publish-snapshot.yml

name: Publish Snapshot

on:
  workflow_run:
    workflows: [Build Snapshot]
    types:
      - completed
    branches:
      - main

permissions:
  contents: read # to fetch code (actions/checkout)

env:
  LANG: 'en_US.UTF-8'

jobs:
  check-version:
    # only run in the official pmd repo, where we have access to the secrets and not on forks
    # and only run for _successful_ push workflow runs on branch "main".
    if: ${{ github.repository == 'pmd/pmd'
            && contains(fromJSON('["push", "workflow_dispatch", "schedule"]'), github.event.workflow_run.event)
            && github.event.workflow_run.head_branch == 'main'
            && github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    outputs:
      PMD_VERSION: ${{ steps.version.outputs.PMD_VERSION }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
         ref: main
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Determine Version
        id: version
        run: |
          PMD_VERSION=$(./mvnw --batch-mode --no-transfer-progress help:evaluate -Dexpression=project.version -q -DforceStdout)
          echo "Determined PMD_VERSION=$PMD_VERSION"
          if [[ "$PMD_VERSION" != *-SNAPSHOT ]]; then
            echo "::error ::PMD_VERSION=$PMD_VERSION is not a snapshot version, aborting."
            exit 1
          fi
          echo "PMD_VERSION=$PMD_VERSION" >> "$GITHUB_OUTPUT"
      - name: Add Job Summary
        env:
          WORKFLOW_RUN_DISPLAY_TITLE: ${{ github.event.workflow_run.display_title }}
          WORKFLOW_RUN_NAME: ${{ github.event.workflow_run.name }}
          WORKFLOW_RUN_NUMBER: ${{ github.event.workflow_run.run_number }}
          WORKFLOW_RUN_HTML_URL: ${{ github.event.workflow_run.html_url }}
          VERSION: ${{ steps.version.outputs.PMD_VERSION }}
          BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          echo "### Run Info" >> "${GITHUB_STEP_SUMMARY}"
          echo "Building Version: ${VERSION}" >> "${GITHUB_STEP_SUMMARY}"
          echo "" >> "${GITHUB_STEP_SUMMARY}"
          echo "Branch: ${BRANCH}" >> "${GITHUB_STEP_SUMMARY}"
          echo "" >> "${GITHUB_STEP_SUMMARY}"
          echo "Called by [${WORKFLOW_RUN_DISPLAY_TITLE} (${WORKFLOW_RUN_NAME} #${WORKFLOW_RUN_NUMBER})](${WORKFLOW_RUN_HTML_URL})" >> "${GITHUB_STEP_SUMMARY}"
          echo "" >> "${GITHUB_STEP_SUMMARY}"

  deploy-to-maven-central:
    needs: check-version
    # use environment maven-central, where secrets are configured for MAVEN_CENTRAL_PORTAL_*
    environment:
      name: maven-central
      url: https://central.sonatype.com/service/rest/repository/browse/maven-snapshots/net/sourceforge/pmd/
    runs-on: ubuntu-latest
    timeout-minutes: 180
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          ref: main
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
        with:
          distribution: 'temurin'
          java-version: '21'
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
          gpg-private-key: ${{ secrets.PMD_CI_GPG_PRIVATE_KEY }}
      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 #v5.0.3
        with:
          key: maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: maven-
          path: .m2/repository
          enableCrossOsArchive: true
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: compile-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
      - name: Build and publish
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_PORTAL_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PORTAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.PMD_CI_GPG_PASSPHRASE }}
        # note: we can't use artifact staging-repository, as the jars are unsigned and javadoc+sources are missing.
        run: |
          ./mvnw --show-version --errors --batch-mode \
            -Dmaven.repo.local=.m2/repository \
            deploy \
            -DskipTests \
            -PfastSkip,sign,pmd-release \
            -Dcyclonedx.skip=false \
            -Dmaven.javadoc.skip=false \
            -Ddokka.skip=false \
            -Dmaven.source.skip=false

  deploy-to-sourceforge-files:
    needs: check-version
    # use environment sourceforge, where secrets/vars are configured for PMD_WEB_SOURCEFORGE_NET_DEPLOY_KEY
    # and PMD_WEB_SOURCEFORGE_NET_KNOWN_HOSTS
    environment:
      name: sourceforge
      url: ${{ steps.upload.outputs.url_output }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: dist-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
          path: dist

      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: docs-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
          path: docs

      - name: Setup GPG
        env:
          PMD_CI_GPG_PRIVATE_KEY: ${{ secrets.PMD_CI_GPG_PRIVATE_KEY }}
        run: |
          mkdir -p "${HOME}/.gpg"
          chmod 700 "${HOME}/.gpg"
          printenv PMD_CI_GPG_PRIVATE_KEY | gpg --batch --import

          gpg --list-keys --fingerprint --keyid-format=long
          gpg --list-secret-keys --fingerprint --keyid-format=long

      - name: Setup ssh key for sourceforge
        env:
          WEB_SF_DEPLOY_KEY: ${{ secrets.PMD_WEB_SOURCEFORGE_NET_DEPLOY_KEY }}
          WEB_SF_KNOWN_HOSTS: ${{ vars.PMD_WEB_SOURCEFORGE_NET_KNOWN_HOSTS }}
        run: |
          mkdir -p "${HOME}/.ssh"
          chmod 700 "${HOME}/.ssh"
          printenv WEB_SF_DEPLOY_KEY > "${HOME}/.ssh/web.sourceforge.net_deploy_key"
          chmod 600 "${HOME}/.ssh/web.sourceforge.net_deploy_key"
          echo "
          Host web.sourceforge.net
              IdentityFile=$HOME/.ssh/web.sourceforge.net_deploy_key
          " > "$HOME/.ssh/config"
          echo "${WEB_SF_KNOWN_HOSTS}" > "$HOME/.ssh/known_hosts"

      - name: Create docs zip
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
        run: |
          mv docs "pmd-doc-${PMD_VERSION}"
          zip -qr "dist/pmd-dist-${PMD_VERSION}-doc.zip" "pmd-doc-${PMD_VERSION}/"

      - name: Sign files
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.PMD_CI_GPG_PASSPHRASE }}
        run: |
          cd dist
          printenv MAVEN_GPG_PASSPHRASE | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --no-tty \
            --status-fd 1 --armor --detach-sign --sign "pmd-dist-${PMD_VERSION}-bin.zip"
          printenv MAVEN_GPG_PASSPHRASE | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --no-tty \
            --status-fd 1 --armor --detach-sign --sign "pmd-dist-${PMD_VERSION}-src.zip"
          printenv MAVEN_GPG_PASSPHRASE | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --no-tty \
            --status-fd 1 --armor --detach-sign --sign "pmd-dist-${PMD_VERSION}-doc.zip"

      - name: Upload to sourceforge
        id: upload
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
          PMD_SF_USER: adangel
        run: |
          # Deploy to sourceforge files https://sourceforge.net/projects/pmd/files/pmd/
          basePath="pmd/${PMD_VERSION}"
          uploadUrl="${PMD_SF_USER}@web.sourceforge.net:/home/frs/project/pmd/${basePath}/"

          rsync -avh "dist/pmd-dist-${PMD_VERSION}-bin.zip"        "${uploadUrl}"
          rsync -avh "dist/pmd-dist-${PMD_VERSION}-bin.zip.asc"    "${uploadUrl}"
          rsync -avh "dist/pmd-dist-${PMD_VERSION}-src.zip"        "${uploadUrl}"
          rsync -avh "dist/pmd-dist-${PMD_VERSION}-src.zip.asc"    "${uploadUrl}"
          rsync -avh "dist/pmd-dist-${PMD_VERSION}-doc.zip"        "${uploadUrl}"
          rsync -avh "dist/pmd-dist-${PMD_VERSION}-doc.zip.asc"    "${uploadUrl}"
          rsync -avh "dist/pmd-${PMD_VERSION}-cyclonedx.xml"       "${uploadUrl}"
          rsync -avh "dist/pmd-${PMD_VERSION}-cyclonedx.json"      "${uploadUrl}"
          rsync -avh "pmd-doc-${PMD_VERSION}/pmd_release_notes.md" "${uploadUrl}/ReadMe.md"

          targetUrl="https://sourceforge.net/projects/pmd/files/${basePath}"
          echo "TargetUrl: ${targetUrl}"
          echo "url_output=${targetUrl}" >> "$GITHUB_OUTPUT"

      - name: Cleanup ssh and gpg
        if: ${{ always() }}
        run: |
          rm -rf "${HOME}/.ssh"
          rm -rf "${HOME}/.gpg"

  deploy-to-sourceforge-io:
    needs: check-version
    # use environment sourceforge, where secrets/vars are configured for PMD_WEB_SOURCEFORGE_NET_DEPLOY_KEY
    # and PMD_WEB_SOURCEFORGE_NET_KNOWN_HOSTS
    environment:
      name: sourceforge
      url: https://pmd.sourceforge.io/snapshot/
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: docs-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
          path: docs

      - name: Setup ssh key for sourceforge
        env:
          WEB_SF_DEPLOY_KEY: ${{ secrets.PMD_WEB_SOURCEFORGE_NET_DEPLOY_KEY }}
          WEB_SF_KNOWN_HOSTS: ${{ vars.PMD_WEB_SOURCEFORGE_NET_KNOWN_HOSTS }}
        run: |
          mkdir -p "${HOME}/.ssh"
          chmod 700 "${HOME}/.ssh"
          printenv WEB_SF_DEPLOY_KEY > "${HOME}/.ssh/web.sourceforge.net_deploy_key"
          chmod 600 "${HOME}/.ssh/web.sourceforge.net_deploy_key"
          echo "
          Host web.sourceforge.net
              IdentityFile=$HOME/.ssh/web.sourceforge.net_deploy_key
          " > "$HOME/.ssh/config"
          echo "${WEB_SF_KNOWN_HOSTS}" > "$HOME/.ssh/known_hosts"

      - name: Upload to sourceforge
        env:
          PMD_SF_USER: adangel
        run: |
          rsync -ah --stats --delete "docs/" "${PMD_SF_USER}@web.sourceforge.net:/home/project-web/pmd/htdocs/snapshot/"

      - name: Cleanup ssh
        if: ${{ always() }}
        run: |
          rm -rf "${HOME}/.ssh"

  deploy-to-pmd-code-doc:
    needs: check-version
    # use environment pmd-code, where secrets/vars are configured for PMD_CODE_ORG_DEPLOY_KEY
    # and PMD_CODE_ORG_KNOWN_HOSTS
    environment:
      name: pmd-code
      url: ${{ steps.upload.outputs.url_output }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: docs-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
          path: docs

      - name: Setup ssh key for pmd-code
        env:
          PMD_CODE_ORG_DEPLOY_KEY: ${{ secrets.PMD_CODE_ORG_DEPLOY_KEY }}
          PMD_CODE_ORG_KNOWN_HOSTS: ${{ vars.PMD_CODE_ORG_KNOWN_HOSTS }}
        run: |
          mkdir -p "${HOME}/.ssh"
          chmod 700 "${HOME}/.ssh"
          printenv PMD_CODE_ORG_DEPLOY_KEY > "${HOME}/.ssh/pmd-code.org_deploy_key"
          chmod 600 "${HOME}/.ssh/pmd-code.org_deploy_key"
          echo "
          Host pmd-code.org
              IdentityFile=$HOME/.ssh/pmd-code.org_deploy_key
          " > "$HOME/.ssh/config"
          echo "${PMD_CODE_ORG_KNOWN_HOSTS}" > "$HOME/.ssh/known_hosts"

      - name: Create docs zip
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
        run: |
          mv docs "pmd-doc-${PMD_VERSION}"
          zip -qr "pmd-dist-${PMD_VERSION}-doc.zip" "pmd-doc-${PMD_VERSION}/"

      - name: Upload to pmd-code.org
        id: upload
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
          PMD_CODE_SSH_USER: pmd
          PMD_CODE_DOCS_PATH: /docs.pmd-code.org/
        run: |
          filename="pmd-dist-${PMD_VERSION}-doc.zip"
          
          scp "${filename}" ${PMD_CODE_SSH_USER}@pmd-code.org:${PMD_CODE_DOCS_PATH}
          # shellcheck disable=SC2029
          ssh ${PMD_CODE_SSH_USER}@pmd-code.org "cd \"${PMD_CODE_DOCS_PATH}\" && \
                  ( test -h pmd-doc-${PMD_VERSION} && rm pmd-doc-${PMD_VERSION} || true ) && \
                  unzip -qo \"${filename}\" && \
                  rm \"${filename}\""

          # only for snapshot builds from branch main: https://docs.pmd-code.org/snapshot -> pmd-doc-${PMD_VERSION}
          # shellcheck disable=SC2029
          ssh ${PMD_CODE_SSH_USER}@pmd-code.org "cd \"${PMD_CODE_DOCS_PATH}\" && \
                  rm -f \"snapshot\" && \
                  ln -s \"pmd-doc-${PMD_VERSION}\" \"snapshot\""

          targetUrl="https://docs.pmd-code.org/pmd-doc-${PMD_VERSION}/"
          echo "TargetUrl: ${targetUrl}"
          echo "url_output=${targetUrl}" >> "$GITHUB_OUTPUT"

      - name: Cleanup ssh
        if: ${{ always() }}
        run: |
          rm -rf "${HOME}/.ssh"

  deploy-to-pmd-code-javadoc:
    needs: check-version
    # use environment pmd-code, where secrets/vars are configured for PMD_CODE_ORG_DEPLOY_KEY
    # and PMD_CODE_ORG_KNOWN_HOSTS
    environment:
      name: pmd-code
      url: https://docs.pmd-code.org/apidocs/
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: javadocs-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Setup ssh key for pmd-code
        env:
          PMD_CODE_ORG_DEPLOY_KEY: ${{ secrets.PMD_CODE_ORG_DEPLOY_KEY }}
          PMD_CODE_ORG_KNOWN_HOSTS: ${{ vars.PMD_CODE_ORG_KNOWN_HOSTS }}
        run: |
          mkdir -p "${HOME}/.ssh"
          chmod 700 "${HOME}/.ssh"
          printenv PMD_CODE_ORG_DEPLOY_KEY > "${HOME}/.ssh/pmd-code.org_deploy_key"
          chmod 600 "${HOME}/.ssh/pmd-code.org_deploy_key"
          echo "
          Host pmd-code.org
              IdentityFile=$HOME/.ssh/pmd-code.org_deploy_key
          " > "$HOME/.ssh/config"
          echo "${PMD_CODE_ORG_KNOWN_HOSTS}" > "$HOME/.ssh/known_hosts"

      - name: Upload javadocs to pmd-code.org
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
          PMD_CODE_SSH_USER: pmd
          PMD_CODE_DOCS_PATH: /docs.pmd-code.org/
        run: |
          for moduleJavadocJar in */target/*-javadoc.jar */*/target/*-javadoc.jar; do
              moduleJavadocJarBasename="$(basename "$moduleJavadocJar")"
              module=${moduleJavadocJarBasename%%-${PMD_VERSION}-javadoc.jar}
    
              echo "Copying module ${moduleJavadocJar}..."
              scp "$moduleJavadocJar" ${PMD_CODE_SSH_USER}@pmd-code.org:${PMD_CODE_DOCS_PATH}
              echo "Extracting remotely ${module}..."
              # shellcheck disable=SC2029
              ssh ${PMD_CODE_SSH_USER}@pmd-code.org "cd \"${PMD_CODE_DOCS_PATH}\" && \
                      mkdir -p \"apidocs/${module}/${PMD_VERSION}\" && \
                      unzip -qo -d \"apidocs/${module}/${PMD_VERSION}\" \"${moduleJavadocJarBasename}\" && \
                      rm \"${moduleJavadocJarBasename}\""
          done

          echo "(Re)creating .htaccess"
          # make sure https://docs.pmd-code.org/apidocs/ shows directory index
          # shellcheck disable=SC2029
          ssh ${PMD_CODE_SSH_USER}@pmd-code.org "cd \"${PMD_CODE_DOCS_PATH}/apidocs\" && \
              echo 'Options +Indexes' > .htaccess"

      - name: Cleanup ssh
        if: ${{ always() }}
        run: |
          rm -rf "${HOME}/.ssh"

  deploy-to-github-pages:
    needs: check-version
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: https://pmd.github.io/pmd/
    timeout-minutes: 10
    permissions:
      contents: write # to push to branch gh-pages
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          ref: gh-pages
      - name: Clear old files
        run: rm -rf *
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: docs-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
      - name: Commit and push new page
        env:
          WORKFLOW_RUN_HTML_URL: ${{ github.event.workflow_run.html_url }}
        run: |
          # https://api.github.com/users/pmd-actions-helper[bot]
          git config user.name "pmd-actions-helper[bot]"
          git config user.email "207160486+pmd-actions-helper[bot]@users.noreply.github.com"
          git add -A
          MSG="Update documentation

          Updated by: https://github.com/pmd/pmd/actions/runs/$GITHUB_RUN_ID
          Triggered by: ${WORKFLOW_RUN_HTML_URL}"
          
          echo "Commit Message:"
          echo "$MSG"
          
          git commit -q -m "$MSG"
          git push

  github-prerelease:
    needs: check-version
    environment:
      name: github
      url: ${{ steps.release.outputs.release_url }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: dist-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
          path: dist

      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: docs-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
          path: pmd-doc-${{ needs.check-version.outputs.PMD_VERSION }}
      - name: Create docs zip
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
        run: zip -qr "dist/pmd-dist-${PMD_VERSION}-doc.zip" "pmd-doc-${PMD_VERSION}/"
      - name: Setup GPG
        env:
          PMD_CI_GPG_PRIVATE_KEY: ${{ secrets.PMD_CI_GPG_PRIVATE_KEY }}
        run: |
          mkdir -p "${HOME}/.gpg"
          chmod 700 "${HOME}/.gpg"
          printenv PMD_CI_GPG_PRIVATE_KEY | gpg --batch --import

          gpg --list-keys --fingerprint --keyid-format=long
          gpg --list-secret-keys --fingerprint --keyid-format=long
      - name: Sign files
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.PMD_CI_GPG_PASSPHRASE }}
        run: |
          cd dist
          printenv MAVEN_GPG_PASSPHRASE | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --no-tty \
            --status-fd 1 --armor --detach-sign --sign "pmd-dist-${PMD_VERSION}-bin.zip"
          printenv MAVEN_GPG_PASSPHRASE | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --no-tty \
            --status-fd 1 --armor --detach-sign --sign "pmd-dist-${PMD_VERSION}-src.zip"
          printenv MAVEN_GPG_PASSPHRASE | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --no-tty \
            --status-fd 1 --armor --detach-sign --sign "pmd-dist-${PMD_VERSION}-doc.zip"
      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf #v2.2.1
        id: pmd-actions-helper-app-token
        with:
          app-id: ${{ secrets.PMD_ACTIONS_HELPER_ID }}
          private-key: ${{ secrets.PMD_ACTIONS_HELPER_PRIVATE_KEY }}
          owner: pmd
          repositories: pmd
          permission-contents: write # create a release, remove/create a tag
          permission-workflows: write # needed for creating a tag, in case some workflow files have been modified
      - name: Prepare tag for GitHub Pre-Release
        id: tags
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
          GH_TOKEN: ${{ steps.pmd-actions-helper-app-token.outputs.token }}
        run: |
          existingTagName="$(gh --repo pmd/pmd release list --json tagName,isPrerelease --jq ".[] | select(.isPrerelease == true) | .tagName")"
          previousTagName=""

          if [ -n "${existingTagName}" ]; then
            # we can't simply delete the old tag, as the existing pre-release would then become a draft and
            # we would need to republish it again, which we want to avoid to avoid notifications for every pre-release.
            # strategy:
            # 1. create a new tag with suffix "-previous-SNAPSHOT"
            previousSha="$(gh api \
              -H "Accept: application/vnd.github+json" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              "/repos/pmd/pmd/git/ref/tags/${existingTagName}" --jq ".object.sha")"
            previousTagName="${existingTagName}-previous-SNAPSHOT"
            echo "Creating tag ${previousTagName} -> ${previousSha}"
            gh api \
              --method POST \
              -H "Accept: application/vnd.github+json" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              /repos/pmd/pmd/git/refs \
              -f "ref=refs/tags/${previousTagName}" -f "sha=${previousSha}"
            # 2. update pre-release to point to this new tag
            echo "Update existing pre-release to use tag ${previousTagName}"
            gh release edit "${existingTagName}" \
              --repo pmd/pmd \
              --tag "${previousTagName}" \
              --verify-tag
            # 3. remove the old, existing tag
            echo "Deleting tag ${existingTagName}"
            gh api \
              --method DELETE \
              -H "Accept: application/vnd.github+json" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              "/repos/pmd/pmd/git/refs/tags/${existingTagName}"
          fi

          # create a new tag
          mainSha="$(gh api \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            /repos/pmd/pmd/git/ref/heads/main --jq ".object.sha")"
          tagName="pmd_releases/${PMD_VERSION}"
          echo "Creating tag ${tagName} -> ${mainSha}"
          gh api \
            --method POST \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            /repos/pmd/pmd/git/refs \
            -f "ref=refs/tags/${tagName}" -f "sha=${mainSha}"
          
          echo "tagName=${tagName}" >> "${GITHUB_OUTPUT}"
          echo "previousTagName=${previousTagName}" >> "${GITHUB_OUTPUT}"
      - name: Create or Update GitHub Pre-Release
        id: release
        env:
          PMD_VERSION: ${{ needs.check-version.outputs.PMD_VERSION }}
          GH_TOKEN: ${{ steps.pmd-actions-helper-app-token.outputs.token }}
          TAG_NAME: ${{ steps.tags.outputs.tagName }}
          PREVIOUS_TAG_NAME: ${{ steps.tags.outputs.previousTagName }}
        run: |
          release_name="PMD ${PMD_VERSION} ($(date -u +%d-%B-%Y))"
          if [ -z "${PREVIOUS_TAG_NAME}" ]; then
            echo "Create new release ${TAG_NAME}"
            gh release create "${TAG_NAME}" \
              --repo pmd/pmd \
              --verify-tag \
              --prerelease \
              --title "$release_name" \
              --notes-file "pmd-doc-${PMD_VERSION}/pmd_release_notes.md" \
                "dist/pmd-dist-${PMD_VERSION}-bin.zip" \
                "dist/pmd-dist-${PMD_VERSION}-bin.zip.asc" \
                "dist/pmd-dist-${PMD_VERSION}-src.zip" \
                "dist/pmd-dist-${PMD_VERSION}-src.zip.asc" \
                "dist/pmd-dist-${PMD_VERSION}-doc.zip" \
                "dist/pmd-dist-${PMD_VERSION}-doc.zip.asc" \
                "dist/pmd-${PMD_VERSION}-cyclonedx.xml" \
                "dist/pmd-${PMD_VERSION}-cyclonedx.json"
          else
            echo "Update release ${PREVIOUS_TAG_NAME} -> ${TAG_NAME}"
            gh release edit "${PREVIOUS_TAG_NAME}" \
              --repo pmd/pmd \
              --tag "${TAG_NAME}" \
              --verify-tag \
              --prerelease \
              --title "$release_name" \
              --notes-file "pmd-doc-${PMD_VERSION}/pmd_release_notes.md"
            echo "Deleting old release assets"
            for name in $(gh release view "${TAG_NAME}" --repo pmd/pmd --json assets --jq ".assets[].name"); do
              gh release delete-asset "${TAG_NAME}" "$name" \
                --repo pmd/pmd \
                --yes
            done
            echo "Uploading new release assets"
            gh release upload "${TAG_NAME}" \
              --repo pmd/pmd \
                "dist/pmd-dist-${PMD_VERSION}-bin.zip" \
                "dist/pmd-dist-${PMD_VERSION}-bin.zip.asc" \
                "dist/pmd-dist-${PMD_VERSION}-src.zip" \
                "dist/pmd-dist-${PMD_VERSION}-src.zip.asc" \
                "dist/pmd-dist-${PMD_VERSION}-doc.zip" \
                "dist/pmd-dist-${PMD_VERSION}-doc.zip.asc" \
                "dist/pmd-${PMD_VERSION}-cyclonedx.xml" \
                "dist/pmd-${PMD_VERSION}-cyclonedx.json"

            echo "Deleting tag ${PREVIOUS_TAG_NAME}"
            gh api \
              --method DELETE \
              -H "Accept: application/vnd.github+json" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              "/repos/pmd/pmd/git/refs/tags/${PREVIOUS_TAG_NAME}"
          fi
          echo "release_url=https://github.com/pmd/pmd/releases/tag/pmd_releases%2F${PMD_VERSION}" >> "$GITHUB_OUTPUT"
      - name: Cleanup gpg
        if: ${{ always() }}
        run: |
          rm -rf "${HOME}/.gpg"

  create-regression-tester-baseline:
    needs: check-version
    runs-on: ubuntu-latest
    # use environment pmd-code, where secrets/vars are configured for PMD_CODE_ORG_DEPLOY_KEY
    # and PMD_CODE_ORG_KNOWN_HOSTS
    environment:
      name: pmd-code
      url: https://pmd-code.org/pmd-regression-tester/
    timeout-minutes: 60
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          ref: main
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
        with:
          distribution: 'temurin'
          java-version: |
            11
            21
      - name: Set up Ruby 3.3
        uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd #v1.288.0
        with:
          ruby-version: 3.3
      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 #v5.0.3
        with:
          path: |
            ~/.m2/repository
            ~/.gradle/caches
            ~/work/pmd/target/repositories
            .ci/files/vendor/bundle
          key: regressiontester-${{ hashFiles('.ci/files/project-list.xml', '.ci/files/Gemfile.lock') }}
          restore-keys: regressiontester-
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7.0.0
        with:
          name: dist-artifact
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
          path: pmd-dist/target
      - name: Setup bundler
        run: |
          bundle config set --local gemfile .ci/files/Gemfile
          bundle config set --local path vendor/bundle
          bundle install
      - name: Prepare HOME/openjdk11
        run: |
          ln -sfn "${JAVA_HOME_11_X64}" "${HOME}/openjdk11"
      - name: Run pmdtester
        run: |
          cd ..
          rm -f .bundle/config
          bundle config set --local gemfile pmd/.ci/files/Gemfile
          bundle config set --local path vendor/bundle
          bundle exec pmdtester \
              --mode single \
              --local-git-repo ./pmd \
              --patch-branch "main" \
              --patch-config ./pmd/.ci/files/all-regression-rules.xml \
              --list-of-project ./pmd/.ci/files/project-list.xml --html-flag \
              --threads "$(nproc)" \
              --error-recovery
          pushd target/reports || { echo "Directory 'target/reports' doesn't exist"; exit 1; }
      - name: Setup ssh key for pmd-code
        env:
          PMD_CODE_ORG_DEPLOY_KEY: ${{ secrets.PMD_CODE_ORG_DEPLOY_KEY }}
          PMD_CODE_ORG_KNOWN_HOSTS: ${{ vars.PMD_CODE_ORG_KNOWN_HOSTS }}
        run: |
          mkdir -p "${HOME}/.ssh"
          chmod 700 "${HOME}/.ssh"
          printenv PMD_CODE_ORG_DEPLOY_KEY > "${HOME}/.ssh/pmd-code.org_deploy_key"
          chmod 600 "${HOME}/.ssh/pmd-code.org_deploy_key"
          echo "
          Host pmd-code.org
              IdentityFile=$HOME/.ssh/pmd-code.org_deploy_key
          " > "$HOME/.ssh/config"
          echo "${PMD_CODE_ORG_KNOWN_HOSTS}" > "$HOME/.ssh/known_hosts"
      - name: Upload report
        run: |
          cd ../target/reports
          zip -q -r "main-baseline.zip" "main/"
          scp "main-baseline.zip" pmd@pmd-code.org:/httpdocs/pmd-regression-tester/
      - name: Cleanup ssh
        if: ${{ always() }}
        run: |
          rm -rf "${HOME}/.ssh"

  run-sonar:
    needs: check-version
    runs-on: ubuntu-latest
    # use environment sonarcloud, where secrets are configured for SONAR_TOKEN
    environment:
      name: sonarcloud
      url: https://sonarcloud.io/dashboard?id=net.sourceforge.pmd%3Apmd
    timeout-minutes: 20
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          ref: main
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 #v5.0.3
        with:
          key: maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: maven-
          path: .m2/repository
          enableCrossOsArchive: true
      - name: Build and upload to sonar cloud
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Note: Sonar also needs GITHUB_TOKEN (!)
          ./mvnw \
              --show-version --errors --batch-mode \
              -Dmaven.repo.local=.m2/repository \
              package \
              sonar:sonar -Psonar,fastSkip

  run-coveralls:
    needs: check-version
    runs-on: ubuntu-latest
    # use environment sonarcloud, where secrets are configured for COVERALLS_REPO_TOKEN
    environment:
      name: coveralls
      url: https://coveralls.io/github/pmd/pmd
    timeout-minutes: 20
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          ref: main
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 #v5.0.3
        with:
          key: maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: maven-
          path: .m2/repository
          enableCrossOsArchive: true
      - name: Create Jacoco Report
        run: |
          ./mvnw \
              --show-version --errors --batch-mode \
              -Dmaven.repo.local=.m2/repository \
              package \
              jacoco:report -Pcoveralls,fastSkip
          
          # workaround, maybe https://github.com/jacoco/jacoco/issues/654
          # we use $ as a regex separator, not a shell variable, so no expansion
          # shellcheck disable=SC2016
          sed -i 's$Comparisons.kt$ApexTreeBuilder.kt$g' pmd-apex/target/site/jacoco/jacoco.xml
      - name: Build and upload to coveralls report
        env:
          COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
        run: |
          # note: generate-sources is needed, so that antlr4 generated directories are on the compileSourceRoots
          # test-compile is needed to that dependency resolution within this multi-module build works
          ./mvnw \
              --show-version --errors --batch-mode \
              -Dmaven.repo.local=.m2/repository \
              generate-sources test-compile \
              coveralls:report -DrepoToken="${COVERALLS_REPO_TOKEN}" -Pcoveralls,fastSkip