release.yml

name: Prepare release

on:
  workflow_dispatch:
    inputs:
      developmentVersion:
        description: "Default version to use for new local working copy."
        required: true
        default: "X.Y.Z-SNAPSHOT"
      dryRun:
        description: "Dry run: build every platform and assemble the deployment bundle, but push no commits or tags and publish nothing."
        required: false
        type: boolean
        default: false

# Preparation pushes commits/tags and dispatches publication; dry-run jobs stay read-only.
permissions:
  contents: read

# Two releases at once would race on the pushed commits and tags.
concurrency:
  group: release-prepare
  cancel-in-progress: false

jobs:
  # Nothing reaches main before release:prepare has succeeded: the changelog
  # commit is made locally, release:prepare adds its two commits and the tag on
  # top, and all of it is pushed in one atomic push at the end. A failure on the
  # way leaves main untouched, so the release can simply be dispatched again.
  prepare-release:
    name: Prepare release
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      actions: write
    outputs:
      release_version: ${{ steps.release-version.outputs.version }}
    steps:
      # The full history, for git-cliff.
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0

      # Maven release:prepare needs a named branch, pinned to the dispatched SHA.
      - name: Git config
        run: |
          git switch -C main
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"

      # The version is the one release:prepare will tag: the pom's version without
      # -SNAPSHOT. git-cliff is told it rather than bumping from the commit types, so
      # that the changelog, the Maven tag and the GitHub release always agree.
      - name: Determine and check the versions
        id: release-version
        env:
          DEVELOPMENT_VERSION: ${{ inputs.developmentVersion }}
        run: |
          version=$(sed -n '0,/<version>/s|.*<version>\([^<]*\)</version>.*|\1|p' pom.xml)
          version="${version%-SNAPSHOT}"
          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::The release version must look like 1.2.3"
            exit 1
          fi
          echo "Release version: $version, next development version: $DEVELOPMENT_VERSION"

          if ! [[ "$DEVELOPMENT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-SNAPSHOT$ ]]; then
            echo "::error::developmentVersion must look like 1.2.3-SNAPSHOT, got '$DEVELOPMENT_VERSION'"
            exit 1
          fi
          if [ "${DEVELOPMENT_VERSION%-SNAPSHOT}" == "$version" ]; then
            echo "::error::developmentVersion must differ from the release version $version"
            exit 1
          fi
          if git rev-parse -q --verify "refs/tags/v$version" >/dev/null; then
            echo "::error::Tag v$version already exists"
            exit 1
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=v$version" >> "$GITHUB_OUTPUT"

      - name: Update CHANGELOG.md
        uses: orhun/git-cliff-action@v4
        with:
          config: .github/changelog/cliff.toml
          args: -v --tag ${{ steps.release-version.outputs.tag }} --use-branch-tags
        env:
          OUTPUT: CHANGELOG.md

      # The docs' versions go into this commit, so that the tagged tree already
      # names the version it releases.
      - name: Commit CHANGELOG.md and the docs' versions
        env:
          RELEASE_TAG: ${{ steps.release-version.outputs.tag }}
          RELEASE_VERSION: ${{ steps.release-version.outputs.version }}
          DEVELOPMENT_VERSION: ${{ inputs.developmentVersion }}
        run: |
          sed -i -e "s/VERSION: '.*'/VERSION: '$RELEASE_VERSION'/" \
            -e "s/VERSION_SNAPSHOT: '.*'/VERSION_SNAPSHOT: '$DEVELOPMENT_VERSION'/" docs/.vitepress/versions.ts

          git add CHANGELOG.md docs/.vitepress/versions.ts
          git commit -m "chore(release): Update CHANGELOG.md for $RELEASE_TAG"

      - name: Set up Java
        uses: actions/setup-java@v6
        with:
          java-version: '17'
          distribution: 'temurin'

      # preparationGoals is "clean validate" instead of the default "clean verify":
      # verify would compile WebRTC and FFmpeg here, on a runner without their
      # caches, only for the platform jobs below to build the tagged tree again.
      #
      # A dry run transforms the poms and writes release.properties, but creates no
      # commit and no tag, so there is nothing to push below.
      - name: Prepare release
        env:
          DEVELOPMENT_VERSION: ${{ inputs.developmentVersion }}
          EXPECTED_VERSION: ${{ steps.release-version.outputs.version }}
        run: |
          mvn -B release:prepare -DpushChanges=false \
            -DpreparationGoals="clean validate" \
            -DdryRun=${{ inputs.dryRun }} \
            -DdevelopmentVersion="$DEVELOPMENT_VERSION"

          # Get the release version from the release.properties file
          RELEASE_VERSION=$(grep "project.rel.dev.onvoid.webrtc\\\:webrtc-java=" release.properties 2>/dev/null | cut -d'=' -f2 || true)
          echo "Extracted release version from release.properties: ${RELEASE_VERSION:-<none>}"

          if [ "$RELEASE_VERSION" != "$EXPECTED_VERSION" ]; then
            echo "::error::release:prepare chose version '$RELEASE_VERSION', expected '$EXPECTED_VERSION'"
            exit 1
          fi

      # The branch and the tag land together or not at all.
      - name: Push release commits and tag
        if: ${{ !inputs.dryRun }}
        env:
          RELEASE_TAG: ${{ steps.release-version.outputs.tag }}
        run: git push --atomic origin HEAD:main "refs/tags/$RELEASE_TAG"

      # Explicit dispatch is supported with GITHUB_TOKEN, unlike push events.
      # --ref makes the new run's github.sha the release commit itself.
      - name: Start publication on the release tag
        if: ${{ !inputs.dryRun }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.release-version.outputs.tag }}
        run: gh workflow run release-publish.yml --ref "$RELEASE_TAG"

  platforms:
    needs: prepare-release
    if: inputs.dryRun
    uses: ./.github/workflows/platforms.yml
    with:
      retention-days: 7
      version: ${{ needs.prepare-release.outputs.release_version }}

  publish-central:
    name: Assemble dry-run deployment bundle
    if: inputs.dryRun
    needs: [prepare-release, platforms]
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.sha }}

      - name: Set up Maven cache
        uses: actions/cache@v6
        with:
          path: |
            ~/.m2/repository
            !~/.m2/repository/dev/onvoid/webrtc
          key: maven-publish-${{ hashFiles('**/pom.xml') }}
          restore-keys: maven-publish-

      - name: Set up JDK 17
        uses: actions/setup-java@v6
        with:
          java-version: '17'
          distribution: 'temurin'
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_TOKEN
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Set the release dry-run version
        env:
          RELEASE_VERSION: ${{ needs.prepare-release.outputs.release_version }}
        run: mvn -B versions:set -DnewVersion="$RELEASE_VERSION" -DgenerateBackupPoms=false

      # Sign and assemble the real release bundle, but never upload it. The
      # placeholder credentials also prevent publication if skipUpload regresses.
      - name: Deploy
        uses: ./.github/actions/publish
        env:
          MAVEN_USERNAME: dry-run-must-not-upload
          MAVEN_TOKEN: dry-run-must-not-upload
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
        with:
          version: ${{ needs.prepare-release.outputs.release_version }}
          profiles: release
          skip-upload: true

      - name: Verify the dry-run deployment bundle exists
        run: test -s target/central-publishing/central-bundle.zip

      - name: Summarize what would have been published
        run: |
          {
            echo "## Dry run — nothing was published"
            echo
            echo "Version: \`${{ needs.prepare-release.outputs.release_version }}\`"
            echo
            echo "Artifacts destined for the deployment bundle:"
            echo '```'
            ls -1 webrtc/target/*.jar webrtc/target/*.asc \
              webrtc-java-media/target/*.jar webrtc-java-media/target/*.asc \
              webrtc-java-javafx/target/*.jar webrtc-java-javafx/target/*.asc \
              natives/*.asc 2>/dev/null || true
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload the deployment bundle for inspection
        uses: actions/upload-artifact@v7
        with:
          name: deployment-bundle-dry-run
          path: |
            target/central-publishing/central-bundle.zip
            webrtc/target/central-*/**
            webrtc/target/*.jar
            webrtc/target/*.asc
            webrtc-java-media/target/central-*/**
            webrtc-java-media/target/*.jar
            webrtc-java-media/target/*.asc
            webrtc-java-javafx/target/central-*/**
            webrtc-java-javafx/target/*.jar
            webrtc-java-javafx/target/*.asc
            natives/*.asc
          if-no-files-found: error
          retention-days: 7