release.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Release
# Ref: https://raw.githubusercontent.com/jreleaser/helloworld-java-jpackage/refs/heads/main/.github/workflows/release.yml

on:
  # Trigger on button click
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to checkout (vx.x.x or early-access)'
        required: true
        type: string
        default: 'early-access'
  # Trigger on tag push
  # Tag is just the same as a branch, it's a ref
  # You can't restrict to a specific branch
  push:
    tags:
      - 'v*'
      - 'early-access'

# When you create and push a tag, Git might trigger the workflow twice if you have other push triggers (like on branches).
# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-only-cancel-in-progress-jobs-or-runs-for-the-current-workflow
# https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-concurrency
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # to cancel any currently running job or workflow in the same concurrency group
  cancel-in-progress: true

# Release Token
# https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps#available-scopes
# The release token should have:
#   * repo scope to create a repo (at least public_repo) to create and manage public repositories
#   * workflow to create workflow files
#   * packages to write packages

# GITHUB_TOKEN: Token permission
# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions
# We publish to other repo in the same organisation
# permissions control what the GITHUB_TOKEN can do within the repository where the workflow is running.
permissions:
  packages: write # Allow creating package in the same repo
  contents: write # Allow creating/deleting a GitHub release in the same repo

# Constant for entire workflow
env:
  JRELEASER_JPACKAGE_ASSEMBLY_NAME: 'doc-exec-installer' # The jpackage assembly name
  JRELEASER_JLINK_ASSEMBLY_NAME: 'doc-exec-jre' # The jlink assembly name
  JRELEASER_JAVA_ARCHIVE_ASSEMBLY_NAME: 'doc-exec-nojre'
  BUILD_DIRECTORY: 'target'
  WORKFLOW_ID: release # the workflow name without extension
  SNAPSHOT_TAG: 'early-access'

jobs:

  # Assemble (Jpackage starts Archive assembly)
  release-assemble:
    uses: ./.github/workflows/release-assemble-jpackage.yml
    with:
      tag: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
      runner: 'windows-latest'

  # Release all generated artifacts
  release:
    runs-on: ubuntu-latest
    needs: [ release-assemble ]
    environment: release
    steps:

      # Checkout first as we do a control on the pom.xml version
      - name: Git Checkout ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
          fetch-depth: 0

      # Homebrew is installed but not in the path
      # https://github.com/actions/runner-images/issues/6283
      - name: Homebrew Setup
        run: echo "/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin" >> $GITHUB_PATH
      - name: Homebrew Utility Installation
        run: brew install yq

      # Extract Props from pom.xml
      - name: Props And Version Check ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
        id: props
        shell: bash
        run: |

          set -TCEeuo pipefail

          # Ref
          TAG=${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
          echo "tag=${TAG}" >> $GITHUB_OUTPUT

          # Generate the effective pom
          POM_EFFECTIVE="${{runner.temp}}/pom-effective.xml"
          ./mvnw help:effective-pom --quiet "-Doutput=$POM_EFFECTIVE" --no-transfer-progress --batch-mode --settings .github\cd-maven-settings.xml

          # Project version and tag
          PROJECT_VERSION=$(yq --exit-status '.project.version' "$POM_EFFECTIVE")
          PROJECT_TAG="v$PROJECT_VERSION"
          if [[ "$PROJECT_VERSION" =~ .*-SNAPSHOT ]]; then
            PROJECT_VERSION=${{env.SNAPSHOT_TAG}}
            PROJECT_TAG=${{env.SNAPSHOT_TAG}}
          fi

          # Check
          if [ "$PROJECT_TAG" != "$TAG" ]; then
            echo "Derived Tag from pom.xml ($PROJECT_TAG) is not the same as the workflow tag $TAG"
            exit 1
          fi

          JDK_VERSION=$(yq --exit-status '.project.properties."jdk.version"' "$POM_EFFECTIVE")
          echo "jdk_version=$JDK_VERSION" >> $GITHUB_OUTPUT

          JDK_DISTRO=$(yq --exit-status '.project.properties."jdk.distribution"' "$POM_EFFECTIVE")
          echo "jdk_distro=$JDK_DISTRO" >> $GITHUB_OUTPUT


      # Cache to not download the maven dependency between matrix run
      # https://github.com/actions/cache/blob/main/examples.md#java---maven
      - name: Cache local Maven repository
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          java-version: ${{ steps.props.outputs.jdk_version }}
          distribution: ${{ steps.props.outputs.jdk_distro }}
          cache: maven

      - name: Download Java Maven Central Artifacts
        uses: actions/download-artifact@v4
        continue-on-error: false
        with:
          pattern: java-maven-central-*
          merge-multiple: true # dont' create the root archive directory
          path: ${{env.BUILD_DIRECTORY}}/staging-deploy

      - name: Download Java Archive Artifacts
        uses: actions/download-artifact@v4
        continue-on-error: false
        with:
          pattern: java-archive-*
          merge-multiple: true # dont' create the root archive directory
          path: ${{env.BUILD_DIRECTORY}}/jreleaser/assemble/${{env.JRELEASER_JAVA_ARCHIVE_ASSEMBLY_NAME}}/java-archive

      - name: Download Jlink Artifacts
        uses: actions/download-artifact@v4
        continue-on-error: false
        with:
          pattern: jlink-*
          merge-multiple: true # dont' create the root archive directory
          path: ${{env.BUILD_DIRECTORY}}/jreleaser/assemble/${{env.JRELEASER_JLINK_ASSEMBLY_NAME}}/jlink

      - name: Download Jpackage Installer Artifacts
        uses: actions/download-artifact@v4
        continue-on-error: false
        with:
          pattern: jpackage-*
          merge-multiple: true # dont' create the root archive directory
          path: ${{env.BUILD_DIRECTORY}}/jreleaser/assemble/${{env.JRELEASER_JPACKAGE_ASSEMBLY_NAME}}/jpackage

      - name: Display structure of downloaded files
        run: ls -R

      - name: Import Gpg Signing Key
        shell: bash
        run:
          gpg --batch --yes --passphrase "${{ secrets.GPG_SOFTWARE_SIGNING_PASSPHRASE }}" --import <(echo "${{ secrets.GPG_SOFTWARE_SIGNING_KEY }}")

      # https://jreleaser.org/guide/latest/concepts/workflow.html#_full_release
      - name: JReleaser Full Release
        env:
          # Mandatory passphrase otherwise: gpg: signing failed: Inappropriate ioctl for device
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_SOFTWARE_SIGNING_PASSPHRASE }}
          # Token
          # JRELEASER_GITHUB_TOKEN should be secrets.GITHUB_TOKEN
          # Otherwise we get another push leading to a recursive start of release workflow
          # see https://github.com/jreleaser/jreleaser/issues/2010
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JRELEASER_DOCKER_GHCR_IO_PASSWORD: ${{ secrets.RELEASE_TOKEN }}
          JRELEASER_WINGET_GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          JRELEASER_HOMEBREW_GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          JRELEASER_CHOCOLATEY_GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
          JRELEASER_NEXUS2_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
          JRELEASER_NEXUS2_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
        shell: bash
        run: |
          set -TCEeuo pipefail
          ./mvnw jreleaser:full-release \
            --no-transfer-progress \
            --batch-mode \
            --settings .github\cd-maven-settings.xml

      - name: JReleaser Logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          retention-days: 1
          name: jreleaser-logs-${{env.WORKFLOW_ID}}
          path: |
            ${{env.BUILD_DIRECTORY}}/jreleaser/trace.log
            ${{env.BUILD_DIRECTORY}}/jreleaser/output.properties