Release train

nika: v1
workflow: release-train
description: "parallel gates → human GO → hold until the window → ship · verify · record"

vars:
  version:
    type: string
    required: true
    description: "The version to ship (e.g. 1.4.0)"
  window: "2026-07-28T09:00:00Z"

secrets:
  team_webhook:
    source: env
    key: TEAM_WEBHOOK_URL
    egress:                       # sanction the on_finally ping · the secret IS the URL
      - to: "nika:notify"
        host_from_self: true

tasks:
  - id: t0
    invoke:
      tool: "nika:date"
      args: { op: now }

  # ── the gate wave · all three run in parallel ──
  - id: tests
    exec:
      command: "cargo test --workspace --quiet"
      capture: structured
    timeout: "15m"

  - id: lint
    exec:
      command: "cargo clippy --workspace --all-targets -- -D warnings"
      capture: structured
    timeout: "10m"

  - id: audit
    exec:
      command: "cargo audit"
      capture: structured
    timeout: "5m"
    retry:
      max_attempts: 2                  # advisory DB fetch can flake

  - id: gates_green
    depends_on: [tests, lint, audit]
    invoke:
      tool: "nika:assert"
      args:
        condition: "${{ tasks.tests.output.exit_code == 0 && tasks.lint.output.exit_code == 0 && tasks.audit.output.exit_code == 0 }}"
        message: "A release gate is RED — the train does not depart"

  - id: gate_time
    depends_on: [t0, gates_green]
    invoke:
      tool: "nika:date"
      args:
        op: diff
        start: "${{ tasks.t0.output }}"
        end: "now"
        unit: minutes

  # ── the human signs the departure ──
  - id: conductor
    depends_on: [gates_green, gate_time]
    invoke:
      tool: "nika:prompt"
      args:
        message: "Gates GREEN in ${{ tasks.gate_time.output }} min. Ship ${{ vars.version }} in the ${{ vars.window }} window?"
        default: false

  - id: approved
    depends_on: [conductor]
    invoke:
      tool: "nika:assert"
      args:
        condition: "${{ tasks.conductor.output == true }}"
        message: "Departure not signed — train cancelled"

  # ── hold until the window · absolute time, not a sleep ──
  - id: hold
    depends_on: [approved]
    invoke:
      tool: "nika:wait"
      args:
        until: "${{ vars.window }}"
        timeout: "48h"

  - id: ship
    depends_on: [hold]
    exec:
      command: "./scripts/release.sh ${{ vars.version }}"
      capture: structured
    timeout: "30m"

  - id: verify
    depends_on: [ship]
    invoke:
      tool: "nika:fetch"
      args:
        url: "https://api.example.com/v1/version"
        mode: jq
        jq: ".version"
    retry:
      max_attempts: 5
      backoff_strategy: exponential
      backoff_ms: 5000

  - id: live
    depends_on: [verify]
    invoke:
      tool: "nika:assert"
      args:
        condition: "${{ tasks.verify.output == vars.version }}"
        message: "Prod does not report the shipped version — investigate before announcing"

  # the always-pattern · `when: true` replaces the default success-gate ·
  # this task runs whether `live` succeeded, failed, or never started
  # (upstream abort) — a record that must land on EVERY outcome is a
  # terminal task, not a cleanup hook (03 §Task states).
  - id: record
    depends_on: [live]
    when: true
    invoke:
      tool: "nika:emit"
      args:
        event_type: "release.train.departed"
        payload:
          version: "${{ vars.version }}"
          status: "${{ tasks.live.status }}"
    on_finally:
      - invoke:
          tool: "nika:notify"
          args:
            channel: webhook
            target: "${{ secrets.team_webhook }}"
            message: "Release train ${{ vars.version }} · ${{ tasks.live.status }}"
            severity: info

outputs:
  shipped: ${{ tasks.verify.output }}