Phase 2: shared Verify profiles and isolated development SDK handoff

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ jobs:
       - run: python -m pip install -r requirements.txt
       - name: Check catalog
         run: python tools/snodec_sync check
+      - run: sudo apt-get update && sudo apt-get install -y cmake ninja-build g++ zstd
       - name: Unit and workflow boundary tests
         if: ${{ always() && !cancelled() }}
         run: python -m unittest discover -s tests -v

.github/workflows/publish-dev.yml

@@ -0,0 +1,75 @@
+name: Publish development SDK
+on:
+  workflow_call:
+permissions:
+  contents: write
+concurrency:
+  group: development-sdk-${{ github.repository }}
+  cancel-in-progress: false
+jobs:
+  publish:
+    name: Publish tested development SDK
+    if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: sudo apt-get update && sudo apt-get install -y zstd
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: development-sdk
+          path: sdk
+      - name: Publish current default-branch SDK only
+        shell: python
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          import json
+          import os
+          from pathlib import Path
+          import subprocess
+          import tarfile
+          from urllib.error import HTTPError
+          from urllib.parse import quote
+          from urllib.request import Request, urlopen
+
+          repository = os.environ["GITHUB_REPOSITORY"]
+          sha = os.environ["GITHUB_SHA"]
+          token = os.environ["GH_TOKEN"]
+
+          def api(path, method="GET", data=None):
+              body = None if data is None else json.dumps(data).encode()
+              request = Request("https://api.github.com/" + path, data=body, method=method,
+                                headers={"Authorization": "Bearer " + token, "Accept": "application/vnd.github+json"})
+              with urlopen(request, timeout=60) as response:
+                  return json.load(response)
+
+          path = "repos/" + repository
+          branch = api(path)["default_branch"]
+          if api(path + "/commits/" + quote(branch, safe=""))["sha"] != sha:
+              print("Superseded build: no development SDK publication")
+          else:
+              archives = list(Path("sdk").glob("*-dev-*.tar.zst"))
+              if len(archives) != 1:
+                  raise ValueError("expected one tested SDK archive")
+              archive = archives[0]
+              unpacked = Path(os.environ["RUNNER_TEMP"]) / "sdk.tar"
+              subprocess.run(["zstd", "-d", archive, "-o", unpacked], check=True)
+              with tarfile.open(unpacked) as contents:
+                  identity = json.load(contents.extractfile("./.snodec-sdk.json"))
+              if identity["repository"] != repository or identity["source_commit"] != sha:
+                  raise ValueError("SDK does not match the successful build")
+              try:
+                  release = api(path + "/releases/tags/dev")
+                  if not release["prerelease"]:
+                      raise ValueError("dev must remain a prerelease")
+              except HTTPError as error:
+                  if error.code != 404:
+                      raise
+                  api(path + "/releases", "POST", {
+                      "tag_name": "dev", "target_commitish": sha,
+                      "name": "Development SDK", "body": "Unsigned development SDK from successful default-branch Verify runs. Not a stable product release.",
+                      "prerelease": True, "make_latest": "false",
+                  })
+              subprocess.run(["gh", "release", "upload", "dev", str(archive),
+                              "--clobber", "--repo", repository], check=True)
+              api(path + "/git/refs/tags/dev", "PATCH", {"sha": sha, "force": True})
+              print("Published development SDK for " + sha)