release.yml

name: Release

on:
  workflow_dispatch:
  pull_request:
    types: [closed]
    branches:
      - main

concurrency:
  group: scratch-library-release
  cancel-in-progress: false

jobs:
  validate:
    if: (github.event.pull_request.merged == true && github.event.pull_request.head.ref == 'changeset') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-maven
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 25
          cache: maven
      - run: mvn -B test
      - uses: ./.github/actions/check-browser

  release:
    needs: validate
    if: (github.event.pull_request.merged == true && github.event.pull_request.head.ref == 'changeset') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest

    permissions:
      contents: write   # needed for release + deleting branches
      pages: write      # needed to publish to GitHub Pages
      id-token: write   # required for GitHub Pages deployment
      packages: write   # needed for Maven Central deploy

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      # Maven 3.10 writes Resolver metadata into the Central staging tree,
      # which makes the portal reject an otherwise complete release bundle.
      - uses: ./.github/actions/setup-maven

      - name: Set up Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          # Match the Javadoc toolchain used by validation and shared catalogs.
          # maven.compiler.release still targets Java 17 for the library.
          java-version: 25
          cache: maven
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD

      - name: Import GPG key
        run: |
          mkdir -p ~/.gnupg
          chmod 700 ~/.gnupg
          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

      - name: Deploy to Maven Central (signed)
        run: |
          mvn --version
          # A previous attempt may have published to Central before a later
          # catalog or GitHub upload failed. Reuse immutable published versions.
          mvn -B clean deploy -Pcentral -Dgpg.executable=gpg -DignorePublishedComponents=true -DwaitUntil=published
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Build NRW jar
        # The NRW build returns the List of the NRW Zentralabitur from find,
        # getAll and getTouchingSprites. It is only offered as a download, and
        # the next step cleans the build, so the jar is put aside first.
        run: |
          mvn -B clean package -Pnrw -DskipTests
          mkdir -p dist
          cp all/target/*-nrw-all.jar dist/

      - name: Build fat jar, sources and Javadoc
        # Tests already ran as part of the deploy step above. The central
        # profile adds the sources and Javadoc jars; nothing is signed here.
        run: mvn -B clean package -Pcentral -Dgpg.skip=true -DskipTests

      - name: Require current catalogs and assemble offline examples
        run: |
          ./scripts/reference-docs.sh
          python3 scripts/browser-compatibility.py --check
          python3 scripts/release-catalogs.py --check
          python3 scripts/release-catalogs.py --archive dist/scratch-catalogs.zip

      - name: Checkout curriculum for the release course pack
        uses: actions/checkout@v7
        with:
          repository: openpatch/hyperbook-informatik
          path: .validation/curriculum

      - name: Assemble offline course pack
        run: python3 scripts/build-course-pack.py --curriculum .validation/curriculum --output dist/scratch-to-java-course.zip

      - name: Get project version
        id: get-version
        run: |
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "Detected version: $VERSION"

      - name: Take the release notes from CHANGELOG.md
        # The notes are the version's entry in the changelog, which the version
        # bump wrote from the changesets. Not the merged PR's description: when a
        # release run fails, the PR that fixes it is the one that releases.
        run: |
          awk -v heading="## $VERSION" '
            $0 == heading { found = 1; next }
            found && /^## / { exit }
            found { print }
          ' CHANGELOG.md | sed -e '/./,$!d' | sed -e ':a' -e '/^\n*$/{$d;N;ba' -e '}' > "$RUNNER_TEMP/release-notes.md"
          if [ ! -s "$RUNNER_TEMP/release-notes.md" ]; then
            echo "Automated release of version $VERSION" > "$RUNNER_TEMP/release-notes.md"
          fi
          cat "$RUNNER_TEMP/release-notes.md"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ env.VERSION }}
          name: v${{ env.VERSION }}
          body_path: ${{ runner.temp }}/release-notes.md
          files: |
            all/target/scratch-*-all.jar
            core/target/scratch-*.jar
            dist/*.jar
            dist/*.zip

      - name: Delete changeset branch
        run: |
          echo "Deleting branch 'changeset'"
          git push origin --delete changeset || true