Add Release workflow and prepare v0.1.0-alpha.1 - #45

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*'

printf '%s\n' '--- release workflow outline/context ---'
wc -l .github/workflows/release.yml
cat -n .github/workflows/release.yml | sed -n '1,180p'

printf '%s\n' '--- relevant references ---'
rg -n -C 3 'inputs\.version|GITHUB_EVENT_NAME|GITHUB_REF_NAME|VERSION=|GITHUB_OUTPUT|package\.json|npm version|tag|release' .github/workflows/release.yml

printf '%s\n' '--- behavioral probe: generated Bash from the current interpolation ---'
python3 - <<'PY'
import subprocess

template = r'''set -euo pipefail
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
  VERSION="${{ inputs.version }}"
  VERSION="${VERSION#v}"
else
  TAG_NAME="${GITHUB_REF_NAME}"
  VERSION="${TAG_NAME#v}"
fi
printf 'VERSION=<%s>\n' "$VERSION"
'''

values = {
    "benign": "v1.2.3",
    "quote": '"; printf "INJECTED"; #',
    "command_substitution": '$(printf INJECTED)',
    "newline": '1.2.3\nprintf INJECTED\n#',
}
for name, value in values.items():
    generated = template.replace("${{ inputs.version }}", value)
    result = subprocess.run(
        ["bash", "-c", generated],
        text=True,
        capture_output=True,
        env={"GITHUB_REF_NAME": "v9.9.9"},
    )
    print(f"[{name}] exit={result.returncode}")
    print("stdout:", repr(result.stdout))
    print("stderr:", repr(result.stderr))
PY

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import subprocess

current = r'''set -euo pipefail
if [[ "workflow_dispatch" == "workflow_dispatch" ]]; then
  VERSION="${INPUT_VERSION}"
  VERSION="${VERSION#v}"
  printf 'VERSION=<%s>\n' "$VERSION"
fi
'''

direct_template = r'''set -euo pipefail
if [[ "workflow_dispatch" == "workflow_dispatch" ]]; then
  VERSION="${{ inputs.version }}"
  VERSION="${VERSION#v}"
  printf 'VERSION=<%s>\n' "$VERSION"
fi
'''

env_template = r'''set -euo pipefail
if [[ "workflow_dispatch" == "workflow_dispatch" ]]; then
  VERSION="${RELEASE_VERSION#v}"
  printf 'VERSION=<%s>\n' "$VERSION"
fi
'''

values = {
    "benign": "v1.2.3",
    "command_substitution": '$(printf INJECTED)',
    "quote_and_command": '"; printf INJECTED; #',
    "newline_command": '1.2.3\nprintf INJECTED\n#',
}

for name, value in values.items():
    direct = direct_template.replace("${{ inputs.version }}", value)
    direct_result = subprocess.run(
        ["bash", "-c", direct],
        text=True,
        capture_output=True,
        env={"PATH": "/usr/bin:/bin"},
    )
    env_result = subprocess.run(
        ["bash", "-c", env_template],
        text=True,
        capture_output=True,
        env={"PATH": "/usr/bin:/bin", "RELEASE_VERSION": value},
    )
    print(f"[{name}] direct exit={direct_result.returncode}")
    print(f"direct stdout={direct_result.stdout!r}")
    print(f"direct stderr={direct_result.stderr!r}")
    print(f"[{name}] env exit={env_result.returncode}")
    print(f"env stdout={env_result.stdout!r}")
    print(f"env stderr={env_result.stderr!r}")
PY

printf '%s\n' '--- current regex versus strict SemVer-shaped cases ---'
python3 - <<'PY'
import re

current = re.compile(r'^[0-9]+\.[0-9]+\.[0-9]+([.-].+)?$')
strict = re.compile(
    r'^(0|[1-9][0-9]*)\.'
    r'(0|[1-9][0-9]*)\.'
    r'(0|[1-9][0-9]*)'
    r'(?:-('
    r'(?:0|[1-9][0-9]*|'
    r'[0-9]*[A-Za-z-][0-9A-Za-z-]*'
    r')(?:\.'
    r'(?:0|[1-9][0-9]*|'
    r'[0-9]*[A-Za-z-][0-9A-Za-z-]*'
    r'))*)?'
    r'(?:\+'
    r'[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$'
)

cases = [
    "1.2.3",
    "0.1.0-alpha.1",
    "1.2.3+build.7",
    "1.2.3-alpha+build.7",
    "01.2.3",
    "1.2.3-01",
    "1.2.3.",
    "1.2.3.foo",
    "1.2.3-alpha..1",
]
for value in cases:
    print(f"{value:24} current={bool(current.fullmatch(value))} strict={bool(strict.fullmatch(value))}")
PY

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import re

workflow_pattern = re.compile(r'^[0-9]+\.[0-9]+\.[0-9]+([.-].+)?$')
cases = [
    ("1.2.3", True),
    ("0.1.0-alpha.1", True),
    ("1.2.3+build.7", False),
    ("1.2.3-alpha+build.7", True),
    ("01.2.3", False),
    ("1.2.3-01", False),
    ("1.2.3.", False),
    ("1.2.3.foo", False),
    ("1.2.3-alpha..1", False),
]
for value, strict_semver_expected in cases:
    accepted = bool(workflow_pattern.fullmatch(value))
    print(f"{value:24} workflow_regex={accepted} strict_semver_expected={strict_semver_expected}")
PY

printf '%s\n' '--- exact Bash validation behavior ---'
for value in '1.2.3+build.7' '01.2.3' '1.2.3-01' '1.2.3.foo' '1.2.3-alpha..1'; do
  if [[ "$value" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-].+)?$ ]]; then
    result=accepted
  else
    result=rejected
  fi
  printf '%s: %s\n' "$value" "$result"
done

#!/bin/bash
set -eu
printf '%s\n' '--- workflow action references ---'
rg -n '^[[:space:]]*-[[:space:]]+uses:' .github/workflows/release.yml
printf '%s\n' '--- relevant workflow sections ---'
sed -n '1,280p' .github/workflows/release.yml

#!/bin/bash
set -eu
python3 - <<'PY'
import json
import re
import urllib.request
from pathlib import Path

workflow = Path(".github/workflows/release.yml").read_text()
refs = re.findall(r'uses:\s*([^@\s]+)@([^\s#]+)', workflow)

for repo, ref in refs:
    if "/" not in repo:
        continue
    if ref.startswith(("v", "stable")):
        kind = "heads" if ref == "stable" else "tags"
        url = f"https://api.github.com/repos/{repo}/git/ref/{kind}/{ref}"
        try:
            with urllib.request.urlopen(url) as response:
                data = json.load(response)
            obj = data.get("object", {})
            print(f"{repo}@{ref}: {kind}, type={obj.get('type')}, sha={obj.get('sha')}")
        except Exception as exc:
            print(f"{repo}@{ref}: lookup failed: {exc}")
    else:
        print(f"{repo}@{ref}: non-version ref")
PY

#!/bin/bash
set -eu
python3 - <<'PY'
import json
import re
import subprocess
from pathlib import Path

refs = sorted(set(re.findall(
    r'uses:\s*([^@\s]+)@([^\s#]+)',
    Path(".github/workflows/release.yml").read_text(),
)))

for repo, ref in refs:
    endpoint = "heads" if ref == "stable" else "tags"
    url = f"https://api.github.com/repos/{repo}/git/ref/{endpoint}/{ref}"
    result = subprocess.run(
        ["curl", "-kfsSL", "-H", "Accept: application/vnd.github+json", url],
        text=True, capture_output=True, check=False,
    )
    try:
        data = json.loads(result.stdout)
        obj = data.get("object", {})
        print(json.dumps({
            "uses": f"{repo}@{ref}",
            "ref_type": endpoint,
            "object_type": obj.get("type"),
            "object_sha": obj.get("sha"),
            "error": data.get("message"),
        }, sort_keys=True))
    except Exception:
        print(json.dumps({
            "uses": f"{repo}@{ref}",
            "error": result.stderr.strip() or result.stdout[:200],
        }, sort_keys=True))
PY