATE_KEY }}
          repositories: |
            sgp

      - name: Checkout sgp repo (sparse)
        uses: actions/checkout@v4
        with:
          repository: scaleapi/sgp
          token: ${{ steps.app-token.outputs.token }}
          sparse-checkout: services/sgpctl
          sparse-checkout-cone-mode: true

      - name: Get latest SGP commit for services/sgpctl
        id: sgp-sha
        run: |
          echo "sha=$(git log -1 --format=%H -- services/sgpctl)" >> "$GITHUB_OUTPUT"

      - name: Compare with last release
        id: compare
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Get the sgp-commit.txt asset from the latest release
          LAST_SHA=$(gh release view --repo "${{ github.repository }}" --json assets -q '.assets[] | select(.name=="sgp-commit.txt") | .url' 2>/dev/null | xargs -I{} curl -sL -H "Authorization: token $GH_TOKEN" -H "Accept: application/octet-stream" {} 2>/dev/null || echo "")

          CURRENT_SHA="${{ steps.sgp-sha.outputs.sha }}"
          echo "Last release SGP commit: ${LAST_SHA:-none}"
          echo "Current SGP commit:      $CURRENT_SHA"

          if [ "$LAST_SHA" = "$CURRENT_SHA" ]; then
            echo "No changes to services/sgpctl/ since last release — skipping build."
            echo "should-build=false" >> "$GITHUB_OUTPUT"
          else
            echo "Changes detected — proceeding with build."
            echo "should-build=true" >> "$GITHUB_OUTPUT"
          fi

  build:
    needs: check
    if: needs.check.outputs.should-build == 'true'
    strategy:
      matrix:
        include:
          # Linux builds run inside a manylinux_2_28 container (glibc 2.28,
          # AlmaLinux 8 base) so the resulting binary loads on any host with
          # glibc >= 2.28: RHEL/Rocky/AlmaLinux 8+, Ubuntu 20.04+, Debian
          # 11+, Amazon Linux 2023. Building on ubuntu-latest pins the
          # binary's glibc floor to whatever the runner ships (currently
          # 2.39 on ubuntu-24.04), which fails to load on most production
          # bastions. glibc is forward-compatible but not backward-
          # compatible — always build against the oldest glibc you want to
          # support.
          - runner: ubuntu-latest
            container: quay.io/pypa/manylinux_2_28_x86_64
            python_bin: /opt/python/cp312-cp312/bin
            artifact: sgpctl-linux-amd64
          - runner: macos-latest
            artifact: sgpctl-darwin-arm64
          - runner: windows-latest
            artifact: sgpctl-windows-amd64.exe
    runs-on: ${{ matrix.runner }}
    container: ${{ matrix.container }}
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ vars.SGPCTL_SYNC_APP_ID }}
          private-key: ${{ secrets.SGPCTL_SYNC_PRIVATE_KEY }}
          repositories: |
            sgp

      - name: Checkout sgp repo (sparse)
        uses: actions/checkout@v4
        with:
          repository: scaleapi/sgp
          token: ${{ steps.app-token.outputs.token }}
          sparse-checkout: services/sgpctl
          sparse-checkout-cone-mode: true

      # actions/setup-python doesn't work inside the manylinux container
      # (the container provides Python at /opt/python/*/bin instead). Use
      # the bundled interpreter on Linux, setup-python everywhere else.
      - name: Setup Python (manylinux container)
        if: matrix.container != ''
        run: echo "${{ matrix.python_bin }}" >> "$GITHUB_PATH"

      - name: Setup Python (host runner)
        if: matrix.container == ''
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # Install via poetry against poetry.lock so all platforms get the
      # exact pinned versions of scale-gp-beta, agentex-sdk, etc. Plain
      # `pip install ./services/sgpctl` resolves the floating constraints
      # in pyproject.toml, which can pull a newer SDK whose module layout
      # has changed (e.g. scale-gp-beta 0.1.0a51 → 0.1.1 renamed
      # scale_gp_beta.types.deploy_retrieve_response → agentex_cloud_*).
      # POETRY_VIRTUALENVS_CREATE=false makes poetry install into the
      # active Python's site-packages so PyInstaller can find the deps.
      - name: Install dependencies
        shell: bash
        env:
          POETRY_VIRTUALENVS_CREATE: "false"
        run: |
          pip install poetry==2.1.3
          poetry --directory services/sgpctl install --only main --no-interaction --no-ansi
          pip install pyinstaller==6.10.0

      # --collect-all is needed for SDKs that use lazy/generated module
      # loading; PyInstaller's static analysis misses submodules that are
      # only imported via __getattr__ or pkg_resources.
      - name: Build with PyInstaller
        shell: bash
        run: |
          pyinstaller \
            --onefile \
            --name sgpctl \
            --collect-all sgpctl \
            --collect-all scale_gp_beta \
            --collect-all agentex \
            --collect-submodules pydantic \
            services/sgpctl/sgpctl/cli.py

      - name: Rename binary (Windows)
        if: runner.os == 'Windows'
        run: |
          mv dist/sgpctl.exe dist/${{ matrix.artifact }}

      - name: Rename binary (Unix)
        if: runner.os != 'Windows'
        run: |
          mv dist/sgpctl dist/${{ matrix.artifact }}

      - name: Smoke test
        run: |
          ./dist/${{ matrix.artifact }} --help

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: dist/${{ matrix.artifact }}

  release:
    needs: [check, build]
    if: needs.check.outputs.should-build == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Write SGP commit SHA
        run: |
          echo "${{ needs.check.outputs.sgp-commit }}" > artifacts/sgp-commit.txt

      - name: Create draft release with assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="v${{ github.event.inputs.version }}"
          REPO="${{ github.repository }}"

          # Create a draft release
          gh release create "$TAG" --repo "$REPO" --title "$TAG" --generate-notes --draft

          # Upload sgp-commit.txt for future change detection
          gh release upload "$TAG" artifacts/sgp-commit.txt --repo "$REPO"

          # Upload all binaries
          for dir in artifacts/*/; do
            for file in "$dir"*; do
              gh release upload "$TAG" "$file" --repo "$REPO"
            done
          done