ci-release.yml

# ----------------------------------------------------------------------------
# Copyright 2021 The Netty Project
#
# The Netty Project licenses this file to you under the Apache License,
# version 2.0 (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at:
#
#   https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
# ----------------------------------------------------------------------------
name: Release

on:
  # Releases can only be triggered via the action tab
  workflow_dispatch:

env:
  MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryhandler.count=5 -Dmaven.wagon.httpconnectionManager.ttlSeconds=240

# Cancel running jobs when a new push happens to the same branch as otherwise it will
# tie up too many resources without providing much value.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main

      - name: Set up JDK 8
        uses: actions/setup-java@v4
        with:
          distribution: zulu
          java-version: 8

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      # Caching of maven dependencies
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: prepare-release-maven-cache-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            prepare-release-maven-cache-

      - name: Prepare release with Maven
        run: |
          ./mvnw -B -ntp --file pom.xml -DskipTests=true -DpreparationGoals=clean release:prepare
          ./mvnw -B -ntp clean

      - name: Checkout tag
        run: ./.github/scripts/release_checkout_tag.sh release.properties

      - name: Upload workspace
        uses: actions/upload-artifact@v4
        with:
          name: prepare-release-workspace
          path: |
            ${{ github.workspace }}/**
            !${{ github.workspace }}/.git/config
          include-hidden-files: true

  stage-release-linux:
    runs-on: ubuntu-latest
    needs: prepare-release
    strategy:
      matrix:
        include:
          - setup: linux-x86_64
            docker-compose-build: "-f docker/docker-compose.centos-7.yaml -f docker/docker-compose.centos-7.18.yaml build"
            docker-compose-run: "-f docker/docker-compose.centos-7.yaml -f docker/docker-compose.centos-7.18.yaml run stage-release"
          - setup: linux-aarch64
            docker-compose-build: "-f docker/docker-compose.centos-7-cross.yaml build"
            docker-compose-run: "-f docker/docker-compose.centos-7-cross.yaml run cross-compile-aarch64-stage-release"

    name: stage-release-${{ matrix.setup }}

    steps:
      - name: Download release-workspace
        uses: actions/download-artifact@v4
        with:
          name: prepare-release-workspace
          path: ./prepare-release-workspace/

      - name: Adjust mvnw permissions
        run: chmod 755 ./prepare-release-workspace/mvnw

      - name: Set up JDK 8
        uses: actions/setup-java@v4
        with:
          distribution: zulu
          java-version: 8

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      # Caching of maven dependencies
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: staging-${{ matrix.setup }}-maven-cache-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            staging-${{ matrix.setup }}-maven-cache-

      - uses: s4u/maven-settings-action@v3.0.0
        with:
          servers: |
            [{
              "id": "central",
              "username": "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
              "password": "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
            }]

      - name: Create local staging directory
        run: mkdir -p ~/local-staging

      - name: Build docker image
        working-directory: ./prepare-release-workspace/
        run: docker compose ${{ matrix.docker-compose-build }}

      - name: Stage release to local staging directory
        working-directory: ./prepare-release-workspace/
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_KEYNAME: ${{ secrets.GPG_KEYNAME }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: docker compose ${{ matrix.docker-compose-run }}

      - name: Upload local staging directory
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.setup }}-local-staging
          path: ./prepare-release-workspace/target/central-staging
          if-no-files-found: error
          include-hidden-files: true

      - name: Rollback release on failure
        working-directory: ./prepare-release-workspace/
        if: ${{ failure() }}
        # Rollback the release in case of an failure
        run: bash ./.github/scripts/release_rollback.sh release.properties netty/netty-incubator-codec-quic main

  stage-release-windows-x86_64:
    runs-on: windows-2022
    name: stage-release-windows-x86_64
    needs: prepare-release
    env:
      # Let's limit the amount of ram that is used to unpack rustup as we saw
      # failures sometimes due the fact that not enough memory could be reserved.
      RUSTUP_UNPACK_RAM: 134217728  # Use 128 MiB
    steps:
      - name: Download release-workspace
        uses: actions/download-artifact@v4
        with:
          name: prepare-release-workspace
          path: ${{ github.workspace }}/prepare-release-workspace

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      - name: Set up JDK 8
        uses: actions/setup-java@v4
        with:
          distribution: zulu
          java-version: 8

      - name: Install stable rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc

      - name: Add msbuild to PATH
        uses: microsoft/setup-msbuild@v2

      - name: Configuring Developer Command Prompt
        uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: x86_amd64

      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Install tools
        uses: crazy-max/ghaction-chocolatey@v3
        with:
          args: install ninja nasm

      # Caching of maven dependencies
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: stage-release-windows-x86_64-maven-cache-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            stage-release-windows-x86_64-maven-cache-

      - uses: s4u/maven-settings-action@v3.0.0
        with:
          servers: |
            [{
              "id": "central",
              "username": "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
              "password": "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
            }]

      - name: Stage release to local staging directory
        working-directory: ${{ github.workspace }}/prepare-release-workspace
        run: ./mvnw.cmd -B -ntp clean package javadoc:jar gpg:sign org.sonatype.central:central-publishing-maven-plugin:publish -DskipTests=true -D'checkstyle.skip=true'

      - name: Upload local staging directory
        uses: actions/upload-artifact@v4
        with:
          name: windows-x86_64-local-staging
          path: ./prepare-release-workspace/target/central-staging
          if-no-files-found: error
          include-hidden-files: true

      - name: Rollback release on failure
        working-directory: ${{ github.workspace }}/prepare-release-workspace
        if: ${{ failure() }}
        # Rollback the release in case of an failure
        run: ./.github/scripts/release_rollback.ps1 release.properties netty/netty-incubator-codec-quic main

  stage-release-macos:
    strategy:
      fail-fast: false
      matrix:
        include:
          - setup: macos-x86_64
            os: macos-13
          - setup: macos-aarch64
            os: macos-15
    needs: prepare-release
    runs-on: ${{ matrix.os }}
    name:  stage-release-${{ matrix.setup }}

    steps:
      - name: Download release-workspace
        uses: actions/download-artifact@v4
        with:
          name: prepare-release-workspace
          path: ./prepare-release-workspace/

      - name: Adjust mvnw permissions
        run: chmod 755 ./prepare-release-workspace/mvnw

      - name: Set up JDK 8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '8'

      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      - uses: s4u/maven-settings-action@v3.0.0
        with:
          servers: |
            [{
              "id": "central",
              "username": "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
              "password": "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
            }]

      # Cache .m2/repository
      # Caching of maven dependencies
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: pr-${{ matrix.setup }}-maven-cache-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            pr-${{ matrix.setup }}-maven-cache-

      - name: Install tools via brew
        working-directory: ./prepare-release-workspace/
        run: brew bundle

      - name: Create local staging directory
        run: mkdir -p ~/local-staging

      - name: Stage snapshots to local staging directory
        working-directory: ./prepare-release-workspace/
        run: ./mvnw -B -ntp clean package javadoc:jar gpg:sign org.sonatype.central:central-publishing-maven-plugin:publish -DskipTests=true

      - name: Upload local staging directory
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.setup }}-local-staging
          path: ./prepare-release-workspace/target/central-staging
          if-no-files-found: error
          include-hidden-files: true

      - name: Rollback release on failure
        working-directory: ./prepare-release-workspace/
        if: ${{ failure() }}
        # Rollback the release in case of an failure
        run: bash ./.github/scripts/release_rollback.sh release.properties netty/netty-incubator-codec-quic main

  deploy-staged-release:
    runs-on: ubuntu-latest
    # Wait until we have staged everything
    needs: [stage-release-linux, stage-release-windows-x86_64, stage-release-macos]
    steps:
      - name: Download release-workspace
        uses: actions/download-artifact@v4
        with:
          name: prepare-release-workspace
          path: ./prepare-release-workspace/

      - name: Adjust mvnw permissions
        run: chmod 755 ./prepare-release-workspace/mvnw

      - name: Set up JDK 8
        uses: actions/setup-java@v4
        with:
          distribution: zulu
          java-version: 8

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      # Hardcode the staging artifacts that need to be downloaded.
      # These must match the matrix setups. There is currently no way to pull this out of the config.
      - name: Download windows-x86_64 staging directory
        uses: actions/download-artifact@v4
        with:
          name: windows-x86_64-local-staging
          path: ~/windows-x86_64-local-staging

      - name: Download macos-x86_64 staging directory
        uses: actions/download-artifact@v4
        with:
          name: macos-x86_64-local-staging
          path: ~/macos-x86_64-local-staging

      - name: Download macos-aarch64 staging directory
        uses: actions/download-artifact@v4
        with:
          name: macos-aarch64-local-staging
          path: ~/macos-aarch64-local-staging

      - name: Download linux-aarch64 staging directory
        uses: actions/download-artifact@v4
        with:
          name: linux-aarch64-local-staging
          path: ~/linux-aarch64-local-staging

      - name: Download linux-x86_64 staging directory
        uses: actions/download-artifact@v4
        with:
          name: linux-x86_64-local-staging
          path: ~/linux-x86_64-local-staging

      # This step takes care of merging all the previous staged repositories in a way that will allow us to deploy
      # all together with one maven command.
      - name: Merge staging repositories
        working-directory: ./prepare-release-workspace/
        run: bash ./.github/scripts/local_staging_merge_release.sh ~/local-staging ~/windows-x86_64-local-staging ~/macos-x86_64-local-staging ~/macos-aarch64-local-staging ~/linux-aarch64-local-staging ~/linux-x86_64-local-staging

      # Caching of maven dependencies
      - uses: actions/cache@v4
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: deploy-staged-release-maven-cache-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            deploy-staged-release-maven-cache-

      - name: Create bundle
        working-directory: ./prepare-release-workspace/
        run: bash ./.github/scripts/bundle_create.sh ~/central-bundle.zip ~/local-staging/

      - name: Upload bundle to maven central
        working-directory: ./prepare-release-workspace/
        run: bash ./.github/scripts/bundle_upload.sh ~/central-bundle.zip ${{ secrets.MAVEN_CENTRAL_USERNAME }} ${{ secrets.MAVEN_CENTRAL_PASSWORD }}

      - name: Rollback release on failure
        working-directory: ./prepare-release-workspace/
        if: ${{ failure() }}
        # Rollback the release in case of an failure
        run: bash ./.github/scripts/release_rollback.sh release.properties netty/netty-incubator-codec-quic main