release-workflow.yml

name: Release ESMF SDK
on:
  workflow_dispatch:
    inputs:
      release_version:
        description: 'Version number of the release'
        required: true
env:
  RELEASE_VERSION: ${{ github.event.inputs.release_version }}
permissions: {}
jobs:
  check-preconditions:
    name: Check preconditions
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          submodules: recursive
          persist-credentials: false

      # Required for Maven
      - name: Set up JDK 25
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0
        with:
          distribution: 'temurin'
          java-version: '25.0.1'
          overwrite-settings: false

      - name: Setup Git
        run: |
          git config user.name github-actions
          git config user.email github-actions@github.com

      - name: Sanity check version
        if: ${{ !contains( env.RELEASE_VERSION, '-M' ) }}
        run: |
          current_version=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)

          if [[ "${RELEASE_VERSION}" =~ ^[0-9]+.[0-9]+.[0-9]+$ ]]
          then
            echo version is valid
          else
            echo release version ${RELEASE_VERSION} is invalid
            exit 1
          fi

  # The Linux build will upload the local Maven Central bundle
  # (i.e., what will be deployed to Maven Central)
  # and the Linux-specific samm-cli binary to the build artifacts
  build-linux:
    name: Linux build
    needs: [check-preconditions]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          submodules: recursive
          persist-credentials: false

      - name: Configure GPG
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0
        with:
          distribution: 'temurin'
          java-version: '25.0.1'
          server-id: central
          # The following variables are defined in https://github.com/eclipse-esmf/.eclipsefdn/blob/main/otterdog/eclipse-esmf.jsonnet
          gpg-private-key: ${{ secrets.PGP_KEY }}
          gpg-passphrase-env-var: PGP_KEY_PASSWORD
          server-username-env-var: CENTRAL_SONATYPE_TOKEN_USERNAME
          server-password-env-var: CENTRAL_SONATYPE_TOKEN_PASSWORD
          overwrite-settings: false

      - name: Cache Maven packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      # The Linux build will prepare a Maven Central upload "bundle"
      # that includes all .jars except the CLI jar
      - name: Build and run tests
        run: |
          set -x
          export MAVEN_OPTS="-Xmx4096m"
          export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"

          # Required for reactor dependencies
          mvn clean install -DskipTests -Dmaven.javadoc.skip=true -Dskip.maven.failsafe
          mvn versions:set -DnewVersion=${RELEASE_VERSION}
          mvn versions:commit

          # Actual build of core SDK
          mvn -B -pl '!org.eclipse.esmf:samm-cli' clean deploy -Dmaven.wagon.httpconnectionManager.ttlSeconds=60 -Prelease-build,sign

          # Create Maven Central upload bundle
          pushd target/central-staging
          echo "Contents of $(pwd):"
          ls -lR
          rm -rf org/eclipse/esmf/esmf-documentation
          find . -type f -name maven-metadata* -exec rm -f "{}" \;
          find . -type f -name "_remote.repositories*" -exec rm -f "{}" \;
          zip -r -9 ../../central-bundle.zip .
          popd

          # Build samm-cli executable jar
          unset JAVA_TOOL_OPTIONS
          mvn -B -pl tools/samm-cli clean verify -Dmaven.wagon.httpconnectionManager.ttlSeconds=60

          # Build native executable with warp-packer
          bundle="samm-cli-${RELEASE_VERSION}"
          mkdir -p ${bundle}/runtime
          curl -Lo jre.tar.gz https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.1%2B8/OpenJDK25U-jre_x64_linux_hotspot_25.0.1_8.tar.gz
          tar -xvf jre.tar.gz
          mv ./jdk-25.0.1+8-jre ./${bundle}/runtime/jre
          # The jar must not sit in or next to a directory that ClassGraph probes for
          # JRE/ext jars (java.home and its parent), hence the jre lives under runtime/
          cp tools/samm-cli/target/samm-cli-${RELEASE_VERSION}.jar ./${bundle}/
          cp tools/samm-cli/scripts/linux/run.sh ./${bundle}/
          chmod +x ./${bundle}/run.sh

          curl -Lo warp-packer https://github.com/kirbylink/warp/releases/download/v1.3.0/linux-x64.warp-packer
          if [ "$(sha256sum warp-packer | cut -d' ' -f1)" != "add6f937db8b9207d1bb81a900ef609f41875f07c6c8b2d596bfc134c8f285ff" ]; then
            echo "Warp packer checksum does not match"
            exit 1
          fi
          chmod +x warp-packer

          ./warp-packer pack --arch linux-x64 --input-dir ${bundle} --exec run.sh --output samm --prefix samm-cli-${RELEASE_VERSION}
          chmod a+x samm
          tar cfvz samm-cli-${RELEASE_VERSION}-linux-x86_64.tar.gz samm
          cp tools/samm-cli/target/samm-cli-*.jar .
        env:
          PGP_KEY_PASSWORD: ${{ secrets.PGP_KEY_PASSWORD }}

      - name: Upload staging directory and Linux binary
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7.0.2
        with:
          name: linux-artifacts
          path: |
            central-bundle.zip
            samm-cli-${{ env.RELEASE_VERSION }}-linux-x86_64.tar.gz
            samm-cli-${{ env.RELEASE_VERSION }}.jar
            samm-cli-${{ env.RELEASE_VERSION }}-javadoc.jar
            samm-cli-${{ env.RELEASE_VERSION }}-sources.jar
            samm-cli-${{ env.RELEASE_VERSION }}-tests.jar

  build-macos:
    name: Mac build
    needs: [check-preconditions]
    runs-on: macos-15-intel
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          submodules: recursive
          persist-credentials: false

      - name: Setup JDK
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0
        with:
          java-version: '25.0.1'
          distribution: 'temurin'

      - name: Cache Maven packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Build and run tests
        run: |
          set -x
          export MAVEN_OPTS="-Xmx4096m"
          export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
          # Required for reactor dependencies
          mvn clean install -DskipTests -Dmaven.javadoc.skip=true -Dskip.maven.failsafe
          mvn versions:set -DnewVersion=${RELEASE_VERSION}
          mvn versions:commit
          # Actual build of core SDK
          mvn -B -pl '!org.eclipse.esmf:samm-cli' clean install -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
          # Build samm-cli executable jar
          unset JAVA_TOOL_OPTIONS
          mvn -B -pl tools/samm-cli clean verify -Dmaven.wagon.httpconnectionManager.ttlSeconds=60

          # Build native binary
          bundle="samm-cli-${RELEASE_VERSION}"
          mkdir -p ${bundle}/runtime
          curl -Lo jre.tar.gz https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.1%2B8/OpenJDK25U-jre_x64_mac_hotspot_25.0.1_8.tar.gz
          tar -xvf jre.tar.gz
          mv ./jdk-25.0.1+8-jre ./${bundle}/runtime/jre
          # The jar must not sit in or next to a directory that ClassGraph probes for
          # JRE/ext jars (java.home and its parent), hence the jre lives under runtime/
          cp tools/samm-cli/target/samm-cli-${RELEASE_VERSION}.jar ./${bundle}/
          cp tools/samm-cli/scripts/macos/run.sh ./${bundle}/
          chmod +x ./${bundle}/run.sh

          curl -Lo warp-packer https://github.com/kirbylink/warp/releases/download/v1.3.0/macos-x64.warp-packer
          if [ "$(shasum -a 256 warp-packer | cut -d' ' -f1)" != "311bd238d087ea92f486d3d754a0f11826d9bd49d6f8ae849e5d6f6089a2e9c9" ]; then
            echo "Warp packer checksum does not match"
            exit 1
          fi
          chmod +x warp-packer
          xattr -d com.apple.quarantine warp-packer || true

          ./warp-packer pack --arch macos-x64 --input-dir ${bundle} --exec run.sh --output samm --prefix samm-cli-${RELEASE_VERSION}
          chmod a+x samm
          tar cfvz samm-cli-${RELEASE_VERSION}-macos-x86_64.tar.gz samm
        shell: bash

      - name: Upload Mac binary
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7.0.2
        with:
          name: mac-artifacts
          path: |
            samm-cli-${{ env.RELEASE_VERSION }}-macos-x86_64.tar.gz

  # The Windows build will build the Windows-specific samm-cli
  # and upload the binary to the build artifacts
  build-windows:
    name: Windows build
    needs: [check-preconditions]
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - name: Enable long paths for checkout (Windows)
        shell: pwsh
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}\.gitconfig
        run: |
          git config --global core.longpaths true
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}\.gitconfig
        with:
          submodules: recursive
          persist-credentials: false

      - name: Setup JDK
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0
        with:
          java-version: '25.0.1'
          distribution: 'temurin'

      - name: Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0
        with:
          python-version: '3.13'
      - run: pip install pefile

      - name: Cache Maven packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Build and run tests
        run: |
          set -x
          export MAVEN_OPTS="-Xmx4096m"
          export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"

          mvn clean install -DskipTests -Dmaven.javadoc.skip=true -Dskip.maven.failsafe
          mvn versions:set -DnewVersion=${RELEASE_VERSION}
          mvn versions:commit

          # Actual build of core SDK
          mvn -B -pl '!org.eclipse.esmf:samm-cli' clean install -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
          # Build samm-cli executable jar
          unset JAVA_TOOL_OPTIONS
          mvn -B -pl tools/samm-cli clean verify -Dmaven.wagon.httpconnectionManager.ttlSeconds=60

          # Build native executable
          bundle="samm-cli-${RELEASE_VERSION}"
          mkdir -p ${bundle}/runtime
          curl -Lo jre.zip https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.1%2B8/OpenJDK25U-jre_x64_windows_hotspot_25.0.1_8.zip
          7z x jre.zip
          mv ./jdk-25.0.1+8-jre ./${bundle}/runtime/jre
          # The jar must not sit in or next to a directory that ClassGraph probes for
          # JRE/ext jars (java.home and its parent), hence the jre lives under runtime/
          cp tools/samm-cli/target/samm-cli-${RELEASE_VERSION}.jar ./${bundle}/
          cp tools/samm-cli/scripts/windows/run.bat ./${bundle}/

          curl -Lo warp-packer.exe https://github.com/kirbylink/warp/releases/download/v1.3.0/windows-x64.warp-packer.exe
          if [ "$(sha256sum warp-packer.exe | cut -d' ' -f1)" != "483726e0eb10a43167c03c8e4f27a2901741affd245e5ec8ed45509f9dcd7a8a" ]; then
            echo "Warp packer checksum does not match"
            exit 1
          fi

          ./warp-packer.exe pack --arch windows-x64 --input-dir ${bundle} --exec run.bat --output samm.exe --prefix samm-cli-${RELEASE_VERSION}
          python3 tools/samm-cli/scripts/windows/set_cui_flag.py samm.exe
        shell: bash

      - name: Upload Windows binary
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7.0.2
        with:
          name: windows-artifacts
          path: |
            samm.exe

  release:
    name: Release
    needs: [build-linux, build-windows, build-macos]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: read
      issues: write
      pull-requests: write
    steps:
      # Need to checkout here too, so that we have the pom.xml
      # with the deployment info available
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: true

      # Required to have Maven settings.xml set up correctly
      - name: Set up JDK 25
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0
        with:
          distribution: 'temurin'
          java-version: '25.0.1'
          server-id: central
          # The following variables are defined in https://github.com/eclipse-esmf/.eclipsefdn/blob/main/otterdog/eclipse-esmf.jsonnet
          server-username: CENTRAL_SONATYPE_TOKEN_USERNAME
          server-password: CENTRAL_SONATYPE_TOKEN_PASSWORD
          overwrite-settings: false

      - name: Setup JDK
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0
        with:
          java-version: '25.0.1'
          distribution: 'temurin'

      - name: Fetch Linux Artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2
        with:
          name: linux-artifacts

      - name: Fetch Mac Artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2
        with:
          name: mac-artifacts

      - name: Set versions
        continue-on-error: true
        run: |
          release_branch_name=${RELEASE_VERSION%.*}.x
          echo "release_branch_name=$release_branch_name" >> $GITHUB_ENV

          # Set version in pom.xml files
          mvn -B clean install -DskipTests -Dmaven.javadoc.skip=true -Dskip.maven.failsafe
          mvn -B versions:set -DnewVersion=${RELEASE_VERSION}
          mvn -B versions:commit
          # Set version in Antora module
          yq eval -i ".version = \"${RELEASE_VERSION}\"" documentation/developer-guide/antora.yml

      - name: Commit version changes and push to upstream repository
        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          branch: ${{ env.release_branch_name }}
          commit_user_name: github-actions
          commit_user_email: github-actions@github.com
          commit_author: 'Author <actions@github.com>'
          file_pattern: 'documentation/developer-guide/antora.yml pom.xml */pom.xml */*/pom.xml'

      # Full release: Github
      - name: "Create Github release (full)"
        if: ${{ !contains( env.RELEASE_VERSION, '-M' ) }}
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          body: "Release version ${{ env.RELEASE_VERSION }}."
          tag_name: v${{ env.RELEASE_VERSION }}
          target_commitish: ${{ env.release_branch_name }}
          draft: false
          prerelease: false
          files: |
            samm-cli-${{ env.RELEASE_VERSION }}-linux-x86_64.tar.gz
            samm-cli-${{ env.RELEASE_VERSION }}-macos-x86_64.tar.gz
            samm-cli-*.jar
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN  }}

      - name: "Notify issues of release their fix is contained in"
        if: ${{ !contains( env.RELEASE_VERSION, '-M' ) }}
        continue-on-error: true
        uses: apexskier/github-release-commenter@e7813a9625eabd79a875b4bc4046cfcae377ab34 # v1.4.1
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          comment-template: |
            Release {release_link} addresses this.

      # Sign SAMM-CLI Windows executable
      - name: Get Artifact ID (Windows)
        shell: bash
        run: |
          # Get the list of artifacts for the specified workflow run
          response=$(curl -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/${{ github.repository_owner }}/$(echo '${{ github.repository }}' | cut -d'/' -f2)/actions/runs/${{ github.run_id }}/artifacts")

          # Filter out the ID of the artifact with a name that contains "windows"
          artifact_id=$(echo "$response" | jq -r '.artifacts[] | select(.name | contains("windows-artifacts")) | .id')

          # Save the artifact ID in an environment variable
          echo "ARTIFACT_ID=$artifact_id" >> $GITHUB_ENV
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Commit Artifact URL and version changes and push to pre release branch for Jenkins (Windows)
        shell: bash
        run: |
          ARTIFACT_URL_WIN="https://api.github.com/repos/eclipse-esmf/esmf-sdk/actions/artifacts/$ARTIFACT_ID/zip"
          BRANCH_NAME="pre_release_configuration"

          echo "artifact_url_win=$ARTIFACT_URL_WIN" > parameters.txt
          echo "version=${RELEASE_VERSION}" >> parameters.txt

          git config --global user.email "github-actions@github.com"
          git config --global user.name "github-actions"
          git checkout -b $BRANCH_NAME
          git add parameters.txt
          git commit -m "Add parameters.txt with artifact_url_win and version"
          git push origin $BRANCH_NAME
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Trigger Jenkins Job, for signing executable
        shell: bash
        run: |
          DATA='{"repository": {"url": "https://github.com/eclipse-esmf/esmf-sdk", "html_url": "https://github.com/eclipse-esmf/esmf-sdk", "owner": { "name": "ESMF"}}, "pusher": { "name": "GitHub Action", "email": "esmf-dev@eclipse.org"}}'
          SHA1="$(echo -n "${DATA}" | openssl dgst -sha1 -hmac "${WEBHOOK_SECRET}" | sed 's/SHA1(stdin)= //')"
          curl -X POST https://ci.eclipse.org/esmf/github-webhook/ -H "Content-Type: application/json" -H "X-GitHub-Event: push" -H "X-Hub-Signature: sha1=${SHA1}" -d "${DATA}"

      - name: Display contents of uploaded bundle
        run: |
          ls -lh central-bundle.zip
          echo "Contents of central-bundle.zip:"
          unzip -l central-bundle.zip

      # Full release: Maven Central
      - name: Release to Maven Central
        if: ${{ !contains( env.RELEASE_VERSION, '-M' ) }}
        run: |
          token_header=$(printf "$CENTRAL_USERNAME:$CENTRAL_TOKEN" | base64)
          curl --request POST \
          --header "Authorization: Bearer $token_header" \
          --form bundle=@central-bundle.zip \
          https://central.sonatype.com/api/v1/publisher/upload
        env:
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          CENTRAL_TOKEN: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}

      # Milestone release: Write settings to deploy to Github repo
      - name: Write settings.xml
        if: contains( env.RELEASE_VERSION, '-M' )
        uses: DamianReeves/write-file-action@0a7fcbe1960c53fc08fe789fa4850d24885f4d84 # v1.2
        with:
          path: settings.xml
          contents: |
            <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                      xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                                      https://maven.apache.org/xsd/settings-1.0.0.xsd">
               <servers>
                  <server>
                     <id>github</id>
                     <configuration>
                        <httpHeaders>
                           <property>
                              <name>Authorization</name>
                              <value>Bearer ${env.GITHUB_TOKEN}</value>
                           </property>
                        </httpHeaders>
                     </configuration>
                  </server>
                  <server>
                     <id>gpg.passphrase</id>
                     <passphrase>${env.PGP_KEY_PASSWORD}</passphrase>
                  </server>
               </servers>
            </settings>
          write-mode: overwrite

      # Milestone release: Maven deploy to Github
      - name: Publish to Github
        if: contains( env.RELEASE_VERSION, '-M' )
        run: mvn -s ./settings.xml -B clean -pl '!documentation,!tools/samm-cli' deploy -DskipTests -Dskip.maven.failsafe -Pmilestone-build,sign
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN  }}
          PGP_KEY_PASSWORD: ${{ secrets.PGP_KEY_PASSWORD }}

      # Milestone release: Github
      - name: "Create Github release (milestone)"
        if: contains( env.RELEASE_VERSION, '-M' )
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
        with:
          body: "Release version ${{ env.RELEASE_VERSION }}."
          tag_name: v${{ env.RELEASE_VERSION }}
          target_commitish: ${{ env.release_branch_name }}
          draft: false
          prerelease: true
          files: |
            samm-cli-${{ env.RELEASE_VERSION }}-linux-x86_64.tar.gz
            samm-cli-${{ env.RELEASE_VERSION }}-macos-x86_64.tar.gz
            samm-cli-*.jar
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN  }}