feat: further release automation (#9092)

This PR further updates release automation. The per-repository update
scripts `script/release_steps.py` now actually performs the tests,
rather than outputting a script for the release manager to run line by
line. It's been tested on `v4.21.0` (i.e. the easy case of a stable
release), and we'll debug its behaviour on `v4.22.0-rc1` tonight.

Author: kim-em

.gitignore

@@ -31,3 +31,4 @@ fwOut.txt
 wdErr.txt
 wdIn.txt
 wdOut.txt
+downstream_releases/

script/push_repo_release_tag.py

@@ -3,6 +3,32 @@
 import subprocess
 import requests
 
+def check_gh_auth():
+    """Check if GitHub CLI is properly authenticated."""
+    try:
+        result = subprocess.run(["gh", "auth", "status"], capture_output=True, text=True)
+        if result.returncode != 0:
+            return False, result.stderr
+        return True, None
+    except FileNotFoundError:
+        return False, "GitHub CLI (gh) is not installed. Please install it first."
+    except Exception as e:
+        return False, f"Error checking authentication: {e}"
+
+def handle_gh_error(error_output):
+    """Handle GitHub CLI errors and provide helpful messages."""
+    if "Not Found (HTTP 404)" in error_output:
+        return "Repository not found or access denied. Please check:\n" \
+               "1. The repository name is correct\n" \
+               "2. You have access to the repository\n" \
+               "3. Your GitHub CLI authentication is valid"
+    elif "Bad credentials" in error_output or "invalid" in error_output.lower():
+        return "Authentication failed. Please run 'gh auth login' to re-authenticate."
+    elif "rate limit" in error_output.lower():
+        return "GitHub API rate limit exceeded. Please try again later."
+    else:
+        return f"GitHub API error: {error_output}"
+
 def main():
     if len(sys.argv) != 4:
         print("Usage: ./push_repo_release_tag.py <repo> <branch> <version_tag>")
@@ -14,6 +40,13 @@ def main():
         print(f"Error: Branch '{branch}' is not 'master' or 'main'.")
         sys.exit(1)
 
+    # Check GitHub CLI authentication first
+    auth_ok, auth_error = check_gh_auth()
+    if not auth_ok:
+        print(f"Authentication error: {auth_error}")
+        print("\nTo fix this, run: gh auth login")
+        sys.exit(1)
+
     # Get the `lean-toolchain` file content
     lean_toolchain_url = f"https://raw.githubusercontent.com/{repo}/{branch}/lean-toolchain"
     try:
@@ -43,12 +76,23 @@ def main():
                 for tag in existing_tags:
                     print(tag.replace("refs/tags/", ""))
                 sys.exit(1)
+        elif list_tags_output.returncode != 0:
+            # Handle API errors when listing tags
+            error_msg = handle_gh_error(list_tags_output.stderr)
+            print(f"Error checking existing tags: {error_msg}")
+            sys.exit(1)
 
         # Get the SHA of the branch
         get_sha_cmd = [
             "gh", "api", f"repos/{repo}/git/ref/heads/{branch}", "--jq", ".object.sha"
         ]
-        sha_result = subprocess.run(get_sha_cmd, capture_output=True, text=True, check=True)
+        sha_result = subprocess.run(get_sha_cmd, capture_output=True, text=True)
+        
+        if sha_result.returncode != 0:
+            error_msg = handle_gh_error(sha_result.stderr)
+            print(f"Error getting branch SHA: {error_msg}")
+            sys.exit(1)
+            
         sha = sha_result.stdout.strip()
 
         # Create the tag
@@ -58,11 +102,20 @@ def main():
             "-F", f"ref=refs/tags/{version_tag}",
             "-F", f"sha={sha}"
         ]
-        subprocess.run(create_tag_cmd, capture_output=True, text=True, check=True)
+        create_result = subprocess.run(create_tag_cmd, capture_output=True, text=True)
+        
+        if create_result.returncode != 0:
+            error_msg = handle_gh_error(create_result.stderr)
+            print(f"Error creating tag: {error_msg}")
+            sys.exit(1)
 
         print(f"Successfully created and pushed tag '{version_tag}' to {repo}.")
     except subprocess.CalledProcessError as e:
-        print(f"Error while creating/pushing tag: {e.stderr.strip() if e.stderr else e}")
+        error_msg = handle_gh_error(e.stderr.strip() if e.stderr else str(e))
+        print(f"Error while creating/pushing tag: {error_msg}")
+        sys.exit(1)
+    except Exception as e:
+        print(f"Unexpected error: {e}")
         sys.exit(1)
 
 if __name__ == "__main__":

script/release_checklist.py

@@ -262,6 +262,61 @@ def pr_exists_with_title(repo_url, title, github_token):
             return pr['number'], pr['html_url']
     return None
 
+def check_proofwidgets4_release(repo_url, target_toolchain, github_token):
+    """Check if ProofWidgets4 has a release tag that uses the target toolchain."""
+    api_base = repo_url.replace("https://github.com/", "https://api.github.com/repos/")
+    headers = {'Authorization': f'token {github_token}'} if github_token else {}
+    
+    # Get all tags matching v0.0.* pattern
+    response = requests.get(f"{api_base}/git/matching-refs/tags/v0.0.", headers=headers)
+    if response.status_code != 200:
+        print(f"  ❌ Could not fetch ProofWidgets4 tags")
+        return False
+    
+    tags = response.json()
+    if not tags:
+        print(f"  ❌ No v0.0.* tags found for ProofWidgets4")
+        return False
+    
+    # Extract tag names and sort by version number (descending)
+    tag_names = []
+    for tag in tags:
+        ref = tag['ref']
+        if ref.startswith('refs/tags/v0.0.'):
+            tag_name = ref.replace('refs/tags/', '')
+            try:
+                # Extract the number after v0.0.
+                version_num = int(tag_name.split('.')[-1])
+                tag_names.append((version_num, tag_name))
+            except (ValueError, IndexError):
+                continue
+    
+    if not tag_names:
+        print(f"  ❌ No valid v0.0.* tags found for ProofWidgets4")
+        return False
+    
+    # Sort by version number (descending) and take the most recent 10
+    tag_names.sort(reverse=True)
+    recent_tags = tag_names[:10]
+    
+    # Check each recent tag to see if it uses the target toolchain
+    for version_num, tag_name in recent_tags:
+        toolchain_content = get_branch_content(repo_url, tag_name, "lean-toolchain", github_token)
+        if toolchain_content is None:
+            continue
+        
+        if is_version_gte(toolchain_content.strip(), target_toolchain):
+            print(f"  ✅ Found release {tag_name} using compatible toolchain (>= {target_toolchain})")
+            return True
+    
+    # If we get here, no recent release uses the target toolchain
+    # Find the highest version number to suggest the next one
+    highest_version = max(version_num for version_num, _ in recent_tags)
+    next_version = highest_version + 1
+    print(f"  ❌ No recent ProofWidgets4 release uses toolchain >= {target_toolchain}")
+    print(f"     You will need to create and push a tag v0.0.{next_version}")
+    return False
+
 def main():
     parser = argparse.ArgumentParser(description="Check release status of Lean4 repositories")
     parser.add_argument("toolchain", help="The toolchain version to check (e.g., v4.6.0)")
@@ -386,6 +441,12 @@ def main():
             continue
         print(f"  ✅ On compatible toolchain (>= {toolchain})")
 
+        # Special handling for ProofWidgets4
+        if name == "ProofWidgets4":
+            if not check_proofwidgets4_release(url, toolchain, github_token):
+                repo_status[name] = False
+                continue
+
         if check_tag:
             tag_exists_initially = tag_exists(url, toolchain, github_token)
             if not tag_exists_initially: