Java: add Windows x64 in-process runtime and native classifier publishing

.github/actions/java-test-report/action.yml

@@ -126,7 +126,8 @@ runs:
             if [ -n "$covered" ] && [ -n "$missed" ]; then
               local total=$((covered + missed))
               if [ "$total" -gt 0 ]; then
-                echo "scale=1; $covered * 100 / $total" | bc
+                awk -v covered="$covered" -v total="$total" \
+                  'BEGIN { printf "%.1f\n", covered * 100 / total }'
               else
                 echo "0"
               fi

.github/workflows/java-publish-snapshot.yml

@@ -16,8 +16,86 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  publish-snapshot:
+  resolve-source:
+    name: Resolve immutable snapshot source
+    runs-on: ubuntu-latest
+    outputs:
+      source_sha: ${{ steps.source.outputs.sha }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - id: source
+        shell: bash
+        run: |
+          SHA=$(git rev-parse HEAD)
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+
+  build-windows-classifier:
+    name: Build Windows snapshot classifier
+    needs: resolve-source
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: pwsh
+        working-directory: ./java
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        with:
+          java-version: "25"
+          distribution: "microsoft"
+          cache: "maven"
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 22
+
+      - name: Build and validate win32-x64 classifier
+        id: build
+        run: |
+          $sourceCommit = git rev-parse HEAD
+          if ($sourceCommit -ne '${{ needs.resolve-source.outputs.source_sha }}') {
+            throw "Checked out $sourceCommit instead of the resolved snapshot source."
+          }
+          node copilot-native/scripts/validate-native-host.mjs win32-x64
+          mvn -B -pl copilot-native package -DskipTests
+          $version = mvn help:evaluate "-Dexpression=project.version" -q "-DforceStdout"
+          $jar = "copilot-native/target/copilot-sdk-java-runtime-$version-win32-x64.jar"
+          $primaryJar = "copilot-native/target/copilot-sdk-java-runtime-$version.jar"
+          if (-not (Test-Path -LiteralPath $jar -PathType Leaf)) {
+            throw "Expected Windows classifier was not produced: $jar"
+          }
+          node copilot-native/scripts/validate-native-artifact.mjs classifier win32-x64 $jar ([IO.Path]::GetFileName($jar)) ..
+          node copilot-native/scripts/validate-native-artifact.mjs placeholder $primaryJar
+          $manifest = "copilot-native/target/win32-x64-$version.sha256"
+          $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $jar).Hash.ToLowerInvariant()
+          "$hash  $([IO.Path]::GetFileName($jar))" | Set-Content -NoNewline -Encoding ascii $manifest
+          node copilot-native/scripts/validate-native-artifact.mjs checksum $jar $manifest ([IO.Path]::GetFileName($jar))
+          "version=$version" | Add-Content $env:GITHUB_OUTPUT
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: java-native-win32-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-win32-x64.jar
+            java/copilot-native/target/win32-x64-${{ steps.build.outputs.version }}.sha256
+          if-no-files-found: error
+          retention-days: 1
+
+  deploy-snapshot:
     name: Publish SNAPSHOT to Maven Central
+    needs: [resolve-source, build-windows-classifier]
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -26,12 +104,13 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch-depth: 0
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-copilot
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: "25"
           distribution: "microsoft"
@@ -40,22 +119,64 @@ jobs:
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
 
-      - name: Verify version is a SNAPSHOT
-        working-directory: ./java
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 22
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: java-native-win32-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/java-native-win32-x64
+
+      - name: Verify version, source, and Windows classifier
+        id: windows-artifact
         run: |
+          SOURCE_COMMIT=$(git rev-parse HEAD)
+          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
+            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
+            exit 1
+          fi
           VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
-          echo "Publishing version: $VERSION"
           if [[ "$VERSION" != *"-SNAPSHOT" ]]; then
-            echo "ERROR: This workflow only publishes SNAPSHOT versions. Current version: $VERSION"
+            echo "::error::This workflow only publishes SNAPSHOT versions. Current version: $VERSION"
             exit 1
           fi
-          echo "### Snapshot Publish" >> $GITHUB_STEP_SUMMARY
-          echo "- **Version:** $VERSION" >> $GITHUB_STEP_SUMMARY
-          echo "- **Repository:** Maven Central Snapshots" >> $GITHUB_STEP_SUMMARY
+          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-win32-x64"
+          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-win32-x64.jar"
+          MANIFEST="$ARTIFACT_DIRECTORY/win32-x64-$VERSION.sha256"
+          test -f "$JAR"
+          test -f "$MANIFEST"
+          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
+            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
+          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
+            classifier win32-x64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
+          echo "windows_jar=$JAR" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "windows_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"
 
-      - name: Deploy Snapshot
-        working-directory: ./java
-        run: mvn -B deploy -DskipTests
+      - name: Build Linux classifier and deploy complete snapshot
+        run: |
+          VERSION="${{ steps.windows-artifact.outputs.version }}"
+          mvn -B deploy -DskipTests -Dcopilot.native.libc=glibc \
+            "-Dcopilot.native.external.win32.classifier.path=${{ steps.windows-artifact.outputs.windows_jar }}"
+          LINUX_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-linux-x64.jar"
+          test -f "$LINUX_JAR"
+          node copilot-native/scripts/validate-native-artifact.mjs \
+            classifier linux-x64 "$LINUX_JAR" "$(basename "$LINUX_JAR")" ..
+          LINUX_SHA=$(sha256sum "$LINUX_JAR" | cut -d ' ' -f 1)
+          {
+            echo "### Snapshot Publish"
+            echo "- **Version:** $VERSION"
+            echo "- **Source commit:** \`${{ needs.resolve-source.outputs.source_sha }}\`"
+            echo "- **Repository:** Maven Central Snapshots"
+            echo ""
+            echo "#### Published Native Classifiers"
+            echo ""
+            echo "| Classifier | Build runner | Artifact | SHA-256 | Status |"
+            echo "| --- | --- | --- | --- | --- |"
+            echo "| \`linux-x64\` | \`ubuntu-latest\` | \`$(basename "$LINUX_JAR")\` | \`$LINUX_SHA\` | Published |"
+            echo "| \`win32-x64\` | \`windows-latest\` | \`$(basename "${{ steps.windows-artifact.outputs.windows_jar }}")\` | \`${{ steps.windows-artifact.outputs.windows_sha }}\` | Published |"
+          } >> "$GITHUB_STEP_SUMMARY"
         env:
           MAVEN_USERNAME: ${{ secrets.JAVA_MAVEN_CENTRAL_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.JAVA_MAVEN_CENTRAL_PASSWORD }}

.github/workflows/java-sdk-tests.yml

@@ -18,12 +18,19 @@ permissions:
 
 jobs:
   java-sdk-inprocess:
-    name: "Java SDK InProcess Tests"
+    name: "Java SDK InProcess Tests (${{ matrix.classifier }})"
     if: github.event.repository.fork == false
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            classifier: linux-x64
+          - os: windows-latest
+            classifier: win32-x64
+    runs-on: ${{ matrix.os }}
     defaults:
       run:
-        shell: bash
         working-directory: ./java
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -40,13 +47,13 @@ jobs:
         with:
           node-version: 22
 
-      - name: Validate Linux glibc native host
-        run: node copilot-native/scripts/validate-native-host.mjs linux-x64
+      - name: Validate native host
+        run: node copilot-native/scripts/validate-native-host.mjs ${{ matrix.classifier }}
 
       - name: Run Java SDK tests (InProcess)
         env:
           CI: "true"
-        run: mvn clean verify -Pinprocess -Dcopilot.native.skip.download=false
+        run: mvn clean verify -Pinprocess
 
       - name: Generate Test Report Summary
         if: always()
@@ -58,13 +65,128 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: java-test-results-inprocess
+          name: java-test-results-inprocess-${{ matrix.classifier }}
           path: |
             java/sdk/target/surefire-reports/
             java/sdk/target/surefire-reports-isolated/
             java/sdk/target/failsafe-reports/
           retention-days: 7
 
+  java-native-publication-windows:
+    name: "Java Native Publication Input (win32-x64)"
+    if: github.event.repository.fork == false
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    outputs:
+      source_sha: ${{ steps.build.outputs.source_sha }}
+      version: ${{ steps.build.outputs.version }}
+    defaults:
+      run:
+        shell: pwsh
+        working-directory: ./java
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        with:
+          java-version: "25"
+          distribution: "microsoft"
+          cache: "maven"
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 22
+
+      - name: Build and validate win32-x64 classifier
+        id: build
+        run: |
+          node copilot-native/scripts/validate-native-host.mjs win32-x64
+          mvn -B -pl copilot-native package -DskipTests
+          $version = mvn help:evaluate "-Dexpression=project.version" -q "-DforceStdout"
+          $jar = "copilot-native/target/copilot-sdk-java-runtime-$version-win32-x64.jar"
+          $primaryJar = "copilot-native/target/copilot-sdk-java-runtime-$version.jar"
+          if (-not (Test-Path -LiteralPath $jar -PathType Leaf)) {
+            throw "Expected Windows classifier was not produced: $jar"
+          }
+          node copilot-native/scripts/validate-native-artifact.mjs classifier win32-x64 $jar ([IO.Path]::GetFileName($jar)) ..
+          node copilot-native/scripts/validate-native-artifact.mjs placeholder $primaryJar
+          $manifest = "copilot-native/target/win32-x64-$version.sha256"
+          $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $jar).Hash.ToLowerInvariant()
+          "$hash  $([IO.Path]::GetFileName($jar))" | Set-Content -NoNewline -Encoding ascii $manifest
+          node copilot-native/scripts/validate-native-artifact.mjs checksum $jar $manifest ([IO.Path]::GetFileName($jar))
+          echo "source_sha=$(git rev-parse HEAD)" >> $env:GITHUB_OUTPUT
+          echo "version=$version" >> $env:GITHUB_OUTPUT
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: java-native-publication-win32-x64-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-win32-x64.jar
+            java/copilot-native/target/win32-x64-${{ steps.build.outputs.version }}.sha256
+          if-no-files-found: error
+          retention-days: 1
+
+  java-native-publication-assembly:
+    name: "Java Native Publication Assembly"
+    if: github.event.repository.fork == false
+    needs: java-native-publication-windows
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: ./java
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        with:
+          java-version: "25"
+          distribution: "microsoft"
+          cache: "maven"
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 22
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: java-native-publication-win32-x64-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ github.workspace }}/java/native-publication-input
+
+      - name: Verify Windows input and deploy the complete local release
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "${{ needs.java-native-publication-windows.outputs.source_sha }}"
+          VERSION="${{ needs.java-native-publication-windows.outputs.version }}"
+          INPUT_DIRECTORY="$GITHUB_WORKSPACE/java/native-publication-input"
+          WINDOWS_JAR="$INPUT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-win32-x64.jar"
+          WINDOWS_MANIFEST="$INPUT_DIRECTORY/win32-x64-$VERSION.sha256"
+          node copilot-native/scripts/validate-native-artifact.mjs \
+            checksum "$WINDOWS_JAR" "$WINDOWS_MANIFEST" "$(basename "$WINDOWS_JAR")"
+          node copilot-native/scripts/validate-native-artifact.mjs \
+            classifier win32-x64 "$WINDOWS_JAR" "$(basename "$WINDOWS_JAR")" ..
+          export GNUPGHOME="$GITHUB_WORKSPACE/java/copilot-native/target/local-publication-gpg"
+          rm -rf "$GNUPGHOME"
+          mkdir -p "$GNUPGHOME"
+          chmod 700 "$GNUPGHOME"
+          gpg --batch --pinentry-mode loopback --passphrase '' \
+            --quick-generate-key 'Copilot SDK local validation <local-validation@example.invalid>' rsa2048 sign 1d
+          LOCAL_REPOSITORY="$GITHUB_WORKSPACE/java/copilot-native/target/local-publication-repository"
+          rm -rf "$LOCAL_REPOSITORY"
+          mvn -B -pl copilot-native deploy -Prelease -DskipTests \
+            -Dcopilot.native.libc=glibc \
+            -Dcopilot.native.test.local.publication=true \
+            "-Dcopilot.native.external.win32.classifier.path=$WINDOWS_JAR" \
+            "-Dmaven.repo.local=$LOCAL_REPOSITORY"
+          node copilot-native/scripts/validate-local-publication.mjs \
+            "$LOCAL_REPOSITORY" copilot-sdk-java-runtime "$VERSION" .. --signatures
+
   java-sdk:
     name: "Java SDK Tests (JDK ${{ matrix.test-jdk }})"
     if: github.event.repository.fork == false