CI/CD

.github/workflows/architecture.yml

@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'

.github/workflows/build.yml

@@ -41,7 +41,7 @@ jobs:
           cache-dependency-path: web-ui/package-lock.json
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'

.github/workflows/crowdin.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python 3.15
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.15'
 

.github/workflows/format.yml

@@ -33,7 +33,7 @@ jobs:
           cache-dependency-path: web-ui/package-lock.json
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'

.github/workflows/nightly.yml

@@ -33,7 +33,7 @@ jobs:
           cache-dependency-path: web-ui/package-lock.json
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'

.github/workflows/release.yml

@@ -0,0 +1,96 @@
+name: Release
+
+on:
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: write
+  id-token: write
+  attestations: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Draft release
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    env:
+      GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Select release token
+        id: release-token
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          actor_id="$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}" \
+            --jq '.triggering_actor.id')"
+          echo "secret-name=PAT_${actor_id}" >> "${GITHUB_OUTPUT}"
+
+      - name: Set up Node.js 24
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: web-ui/package-lock.json
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+        with:
+          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+
+      - name: Cache Gradle configuration
+        if: env.GRADLE_ENCRYPTION_KEY != ''
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .gradle/configuration-cache
+          key: cc-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}-${{ github.sha }}
+          restore-keys: |
+            cc-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}-
+
+      - name: Build
+        run: |
+          chmod +x gradlew
+          ./gradlew assemble -PreleaseBuild=true --no-daemon --console=plain
+
+      - name: Attest build provenance
+        id: attest
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: build/libs/12pit.jar
+
+      - name: Create draft release
+        env:
+          GH_TOKEN: ${{ secrets[steps.release-token.outputs.secret-name] || github.token }}
+          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+          ATTESTATION_URL: ${{ steps.attest.outputs.attestation-url }}
+        run: |
+          set -euo pipefail
+
+          release_version="$(sed -n 's/^modVersion=//p' gradle.properties)"
+          cp "${ATTESTATION_BUNDLE}" build/libs/12pit.jar.sigstore.json
+          cat > "${RUNNER_TEMP}/release-notes.md" <<EOF
+          _The attached JAR was built from commit [${GITHUB_SHA::7}](https://github.com/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}) by [GitHub Actions](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}). You can click [here](${ATTESTATION_URL}) to view the build provenance attestation._
+          EOF
+
+          gh release create "${release_version}" \
+            build/libs/12pit.jar \
+            build/libs/12pit.jar.sigstore.json \
+            --repo "${GITHUB_REPOSITORY}" \
+            --title "12pit ${release_version}" \
+            --notes-file "${RUNNER_TEMP}/release-notes.md" \
+            --draft