release.yaml

name: Release
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g. 1.2.3, without leading v)'
        required: true

jobs:
  package:
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve version
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            # Strip leading 'v' from tag name
            VERSION="${{ github.ref_name }}"
            VERSION="${VERSION#v}"
          fi
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT

      - name: Set up temurin-jdk-17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Setup Android SDK + NDK r28
        uses: android-actions/setup-android@v3
        with:
          packages: ndk;28.0.13004108

      - name: Check secrets
        id: check-secrets
        run: |
          echo "has_keystore=${{ secrets.ANDROID_JKS != '' && secrets.ANDROID_JKS_SHA256 != '' && secrets.ANDROID_JKS_PASSWORD != '' }}" >> $GITHUB_OUTPUT
          echo "has_maven=${{ secrets.MAVEN_CENTRAL_USERNAME != '' && secrets.MAVEN_CENTRAL_PASSWORD != '' }}" >> $GITHUB_OUTPUT
          echo "has_gpg=${{ secrets.GPG_PUBLIC_KEY != '' && secrets.GPG_PRIVATE_KEY != '' }}" >> $GITHUB_OUTPUT

      - name: Inflate Keystore
        if: steps.check-secrets.outputs.has_keystore == 'true'
        env:
          ANDROID_JKS: ${{ secrets.ANDROID_JKS }}
          ANDROID_JKS_SHA256: ${{ secrets.ANDROID_JKS_SHA256 }}
        run: |
          JKS_FILE="$(mktemp -p "${RUNNER_TEMP}" -d)/android.jks"
          echo -n "$ANDROID_JKS" | base64 --decode > "$JKS_FILE"
          if [ "${ANDROID_JKS_SHA256} *-" != "$(cat $JKS_FILE | sha256sum -b)" ]; then
            echo "::error::Keystore SHA256 mismatch — secret may be corrupted or truncated"
            exit 1
          fi
          echo "ANDROID_JKS_FILE=$JKS_FILE" >> $GITHUB_ENV

      - name: Build
        env:
          ANDROID_JKS_PASSWORD: ${{ secrets.ANDROID_JKS_PASSWORD }}
        run: ./gradlew :lib:assembleRelease

      - name: Verify 16 KB page alignment
        run: |
          failed=0
          for so in lib/build/intermediates/cxx/RelWithDebInfo/*/obj/*.so; do
            echo "Checking $(basename "$so")..."
            while read -r line; do
              align=$(echo "$line" | grep -oP 'Align: 0x\K[0-9a-fA-F]+')
              if [ "$align" != "4000" ]; then
                echo "FAIL: $(basename "$so") has alignment 0x$align (expected 0x4000)"
                failed=1
              fi
            done < <(readelf -lL "$so" | grep LOAD)
          done
          exit $failed

      - name: Upload lib artifacts
        uses: actions/upload-artifact@v4
        with:
          name: lib
          path: lib/build/outputs/aar/*-release.aar

      - name: Stage library artifacts
        run: >
          ./gradlew :lib:publishReleasePublicationToStagingDeployRepository
          -Puvccamera.version=${{ steps.version.outputs.VERSION }}

      - name: Publish to Maven Central
        if: >-
          steps.check-secrets.outputs.has_maven == 'true'
          && steps.check-secrets.outputs.has_gpg == 'true'
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JRELEASER_MAVENCENTRAL_SONATYPE_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          JRELEASER_MAVENCENTRAL_SONATYPE_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: >
          ./gradlew jreleaserDeploy --no-configuration-cache
          -Puvccamera.version=${{ steps.version.outputs.VERSION }}

      - name: Publish to GitHub Packages
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >
          ./gradlew :lib:publishReleasePublicationToGitHubPackagesRepository
          -Puvccamera.version=${{ steps.version.outputs.VERSION }}