java.yml

name: Java (Bindings)

on:
  push:
    branches: [main]
    tags: ["*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  RUST_BACKTRACE: 1
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  UV_HTTP_RETRIES: 5
  UV_HTTP_TIMEOUT: 60

jobs:
  plan:
    runs-on: ubuntu-slim
    outputs:
      test: ${{ steps.decisions.outputs.test }}
      gate: ${{ steps.decisions.outputs.gate }}
    steps:
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
        if: github.event_name == 'pull_request'
        id: filter
        with:
          filters: |
            src:
              - 'core/**'
              - 'macros/**'
              - 'bindings/java/**'
              - 'Cargo.*'
              - '.github/workflows/java.yml'
      - id: decisions
        run: |
          test=${{ steps.filter.outputs.src == 'true' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
          gate=${{ github.event_name == 'pull_request' }}
          echo "test=$test" >> "$GITHUB_OUTPUT"
          echo "gate=$gate" >> "$GITHUB_OUTPUT"

  compile-bindings:
    needs: [plan]
    if: needs.plan.outputs.test == 'true'
    name: Compile native bindings
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
          - windows-latest
          - windows-11-arm
          - macos-15-intel # x86
          - macos-latest # arm64

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: cargo build ...
        run: cargo build --locked --package sysand-java --release

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        if: matrix.os == 'ubuntu-24.04'
        with:
          python-version: "3.14"
      - name: Create version.txt
        if: matrix.os == 'ubuntu-24.04'
        run: python bindings/java/scripts/java-builder.py create-version-file
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}
      - name: Upload version.txt
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        if: matrix.os == 'ubuntu-24.04'
        with:
          name: version
          path: version.txt
          if-no-files-found: error

      - name: Upload native bindings
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: native-bindings-${{ matrix.os }}
          path: |
            target/release/*.so
            target/release/*.dylib
            target/release/*.dll
          if-no-files-found: error
          retention-days: 5 # lower than default, many ~5 MB files

  build-jar:
    name: Build Java JAR
    needs: [compile-bindings]
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.14"
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25" # our compiler target is Java 8
          distribution: temurin
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Download version.txt
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: version
      - name: Download native bindings
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: native-bindings
      - name: List native bindings
        run: ls -la native-bindings/*

      - name: Build JAR
        run: |
          python bindings/java/scripts/java-builder.py \
              ${{ startsWith(github.ref, 'refs/tags/') && '--release-jar-version' || '' }} \
              build \
              --use-existing-native-libs native-bindings \
              --use-release-build \
              ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE && '--sign-artifacts' || '' }}
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}

      - name: Build Sysand Maven plugin and run integration tests
        run: |
          python bindings/java/scripts/java-builder.py \
              ${{ startsWith(github.ref, 'refs/tags/') && '--release-jar-version' || '' }} \
              build-plugin \
              ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE && '--sign-artifacts' || '' }}
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}

      - name: Upload JARs
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: jars
          path: target/java
          if-no-files-found: error
          retention-days: 5 # lower than default, a ~160 MB file
      - name: Upload Maven plugin JAR
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: maven-plugin-jar
          path: target/java-plugin
          if-no-files-found: error
          # We need to include hidden files because integration tests use
          # .meta.json and .project.json files.
          include-hidden-files: true

  test-jar:
    name: Test Java JAR
    needs: [build-jar]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
          - windows-latest
          - windows-11-arm
          - macos-15-intel # x86
          - macos-latest # arm64

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.14"
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          # TODO: Use temurin 25 systematically when this issue resolves
          #       https://github.com/adoptium/adoptium-support/issues/1402
          java-version: ${{ matrix.os == 'windows-11-arm' && '21' || '25' }} # our build target is Java 8+
          distribution: temurin
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Download JARs
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: jars
          path: target/java
      - name: Download version.txt
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: version
      - name: List .jar files and more
        run: |
          find . -iname "*.jar"
          ls -la *
          ls -la target/*
          ls -la target/java/*
          ls -la target/java/target/*

      - name: Test Java JAR
        run: |
          python bindings/java/scripts/java-builder.py \
              ${{ startsWith(github.ref, 'refs/tags/') && '--release-jar-version' || '' }} \
              test
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}

  ci-gate:
    name: Java CI Gate
    needs: [plan, compile-bindings, build-jar, test-jar]
    if: needs.plan.outputs.gate == 'true' && !cancelled()
    runs-on: ubuntu-slim
    steps:
      - run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
            exit 1
          fi

  release:
    # Nightly tags do not trigger CI since they are created in CI
    name: Release
    needs: [build-jar, test-jar]
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04
    permissions:
      id-token: write # for actions/attest
      attestations: write # for actions/attest
      artifact-metadata: write # for actions/attest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.14"
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25" # our build target is Java 8+
          distribution: temurin
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Download native bindings
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: jars
          path: target/java
      - name: Download Maven plugin JAR
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: maven-plugin-jar
          path: target/java-plugin
      - name: Download version.txt
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: version
      - name: List .jar files and more
        run: |
          find . -iname "*.jar"
          find target/java-plugin/target/it/

      - name: Generate artifact attestation
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
        with:
          subject-path: "target/java/target/*.jar"

      - name: Deploy Java bindings
        run: python bindings/java/scripts/java-builder.py deploy
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_TOKEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}