From d33121e95c5cba802969db25bffcbf9b474dd149 Mon Sep 17 00:00:00 2001
From: Myron Marston <myron@squareup.com>
Date: Tue, 19 Aug 2025 08:41:40 -0700
Subject: [PATCH] chore: Improve CI build by validating the release workflow.

The release workflow has broken a couple times recently, and had to be
fixed up via #759 and #797. The fact that the workflow is only used when
we cut a release means that it does not run super often (and certainly
not part of the CI build for each PR!).

To help avoid breaking it in the future, I've added a new script,
`script/validate_release_workflow`, which validates the brittle part
of the release workflow, and I've integrated it into the CI build
so that a build will fail if a change would break the release workflow.
---
 script/ci_parts/run_misc_checks  |  1 +
 script/validate_release_workflow | 68 ++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100755 script/validate_release_workflow

diff --git a/script/ci_parts/run_misc_checks b/script/ci_parts/run_misc_checks
index 489191fe1..746a8c8bd 100755
--- a/script/ci_parts/run_misc_checks
+++ b/script/ci_parts/run_misc_checks
@@ -10,6 +10,7 @@ script/update_dependency_diagrams --verify
 script/update_ci_yaml --verify
 script/update_licenses --verify
 script/validate_readme_snippets
+script/validate_release_workflow
 
 bundle exec standardrb
 bundle exec rake schema_artifacts:check VERBOSE=true
diff --git a/script/validate_release_workflow b/script/validate_release_workflow
new file mode 100755
index 000000000..607226797
--- /dev/null
+++ b/script/validate_release_workflow
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# Our release workflow (at `.github/workflows/release.yaml`) has proven to be a bit brittle.
+# We don't run it frequently (just when we release!) so if we break it, we don't automatically
+# know. It's gotten broken a couple times due to changes to `config/site/Rakefile` (and its
+# dependencies), which `config/release/Rakefile` pulls in. Here we validate that the task from
+# `config/site/Rakefile` which we need to run can pass when run in the context of the release
+# bundle.
+
+# Abort script at first error, when a command exits with non-zero status.
+# Verbose form of `set -e`.
+set -o errexit
+
+# Attempt to use undefined variable outputs error message, and forces an exit
+# Verbose form of `set -u`.
+set -o nounset
+
+# If set, the return value of a pipeline is the value of the last (rightmost)
+# command to exit with a non-zero status, or zero if all commands in the
+# pipeline exit successfully.
+set -o pipefail
+
+# Print a trace of simple commands.
+# Verbose form of `set -x`.
+set -o xtrace
+
+verify_git_status_clean() {
+  if [[ -n "$(git status --porcelain)" ]]; then
+    echo "Error: Git working directory is not clean."
+    echo "Uncommitted changes:"
+    git status --porcelain
+    exit 1
+  fi
+}
+
+# Function to restore the original Rakefile
+restore_rakefile() {
+  if [[ -f "Rakefile.backup" ]]; then
+    echo "Restoring original Rakefile..."
+    mv Rakefile.backup Rakefile
+  fi
+}
+
+verify_git_status_clean
+
+# Make a backup of the original Rakefile and replace it with the release version
+cp Rakefile Rakefile.backup
+
+# Set up trap to ensure Rakefile is restored even if the script fails
+trap restore_rakefile EXIT
+
+cp config/release/Rakefile Rakefile
+
+BUNDLE_GEMFILE=config/release/Gemfile bundle install
+BUNDLE_GEMFILE=config/release/Gemfile bundle exec rake "site:archive_docs[99.99.99]"
+
+# Delete the archived docs artifact
+if [[ -f "config/site/archived_docs/v99.99.99.tar.gz" ]]; then
+  rm config/site/archived_docs/v99.99.99.tar.gz
+fi
+
+restore_rakefile
+
+# Re-run bundle install without BUNDLE_GEMFILE to ensure the original bundle is still in good shape
+bundle install
+
+# Confirm we're still leaving the git status clean. (If not, it's likely a bug in this script.)
+verify_git_status_clean