public-release-boundary.yml

name: Public Release Boundary

on:
  pull_request:
    branches: [develop, main]
  push:
    branches: [develop, main]
  workflow_dispatch:

jobs:
  boundary-validation:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Validate source boundary (allowlisted scope)
        run: |
          bash scripts/validate-public-manifest.sh \
            --root . \
            --manifest release/public-manifest.yaml \
            --only-included

      - name: Build deterministic public artifact
        run: |
          mkdir -p /tmp/public-artifact
          bash scripts/build-public-artifact.sh \
            --root . \
            --manifest release/public-manifest.yaml \
            --output /tmp/public-artifact

      - name: Verify artifact boundary
        run: |
          bash scripts/validate-public-manifest.sh \
            --root /tmp/public-artifact \
            --manifest release/public-manifest.yaml

      - name: Run pipeline regression tests
        run: |
          bash tests/test_public_manifest_pipeline.sh

      - name: Validate public docs version consistency
        run: |
          python - <<'PY'
          from pathlib import Path
          import re
          import sys

          version = Path("VERSION").read_text(encoding="utf-8").strip()
          readme = Path("README.md")
          changelog = Path("CHANGELOG.md")
          contributing = Path("CONTRIBUTING.md")

          missing = [p for p in [readme, changelog, contributing] if not p.exists()]
          if missing:
              print("Missing required public docs:")
              for p in missing:
                  print(f"- {p}")
              sys.exit(1)

          readme_text = readme.read_text(encoding="utf-8", errors="ignore")
          changelog_text = changelog.read_text(encoding="utf-8", errors="ignore")

          if not re.search(re.escape(version), readme_text):
              print(f"README.md missing current version marker: {version}")
              sys.exit(1)
          if not re.search(re.escape(version), changelog_text):
              print(f"CHANGELOG.md missing current version marker: {version}")
              sys.exit(1)

          print("Public docs version consistency check passed.")
          PY