chore: update config.py and release flow

Author: gersmann

.github/workflows/draft-release.yml

@@ -0,0 +1,33 @@
+name: Draft Release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: draft-release
+  cancel-in-progress: true
+
+jobs:
+  draft:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create or update draft release
+        uses: softprops/action-gh-release@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: v-next
+          name: Unreleased (auto-updated)
+          draft: true
+          allow_updates: true
+          generate_release_notes: true
+          make_latest: false
+          fail_on_unmatched_files: false

.github/workflows/publish.yml .github/workflows/release-published.yml.github/workflows/publish.yml renamed to .github/workflows/release-published.yml

@@ -1,43 +1,98 @@
-name: Publish to PyPI
+name: Release Published Pipeline
 
 on:
-  push:
-    tags:
-      - 'v*'
+  release:
+    types: [published]
 
 permissions:
-  contents: read
+  contents: write
   id-token: write
 
+concurrency:
+  group: release-published
+  cancel-in-progress: false
+
 jobs:
-  guard:
-    name: Guard (tag points to main?)
+  prepare:
+    name: Bump versions and align tag
     runs-on: ubuntu-latest
     outputs:
-      publish: ${{ steps.check.outputs.publish }}
+      tag: ${{ steps.ctx.outputs.tag }}
+      version: ${{ steps.ctx.outputs.version }}
+      sha: ${{ steps.ctx.outputs.sha }}
     steps:
-      - name: Checkout (shallow)
+      - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Check if tag commit is on main
-        id: check
-        env:
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+
+      - name: Read context
+        id: ctx
+        shell: bash
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          if [[ ! "$TAG" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            echo "Tag $TAG is not semver (vX.Y.Z). Exiting." >&2
+            exit 1
+          fi
+          VER="${TAG#v}"
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          # Resolve current tag SHA (lightweight or annotated)
+          if git rev-parse -q --verify "refs/tags/$TAG^{commit}" >/dev/null; then
+            SHA=$(git rev-parse "refs/tags/$TAG^{commit}")
+          else
+            echo "Cannot resolve commit for tag $TAG" >&2
+            exit 1
+          fi
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          echo "Tag=$TAG Version=$VER TagSHA=$SHA"
+
+      - name: Configure bot user
         run: |
-          git fetch origin $DEFAULT_BRANCH --depth=1
-          if git merge-base --is-ancestor "$GITHUB_SHA" "origin/$DEFAULT_BRANCH"; then
-            echo "publish=true" >> "$GITHUB_OUTPUT"
-            echo "Tag commit is on $DEFAULT_BRANCH; will publish."
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Update versions in sources
+        shell: bash
+        run: |
+          set -euo pipefail
+          VER="${{ steps.ctx.outputs.version }}"
+          # Update Cargo.toml version
+          sed -i.bak -E "s/^version = \"[0-9]+\.[0-9]+\.[0-9]+\"/version = \"${VER}\"/" crates/codex_native/Cargo.toml
+          rm -f crates/codex_native/Cargo.toml.bak
+          # Update Python __version__
+          perl -0777 -pe 's/(\n__version__\s*=\s*\")[^"]*(\")/\1'"${VER}"'\2/s' -i codex/__init__.py
+          echo "Updated versions to ${VER}"
+
+      - name: Commit version bump
+        shell: bash
+        run: |
+          VER="${{ steps.ctx.outputs.version }}"
+          if git diff --quiet; then
+            echo "No changes to commit (versions already ${VER})."
           else
-            echo "publish=false" >> "$GITHUB_OUTPUT"
-            echo "Tag commit is NOT on $DEFAULT_BRANCH; skipping publish."
+            git add crates/codex_native/Cargo.toml codex/__init__.py
+            git commit -m "chore(release): v${VER} [skip ci]"
+            DEFAULT_BRANCH="${{ github.event.repository.default_branch }}"
+            git push origin HEAD:"${DEFAULT_BRANCH}"
           fi
 
+      - name: Move tag to version bump commit
+        shell: bash
+        run: |
+          TAG="${{ steps.ctx.outputs.tag }}"
+          # Point the tag at the latest main commit (which includes the bump)
+          DEFAULT_BRANCH="${{ github.event.repository.default_branch }}"
+          git fetch origin "$DEFAULT_BRANCH" --depth=1
+          NEW_SHA=$(git rev-parse "origin/${DEFAULT_BRANCH}")
+          git tag -fa "$TAG" "$NEW_SHA" -m "Align $TAG to version bump commit"
+          git push origin "refs/tags/${TAG}" --force
+          echo "Aligned tag $TAG -> $NEW_SHA"
+
   build-wheels:
     name: Build native wheels
-    needs: guard
-    if: needs.guard.outputs.publish == 'true'
+    needs: prepare
     strategy:
       fail-fast: false
       matrix:
@@ -65,6 +120,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
@@ -89,16 +146,13 @@ jobs:
         if: ${{ matrix.platform == 'linux-x86_64' }}
         uses: PyO3/maturin-action@v1
         env:
-          # Ensure glibc exposes htobe*/be*toh macros in <endian.h>
           CFLAGS: -D_DEFAULT_SOURCE -D_BSD_SOURCE
         with:
           manylinux: '2014'
           command: build
           before-script-linux: |
             yum -y install curl perl-core >/dev/null 2>&1 || true
             (perl -MText::Template -e1 >/dev/null 2>&1 || (curl -sL https://cpanmin.us | perl - App::cpanminus Text::Template >/dev/null))
-          # Build via root pyproject so distribution name is 'codex-python'
-          # Use the default container python since we build abi3 once.
           args: --release -i python3.12 -o dist
 
       - name: Build Linux aarch64 wheel (manylinux2014)
@@ -113,8 +167,6 @@ jobs:
           before-script-linux: |
             yum -y install curl perl-core >/dev/null 2>&1 || true
             (perl -MText::Template -e1 >/dev/null 2>&1 || (curl -sL https://cpanmin.us | perl - App::cpanminus Text::Template >/dev/null))
-          # Build via root pyproject so distribution name is 'codex-python'
-          # Use the default container python since we build abi3 once.
           args: --release -i python3.12 -o dist
 
       - name: Build Linux x86_64 wheel (musllinux_1_2)
@@ -128,8 +180,6 @@ jobs:
           command: build
           before-script-linux: |
             apk add --no-cache curl perl perl-text-template >/dev/null 2>&1 || true
-          # Build via root pyproject so distribution name is 'codex-python'
-          # Use the default container python since we build abi3 once.
           args: --release -i python3.12 -o dist
 
       - name: Build Linux aarch64 wheel (musllinux_1_2)
@@ -143,8 +193,6 @@ jobs:
           command: build
           before-script-linux: |
             apk add --no-cache curl perl perl-text-template >/dev/null 2>&1 || true
-          # Build via root pyproject so distribution name is 'codex-python'
-          # Use the default container python since we build abi3 once.
           args: --release -i python3.12 -o dist
 
       - name: Build macOS universal2 wheel
@@ -153,16 +201,13 @@ jobs:
           python -m pip install --upgrade pip
           pip install maturin
           rustup target add x86_64-apple-darwin aarch64-apple-darwin
-          # maturin >=1.0 removed --universal2; use --target universal2-apple-darwin
-          # Build via root pyproject so distribution name is 'codex-python'
           maturin build --release -i python -o dist --target universal2-apple-darwin
 
       - name: Build Windows wheel
         if: ${{ matrix.platform == 'windows-amd64' }}
         run: |
           python -m pip install --upgrade pip
           pip install maturin
-          # Build via root pyproject so distribution name is 'codex-python'
           maturin build --release -i python -o dist
 
       - name: Upload wheels
@@ -173,8 +218,7 @@ jobs:
 
   build-sdist:
     name: Build sdist
-    needs: guard
-    if: needs.guard.outputs.publish == 'true'
+    needs: prepare
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -205,15 +249,13 @@ jobs:
 
   publish:
     name: Publish to PyPI (Trusted Publishing)
-    needs: [guard, build-wheels, build-sdist]
-    if: needs.guard.outputs.publish == 'true'
+    needs: [prepare, build-wheels, build-sdist]
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@v4
         with:
           path: dist
-          # Merge all artifacts directly into dist/ so Twine finds files
           merge-multiple: true
 
       - name: Flatten artifacts into dist/