From 4fe7b0685d7e944cbc9821549d6800304f4f3173 Mon Sep 17 00:00:00 2001
From: Rahul Krishna <rkrsn@ibm.com>
Date: Wed, 8 Jul 2026 17:59:24 -0400
Subject: [PATCH 1/2] ci: unit gate, nightly strict e2e, tag-triggered image
 publish

---
 .github/workflows/release.yml | 36 ++++++++++++++++++++++++++++++
 .github/workflows/test.yml    | 41 +++++++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 .github/workflows/release.yml
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..b14102f
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,36 @@
+name: release
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/codellm-devkit/cocoa:${{ github.ref_name }}
+            ghcr.io/codellm-devkit/cocoa:latest
+
+  pypi:
+    if: false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv build
+      - run: echo "enable trusted publishing, then uv publish"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..aa5b116
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,41 @@
+name: test
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 6 * * *"   # nightly strict e2e
+
+jobs:
+  unit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync --all-groups
+      - run: uv run pytest -v
+
+  e2e:
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+      - name: Build codeanalyzer-go (unreleased; codeanalyzer-go#5)
+        run: |
+          git clone --depth 1 --branch feat/initial-implementation \
+            https://github.com/codellm-devkit/codeanalyzer-go /tmp/cango
+          (cd /tmp/cango && go build -o /usr/local/bin/codeanalyzer-go ./cmd/codeanalyzer)
+      - run: uv sync --all-groups
+      - name: Jar workaround (python-sdk#236)
+        run: |
+          JAR_DIR="$(uv run python -c 'import cldk.analysis.java.codeanalyzer as m, pathlib; print(pathlib.Path(m.__file__).parent / "jar")')"
+          mkdir -p "${JAR_DIR}"
+          curl -fsSL -o "${JAR_DIR}/codeanalyzer-2.4.1.jar" \
+            "https://github.com/codellm-devkit/codeanalyzer-java/releases/download/v2.4.1/codeanalyzer-2.4.1.jar"
+      - name: Strict e2e (launch gate)
+        run: uv run pytest -m e2e -v

From 5f4c5e0c4177f4c6abf8cc45f9e1a5674bfc390c Mon Sep 17 00:00:00 2001
From: Rahul Krishna <rkrsn@ibm.com>
Date: Wed, 8 Jul 2026 18:05:57 -0400
Subject: [PATCH 2/2] fix: restore pypi blocker comment and exact echo text

---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b14102f..d46ea02 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,6 +26,8 @@ jobs:
             ghcr.io/codellm-devkit/cocoa:${{ github.ref_name }}
             ghcr.io/codellm-devkit/cocoa:latest
 
+  # PyPI publish is BLOCKED on the package-name conflict (cocoa-mcp#3).
+  # Flip `if: false` and add a trusted-publisher config once the name is free.
   pypi:
     if: false
     runs-on: ubuntu-latest
@@ -33,4 +35,4 @@ jobs:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v5
       - run: uv build
-      - run: echo "enable trusted publishing, then uv publish"
+      - run: 'echo "enable trusted publishing, then: uv publish"'