release.yml

name: release

# Plan 04 §5. Trigger: tag v*. The publish job runs in the protected
# `maven-central` environment — one-time maintainer setup (Central Portal
# namespace ownership for io.laminardb, GPG key, environment secrets
# CENTRAL_TOKEN / GPG_* / CENTAL_PORTAL) is a recorded blocker: see
# docs/plans/04-release-engineering.md §5.

on:
  push:
    tags: ["v*"]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Version parity and core-pin gate
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          CARGO_V=$(grep -m1 '^version' Cargo.toml | sed -E 's/^version = "([^"]+)".*/\1/')
          POM_V=$(mvn -q help:evaluate -Dexpression=project.version -DforceStdout)
          test "$TAG" = "v$CARGO_V" || { echo "tag $TAG != Cargo $CARGO_V"; exit 1; }
          test "$TAG" = "v$POM_V" || { echo "tag $TAG != pom $POM_V"; exit 1; }
          grep -q 'laminar-db = { git = "https://github.com/laminardb/laminardb", tag = "v' Cargo.toml \
            || { echo "core pin must be a git tag"; exit 1; }
          grep -q "## \[$CARGO_V\]" CHANGELOG.md || { echo "no CHANGELOG entry"; exit 1; }
      - name: Latest phase review shows zero open findings
        run: |
          LATEST=$(ls docs/reviews/ | sort | tail -1)
          grep -q "Open REQUEST CHANGES findings: \*\*0\*\*" "docs/reviews/$LATEST" \
            || { echo "$LATEST has open findings"; exit 1; }

  build-native:
    needs: validate
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: x86_64-unknown-linux-gnu, runner: ubuntu-latest, platform: linux-amd64 }
          - { target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm, platform: linux-aarch64 }
          - { target: aarch64-apple-darwin, runner: macos-latest, platform: macos-aarch64 }
          - { target: x86_64-apple-darwin, runner: macos-latest, platform: macos-amd64 }
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}
      - run: cargo build --release --target ${{ matrix.target }}
      - name: Stage native
        run: |
          mkdir -p natives/${{ matrix.platform }}
          cp target-rust/${{ matrix.target }}/release/liblaminar_java.* natives/${{ matrix.platform }}/
      - uses: actions/upload-artifact@v4
        with:
          name: native-${{ matrix.platform }}
          path: natives/

  assemble-and-test:
    needs: build-native
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # Java 25 blocked on an arrow-java 19 upgrade: the netty-backed
        # allocator probes EmptyByteBuf.memoryAddress() at init, which JDK
        # 25's module restrictions break (both netty 4.1 and 4.2). Recorded
        # in plan 04 §5; re-add 25 with the arrow-java bump.
        os: [ubuntu-latest, macos-latest]
        java: [17, 21]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: downloaded-natives
          pattern: native-*
          merge-multiple: true
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}
          cache: maven
      - name: Package fat jar with bundled natives
        run: mvn -Dnatives.dir=downloaded-natives -DskipTests package
      # Re-verify with bundling still active so the jar keeps /natives/ and
      # the suite exercises NativeLoader's bundled-extraction path.
      - name: Suite against the packaged jar (bundled-natives load path)
        run: mvn -Dnatives.dir=downloaded-natives verify
      - name: Bare-project quickstart
        run: scripts/bare-quickstart.sh "$(mvn -q help:evaluate -Dexpression=project.version -DforceStdout)" downloaded-natives

  publish:
    needs: assemble-and-test
    runs-on: ubuntu-latest
    environment: maven-central
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: downloaded-natives
          pattern: native-*
          merge-multiple: true
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: maven
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - name: Publish to Maven Central (Central Portal)
        env:
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
          CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
        run: |
          # The central-publishing-maven-plugin reads server credentials from
          # settings.xml (serverId "central"); the Portal token is a
          # username + password pair.
          mkdir -p ~/.m2
          cat > ~/.m2/settings.xml <<SETTINGS
          <settings>
            <servers>
              <server>
                <id>central</id>
                <username>\${env.CENTRAL_USERNAME}</username>
                <password>\${env.CENTRAL_TOKEN}</password>
              </server>
            </servers>
          </settings>
          SETTINGS
          # Tests already ran in assemble-and-test against the packaged jar;
          # here they would fail anyway: the test phase precedes
          # prepare-package, so the bundled /natives/ resources do not exist
          # yet and this job sets no java.library.path.
          mvn -DskipTests -Dnatives.dir=downloaded-natives -Pcentral deploy
      - name: Record missing-credentials blocker
        if: ${{ env.CENTRAL_TOKEN == '' || env.CENTRAL_USERNAME == '' }}
        env:
          CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
        run: |
          echo "::error::Central Portal credentials absent — maintainer one-time setup (plan 04 §5) is a recorded blocker."
          exit 1

  verify-publish:
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Poll Central for resolvability
        run: |
          V=$(mvn -q help:evaluate -Dexpression=project.version -DforceStdout)
          for i in $(seq 1 30); do
            CODE=$(curl -s -o /dev/null -w '%{http_code}' \
              "https://repo1.maven.org/maven2/io/laminardb/laminardb/$V/laminardb-$V.pom")
            [ "$CODE" = "200" ] && { echo "resolved on Central"; exit 0; }
            sleep 60
          done
          echo "artifact not resolvable on Central after 30 min"
          exit 1

  github-release:
    needs: verify-publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          path: downloaded-natives
          pattern: native-*
          merge-multiple: true
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: maven
      - run: mvn -Dnatives.dir=downloaded-natives -DskipTests package
      - name: Create GitHub release with jar and checksums
        run: |
          V=$(mvn -q help:evaluate -Dexpression=project.version -DforceStdout)
          shasum -a 256 target/laminardb-$V.jar > target/laminardb-$V.jar.sha256
          gh release create "v$V" --title "laminardb-java $V" \
            --notes-file <(awk "/## \[$V\]/{f=1;next} /^## /{f=0} f" CHANGELOG.md) \
            target/laminardb-$V.jar target/laminardb-$V.jar.sha256
        env:
          GH_TOKEN: ${{ github.token }}