litellm/.github/workflows/create-release.yml

name: Create Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, 1.84.0-dev.2, 1.84.0.post1; legacy v1.83.10-stable still accepted)"
        required: true
        type: string
      commit_hash:
        description: "Full 40-char commit SHA to target"
        required: true
        type: string

permissions: {}

jobs:
  release:
    name: Create Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Validate inputs
        env:
          TAG: ${{ inputs.tag }}
          COMMIT_HASH: ${{ inputs.commit_hash }}
        run: |
          if ! echo "${COMMIT_HASH}" | grep -qE '^[0-9a-f]{40}$'; then
            echo "::error::commit_hash must be a full 40-character commit SHA"
            exit 1
          fi
          if ! echo "${TAG}" | grep -qE '^v?[0-9]+\.[0-9]+\.[0-9]+'; then
            echo "::error::tag must start with X.Y.Z (optional leading v), e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, or v1.83.10-stable"
            exit 1
          fi

      - name: Create release
        env:
          TAG: ${{ inputs.tag }}
          COMMIT_HASH: ${{ inputs.commit_hash }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const tag = process.env.TAG;
            const commitHash = process.env.COMMIT_HASH;

            // Mark RC / dev / nightly / alpha / beta tags as GitHub pre-releases.
            // Accept both PEP 440 (`.dev`) and SemVer (`-dev`) separators so tags
            // like `1.84.0.dev2` and `1.84.0-dev.2` are both detected.
            // PEP 440 post-releases (e.g. `1.84.0.post1`) and legacy `-stable[.patch.N]`
            // are stable maintenance releases, not pre-releases.
            const isPrerelease = /(?:rc|nightly|alpha|beta|[-.]dev)/i.test(tag);

            // A stable release should only claim the repo "latest" badge when its
            // version is >= the current latest. Otherwise a backport (e.g. 1.84.6)
            // would steal "latest" from a newer line (e.g. 1.88.1).
            const versionKey = (rawTag) => {
              const m = String(rawTag).match(/^v?(\d+)\.(\d+)\.(\d+)/);
              if (!m) return null;
              const maintenance = String(rawTag).match(/(?:\.post|\.patch\.)(\d+)/i);
              return [Number(m[1]), Number(m[2]), Number(m[3]), maintenance ? Number(maintenance[1]) : 0];
            };
            const isAtLeast = (a, b) => {
              for (let i = 0; i < a.length; i++) {
                if (a[i] !== b[i]) return a[i] > b[i];
              }
              return true;
            };

            const cosignSection = [
              `## Verify Docker Image Signature`,
              ``,
              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit \`0112e53\`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).`,
              ``,
              `**Verify using the pinned commit hash (recommended):**`,
              ``,
              `A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:`,
              ``,
              '```bash',
              `cosign verify \\`,
              `  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \\`,
              `  ghcr.io/berriai/litellm:${tag}`,
              '```',
              ``,
              `**Verify using the release tag (convenience):**`,
              ``,
              `Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:`,
              ``,
              '```bash',
              `cosign verify \\`,
              `  --key https://raw.githubusercontent.com/BerriAI/litellm/${tag}/cosign.pub \\`,
              `  ghcr.io/berriai/litellm:${tag}`,
              '```',
              ``,
              `Expected output:`,
              ``,
              '```',
              `The following checks were performed on each of these signatures:`,
              `  - The cosign claims were validated`,
              `  - The signatures were verified against the specified public key`,
              '```',
              ``,
              `---`,
              ``,
            ].join('\n');

            try {
              let makeLatest = "false";
              const newVersion = versionKey(tag);
              if (!isPrerelease && newVersion) {
                let latestVersion = null;
                try {
                  const latest = await github.rest.repos.getLatestRelease({
                    owner: context.repo.owner,
                    repo: context.repo.repo,
                  });
                  latestVersion = versionKey(latest.data.tag_name);
                } catch (error) {
                  if (error.status !== 404) throw error;
                }
                makeLatest = (!latestVersion || isAtLeast(newVersion, latestVersion)) ? "true" : "false";
              }

              try {
                await github.rest.git.createRef({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  ref: `refs/tags/${tag}`,
                  sha: commitHash,
                });
              } catch (error) {
                if (error.status !== 422) throw error;
                const existing = await github.rest.git.getRef({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  ref: `tags/${tag}`,
                });
                if (existing.data.object.sha !== commitHash) {
                  throw new Error(`Tag ${tag} already exists at ${existing.data.object.sha}, expected ${commitHash}`);
                }
              }

              const response = await github.rest.repos.createRelease({
                draft: true,
                generate_release_notes: true,
                name: tag,
                owner: context.repo.owner,
                prerelease: isPrerelease,
                repo: context.repo.repo,
                tag_name: tag,
              });

              const updatedBody = cosignSection + (response.data.body ?? '');
              await github.rest.repos.updateRelease({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: response.data.id,
                tag_name: tag,
                body: updatedBody,
                draft: false,
              });

              if (!isPrerelease) {
                await github.rest.repos.updateRelease({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  release_id: response.data.id,
                  tag_name: tag,
                  make_latest: makeLatest,
                });
              }

            } catch (error) {
              core.setFailed(error.message);
            }

  create-branch:
    name: Create Release Branch
    needs: release
    permissions:
      contents: write
    uses: ./.github/workflows/create-release-branch.yml
    with:
      tag: ${{ inputs.tag }}
      commit_hash: ${{ inputs.commit_hash }}