feat: Release P1 Mitigation Rules and PyPI Workflow

.github/release.yml

@@ -0,0 +1,28 @@
+# GitHub auto-generated release notes config.
+# Categories are label-based (used if PRs with labels are ever merged).
+# Primary release notes are generated from git log in the workflow.
+changelog:
+  exclude:
+    authors:
+      - "github-actions[bot]"
+  categories:
+    - title: "🛡️ New Rules & Detections"
+      labels:
+        - "rule-engine"
+        - "rules"
+    - title: "✨ Features"
+      labels:
+        - "enhancement"
+        - "feature"
+    - title: "🐛 Bug Fixes"
+      labels:
+        - "bug"
+        - "fix"
+    - title: "🔧 Maintenance"
+      labels:
+        - "chore"
+        - "ci"
+        - "documentation"
+        - "maintenance"
+</content>
+</invoke>

.github/workflows/ci-nightly.yml

@@ -0,0 +1,104 @@
+name: Nightly Prerelease
+
+on:
+  push:
+    branches:
+      - nightly
+
+permissions:
+  contents: write
+
+jobs:
+  nightly_prerelease:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute nightly tag
+        id: vars
+        shell: bash
+        run: |
+          set -euo pipefail
+          date_utc="$(date -u +%Y%m%d)"
+          short_sha="${GITHUB_SHA::7}"
+          tag="nightly-${date_utc}-${short_sha}"
+
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "Computed nightly tag: $tag"
+
+      - name: Check if tag exists
+        id: tag_check
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${{ steps.vars.outputs.tag }}"
+
+          if git ls-remote --exit-code --tags origin "refs/tags/$tag" >/dev/null 2>&1; then
+            echo "Tag already exists: $tag"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+
+      - name: Create and push tag
+        if: steps.tag_check.outputs.skip != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${{ steps.vars.outputs.tag }}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git tag -a "$tag" -m "Nightly prerelease $tag"
+          git push origin "$tag"
+
+      - name: Generate nightly notes
+        if: steps.tag_check.outputs.skip != 'true'
+        id: notes
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${{ steps.vars.outputs.tag }}"
+
+          prev_tag=$(git tag --list 'nightly-*' --sort=-version:refname \
+            | grep -v "^${tag}$" | head -1 2>/dev/null || echo "")
+          [[ -z "$prev_tag" ]] && \
+            prev_tag=$(git tag --list '[0-9][0-9][0-9][0-9].[0-9][0-9].[0-9][0-9]*' \
+            | sort -V | tail -1 2>/dev/null || echo "")
+
+          range="${prev_tag:+${prev_tag}..}HEAD"
+
+          rules="" features="" fixes="" other=""
+
+          while IFS= read -r line; do
+            [[ "$line" =~ ^"chore: release" ]] && continue
+            if   [[ "$line" =~ ^"feat(rules):" ]]; then rules+="- ${line}"$'\n'
+            elif [[ "$line" =~ ^"feat:"        ]]; then features+="- ${line}"$'\n'
+            elif [[ "$line" =~ ^"fix:"         ]]; then fixes+="- ${line}"$'\n'
+            else                                        other+="- ${line}"$'\n'
+            fi
+          done < <(git log "$range" --pretty=format:"%s" --no-merges)
+
+          body=$'> \xf0\x9f\x8c\x99 Nightly build \xe2\x80\x94 not for production use.\n\n'
+          [[ -n "$rules" ]]    && body+=$'## \xf0\x9f\x9b\xa1\xef\xb8\x8f Rules\n'"$rules"$'\n'
+          [[ -n "$features" ]] && body+=$'## \xe2\x9c\xa8 Features\n'"$features"$'\n'
+          [[ -n "$fixes" ]]    && body+=$'## \xf0\x9f\x90\x9b Fixes\n'"$fixes"$'\n'
+          [[ -n "$other" ]]    && body+=$'## \xf0\x9f\x94\xa7 Other\n'"$other"$'\n'
+
+          printf '%s' "$body" > /tmp/nightly_notes.md
+          echo "notes_file=/tmp/nightly_notes.md" >> "$GITHUB_OUTPUT"
+
+      - name: Create prerelease
+        if: steps.tag_check.outputs.skip != 'true'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.vars.outputs.tag }}
+          name: "Nightly — ${{ steps.vars.outputs.tag }}"
+          prerelease: true
+          generate_release_notes: false
+          body_path: ${{ steps.notes.outputs.notes_file }}

.github/workflows/release.yml

@@ -2,46 +2,151 @@ name: Release
 
 on:
   workflow_dispatch:
-    inputs:
-      tag_name:
-        description: "Release tag (example: v0.2.0-nightly.1)"
-        required: true
-      release_name:
-        description: "Release title"
-        required: true
-      target:
-        description: "Branch or commit to release"
-        required: false
-        default: "nightly"
-      prerelease:
-        description: "Mark as pre-release"
-        required: false
-        default: true
-        type: boolean
-      generate_notes:
-        description: "Auto-generate release notes"
-        required: false
-        default: true
-        type: boolean
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   create_release:
-    name: Create GitHub Release
+    name: Create Stable Release
     runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.tag_check.outputs.skip }}
     steps:
-      - name: Checkout target
+      - name: Checkout main
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.target }}
+          ref: main
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Merge nightly into main
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git fetch origin nightly
+          git merge origin/nightly --no-edit --no-ff -m "chore: merge nightly into main for release"
+          echo "Merged origin/nightly into main"
+
+      - name: Compute version tag
+        id: vars
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="$(date -u +%Y.%m.%d)"
+
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Computed release version: $version"
+
+      - name: Check if today's tag exists
+        id: tag_check
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${{ steps.vars.outputs.version }}"
+
+          if git ls-remote --exit-code --tags origin "refs/tags/$version" >/dev/null 2>&1; then
+            echo "Release $version already exists. Run again tomorrow."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+
+      - name: Update pyproject version
+        if: steps.tag_check.outputs.skip != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${{ steps.vars.outputs.version }}"
+
+          sed -i.bak -E "0,/^version = \"[^\"]+\"$/s//version = \"$version\"/" pyproject.toml
+          rm -f pyproject.toml.bak
+
+      - name: Commit, tag, and push
+        if: steps.tag_check.outputs.skip != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${{ steps.vars.outputs.version }}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git add pyproject.toml
+          git commit -m "chore: release $version"
+          git tag -a "$version" -m "Release $version"
+
+          git push origin main
+          git push origin "$version"
+
+      - name: Generate release notes
+        if: steps.tag_check.outputs.skip != 'true'
+        id: notes
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${{ steps.vars.outputs.version }}"
+
+          prev_tag=$(git tag --list '[0-9][0-9][0-9][0-9].[0-9][0-9].[0-9][0-9]*' \
+            | sort -V | tail -1 2>/dev/null || echo "")
+
+          range="${prev_tag:+${prev_tag}..}HEAD"
+
+          rules="" features="" fixes="" other=""
+
+          while IFS= read -r line; do
+            [[ "$line" =~ ^"chore: release" ]] && continue
+            if   [[ "$line" =~ ^"feat(rules):" ]]; then rules+="- ${line}"$'\n'
+            elif [[ "$line" =~ ^"feat:"        ]]; then features+="- ${line}"$'\n'
+            elif [[ "$line" =~ ^"fix:"         ]]; then fixes+="- ${line}"$'\n'
+            else                                        other+="- ${line}"$'\n'
+            fi
+          done < <(git log "$range" --pretty=format:"%s" --no-merges)
+
+          body=""
+          [[ -n "$rules" ]]    && body+=$'## \xf0\x9f\x9b\xa1\xef\xb8\x8f New Rules & Detections\n'"$rules"$'\n'
+          [[ -n "$features" ]] && body+=$'## \xe2\x9c\xa8 Features\n'"$features"$'\n'
+          [[ -n "$fixes" ]]    && body+=$'## \xf0\x9f\x90\x9b Bug Fixes\n'"$fixes"$'\n'
+          [[ -n "$other" ]]    && body+=$'## \xf0\x9f\x94\xa7 Other Changes\n'"$other"$'\n'
+          [[ -z "$body" ]]     && body="No user-facing changes in this release."
+
+          printf '%s' "$body" > /tmp/release_notes.md
+          echo "notes_file=/tmp/release_notes.md" >> "$GITHUB_OUTPUT"
 
       - name: Create release
+        if: steps.tag_check.outputs.skip != 'true'
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ inputs.tag_name }}
-          name: ${{ inputs.release_name }}
-          target_commitish: ${{ inputs.target }}
-          prerelease: ${{ inputs.prerelease }}
-          generate_release_notes: ${{ inputs.generate_notes }}
+          tag_name: ${{ steps.vars.outputs.version }}
+          name: ${{ steps.vars.outputs.version }}
+          prerelease: false
+          generate_release_notes: false
+          body_path: ${{ steps.notes.outputs.notes_file }}
+
+  publish_pypi:
+    name: Publish to PyPI
+    needs: create_release
+    if: needs.create_release.outputs.skip != 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/mantou
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Build package
+        run: |
+          pip install build
+          python -m build
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@release/v1