ci(release): three-tier release automation

.claude/commands/release.md

@@ -0,0 +1,63 @@
+Operate the three-tier release process: instant builds, nightlies, and stable releases.
+
+## Versioning
+
+One version number everywhere: git tag `vX.Y.Z` == extension version == release
+page. Odd minor = pre-release channel, even minor = stable (the VS Code
+Marketplace convention). Nightlies compute `X.<odd>.YYMMDDHH` (UTC hour) on the
+odd minor above the newest release — `0.1.*` today, `0.3.*` after stable
+`v0.2.0` — so nobody edits version numbers by hand. The versions in `CMakeLists.txt`, `pixi.toml`,
+and `editors/vscode/package.json` are permanent placeholders (`0.1.0`); the
+real version is injected from the tag at build time (binary via git describe,
+vsix via CI). A local `vsce publish` with the placeholder is rejected by the
+Marketplace — that is intentional accident protection.
+
+## Tier 1 — Instant builds (every green CI run)
+
+Nothing to operate. Every `main` push and PR run repackages the test-suite
+binaries (no LTO, no strip) into `vsix-build-<target>` workflow artifacts, and
+the raw binaries are in `native-build-*` / `cross-build-*` artifacts. To hand a
+fix to a user: point them at the run's artifact (GitHub login required), or
+have them set `clice.executable` to the extracted binary.
+
+## Tier 2 — Nightly (pre-release channel)
+
+`nightly.yml` runs daily (cron) or via `gh workflow run nightly.yml`:
+skips when main has no new commits, otherwise tags the nightly version, builds the
+full release matrix (ICF + strip + GSYM symbols), publishes a GitHub
+pre-release and Marketplace `--pre-release`, and prunes odd-minor pre-releases
+older than 30 days. A failed nightly just means no nightly that day — fix main
+and rerun via dispatch.
+
+## Tier 3 — Stable release (manual, even minor)
+
+1. Freeze: stop merging features; the last nightlies of the freeze are the RCs.
+2. When a nightly is judged good, tag its commit: `git tag v0.2.0 <commit> && git push origin v0.2.0`.
+   The tag push runs the release path of `main.yml` (packages + extensions,
+   Marketplace without `--pre-release`).
+3. Write the release notes on the GitHub release page (the download table
+   format from the nightly notes is a good template).
+4. Verify: assets present (6 packages + 4 symbol archives + 2 PDB zips +
+   6 vsix), Marketplace shows the new stable version.
+
+## Dry run / plumbing changes
+
+PRs touching release plumbing (publish workflows, `cmake/release.cmake`,
+`cmake/archive.cmake`, `CMakeLists.txt`) automatically run the full 6+6 dry
+run via the `release-check-*` jobs; `gh workflow run main.yml --ref <branch>`
+does the same on demand. Uploads stay tag-gated, so nothing publishes.
+
+## Crash log support
+
+Ask the user for the log (worker `.log` from the workspace `.clice/logs/` or
+the cache dir). The crash section starts with `clice <version> <target>` —
+download that release's `*-symbol.tar.xz` (GSYM) and run:
+
+```bash
+python scripts/symbolize.py crash.log --symbols clice.gsym
+```
+
+For core-dump-level debugging, fetch the full DWARF from the release run's
+`debug-info-*` workflow artifact (90-day retention). If the log predates the
+version line or the release was pruned, symbolization is not possible — ask
+the user to reproduce on a current nightly.

.github/workflows/cross-pair.yml

@@ -21,7 +21,6 @@ env:
   CCACHE_DIR: ${{ github.workspace }}/.cache/ccache
   SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
   CCACHE_BASEDIR: ${{ github.workspace }}
-  SCCACHE_BASEDIRS: ${{ github.workspace }}
   CCACHE_COMPILERCHECK: content
   CCACHE_MAXSIZE: 2G
   SCCACHE_CACHE_SIZE: 2G

.github/workflows/main.yml

@@ -6,14 +6,16 @@ on:
     tags: ["v*"]
   pull_request:
     branches: [main]
+  # Manual full release dry run (packages + bundled extensions) from any ref.
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   changes:
-    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    if: ${{ !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
@@ -24,6 +26,7 @@ jobs:
       vscode: ${{ steps.filter.outputs.vscode }}
       zed: ${{ steps.filter.outputs.zed }}
       cmake: ${{ steps.filter.outputs.cmake }}
+      release: ${{ steps.filter.outputs.release }}
 
     steps:
       - uses: actions/checkout@v7
@@ -48,6 +51,14 @@ jobs:
             zed:
               - 'editors/zed/**'
               - '.github/workflows/main.yml'
+            release:
+              - '.github/workflows/publish-clice.yml'
+              - '.github/workflows/publish-vscode.yml'
+              - '.github/workflows/main.yml'
+              - '.github/workflows/nightly.yml'
+              - 'CMakeLists.txt'
+              - 'cmake/release.cmake'
+              - 'cmake/archive.cmake'
             cmake:
               - 'CMakeLists.txt'
               - 'src/**'
@@ -65,7 +76,7 @@ jobs:
               - '.github/workflows/editor-test.yml'
 
   conventional-commit:
-    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    if: ${{ !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     steps:
       - name: Check conventional commit format
@@ -92,20 +103,67 @@ jobs:
   format:
     needs: changes
     if: ${{ needs.changes.outputs.format == 'true' }}
-    uses: ./.github/workflows/check-format.yml
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-pixi
+        with:
+          environments: format
+
+      - name: Run formatter
+        run: pixi run format
+        continue-on-error: true
+
+      - name: Auto correct
+        uses: huacnlee/autocorrect-action@v2.5.4
+        with:
+          args: --lint ./docs
+        continue-on-error: true
+
+      - name: Check diff
+        run: |
+          if ! git diff --quiet; then
+            echo "::error::Formatting changes detected. Please run 'pixi run format' and commit the result."
+            git --no-pager diff --stat
+            git --no-pager diff
+            exit 1
+          fi
 
   deploy:
     needs: changes
-    if: ${{ needs.changes.outputs.docs == 'true' }}
+    if: ${{ needs.changes.outputs.docs == 'true' && github.ref == 'refs/heads/main' }}
     permissions:
       contents: write
-    uses: ./.github/workflows/deploy-docs.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: clice-io/docs@main
+        with:
+          project: clice
+          token: ${{ secrets.PUBLISH_DOCS }}
 
-  # clice:
-  #   needs: changes
-  #   if: ${{ needs.changes.outputs.clice == 'true' }}
-  #   uses: ./.github/workflows/publish-clice.yml
+  # Release-pipeline dry run: exercises all six packages and all six bundled
+  # extension builds without publishing (upload steps are tag-gated). Runs on
+  # PRs that touch release plumbing, and on workflow_dispatch from any ref.
+  release-check-clice:
+    needs: changes
+    if: >-
+      ${{ !cancelled() && (github.event_name == 'workflow_dispatch' ||
+          needs.changes.outputs.release == 'true') }}
+    uses: ./.github/workflows/publish-clice.yml
+
+  release-check-vscode:
+    needs: release-check-clice
+    if: ${{ !cancelled() && needs.release-check-clice.result == 'success' }}
+    uses: ./.github/workflows/publish-vscode.yml
+    with:
+      source: package
 
   vscode:
     needs: changes
@@ -143,21 +201,30 @@ jobs:
     if: ${{ needs.changes.outputs.cmake == 'true' }}
     uses: ./.github/workflows/editor-test.yml
 
+  # Instant builds: repackage the test-suite binaries as installable vsix
+  # artifacts so a fix can be tried the moment CI is green.
+  instant-vscode:
+    needs: [changes, native-test, cross-test]
+    if: ${{ needs.changes.outputs.cmake == 'true' }}
+    uses: ./.github/workflows/publish-vscode.yml
+    with:
+      source: build
+
   release-clice:
     permissions:
       contents: write
-    if: startsWith(github.ref, 'refs/tags/v')
+    # push only: a workflow_dispatch aimed at a tag ref must stay a dry run.
+    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
     uses: ./.github/workflows/publish-clice.yml
-    secrets: inherit
 
   release-vscode:
     permissions:
       contents: write
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
     needs: release-clice
     uses: ./.github/workflows/publish-vscode.yml
     with:
-      bundle: true
+      source: package
     secrets: inherit
 
   checks-passed:
@@ -166,19 +233,22 @@ jobs:
       - conventional-commit
       - format
       - deploy
-      # - clice
       - vscode
       - zed
       - native-test
       - cross-test
       - editor-test
+      - instant-vscode
+      - release-check-clice
+      - release-check-vscode
 
     runs-on: ubuntu-latest
     steps:
       - name: Check results
         uses: re-actors/alls-green@v1.2.2
         with:
           allowed-skips: >-
-            conventional-commit,format,deploy,clice,vscode,zed,
-            native-test,cross-test,editor-test
+            conventional-commit,format,deploy,vscode,zed,
+            native-test,cross-test,editor-test,instant-vscode,
+            release-check-clice,release-check-vscode
           jobs: ${{ toJSON(needs) }}

.github/workflows/native-test.yml

@@ -7,7 +7,6 @@ env:
   CCACHE_DIR: ${{ github.workspace }}/.cache/ccache
   SCCACHE_DIR: ${{ github.workspace }}/.cache/sccache
   CCACHE_BASEDIR: ${{ github.workspace }}
-  SCCACHE_BASEDIRS: ${{ github.workspace }}
   CCACHE_COMPILERCHECK: content
   CCACHE_MAXSIZE: 2G
   SCCACHE_CACHE_SIZE: 2G