continuo-python-runtime 0.2.0__tar.gz → 0.3.1__tar.gz

{continuo_python_runtime-0.2.0 → continuo_python_runtime-0.3.1}/.dockerignore

@@ -11,4 +11,5 @@ dist/
 docs/
 template/
 tests/
-python-runtime-*/tests/
+adapters/*/tests/
+contract/tests/

continuo_python_runtime-0.3.1/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Every change is reviewed by the maintainer.
+*       @carolsimone

continuo_python_runtime-0.3.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,59 @@
+name: Bug report
+description: Something in the Continuo Python runtime behaves incorrectly.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please do not report security vulnerabilities here — see SECURITY.md.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did you observe, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Write a contract with ...
+        2. Run `continuo-runtime validate ...`
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Which component
+      multiple: true
+      options:
+        - continuo_python_runtime (harness / CLI)
+        - contract (continuo-engine-contract)
+        - adapters/postgres
+        - adapters/trino
+        - template
+        - CI (.github/workflows)
+        - Not sure
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Package version (PyPI) or commit SHA.
+      placeholder: "v0.3.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Please redact any credentials before pasting.
+      render: shell

continuo_python_runtime-0.3.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/carolsimone/continuo-python-runtime/security/advisories/new
+    about: Report privately. Please do not open a public issue for security problems.

continuo_python_runtime-0.3.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Propose a change or addition to the Continuo Python runtime.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve
+      description: Describe the situation you are in, not the solution you have in mind.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like to happen
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contribution
+      options:
+        - label: I am willing to open a pull request for this.

continuo_python_runtime-0.3.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## What this changes
+
+<!-- One or two sentences. Link the issue this addresses. -->
+
+Closes #
+
+## Why
+
+<!-- What problem does this solve? -->
+
+## How it was verified
+
+<!-- The commands you ran and what they printed. "Tests pass" on its own is not enough. -->
+
+## Checklist
+
+- [ ] Every commit is signed off (`git commit -s`) — the `dco` check enforces this
+- [ ] Tests added or updated for the behavior changed
+- [ ] `uv run ruff check .` and `uv run mypy` (relevant packages) pass
+- [ ] `scripts/security-scan.sh` passes (dependency or credential-adjacent changes)

continuo_python_runtime-0.3.1/.github/dependabot.yml

@@ -0,0 +1,64 @@
+# Dependabot keeps dependencies current so that known CVEs are fixed by an
+# upgrade before a scanner has to report them.
+#
+# Every ecosystem groups its patch and minor updates into a single pull request
+# per week to keep the noise down. Major updates stay ungrouped because they
+# carry breaking changes and need to be reviewed one at a time.
+version: 2
+
+updates:
+  # The uv workspace: this package (root), contract/, and the two adapters. All
+  # four share one lockfile, but Dependabot still needs one entry per pyproject.toml
+  # directory to see each package's own dependency declarations.
+  - package-ecosystem: uv
+    directories:
+      - /
+      - /contract
+      - /adapters/postgres
+      - /adapters/trino
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      python-minor-patch:
+        applies-to: version-updates
+        update-types: [minor, patch]
+      python-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: chore(deps)
+
+  # Actions are a supply-chain surface in their own right: a compromised or
+  # abandoned action runs with access to the workflow token.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        applies-to: version-updates
+        update-types: [minor, patch]
+      actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: chore(ci)
+
+  # Dockerfile.postgres and Dockerfile.trino, the published engine images. Most
+  # base-image CVEs are fixed by moving to a newer tag.
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      docker:
+        applies-to: version-updates
+        update-types: [minor, patch]
+      docker-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: chore(deps)

continuo_python_runtime-0.3.1/.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: ci
+on:
+  push: { branches: [main] }
+  pull_request:
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v7
+      - name: Sync
+        run: uv sync --all-packages --all-groups
+      - name: Lint
+        run: uv run ruff check .
+      - name: Lint (contract)
+        run: uv run ruff check contract
+      - name: Types (runtime)
+        run: uv run mypy continuo_python_runtime
+      - name: Types (contract)
+        run: uv run mypy contract/continuo_engine_contract
+      - name: Types (postgres adapter)
+        run: uv run --package continuo-python-runtime-postgres mypy adapters/postgres/continuo_python_runtime_postgres
+      - name: Types (trino adapter)
+        run: uv run --package continuo-python-runtime-trino mypy adapters/trino/continuo_python_runtime_trino
+      # `-m "not image"` deselects tests/test_image_smoke_validation.py, which
+      # needs a built engine image and the env naming it. Those tests run in
+      # images.yml's smoke jobs, where an image actually exists.
+      - name: Tests (runtime)
+        run: uv run pytest --cov=continuo_python_runtime -m "not image" -v
+      - name: Tests (contract)
+        run: uv run pytest contract/tests -v
+      - name: Tests (adapter units)
+        run: uv run pytest adapters/postgres/tests adapters/trino/tests -m "not integration" -v
+
+  integration-postgres:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v7
+      - run: uv sync --all-packages --all-groups
+      - name: Start postgres stack
+        run: docker compose -f tests/smoke/postgres-stack/docker-compose.yml up -d --wait
+      - name: Tests (postgres integration)
+        run: uv run pytest adapters/postgres/tests -m integration -v
+      - name: Tear down postgres stack
+        if: always()
+        run: docker compose -f tests/smoke/postgres-stack/docker-compose.yml down -v
+
+  integration-trino:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v7
+      - run: uv sync --all-packages --all-groups
+      - name: Start trino stack
+        run: docker compose -f tests/smoke/trino-stack/docker-compose.yml up -d --wait
+      - name: Tests (trino integration)
+        run: uv run pytest adapters/trino/tests -m integration -v
+      - name: Tear down trino stack
+        if: always()
+        run: docker compose -f tests/smoke/trino-stack/docker-compose.yml down -v

continuo_python_runtime-0.3.1/.github/workflows/dco.yml

@@ -0,0 +1,49 @@
+name: dco
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  # Job name becomes the check-run name, which is what a branch ruleset requires
+  # by string. Keep it "dco" so the required check is unambiguous.
+  dco:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # The whole PR commit range has to be walkable, not just the merge commit.
+          fetch-depth: 0
+
+      - name: Verify every commit is signed off
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          missing=0
+          while read -r sha; do
+            [ -z "$sha" ] && continue
+            # Merge commits are generated by GitHub and carry no sign-off.
+            if [ "$(git rev-list --no-walk --count --merges "$sha")" -eq 1 ]; then
+              continue
+            fi
+            if ! git show -s --format='%B' "$sha" | grep -qiE '^Signed-off-by: .+ <.+@.+>$'; then
+              echo "::error::Commit $sha ($(git show -s --format='%an' "$sha")) has no Signed-off-by line."
+              missing=1
+            fi
+          done < <(git rev-list "$BASE_SHA".."$HEAD_SHA")
+
+          if [ "$missing" -ne 0 ]; then
+            echo ""
+            echo "Every commit needs a Developer Certificate of Origin sign-off (see DCO)."
+            echo "Fix an existing branch with:"
+            echo "    git rebase --signoff origin/main && git push --force-with-lease"
+            echo "Sign off future commits automatically with 'git commit -s'."
+            exit 1
+          fi
+          echo "All commits signed off."

{continuo_python_runtime-0.2.0 → continuo_python_runtime-0.3.1}/.github/workflows/images.yml

@@ -5,8 +5,8 @@ on:
       - "Dockerfile.*"
       - "tests/smoke/**"
       - "continuo_python_runtime/**"
-      - "python-runtime-postgres/**"
-      - "python-runtime-trino/**"
+      - "contract/**"
+      - "adapters/**"
       - "pyproject.toml"
       - ".github/workflows/images.yml"
   push:
@@ -56,6 +56,16 @@ jobs:
           path: /tmp
       - name: Load image
         run: docker load -i /tmp/cpr-smoke-postgres.tar
+      - uses: astral-sh/setup-uv@v7
+      - name: Sync
+        run: uv sync --all-packages --all-groups
+      - name: Image smoke tests (postgres)
+        env:
+          VALIDATION_IMAGE_UNDER_TEST: cpr-smoke-postgres
+          VALIDATION_IMAGE_ENGINE: postgres
+          # PostgresAdapter.required_env()[0]
+          VALIDATION_IMAGE_REQUIRED_ENV: POSTGRES_HOST
+        run: uv run pytest tests/test_image_smoke_validation.py -m image -v
       - name: Install psql client
         run: |
           sudo apt-get update
@@ -101,6 +111,16 @@ jobs:
           path: /tmp
       - name: Load image
         run: docker load -i /tmp/cpr-smoke-trino.tar
+      - uses: astral-sh/setup-uv@v7
+      - name: Sync
+        run: uv sync --all-packages --all-groups
+      - name: Image smoke tests (trino)
+        env:
+          VALIDATION_IMAGE_UNDER_TEST: cpr-smoke-trino
+          VALIDATION_IMAGE_ENGINE: trino
+          # TrinoAdapter.required_env()[0]
+          VALIDATION_IMAGE_REQUIRED_ENV: TRINO_HOST
+        run: uv run pytest tests/test_image_smoke_validation.py -m image -v
       - name: Start trino stack
         run: docker compose -f tests/smoke/trino-stack/docker-compose.yml up -d --wait
       - name: Seed source table
@@ -133,13 +153,20 @@ jobs:
         if: always()
         run: docker compose -f tests/smoke/trino-stack/docker-compose.yml down -v
 
-  # On tag push: log in to ghcr.io and push ghcr.io/${{ github.repository }}:<tag>-postgres
-  # and :<tag>-trino. continuo-validation-contract, continuo-python-runtime-postgres,
-  # and continuo-python-runtime-trino are all installed from the build context /
-  # PyPI already (see Dockerfile.postgres / Dockerfile.trino and
-  # publish-pypi.yml) — nothing pending here.
+  # On tag push: build both engine images for linux/amd64 and linux/arm64 and
+  # push them to ghcr.io/<owner>/continuo-python-runtime-<engine>:<tag>. The
+  # engine belongs in the image NAME, not the tag: Continuo's Helm chart pins an
+  # image as `<name>:vX.Y.Z@sha256:<digest>`, so the tag must be the bare
+  # version. Both platforms are required: domain repos build their own images
+  # FROM these, and Continuo's e2e runs them in a kind cluster on aarch64
+  # developer machines as well as on amd64 CI runners, so a single-arch publish
+  # is unusable off amd64. The smoke jobs above stay single-arch — they load a
+  # `docker save` tarball, which has no multi-platform equivalent.
+  # continuo-engine-contract and the two engine adapters are installed from the
+  # build context (see Dockerfile.postgres / Dockerfile.trino) — nothing pending
+  # here.
   publish:
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-test')
     needs: [smoke-postgres, smoke-trino]
     strategy:
       matrix:
@@ -150,15 +177,19 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v4
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v4
       - name: Log in to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push ${{ matrix.engine }} image
-        run: |
-          tag="${GITHUB_REF_NAME}"
-          image="ghcr.io/${{ github.repository }}:${tag}-${{ matrix.engine }}"
-          docker build -f Dockerfile.${{ matrix.engine }} -t "$image" .
-          docker push "$image"
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.${{ matrix.engine }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/${{ github.repository_owner }}/continuo-python-runtime-${{ matrix.engine }}:${{ github.ref_name }}

{continuo_python_runtime-0.2.0 → continuo_python_runtime-0.3.1}/.github/workflows/publish-pypi.yml

@@ -1,37 +1,42 @@
 name: publish-pypi
 
-# Publishes the continuo-python-runtime package via PyPI Trusted Publishing
-# (OIDC, no stored token).
+# Publishes both PyPI distributions this repo owns — continuo-python-runtime
+# (the harness) and continuo-engine-contract (the port, result-block format,
+# and shared guards) — via PyPI Trusted Publishing (OIDC, no stored token).
 #
 # The two engine adapters (continuo-python-runtime-postgres /
 # continuo-python-runtime-trino) are deliberately NOT published here. Nothing
-# installs them from an index: the runtime images build them from the build
+# installs them from an index: the engine images build them from the build
 # context (see Dockerfile.postgres / Dockerfile.trino and images.yml), and the
 # harness package does not depend on them — adapters are found at run time
-# through the `continuo_runtime.adapters` entry-point group, inside the image
+# through the `continuo_engine.adapters` entry-point group, inside the image
 # that installed exactly one. Publishing them would only add releases with no
 # consumer. They remain uv workspace members and are still built, typed, and
 # tested by ci.yml.
 #
-# Tag glob note: "python-runtime-v*" requires a literal "v" immediately after
-# the dash, so it matches only the harness tag (python-runtime-v1.2.3[-testN]).
-# Tag `<pkg>-v<ver>-test<n>` publishes to TestPyPI; `<pkg>-v<ver>` publishes to
-# real PyPI. The GitHub environment name is what the PyPI "pending publisher"
-# is registered against.
+# Tag glob note: `v*` is the repository's single release pattern — the same tag
+# that images.yml builds and pushes both engine images from, so one tag ships
+# the whole release. GitHub Actions tag globs anchor at character 1, so `v*`
+# claims every tag beginning with "v"; no other pattern may be introduced.
+# Tag `v<ver>-test<n>` publishes to TestPyPI; `v<ver>` publishes to real PyPI.
+# The GitHub environment name is what the PyPI "pending publisher" is
+# registered against — both project names need one on each index.
 #
-# Ordering: continuo-validation-contract==0.4.0 must exist on the target index
-# before publishing here — consumers of the wheel resolve it from that index
-# ([tool.uv.sources] is dev-only and not embedded in the wheel).
+# Both distributions are built into a single `dist/` and uploaded in one
+# publish call, so there is no ordering constraint between them. The runtime
+# wheel declares continuo-engine-contract as a dependency and resolves it from
+# the index at install time ([tool.uv.sources] is dev-only and is not embedded
+# in the wheel).
 on:
   push:
     tags:
-      - "python-runtime-v*"
+      - "v*"
 
 permissions: {}
 
 jobs:
-  publish-runtime:
-    if: startsWith(github.ref_name, 'python-runtime-v')
+  publish-packages:
+    if: startsWith(github.ref_name, 'v')
     runs-on: ubuntu-latest
     environment: ${{ contains(github.ref_name, '-test') && 'testpypi' || 'pypi' }}
     permissions:
@@ -39,12 +44,16 @@ jobs:
       contents: read # actions/checkout needs read access to the repo
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
       - name: Test before publishing
+        # `-m "not image"` deselects the image smoke tests; images.yml runs
+        # those against a built engine image.
         run: |
-          uv sync --all-groups
-          uv run pytest -q
-      - name: Build the sdist + wheel
+          uv sync --all-packages --all-groups
+          uv run pytest tests contract/tests -m "not image" -q
+      - name: Build the contract sdist + wheel
+        run: uv build --package continuo-engine-contract -o dist
+      - name: Build the runtime sdist + wheel
         run: uv build -o dist
       - name: Publish to TestPyPI
         if: contains(github.ref_name, '-test')

continuo_python_runtime-0.3.1/.github/workflows/release.yml

@@ -0,0 +1,141 @@
+name: release
+
+# Creates a GitHub Release once BOTH tag-triggered publish workflows
+# (publish-pypi.yml, images.yml) have finished successfully for this exact
+# tag. A Release exists here beyond what PyPI already shows because a tag
+# also ships two ghcr.io images that PyPI knows nothing about — the Release
+# is the one place that says "this tag = these packages + these images."
+#
+# Triggered by the same tag push as its two siblings, rather than by
+# workflow_run watching them complete: `needs:` cannot cross workflow files,
+# and this avoids depending on workflow_run's head_branch semantics for a
+# tag-triggered source run, which nothing else in this repo relies on.
+# Instead the job below polls the Actions API for the sibling runs at this
+# exact commit until both report a conclusion — that only depends on the
+# same push:tags trigger every other release workflow here already uses.
+on:
+  push:
+    tags:
+      # Digit after v: keeps this to release tags, same reasoning continuo's
+      # release.yml uses. publish-pypi.yml and images.yml use the looser `v*`
+      # and instead guard internally with startsWith(..., 'v') checks, so
+      # this is deliberately the stricter of the three triggers.
+      - "v[0-9]*"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  github-release:
+    # -test tags are a TestPyPI dry run (see publish-pypi.yml) and skip
+    # images.yml's publish job by design (its own if: guards on this same
+    # condition) — no public Release for them.
+    if: "!contains(github.ref_name, '-test')"
+    runs-on: ubuntu-latest
+    # Each wait_for call below can itself run up to 30 minutes (its own
+    # internal timeout), called twice, sequentially — so this job's ceiling
+    # has to clear 60 minutes on its own polling math alone, before even
+    # accounting for how long the siblings actually take to run.
+    timeout-minutes: 70
+    permissions:
+      contents: write # gh release create/edit
+      actions: read # poll sibling workflow runs
+    env:
+      TAG: ${{ github.ref_name }}
+      SHA: ${{ github.sha }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Wait for publish-pypi.yml and images.yml to finish on this commit
+        run: |
+          set -euo pipefail
+
+          wait_for() {
+            local workflow_file="$1" elapsed=0 interval=20 timeout=1800
+            while :; do
+              # event=push, not just head_sha: images.yml also triggers on
+              # pull_request, and a coincidentally-identical head_sha between
+              # an open PR and this tag would otherwise pick up the wrong run.
+              # Query params go in the URL, not via -f: gh api switches a
+              # request to POST the moment any -f/-F flag is present, and this
+              # listing endpoint only accepts GET — it 404s on POST, which
+              # under `set -e` would abort this script on the very first poll,
+              # every time. Verified against this repo's real API: -f flags
+              # 404 here, the URL query string form returns real run data.
+              conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow_file}/runs?head_sha=${SHA}&event=push" \
+                --jq '.workflow_runs[0].conclusion // "pending"')"
+              case "${conclusion}" in
+                success)
+                  echo "${workflow_file}: success"
+                  return 0
+                  ;;
+                pending)
+                  # Covers both "no matching run yet" (API eventual
+                  # consistency right after the push) and "run exists but
+                  # still queued/in_progress" — conclusion is JSON null in
+                  # both cases until the run completes.
+                  ;;
+                *)
+                  echo "::error::${workflow_file} concluded '${conclusion}' for ${SHA}; not creating a Release."
+                  exit 1
+                  ;;
+              esac
+              elapsed=$((elapsed + interval))
+              if [ "${elapsed}" -ge "${timeout}" ]; then
+                echo "::error::timed out after ${timeout}s waiting for ${workflow_file} to finish on ${SHA}."
+                exit 1
+              fi
+              sleep "${interval}"
+            done
+          }
+
+          wait_for "publish-pypi.yml"
+          wait_for "images.yml"
+
+      - name: Extract this version's CHANGELOG section
+        id: notes
+        run: |
+          set -euo pipefail
+          VERSION="${TAG#v}"
+          # Print the body between "## [X.Y.Z]" and the next "## [" heading.
+          if grep -qE "^## \[${VERSION}\]" CHANGELOG.md; then
+            awk -v ver="## [${VERSION}]" '
+              index($0, ver) == 1 { found = 1; next }
+              found && /^## \[/    { exit }
+              found                { print }
+            ' CHANGELOG.md > /tmp/release-body.md
+          fi
+
+          if [ -s /tmp/release-body.md ]; then
+            echo "generate=false" >> "$GITHUB_OUTPUT"
+          else
+            # A tag with no matching CHANGELOG.md section (e.g. someone
+            # forgot to add one before tagging) still gets a Release — just
+            # with GitHub's generated notes instead of failing the job over
+            # a missing doc update.
+            echo "::warning::no '## [${VERSION}]' section in CHANGELOG.md; falling back to generated notes."
+            echo "generate=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create the Release
+        run: |
+          set -euo pipefail
+          # Idempotent: re-running this workflow for an existing tag updates
+          # the Release rather than failing.
+          if gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
+            if [ "${{ steps.notes.outputs.generate }}" = "true" ]; then
+              gh release edit "${TAG}" --repo "${GITHUB_REPOSITORY}" --latest
+            else
+              gh release edit "${TAG}" --repo "${GITHUB_REPOSITORY}" \
+                --notes-file /tmp/release-body.md --latest
+            fi
+          elif [ "${{ steps.notes.outputs.generate }}" = "true" ]; then
+            gh release create "${TAG}" --repo "${GITHUB_REPOSITORY}" \
+              --title "${TAG}" --generate-notes --latest
+          else
+            gh release create "${TAG}" --repo "${GITHUB_REPOSITORY}" \
+              --title "${TAG}" --notes-file /tmp/release-body.md --latest
+          fi