release.yml

# SPDX-License-Identifier: Apache-2.0

name: Release Artifacts

# Deploys to Maven Central (via JReleaser) and creates a GitHub release
# whenever a tag like v1.1.0 is pushed. Mirrors the manual release.sh,
# but expects the version/tag to already be set and pushed.
on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest

    permissions:
      contents: write # JReleaser needs this to create the GitHub release
      issues: write # JReleaser queries/closes the release milestone (Issues API)

    steps:
      - name: Checkout Code
        uses: actions/checkout@v6
        with:
          # Full history + tags so the JReleaser conventional-commits
          # changelog can be generated.
          fetch-depth: 0
          fetch-tags: true

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          java-version: "21"
          distribution: "temurin"

      - name: Cache Maven dependencies
        uses: actions/cache@v5
        with:
          path: ~/.m2/repository
          key: maven-${{ hashFiles('pom.xml') }}
          restore-keys: maven-

      - name: Verify POM version matches tag
        run: |
          POM_VERSION=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)
          TAG_VERSION="${GITHUB_REF_NAME#v}"

          if [ "$POM_VERSION" != "$TAG_VERSION" ]; then
            echo "Error: Version mismatch, POM version ($POM_VERSION) does not match tag ($TAG_VERSION)"
            exit 1
          fi

          echo "Success: POM version matches the tag"

      - name: Build & stage artifacts
        # Build, test, and stage the artifacts into a local repository that
        # JReleaser then signs and uploads to Maven Central.
        # distributionManagement points at GitHub Packages, so we override
        # the deploy target to the local staging directory configured in the
        # JReleaser <stagingRepositories> block (target/staging-deploy).
        #
        # project.build.outputTimestamp pins every archive/manifest timestamp
        # to the release commit's committer date (strict ISO-8601 via %cI), so
        # the same tag always builds byte-identical artifacts (reproducible
        # builds), independent of when or where the build runs.
        run: |
          BUILD_TS=$(git log -1 --format=%cI)
          echo "Pinning project.build.outputTimestamp to $BUILD_TS"
          ./mvnw -B -Pfull-build clean deploy \
            -DaltDeploymentRepository=local::file:./target/staging-deploy \
            -Dproject.build.outputTimestamp="$BUILD_TS"

      - name: Publish with JReleaser
        run: ./mvnw -B -Pdeploy-release jreleaser:full-release -N
        env:
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}