code-maven_java-release.yml

# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
# SPDX-License-Identifier: Apache-2.0

name: code-maven-java-release
run-name: Publish Java release to Maven Central and GitHub from ${{ github.event_name }}

on:
  pull_request:
    types: [closed]
  workflow_dispatch:
    inputs:
      release_type:
        description: Release type to use
        required: true
        default: release-type/minor
        type: choice
        options:
          - release-type/hotfix
          - release-type/multi-hotfix
          - release-type/major
          - release-type/minor
          - release-type/patch

permissions:
  actions: read
  contents: read

concurrency:
  group: code-maven-java-release-${{ github.repository }}-${{ github.event.pull_request.base.ref || github.ref_name }}
  cancel-in-progress: false

jobs:
  release-core:
    name: Prepare and Build Release
    if: >-
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository
    uses: ./.github/workflows/code-maven_java-release-core.yml
    with:
      phase: prepare
      release_type: ${{ inputs.release_type }}
    secrets:
      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

  publish-maven-central:
    name: Publish ${{ matrix.release.tag }} to Maven Central
    needs: release-core
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    environment: maven-central
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        release: ${{ fromJSON(needs.release-core.outputs.releases) }}
    env:
      MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
      MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
      CI_GPG_SECRET_KEY: ${{ secrets.CI_GPG_SECRET_KEY }}
      CI_GPG_SECRET_KEY_PASSWORD: ${{ secrets.CI_GPG_SECRET_KEY_PASSWORD }}
      WORKING_DIRECTORY: ${{ vars.WORKING_DIRECTORY }}
      ASDF_BRANCH_VERSION: '0.18.0'
    steps:
      - name: Check out release commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ needs.release-core.outputs.release_commit }}

      - name: Resolve governed project type
        shell: bash
        run: |
          set -euo pipefail
          descriptor="$GITHUB_WORKSPACE/.github/inditextech-ci-java.json"
          if [[ ! -f "$descriptor" ]]; then
            echo "::error title=Missing descriptor::.github/inditextech-ci-java.json not found."
            exit 1
          fi
          project_type="$(jq -r '.project_type // empty' "$descriptor")"
          case "$project_type" in
            single|monorepo) ;;
            *)
              echo "::error title=Invalid project type::Descriptor .project_type must be single or monorepo."
              exit 1
              ;;
          esac
          workdir="${WORKING_DIRECTORY:-$(jq -r '.working_directory // empty' "$descriptor")}"
          case "$workdir" in
            ""|/*|..|../*|*/..|*/../*)
              echo "::error title=Invalid working directory::WORKING_DIRECTORY must be a non-empty relative repository path." >&2
              exit 1
              ;;
          esac
          if [[ ! -d "$workdir" ]]; then
            echo "::error title=Missing working directory::'${workdir}' is not a directory in this checkout." >&2
            exit 1
          fi
          echo "WORKING_DIRECTORY=${workdir}" >> "$GITHUB_ENV"
          echo "PROJECT_TYPE=$project_type" >> "$GITHUB_ENV"

      - name: Resolve release lifecycle
        id: lifecycle
        shell: bash
        run: |
          set -euo pipefail
          descriptor="$GITHUB_WORKSPACE/.github/inditextech-ci-java.json"
          mode="$(jq -r '.release.lifecycle // "govern-inject"' "$descriptor")"
          case "$mode" in
            govern-inject|delegated) ;;
            *)
              echo "::error title=Invalid release lifecycle::release.lifecycle must be govern-inject or delegated."
              exit 1
              ;;
          esac
          echo "mode=$mode" >> "$GITHUB_OUTPUT"

      - name: Set up workflow Java
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin
          java-version: '25.0.2+10.0.LTS'
          cache: maven
          cache-dependency-path: ${{ env.WORKING_DIRECTORY }}/**/pom.xml

      - name: Read governed tool versions
        id: tool-versions
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          if grep -Evq '^[a-zA-Z0-9_-]+ [a-zA-Z0-9._+-]+$' .tool-versions; then
            echo "::error title=Invalid tool-versions::${WORKING_DIRECTORY}/.tool-versions is malformed."
            exit 1
          fi
          {
            echo "tool_versions<<EOF"
            cat .tool-versions
            echo
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up asdf-managed Java
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1
        with:
          tool_versions: ${{ steps.tool-versions.outputs.tool_versions }}
          asdf_version: ${{ env.ASDF_BRANCH_VERSION }}

      - name: Resolve build JDK from .tool-versions
        id: jdk
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          echo "java_home=$(asdf where java)" >> "$GITHUB_OUTPUT"

      - name: Deploy release to Maven Central
        if: steps.lifecycle.outputs.mode != 'delegated'
        env:
          JAVA_HOME: ${{ steps.jdk.outputs.java_home }}
        uses: InditexTech/gh-actions/maven-central@ab7978dfa118776238a6982e445707a1ae6c0668 # v1.2.0
        with:
          working-directory: ${{ env.WORKING_DIRECTORY }}
          project-type: ${{ env.PROJECT_TYPE }}
          packages: ${{ env.PROJECT_TYPE == 'monorepo' && join(matrix.release.packages, ',') || '' }}
          auto-publish: 'true'
          extra-maven-arguments: -DskipITs

      - name: Perform delegated release
        if: steps.lifecycle.outputs.mode == 'delegated'
        env:
          JAVA_HOME: ${{ steps.jdk.outputs.java_home }}
        uses: InditexTech/gh-actions/maven-central@ab7978dfa118776238a6982e445707a1ae6c0668 # v1.2.0
        with:
          working-directory: ${{ env.WORKING_DIRECTORY }}
          project-type: ${{ env.PROJECT_TYPE }}
          packages: ${{ env.PROJECT_TYPE == 'monorepo' && join(matrix.release.packages, ',') || '' }}
          auto-publish: 'true'
          extra-maven-arguments: |
            -DskipEnforceSnapshots
            -Dmaven.deploy.skip=false
            -DskipITs

  finalize-release:
    name: Finalize release (promote + next dev)
    needs: [release-core, publish-maven-central]
    if: always() && needs.release-core.result == 'success'
    uses: ./.github/workflows/code-maven_java-release-core.yml
    with:
      phase: finalize
      promote: ${{ needs.publish-maven-central.result == 'success' }}
      release_commit: ${{ needs.release-core.outputs.release_commit }}
      promote_commit: ${{ needs.release-core.outputs.promote_commit }}
      releases: ${{ needs.release-core.outputs.releases }}
      expected_ref: ${{ needs.release-core.outputs.expected_ref }}
      staging_ref: ${{ needs.release-core.outputs.staging_ref }}
      staged_tag_ref: ${{ needs.release-core.outputs.staged_tag_ref }}
    secrets:
      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

  github-release:
    name: Create GitHub Release ${{ matrix.release.tag }}
    needs: [release-core, publish-maven-central, finalize-release]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        release: ${{ fromJSON(needs.release-core.outputs.releases) }}
    steps:
      - name: Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write

      - name: Download release distributions
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: java-distributions-${{ matrix.release.tag }}
          path: dist

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RELEASE_TAG: ${{ matrix.release.tag }}
          RELEASE_VERSION: ${{ matrix.release.version }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          assets=(dist/*)
          if [[ ${#assets[@]} -eq 0 ]]; then
            echo "::error title=Missing distributions::The release artifact is empty."
            exit 1
          fi

          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" "${assets[@]}" \
              --repo "$GITHUB_REPOSITORY" \
              --clobber
          else
            gh release create "$RELEASE_TAG" "${assets[@]}" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$RELEASE_VERSION" \
              --generate-notes
          fi