release.yml

name: Release

on:
  push:
    tags:
    - "[0-9]+.[0-9]+.[0-9]+"
    - "[0-9]+.[0-9]+.[0-9]+-RC[0-9]+"
  workflow_dispatch:
    inputs:
      tag:
        description: "Git tag to release from"
        required: true
        type: string

env:
  GRADLE_OPTS: -Dorg.gradle.daemon=false
  ORT_SERVER_VERSION: ${{ inputs.tag || github.ref_name }}

jobs:
  release-notes:
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout Repository
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        ref: ${{ env.ORT_SERVER_VERSION }}
        fetch-depth: 0

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
      with:
        dependency-graph: generate-and-submit

    - name: Generate Release Notes
      run: ./gradlew -q printChangeLog > RELEASE_NOTES.md

    - name: Upload Release Notes
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: release-notes
        path: RELEASE_NOTES.md
        retention-days: 7

  publish-server:
    if: github.repository == 'eclipse-apoapsis/ort-server'
    permissions:
      contents: write
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout Repository
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        ref: ${{ env.ORT_SERVER_VERSION }}
        fetch-depth: 0

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
      with:
        dependency-graph: generate-and-submit

    - name: Publish to OSSRH
      env:
        GITHUB_DEPENDENCY_GRAPH_REF: refs/heads/main
        ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
        ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
        ORG_GRADLE_PROJECT_signAllPublications: true
        ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.ORG_GPG_PRIVATE_KEY }}
        ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.ORG_GPG_SUBKEY_ID }}
        ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.ORG_GPG_PASSPHRASE }}
        ORG_GRADLE_PROJECT_SONATYPE_CONNECT_TIMEOUT_SECONDS: 300
        ORG_GRADLE_PROJECT_SONATYPE_CLOSE_TIMEOUT_SECONDS: 3600
      run: ./gradlew --stacktrace publishAndReleaseToMavenCentral

  build-cli:
    strategy:
      matrix:
        target:
        - name: "Linux x64"
          os: ubuntu-24.04
          task: :cli:linkReleaseExecutableLinuxX64
          artifact: osc-cli-linux-x64
          buildPath: cli/build/bin/linuxX64/releaseExecutable/osc.kexe
          binName: osc
          archiveExt: tar.gz
        - name: "macOS arm64"
          os: macos-15
          task: :cli:linkReleaseExecutableMacosArm64
          artifact: osc-cli-macos-arm64
          buildPath: cli/build/bin/macosArm64/releaseExecutable/osc.kexe
          binName: osc
          archiveExt: tar.gz
        - name: "macOS x64"
          os: macos-15-intel
          task: :cli:linkReleaseExecutableMacosX64
          artifact: osc-cli-macos-x64
          buildPath: cli/build/bin/macosX64/releaseExecutable/osc.kexe
          binName: osc
          archiveExt: tar.gz
        - name: "Windows x64"
          os: windows-2025
          task: :cli:linkReleaseExecutableMingwX64
          artifact: osc-cli-windows-x64
          buildPath: cli/build/bin/mingwX64/releaseExecutable/osc.exe
          binName: osc.exe
          archiveExt: zip
    runs-on: ${{ matrix.target.os }}
    steps:
    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        ref: ${{ env.ORT_SERVER_VERSION }}
        fetch-depth: 0

    - name: Setup Java
      if: runner.os == 'Windows'
      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
      with:
        distribution: temurin
        java-version: 25

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
      with:
        dependency-graph: generate-and-submit

    - name: Build CLI
      run: ./gradlew --stacktrace ${{ matrix.target.task }}

    - name: Rename binaries
      shell: bash
      run: |
        mkdir -p ${{ matrix.target.artifact }}
        mv ${{ matrix.target.buildPath }} ${{ matrix.target.artifact }}/${{ matrix.target.binName }}

    # Compress the binaries to reduce the size of the artifacts, to keep `osc` as the binary name, and to ensure that
    # the executable permissions are preserved.
    - name: Compress binaries
      shell: bash
      run: |
        if [ "$RUNNER_OS" == "Windows" ]; then
          # On Windows, "bash" is "Git Bash" which does not come with the "zip" tool, so use a PowerShell command.
          powershell Compress-Archive -Path ${{ matrix.target.artifact }}/${{ matrix.target.binName }} -DestinationPath ${{ matrix.target.artifact }}.${{ matrix.target.archiveExt }}
        else
          tar -czf ${{ matrix.target.artifact }}.${{ matrix.target.archiveExt }} -C ${{ matrix.target.artifact }} ${{ matrix.target.binName }}
        fi

    - name: Upload binaries
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ${{ matrix.target.artifact }}
        path: ${{ matrix.target.artifact }}.${{ matrix.target.archiveExt }}
        retention-days: 7

  create-release:
    needs: [build-cli, publish-server, release-notes]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
    - name: Checkout Repository
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        ref: ${{ env.ORT_SERVER_VERSION }}
        fetch-depth: 0

    - name: Download Artifacts
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        path: artifacts/

    - name: Create checksums
      shell: bash
      run: |
        shasum --algorithm 256 ./artifacts/osc-cli-*/*.{tar.gz,zip} | sed 's|./artifacts/osc-cli-[^/]*/||' > checksums.txt

    - name: Create GitHub Release
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        if [[ "$ORT_SERVER_VERSION" =~ -RC[0-9]+ ]]; then
          PRERELEASE_ARG="--prerelease"
        fi

        gh release create $ORT_SERVER_VERSION --notes-file ./artifacts/release-notes/RELEASE_NOTES.md $PRERELEASE_ARG \
          './artifacts/osc-cli-linux-x64/osc-cli-linux-x64.tar.gz#osc-cli-linux-x64' \
          './artifacts/osc-cli-macos-arm64/osc-cli-macos-arm64.tar.gz#osc-cli-macos-arm64' \
          './artifacts/osc-cli-macos-x64/osc-cli-macos-x64.tar.gz#osc-cli-macos-x64' \
          './artifacts/osc-cli-windows-x64/osc-cli-windows-x64.zip#osc-cli-windows-x64' \
          'checksums.txt#checksums'