chore: finalize release docs and harden release flow

1 files changed, 56 insertions, 5 deletions

diff --git a/justfile b/justfile
index 8922e2fe..1f5a475a 100644
--- a/justfile
+++ b/justfile
@@ -20,7 +20,7 @@ ci: lint
 
 # Check formatting + run unit tests + maintenance script tests
 check: ci
-    python3 -m unittest scripts.test_changelog scripts.test_vendor_libghostty_vt
+    python3 -m unittest scripts.test_changelog scripts.test_nix_cargo_hash scripts.test_vendor_libghostty_vt
     @echo "docs reminder: if this changes user-facing behavior, make sure the relevant release docs are updated or called out before release."
 
 # Install repo-local git hooks
@@ -75,8 +75,16 @@ release-docs-check:
         fi; \
     done
 
-# Finalize changelog, bump version, commit, tag, push, and trigger the GitHub Release workflow (usage: just release 0.1.1)
-release version:
+# Refresh nix/package.nix cargoHash after Cargo.toml or Cargo.lock changes
+refresh-nix-cargo-hash:
+    python3 scripts/nix_cargo_hash.py refresh
+
+# Check nix/package.nix cargoHash without patching
+check-nix-cargo-hash:
+    python3 scripts/nix_cargo_hash.py check
+
+# Prepare the release commit without tagging or pushing (usage: just release-prepare 0.1.1)
+release-prepare version:
     @if [ -n "$(git status --porcelain)" ]; then \
         echo "error: commit your changes first"; \
         exit 1; \
@@ -90,13 +98,56 @@ release version:
     cp CHANGELOG.md docs/next/CHANGELOG.md
     sed -i.bak 's/^version = ".*"/version = "{{version}}"/' Cargo.toml && rm -f Cargo.toml.bak
     cargo update -p herdr --offline
+    just refresh-nix-cargo-hash
     just check
-    git add CHANGELOG.md docs/next/CHANGELOG.md Cargo.toml Cargo.lock
+    git add CHANGELOG.md docs/next/CHANGELOG.md Cargo.toml Cargo.lock nix/package.nix
     git diff --cached --quiet || git commit -m "release: v{{version}}"
+    @echo "v{{version}} release commit prepared. Review it, then run: just release-publish {{version}}"
+
+# Tag and push an already-prepared release commit (usage: just release-publish 0.1.1)
+release-publish version:
+    @if [ -n "$(git status --porcelain)" ]; then \
+        echo "error: working tree must be clean before publishing"; \
+        exit 1; \
+    fi
+    @branch="$(git branch --show-current)"; \
+    if [ "$branch" != "master" ]; then \
+        echo "error: release-publish must run from master, got $branch"; \
+        exit 1; \
+    fi
+    @git fetch origin master --tags
+    @if git rev-parse "v{{version}}" >/dev/null 2>&1; then \
+        echo "error: tag v{{version}} already exists"; \
+        exit 1; \
+    fi
+    @cargo_version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)"; \
+    if [ "$cargo_version" != "{{version}}" ]; then \
+        echo "error: Cargo.toml version $cargo_version does not match {{version}}"; \
+        exit 1; \
+    fi
+    just release-docs-check
+    python3 scripts/changelog.py extract --version {{version}} --output /tmp/herdr-release-notes-check.md
+    rm -f /tmp/herdr-release-notes-check.md
+    just check-nix-cargo-hash
+    @local_head="$(git rev-parse HEAD)"; \
+    remote_head="$(git rev-parse origin/master)"; \
+    if ! git merge-base --is-ancestor "$remote_head" "$local_head"; then \
+        echo "error: origin/master is not an ancestor of HEAD; pull or rebase before publishing"; \
+        exit 1; \
+    fi; \
+    if [ "$local_head" != "$remote_head" ]; then \
+        echo "pushing release commit to origin/master"; \
+        git push origin HEAD:master; \
+    fi
     git tag -a v{{version}} -m "v{{version}}"
-    git push --follow-tags
+    git push origin v{{version}}
     @echo "v{{version}} released — GitHub Actions building binaries and updating website/latest.json"
 
+# Prepare, verify, tag, push, and trigger the GitHub Release workflow (usage: just release 0.1.1)
+release version:
+    just release-prepare {{version}}
+    just release-publish {{version}}
+
 # Print default config
 default-config:
     cargo run --release --locked -- --default-config