release.yaml

# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.0rg/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Release Project

permissions:
  contents: read

# This workflow is triggered by pushes to the `master` branch.
# It first checks if `.github/piper-cut-cl.json` has been modified in the latest push.
# If changes are detected, indicating a new release cut, the workflow proceeds to:
# 1.  Tag the repository at the current commit with the new version ID.
# 2.  Run the test suite.
# 3.  If tests pass, publish the release artifacts to Sonatype.
on:
  push:
    # TODO(dramaix): Trigger this workflow only when .github/piper-cut-cl.json is modified.
    branches: [ master ]

jobs:
  tag_release_version_id:
    name: Tag Release Version ID
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      foundNewRelease: ${{ steps.detect_changes.outputs.foundNewRelease }}
      tag: ${{ fromJson(steps.set_piper_json_vars.outputs.piperJson).version_id }}
    steps:
    # Checkout the piper-cut-cl.json from the most recent two commits
    - name: Checkout Current closure-compiler Commit
      # https://github.com/marketplace/actions/checkout
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        fetch-depth: 2
        sparse-checkout: |
          .github/piper-cut-cl.json
          .github/ci_support/tag_release_version.sh
        sparse-checkout-cone-mode: false

    - id: detect_changes
      run: |
        PIPER_DIFF=$(git diff HEAD~1 -- .github/piper-cut-cl.json)
        FOUND_NEW_RELEASE=$([ -n "$PIPER_DIFF" ] && echo "true" || echo "false")
        echo "foundNewRelease=$FOUND_NEW_RELEASE" >> "$GITHUB_OUTPUT"
        echo "foundNewRelease: $FOUND_NEW_RELEASE"

    - id: set_piper_json_vars
      # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#steps-context
      run: |
        {
            echo 'piperJson<<EOF'
            cat ./.github/piper-cut-cl.json
            echo EOF
        } >> "$GITHUB_OUTPUT"

    # Check out all historical commits
    # This is much more expensive than just checking out the most recent
    # 2 commits, as done above, so only do this if actually cutting a release
    - name: Checkout all closure-compiler commits and tags
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      if: ${{ steps.detect_changes.outputs.foundNewRelease == 'true' }}
      with:
        # a depth of 0 triggers a fetch of all historical commits/branches/tags
        # https://github.com/marketplace/actions/checkout#Fetch-all-history-for-all-tags-and-branches
        fetch-depth: 0

    - name: Tag cut CL
      id: tag_cut_cl
      if: ${{ steps.detect_changes.outputs.foundNewRelease == 'true' }}
      run: |
          git config --global user.name "${GITHUB_ACTOR}"
          git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
          .github/ci_support/tag_release_version.sh \
              "${{ fromJson(env.piperJson).piper_cut_cl }}" \
              "${{ fromJson(env.piperJson).version_id }}";
      env:
        piperJson: ${{ steps.set_piper_json_vars.outputs.piperJson }}
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  run-tests:
    uses: ./.github/workflows/run_tests.yaml
    needs: tag_release_version_id
    # Only run tests if a new release is being cut.
    if: ${{ needs.tag_release_version_id.outputs.foundNewRelease == 'true' }}
    with:
      ref: ${{ needs.tag_release_version_id.outputs.tag }}

  publish-to-sonatype:
    runs-on: ubuntu-latest
    # Only publish if tests passed.
    needs: [tag_release_version_id, run-tests]

    steps:
      - name: Check secrets are provided
        run: |
          check_secret() {
            if [[ -z "${2:-}" ]]; then
              echo "Error: secret ${1} is required but not provided."
              exit 1
            fi
          }
          check_secret "SONATYPE_USERNAME_TOKEN" "${{ secrets.SONATYPE_USERNAME_TOKEN }}"
          check_secret "SONATYPE_PASSWORD_TOKEN" "${{ secrets.SONATYPE_PASSWORD_TOKEN }}"
          check_secret "MAVEN_GPG_PRIVATE_KEY" "${{ secrets.MAVEN_GPG_PRIVATE_KEY }}"
          check_secret "MAVEN_GPG_PASSPHRASE" "${{ secrets.MAVEN_GPG_PASSPHRASE }}"

      - name: Checkout the repo at the release tag
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          ref: ${{ needs.tag_release_version_id.outputs.tag }}

      # Maven and Bazel require Java to be available.
      - name: Setup Java
        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
        with:
          java-version: '21'
          distribution: 'zulu'
          java-package: jdk
          # This will trigger the import of the private key in the GPG secret keyring.
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          # This will create the maven settings.xml file needed for deploying to Sonatype.
          server-id: central
          # Configure Maven settings to use environment variables. These environment variables are
          # populated from GitHub secrets in the publication steps.
          server-username: SONATYPE_USERNAME_TOKEN
          server-password: SONATYPE_PASSWORD_TOKEN
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Setup Bazel
        uses: bazelbuild/setup-bazelisk@v3

      - name: Upload and Publish to Sonatype
        run: |
          ./release.sh --sonatype-auto-publish
        env:
          RELEASE_NUM: ${{ needs.tag_release_version_id.outputs.tag }}
          SONATYPE_USERNAME_TOKEN: ${{ secrets.SONATYPE_USERNAME_TOKEN }}
          SONATYPE_PASSWORD_TOKEN: ${{ secrets.SONATYPE_PASSWORD_TOKEN }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}