release.yml

name: release

on:
  push:
    tags: ['v*']

permissions:
  contents: write

jobs:
  validate:
    runs-on: ubuntu-24.04
    outputs:
      source: ${{ steps.source.outputs.commit }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Bind evidence to its sole source parent
        id: source
        shell: bash
        run: |
          set -euo pipefail
          S=$(python3 crates/synapse-release-checks/check.py source)
          echo "commit=$S" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Download immutable candidate bytes
        run: gh release download "candidate-${{ steps.source.outputs.commit }}" --dir "$RUNNER_TEMP/candidate"
        env:
          GH_TOKEN: ${{ github.token }}
      # Manual prerequisite before tagging: produce each declared cell on its
      # hardware with the catalog-path runner: ckdev-synapse-certify run --row <row> --model <catalog_id>
      # --assets <aggregate-dir> --checkout <root> --mirror <dir>.
      - name: Validate inventory, release gates and catalog-derived records
        run: python3 crates/synapse-release-checks/check.py validate --downloads "$RUNNER_TEMP/candidate" --assets "$RUNNER_TEMP/extracted"
      - uses: actions/upload-artifact@v4
        with:
          name: verified-candidate
          path: ${{ runner.temp }}/candidate/*
          if-no-files-found: error

  smoke:
    needs: validate
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            arch: linux-x64
          - os: windows-2025
            arch: windows-x64
          - os: macos-15
            arch: darwin-arm64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Download this OS candidate assets
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          ARCH: ${{ matrix.arch }}
          SOURCE: ${{ needs.validate.outputs.source }}
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/candidate"
          gh release download "candidate-$SOURCE" --pattern "*-$ARCH.zip*" --dir "$RUNNER_TEMP/candidate"
          if [ "$ARCH" = linux-x64 ]; then
            gh release download "candidate-$SOURCE" --pattern 'release-manifest.json*' --dir "$RUNNER_TEMP/candidate"
          fi
          python crates/synapse-release-checks/check.py extract --os-arch "$ARCH" --downloads "$RUNNER_TEMP/candidate" --assets "$RUNNER_TEMP/extracted"
      - name: Install Linux no-GPU runtime prerequisites
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y libvulkan1 mesa-vulkan-drivers
          mkdir -p "$RUNNER_TEMP/runtime"
          cd "$RUNNER_TEMP/runtime"
          while read -r component version sha; do
            archive="$component.tar.xz"
            curl --fail --location "https://developer.download.nvidia.com/compute/cuda/redist/$component/linux-x86_64/$component-linux-x86_64-$version-archive.tar.xz" -o "$archive"
            echo "$sha  $archive" | sha256sum --check
            tar -xf "$archive"
          done <<'PINS'
          cuda_cudart 13.2.75 9502ab2c7824e5ef3b554d290b9f564c5026994f469b99c72451a53578f386b9
          libcublas 13.4.0.1 eda8001ac6b9a6ad862d054aa9b502ff39684147f1e86d02cc0a58a5ce67f62e
          PINS
          echo "LD_LIBRARY_PATH=$RUNNER_TEMP/runtime/cuda_cudart-linux-x86_64-13.2.75-archive/lib:$RUNNER_TEMP/runtime/libcublas-linux-x86_64-13.4.0.1-archive/lib" >> "$GITHUB_ENV"
      - name: Install pinned Windows Vulkan loader
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $installer = "$env:RUNNER_TEMP/vulkan.exe"
          Invoke-WebRequest 'https://sdk.lunarg.com/sdk/download/1.4.357.0/windows/vulkansdk-windows-X64-1.4.357.0.exe' -OutFile $installer
          if ((Get-FileHash $installer -Algorithm SHA256).Hash.ToLower() -ne '81f474711e9042f4cd22b31b2f7a8870db2e428b21586fb43dd80150be97310d') { throw 'Vulkan SDK digest mismatch' }
          $sdk = "$env:RUNNER_TEMP/VulkanSDK/1.4.357.0"
          $p = Start-Process $installer -ArgumentList @('--root', $sdk, '--accept-licenses', '--default-answer', '--confirm-command', 'install') -Wait -PassThru
          if ($p.ExitCode -ne 0) { throw 'Vulkan SDK install failed' }
          Copy-Item "$sdk/Bin/vulkan-1.dll" "$env:RUNNER_TEMP/extracted/windows-x64/vulkan-1.dll"
      - name: Assert exact version and no-GPU refusal contracts
        shell: bash
        env:
          ARCH: ${{ matrix.arch }}
        run: python crates/synapse-release-checks/smoke.py "$RUNNER_TEMP/extracted/$ARCH"

  promote:
    needs: [validate, smoke]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v4
        with:
          name: verified-candidate
          path: verified
      - name: Promote verified bytes and release notes
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE: ${{ needs.validate.outputs.source }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          python3 crates/synapse-release-checks/promote.py "$TAG" "$SOURCE" verified