ci: add service-scoped calver tagging and automate www deploy

ci/scripts/await-rollout.sh

@@ -32,9 +32,10 @@ while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
 
   if [ "$HTTP_CODE" = "200" ]; then
     LIVE_COMMIT=$(jq -r '.commit // empty' "$RESP_FILE" 2>/dev/null || true)
-    echo "  Live commit: ${LIVE_COMMIT:-<none>}"
+    LIVE_VERSION=$(jq -r '.version // empty' "$RESP_FILE" 2>/dev/null || true)
+    echo "  Live commit: ${LIVE_COMMIT:-<none>}, Live version: ${LIVE_VERSION:-<none>}"
 
-    if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
+    if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ] || [ "$LIVE_VERSION" = "$TARGET_COMMIT" ]; then
       echo "✅ Success! Production $SERVICE has successfully rolled out $TARGET_COMMIT."
       rm -f "$RESP_FILE"
       exit 0

ci/scripts/calver-release.sh

@@ -1,21 +1,79 @@
 #!/bin/bash
 set -euo pipefail
 
+MODE="version"
+SERVICE=""
+COMMIT="HEAD"
+EXPLICIT_VERSION=""
+
+if [ $# -ge 2 ] && [ "$1" = "tag" ]; then
+    MODE="tag"
+    SERVICE="$2"
+    COMMIT="${3:-HEAD}"
+    EXPLICIT_VERSION="${4:-}"
+elif [ $# -ge 1 ]; then
+    SERVICE="$1"
+fi
+
 YEAR_MONTH=$(date -u +'%Y.%m')
 git fetch --tags --quiet 2>/dev/null || true
 
-# Find highest MICRO version for current YYYY.MM (matching tags formatted like YYYY.MM.MICRO)
-LATEST_TAG=$(git tag -l "${YEAR_MONTH}.*" | sort -V | tail -n1 || echo "")
-
-if [ -z "$LATEST_TAG" ]; then
-    MICRO=0
-else
-    LATEST_MICRO="${LATEST_TAG#"${YEAR_MONTH}."}"
-    if [[ "$LATEST_MICRO" =~ ^[0-9]+$ ]]; then
-        MICRO=$((LATEST_MICRO + 1))
+if [ -n "$SERVICE" ]; then
+    PREFIX="services/${SERVICE}-"
+    if [ -n "$EXPLICIT_VERSION" ]; then
+        VERSION="$EXPLICIT_VERSION"
     else
-        MICRO=0
+        PATTERN="${PREFIX}${YEAR_MONTH}.*"
+        LATEST_TAG=$(git tag -l "$PATTERN" | sort -V | tail -n1 || echo "")
+        if [ -z "$LATEST_TAG" ]; then
+            MICRO=1
+        else
+            LATEST_MICRO="${LATEST_TAG#"${PREFIX}${YEAR_MONTH}."}"
+            if [[ "$LATEST_MICRO" =~ ^[0-9]+$ ]]; then
+                MICRO=$((LATEST_MICRO + 1))
+            else
+                MICRO=1
+            fi
+        fi
+        VERSION="${YEAR_MONTH}.${MICRO}"
     fi
+    TAG_NAME="${PREFIX}${VERSION}"
+else
+    if [ -n "$EXPLICIT_VERSION" ]; then
+        VERSION="$EXPLICIT_VERSION"
+    else
+        PATTERN="${YEAR_MONTH}.*"
+        LATEST_TAG=$(git tag -l "$PATTERN" | sort -V | tail -n1 || echo "")
+        if [ -z "$LATEST_TAG" ]; then
+            MICRO=0
+        else
+            LATEST_MICRO="${LATEST_TAG#"${YEAR_MONTH}."}"
+            if [[ "$LATEST_MICRO" =~ ^[0-9]+$ ]]; then
+                MICRO=$((LATEST_MICRO + 1))
+            else
+                MICRO=0
+            fi
+        fi
+        VERSION="${YEAR_MONTH}.${MICRO}"
+    fi
+    TAG_NAME="$VERSION"
 fi
 
-echo "${YEAR_MONTH}.${MICRO}"
+if [ "$MODE" = "tag" ]; then
+    ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+    if git rev-parse -q --verify "refs/tags/$TAG_NAME" >/dev/null; then
+        EXISTING_COMMIT=$(git rev-parse "refs/tags/$TAG_NAME")
+        if [ "$EXISTING_COMMIT" = "$(git rev-parse "$COMMIT")" ]; then
+            echo "Tag $TAG_NAME already points to $COMMIT"
+        else
+            echo "Tag $TAG_NAME exists but points to $EXISTING_COMMIT, skipping create"
+        fi
+    else
+        echo "Creating tag $TAG_NAME on $COMMIT..."
+        git tag "$TAG_NAME" "$COMMIT"
+    fi
+    echo "Pushing tag $TAG_NAME..."
+    python3 "$ROOT_DIR/ci/scripts/git_write.py" "refs/tags/$TAG_NAME"
+    echo "Successfully created and pushed tag $TAG_NAME"
+fi
+echo "$VERSION"

ci/scripts/git_write.py

@@ -9,7 +9,7 @@ from pathlib import Path
 
 def main():
     ref=sys.argv[1]
-    if ref not in ('HEAD:next','trunk') and not re.fullmatch(r'refs/tags/[A-Za-z0-9][A-Za-z0-9._-]*',ref):
+    if ref not in ('HEAD:next','trunk') and not re.fullmatch(r'refs/tags/[A-Za-z0-9][A-Za-z0-9._-]*(/[A-Za-z0-9][A-Za-z0-9._-]*)*',ref):
         raise ValueError('Unexpected publication ref')
     repository=os.environ['GITHUB_REPOSITORY']
     if not re.fullmatch(r'deytenit/[A-Za-z0-9_.-]+',repository):