java.yml

name: Java

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

defaults:
  run:
    shell: bash

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  compile-bindings:
    name: Compile native bindings
    strategy:
      matrix:
        # macos-15-intel is x86, macos-latest is arm64
        os:
          [
            ubuntu-22.04,
            ubuntu-24.04-arm,
            windows-latest,
            windows-11-arm,
            macos-15-intel,
            macos-latest,
          ]
      fail-fast: false

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v6
      - name: Cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
      - name: Compile
        run: cargo build --locked --package sysand-java --release
      - uses: actions/setup-python@v6
        if: ${{ matrix.os == 'ubuntu-22.04' }}
        with:
          python-version: 3.14
      - name: Create version.txt
        if: ${{ matrix.os == 'ubuntu-22.04' }}
        run: python bindings/java/scripts/java-builder.py create-version-file
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}
      - name: Upload native bindings
        uses: actions/upload-artifact@v5
        with:
          name: native-bindings-${{ matrix.os }}
          path: |
            target/release/*.so
            target/release/*.dylib
            target/release/*.dll
          retention-days: 5
      - name: Upload version.txt
        uses: actions/upload-artifact@v5
        if: ${{ matrix.os == 'ubuntu-22.04' }}
        with:
          name: version
          path: version.txt
          if-no-files-found: error
          retention-days: 5

  build-jar:
    name: Build Java JAR
    runs-on: ubuntu-latest
    needs: [compile-bindings]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: 3.14
      - uses: actions/setup-java@v5
        with:
          distribution: "temurin"
          java-version: "21"
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Download version.txt
        uses: actions/download-artifact@v6
        with:
          name: version
      - name: Download native bindings
        uses: actions/download-artifact@v6
        with:
          path: native-bindings
      - name: Debugging
        run: ls -la native-bindings/*
      - name: Build JAR
        run: |
          python bindings/java/scripts/java-builder.py build \
              --use-existing-native-libs native-bindings \
              --use-release-build \
              ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE && '--sign-artifacts' || '' }}
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}
      - name: Build Sysand Maven plugin and run integration tests
        run: |
          python bindings/java/scripts/java-builder.py build-plugin \
              ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE && '--sign-artifacts' || '' }}
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}
      - name: Upload JARs
        uses: actions/upload-artifact@v5
        with:
          name: jars
          path: target/java
          retention-days: 5
      - name: Upload Maven plugin JAR
        uses: actions/upload-artifact@v5
        with:
          name: maven-plugin-jar
          path: target/java-plugin
          retention-days: 5
          # We need to include hidden files because integration tests use
          # .meta.json and .project.json files.
          include-hidden-files: true

  test-jar:
    name: Test Java JAR
    strategy:
      matrix:
        # macos-13 is x86, macos-latest is arm64
        os:
          [
            ubuntu-22.04,
            ubuntu-24.04-arm,
            windows-latest,
            windows-11-arm,
            macos-15-intel,
            macos-latest,
          ]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    needs: [build-jar]
    steps:
      - uses: actions/checkout@v6
      - name: Download JARs
        uses: actions/download-artifact@v6
        with:
          name: jars
          path: target/java
      - name: Download version.txt
        uses: actions/download-artifact@v6
        with:
          name: version
      - name: Debugging
        run: |
          find . -iname "*.jar"
          ls -la *
          ls -la target/*
          ls -la target/java/*
          ls -la target/java/target/*
      - uses: actions/setup-python@v6
        with:
          python-version: 3.14
      - uses: actions/setup-java@v5
        with:
          distribution: "temurin"
          java-version: "21"
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Test Java JAR
        run: python bindings/java/scripts/java-builder.py test
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}

  nightly-release:
    name: Nightly Release
    runs-on: ubuntu-latest
    needs: [build-jar, test-jar]
    if: ${{ github.ref == 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/') }}
    permissions:
      # Use to sign the release artifacts
      id-token: write
      # Used to upload release artifacts
      contents: write
      # Used to generate artifact attestation
      attestations: write
    steps:
      - uses: actions/checkout@v6
      - name: Download native bindings
        uses: actions/download-artifact@v6
        with:
          name: jars
          path: target/java
      - name: Download Maven plugin JAR
        uses: actions/download-artifact@v6
        with:
          name: maven-plugin-jar
          path: target/java-plugin
      - name: Download version.txt
        uses: actions/download-artifact@v6
        with:
          name: version
      - name: Debugging
        run: |
          find . -iname "*.jar"
          find target/java-plugin/target/it/
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: "target/java/target/*.jar"
      - uses: actions/setup-python@v6
        with:
          python-version: 3.14
      - uses: actions/setup-java@v5
        with:
          distribution: "temurin"
          java-version: "21"
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Deploy Java bindings
        run: python bindings/java/scripts/java-builder.py deploy
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_TOKEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}