Qualify UK model and data candidates automatically before promotion

.github/dispatch-policyengine-release.sh

@@ -1,28 +1,51 @@
 #!/usr/bin/env bash
 #
 # Notify consumer repositories that a policyengine release is available on
-# PyPI by sending a policyengine-release repository dispatch, which triggers
-# their update workflows to open single-version bump PRs.
+# PyPI by sending a repository dispatch, which triggers their update
+# workflows.
 #
 # Environment:
-#   VERSION   Exact policyengine version that was released.
-#   GH_TOKEN  PolicyEngine GitHub App token with Contents write access to the
-#             consumer repositories.
+#   VERSION         Exact policyengine version that was released.
+#   GH_TOKEN        PolicyEngine GitHub App token with Contents write access to
+#                   the consumer repositories.
+#   CONSUMER_REPOS  Space-separated repositories to notify (default:
+#                   policyengine-api policyengine-sim-api).
+#   PAYLOAD_FILE    Optional JSON file holding the whole dispatch body
+#                   ({"event_type": ..., "client_payload": {...}}), as written
+#                   by scripts/release_consumers.py. Without it, a
+#                   policyengine-release event carrying only the version is sent.
 set -euo pipefail
 
 if [[ -z "${VERSION:-}" ]]; then
   echo "ERROR: VERSION must be set." >&2
   exit 1
 fi
 
-CONSUMER_REPOS=(
-  policyengine-api
-  policyengine-sim-api
+read -r -a REPOS <<< "${CONSUMER_REPOS:-policyengine-api policyengine-sim-api}"
+
+if [[ -n "${PAYLOAD_FILE:-}" ]]; then
+  payload_version=$(python - "$PAYLOAD_FILE" <<'PY'
+import json
+import sys
+
+payload = json.load(open(sys.argv[1]))["client_payload"]
+request = payload.get("request")
+print(payload.get("version") or request["candidate"]["policyengine"]["version"])
+PY
 )
+  if [[ "$payload_version" != "$VERSION" ]]; then
+    echo "ERROR: ${PAYLOAD_FILE} is for ${payload_version}, not ${VERSION}." >&2
+    exit 1
+  fi
+fi
 
-for repo in "${CONSUMER_REPOS[@]}"; do
-  gh api "repos/PolicyEngine/${repo}/dispatches" \
-    -f event_type=policyengine-release \
-    -f "client_payload[version]=${VERSION}"
-  echo "Dispatched policyengine-release ${VERSION} to PolicyEngine/${repo}."
+for repo in "${REPOS[@]}"; do
+  if [[ -n "${PAYLOAD_FILE:-}" ]]; then
+    gh api "repos/PolicyEngine/${repo}/dispatches" --method POST --input "$PAYLOAD_FILE"
+  else
+    gh api "repos/PolicyEngine/${repo}/dispatches" \
+      -f event_type=policyengine-release \
+      -f "client_payload[version]=${VERSION}"
+  fi
+  echo "Dispatched policyengine ${VERSION} to PolicyEngine/${repo}."
 done

.github/qualification-ledger.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+#
+# Check out, or publish to, the qualification ledger branch.
+#
+#   .github/qualification-ledger.sh checkout <dir>
+#   .github/qualification-ledger.sh publish <dir> "<commit message>"
+#
+# The ledger is an orphan branch that only grows: each candidate pair writes
+# its own directory, so concurrent publishes never touch the same file and a
+# rejected push is retried by replaying the single new commit on the latest
+# tip. The new commit may be the branch's first (two runs can both find no
+# ledger yet), so it is replayed with cherry-pick, which needs no parent.
+set -euo pipefail
+
+BRANCH="${LEDGER_BRANCH:-uk-qualification-ledger}"
+command="${1:?usage: qualification-ledger.sh checkout|publish <dir> [message]}"
+dir="${2:?ledger directory required}"
+
+case "$command" in
+  checkout)
+    if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
+      git fetch --quiet origin "$BRANCH"
+      git worktree add --quiet --force -B "$BRANCH" "$dir" FETCH_HEAD
+    else
+      git worktree add --quiet --detach "$dir"
+      (
+        cd "$dir"
+        git switch --quiet --orphan "$BRANCH"
+        cat > README.md <<'README'
+# UK candidate qualification ledger
+
+Written by `.github/workflows/certify-uk-release.yaml` in PolicyEngine/policyengine.py.
+Each `uk/<pair_id>/` directory holds a candidate pair, every qualification
+attempt's gate evidence, the replay request and receipt, and the latest
+qualification receipt. Nothing is deleted.
+README
+      )
+    fi
+    ;;
+  publish)
+    message="${3:?commit message required}"
+    cd "$dir"
+    git add -A
+    if git diff --cached --quiet; then
+      echo "Ledger unchanged."
+      exit 0
+    fi
+    identity=(-c user.name="policyengine-qualification[bot]"
+              -c user.email="qualification@policyengine.org")
+    git "${identity[@]}" commit --quiet -m "$message"
+    new_commit="$(git rev-parse HEAD)"
+    delay="${LEDGER_RETRY_DELAY:-5}"
+    for attempt in 1 2 3 4 5 6; do
+      if git push --quiet origin "HEAD:refs/heads/$BRANCH"; then
+        echo "Published ledger: $message"
+        exit 0
+      fi
+      # Someone else published first: replay this one commit on their tip.
+      if ! git fetch --quiet origin "$BRANCH"; then
+        sleep $((attempt * delay))
+        continue
+      fi
+      git reset --quiet --hard FETCH_HEAD
+      if ! git "${identity[@]}" cherry-pick --allow-empty "$new_commit" >/dev/null; then
+        git cherry-pick --abort || true
+        echo "::error::The ledger commit conflicts with a concurrent publish."
+        exit 1
+      fi
+      sleep $((attempt * delay))
+    done
+    echo "::error::Could not publish the qualification ledger after 6 attempts."
+    exit 1
+    ;;
+  *)
+    echo "Unknown command: $command" >&2
+    exit 2
+    ;;
+esac