task: configure a GitHub Actions release bot #238

Current state: PR #239 is merged; the latest natural scheduled release, v0.1.1 Developer Preview, was published on 2026-11-03 with wheel, sdist, offline Codex plugin ZIP and checksums from 2baebf6e (successful run, delivery record). Actual account import, scheduling timeliness and requester acceptance remain unresolved. Draft #313 (b7ee0fa502d73600725d89fcfb862825c2723b14) correctly binds the user's DS_API_KEY to DeepSeek's official Responses API. Its final v0.1.0 preview generated a completed, independently checked AI summary with a source-derived coverage notice. Local checks, independent review and final-head hosted CI passed. Code is ready for PR review; the optional stage activates for future releases after merge. Existing public v0.1.0 and its attachments remain unchanged.
Decision needed: Requester acceptance remains pending; the scheduling-timeliness clarification is a proposal, not an accepted deadline.
Next action: The existing implementer (zengchuang-hw, via Codex) has delivered the preview and exact-head review/check evidence. Maintainer review/merge and requester acceptance remain pending; no merge or Issue-closure authority is inferred. After merge, future scheduled AI-stage activation remains to be observed. Actual Codex account import remains independently unverified. The user's DeepSeek key has authenticated successfully; no further key update is required.

Current delivery status — 2026-11-01

Software and first natural publication delivered: #239 is merged after current-head approval; post-merge checks passed. The first natural scheduled Release run completed plan, build and publication successfully. v0.1.0 Developer Preview was publicly published at 2026-11-01 21:35:13 UTC with wheel, sdist, Codex plugin ZIP and SHA256SUMS attached. Actual Codex account import remains unverified; requester acceptance remains pending. This Issue stays open.

Goal and acceptance

Configure a daily automatic GitHub Actions release bot for InferRSI, learning from the public release shape of JiuwenSwarm v0.2.7.

Accepted scope, clarified by the requester on 2026-10-29:

• Run daily early morning, skip when the default branch has no source-tree changes since the last successfully published release (including Developer Previews).

• Use 02:00 Asia/Shanghai (18:00 UTC) as the concrete schedule.

• The bot selects the version, creates its own tag and publishes the GitHub Release automatically; no manual version PR, tag push or draft-publication step.

• Bootstrap from the existing 0.1.0 version; subsequently allocate the next unused numeric patch version. Preserve the existing Developer Preview classification via prerelease=true; published previews count for no-change detection. A stable-channel change is separately reviewed.

• Build/check wheel and sdist, validate a clean installation/version parity and checksums before remote tag creation or public publication.

• Use the built-in GitHub Actions bot/GITHUB_TOKEN without additional secrets. Keep build jobs read-only and restrict write permission to publication.

• Provide a manual dry run, focused regression checks, independent review and maintainer documentation.

• Additional requester scope (updated 2026-10-31): include only the already-merged Codex plugin's self-contained offline-installation ZIP; exclude marketplace catalogs/wrappers and local/Git marketplace installation flows. Include the versioned ZIP in each Release alongside wheel/sdist/checksums. Reuse the canonical plugin builder, keep bundled runtime/plugin/tag versions aligned, validate the extracted archive outside the checkout and include the ZIP in checksum/upload/attachment gates. Generated package metadata may be stamped; builds leave tracked plugin templates and canonical runtime/knowledge bytes unchanged.

• Additional requester scope (2026-11-02): use the OpenAI GPT API to summarize release notes for future releases. Permit an optional Actions secret OPENAI_API_KEY for the read-only notes stage and a configurable model. Keep publication as github-actions[bot], preserve tag/Release-only bot mutations, and fall back to existing GitHub-generated notes if credentials or GPT output are unavailable. Never rewrite existing public releases. This is an explicit extension of the original no-extra-secret baseline; GPT integration alone requires the additional credential.

• Additional requester scope (2026-11-02, provider clarification): the requester updated the stored key and explicitly selected https://yibuapi.com/v1 as the GPT API base URL. Support this approved HTTPS destination through a non-secret repository variable OPENAI_BASE_URL, with gpt-6.1-terra selected. Preserve read-only generation, credential isolation, no redirects and fallback; retest v0.1.0 as a preview without changing the public Release.

• Additional requester scope (2026-11-02, latest provider selection): the requester replaced the stored API key and selected DeepSeek's official API with the exact requested model dsv4.1-flash-1017. DeepSeek's official model table and 2026-10-17 changelog map that version to the API name deepseek-flash; this mapping was explained to the requester in chat. Configure OPENAI_BASE_URL=https://api.deepseek.com and OPENAI_RELEASE_NOTES_MODEL=deepseek-flash. Support the official Responses endpoint with read-only generation, disabled redirects, bounded output and ordinary-note fallback. Verify the documented model call without substituting a different model on failure; continue the historical v0.1.0 artifact-only preview without changing its public Release.

• Additional requester clarification (2026-11-02): the official DeepSeek key is already stored as repository Secret DS_API_KEY. Bind that secret into the notes step's existing internal OPENAI_API_KEY environment variable, with no fallback to the old repository Secret. The earlier HTTP401 preview read the old OPENAI_API_KEY Secret and did not validate DS_API_KEY. Retest the historical artifact-only preview after correcting the binding.

• Additional requester constraint: the release bot may only create version tags and publish Release records/assets. It must not create code commits, create/update/delete code branches, modify source, create/approve/merge PRs, or enable auto-merge. Configuration development in this delivery PR remains contributor work, not an autonomous bot capability.

Scope and constraints

In scope: release-specific workflow, planning/validation tooling and tests, tag-derived Python package/runtime versioning needed for automatic bumps, explicit distribution boundaries and documentation.
Out of scope: custom GitHub App, secrets other than the optional GPT key above, PyPI, native OS installers (EXE/DMG), edits/bypass pushes to any code branch, code commits, PR operations, changes to other collaborators/workflows' branch policies, changes to the four CI lanes or campaign acceptance gates.
The workflow must enforce and test a narrow publication operation surface. GitHub Contents write itself is broader and cannot be represented as a tag/Release-only token permission; documentation must state that limitation honestly. Server-side repository policy changes require a separate concrete scoped decision because GITHUB_TOKEN uses the shared GitHub Actions App identity.
Never overwrite published releases, move existing tags, clobber assets, or equate software release checks with campaign PASS. A failed publication must not count as a successful release for no-change detection; failed reservations may leave version gaps rather than be overwritten.

Ownership and authorization

• Actual requester / goal-acceptance owner: the human user in the originating Codex chat.
• Status: Accepted for implementation by the original release-bot request, explicit selection of the built-in bot, and correction that the bot itself must tag and publish versions daily only when changed.
• Accountable parent / implementer: Codex; bounded research and independent review delegated to separate agents.
• Acceptance/closure owner: requesting human. No Issue closure or merge authorization is inferred.

Inputs and deliverables

Delivery PR: #239 (merged). GPT API notes follow-up: #313 (draft, requester-authorized extension). Its original manual-tag/draft-only design was not accepted as satisfying the request and is superseded by this scope.
Reference publisher is a private GitHub App; its pipeline is not public. InferRSI uses its own built-in-token implementation.

Completion and closure

Report configuration/PR readiness separately from activation and a successful actual scheduled publication. Update tests/review for the revised content. Keep this Issue open for owner acceptance.