feat(dev): expand release:verify with docs, check runs, and release-verify workflow

.github/run-package-tests.sh

@@ -67,6 +67,9 @@ run_package_test() {
     local DIR=$1
     echo "--- Processing ${DIR} ---"
     cp "${DIR}/composer.json" "${DIR}/composer-local.json"
+    local COMPOSER_ROOT_VERSION
+    COMPOSER_ROOT_VERSION=$(cat "${DIR}/VERSION")
+    export COMPOSER_ROOT_VERSION
 
     # Update composer to use local packages
     local PACKAGE_DEPENDENCIES=(

.github/workflows/release-verify.yaml

@@ -0,0 +1,53 @@
+name: Verify Releases
+on:
+  schedule:
+    - cron: '0 9 * * *'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to verify (defaults to unverified releases from the last 14 days)'
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    name: Verify Releases
+    permissions:
+      contents: write
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup PHP
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: '8.2'
+      - name: Install dependencies
+        run: composer --no-interaction --no-ansi --no-progress update -d dev
+      - name: Verify releases
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          CUTOFF=$(date -u -d "-14 days" +"%Y-%m-%dT%H:%M:%SZ")
+          TAGS=${RELEASE_TAG:-$(gh api "repos/$GH_REPO/releases?per_page=20" --jq ".[] | select(.published_at >= \"$CUTOFF\" and ((.body // \"\") | contains(\"## Release Verification: ✅ Verified\") | not)) | .tag_name")}
+          FAILED=0
+          for TAG in $TAGS; do
+            ./dev/google-cloud release:verify "$TAG" --update-release -t "$GH_TOKEN" || FAILED=1
+          done
+          exit $FAILED
+      - name: Create issue if previous step fails
+        if: ${{ failure() && github.ref == 'refs/heads/main' }}
+        uses: googleapis/librarian/.github/actions/create-issue-on-failure@45ada77d3adcdf7f54e94b5ea674a5fa48cb6a75 # v0.46.0
+        with:
+          title: "Release verification failed"
+          body: |
+            `release:verify` failed for a recent release.
+
+            Please check the logs: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          mention: "@googleapis/cloud-sdk-php-team"

.github/workflows/release.yml

@@ -73,10 +73,13 @@ jobs:
             --packagist-token="$PACKAGIST_TOKEN" \
             --packagist-safe-token="$PACKAGIST_SAFE_TOKEN"
       - name: Verify all releases made it to Packagist
+        env:
+          RELEASE_TAG: ${{ inputs.tag != '' && inputs.tag || steps.getTag.outputs.tag }}
+          SPLIT_TOKEN: ${{ secrets.SPLIT_TOKEN }}
         uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           command: |
-            ./dev/google-cloud release:verify
+            ./dev/google-cloud release:verify "$RELEASE_TAG" -t "$SPLIT_TOKEN"
           timeout_minutes: 1
           max_attempts: 3
           retry_wait_seconds: 30

dev/README.md

@@ -20,7 +20,7 @@ Available commands:
   component:update:readme-sample  Add a sample to a component
  release
   release:info                    list information for a google-cloud-php release
-  release:verify                  Verifies the package version from packagist.
+  release:verify                  Verifies that component releases exist on split repositories, Packagist, and Cloud RAD reference documentation.
  repo
   repo:compliance                 ensure all github repositories meet compliance
   repo:split                      [split] Split subtree and push to various remotes.