release-corpus.yml

name: Conformance corpus

# Builds the downloadable conformance corpus (fixtures + expectations.json) and
# attaches it to each GitHub release. workflow_dispatch builds it without
# uploading, for a quick check.

on:
  release:
    types: [published]
  workflow_dispatch:

# Least-privilege default; the corpus job escalates only what it needs
# (CICD-04: write scopes job-level only).
permissions:
  contents: read

# Never run two corpus builds/uploads of the same ref at once (CICD-23).
concurrency:
  group: release-corpus-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # Re-run the full gate set at the tagged commit before anything is built
  # for a release (REL-14/15, added after the 2026-07-05 conformance audit).
  verify:
    uses: ./.github/workflows/verify.yml
    with:
      tag: ${{ github.event_name == 'release' && github.event.release.tag_name || '' }}

  corpus:
    needs: [verify]
    runs-on: ubuntu-latest
    permissions:
      contents: write # upload the asset to the release
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.13"
      - run: python -m pip install -e .
      - run: python scripts/build_conformance_corpus.py dist/tods-conformance-corpus.zip
      - name: Upload to the release
        if: github.event_name == 'release'
        env:
          GH_TOKEN: ${{ github.token }}
          # Routed through env rather than interpolated directly into the run:
          # shell (CICD-21 / zizmor template-injection): the tag name is
          # attacker-influenceable in principle (anyone who can create a
          # release chooses it) and this avoids splicing it into the script
          # text before the shell ever sees it.
          TAG: ${{ github.event.release.tag_name }}
        run: gh release upload "$TAG" dist/tods-conformance-corpus.zip --clobber