java.yml

name: Java (Bindings)

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      publish_snapshot:
        description: Deploy a SNAPSHOT to Maven Central (only when run on main)
        type: boolean
        default: false

permissions:
  contents: read

# Manual runs get their own group so a push to main can't cancel a snapshot
# deploy midway.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  RUST_BACKTRACE: 1
  CARGO_TERM_COLOR: always
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  UV_HTTP_RETRIES: 5
  UV_HTTP_TIMEOUT: 60

jobs:
  plan:
    runs-on: ubuntu-slim
    outputs:
      test: ${{ steps.decisions.outputs.test }}
      gate: ${{ steps.decisions.outputs.gate }}
    steps:
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        if: github.event_name == 'pull_request'
        id: filter
        with:
          filters: |
            src:
              - 'core/**'
              - 'macros/**'
              - 'bindings/java/**'
              - 'Cargo.*'
              - '.github/workflows/java.yml'
      - id: decisions
        run: |
          test=${{ steps.filter.outputs.src == 'true' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
          gate=${{ github.event_name == 'pull_request' }}
          echo "test=$test" >> "$GITHUB_OUTPUT"
          echo "gate=$gate" >> "$GITHUB_OUTPUT"

  compile-bindings:
    needs: [plan]
    if: needs.plan.outputs.test == 'true'
    name: Compile native bindings
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
          - windows-latest
          - windows-11-arm
          - macos-15-intel # x86
          - macos-latest # arm64

    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      # No caches on tag builds, see cache-poisoning in .github/zizmor.yml
      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        with:
          # A cache saved by a PR is visible only to that PR, and it evicts
          # main's caches once the repository's 10GB limit is reached.
          save-if: ${{ github.ref == 'refs/heads/main' }}
          key: ${{ matrix.os }}

      - name: cargo build ...
        run: cargo build --locked --package sysand-java --release

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        if: matrix.os == 'ubuntu-24.04'
        with:
          python-version: "3.14"
      - name: Create version.txt
        if: matrix.os == 'ubuntu-24.04'
        run: python bindings/java/scripts/java-builder.py create-version-file
      - name: Upload version.txt
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: matrix.os == 'ubuntu-24.04'
        with:
          name: version
          path: version.txt
          if-no-files-found: error

      - name: Upload native bindings
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: native-bindings-${{ matrix.os }}
          path: |
            target/release/*.so
            target/release/*.dylib
            target/release/*.dll
          if-no-files-found: error
          retention-days: 5 # lower than default, many ~5 MB files

  build-jar:
    name: Build Java JAR
    needs: [compile-bindings]
    runs-on: ubuntu-24.04
    env:
      # Only `cargo metadata` runs here, which the runner's preinstalled
      # toolchain handles without installing the pinned one.
      RUSTUP_TOOLCHAIN: stable

    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.14"
      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25" # our compiler target is Java 8
          distribution: temurin

      - name: Download version.txt
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: version
      # java-builder.py reads each library from its exact artifact directory,
      # so extra artifacts matching the pattern are ignored.
      - name: Download native bindings
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: native-bindings-*
          path: native-bindings
      - name: List native bindings
        run: ls -la native-bindings/*

      # Artifacts are left unsigned here; `mvn deploy` in the release job signs
      # them, so the signing key is only exposed to that job.
      - name: Build JAR
        run: |
          python bindings/java/scripts/java-builder.py \
              ${{ startsWith(github.ref, 'refs/tags/') && '--release-jar-version' || '' }} \
              build \
              --use-existing-native-libs native-bindings \
              --use-release-build

      - name: Build Sysand Maven plugin and run integration tests
        run: |
          python bindings/java/scripts/java-builder.py \
              ${{ startsWith(github.ref, 'refs/tags/') && '--release-jar-version' || '' }} \
              build-plugin

      - name: Upload JARs
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: jars
          path: target/java
          if-no-files-found: error
          retention-days: 5 # lower than default, a ~160 MB file
      - name: Upload Maven plugin JAR
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: maven-plugin-jar
          path: target/java-plugin
          if-no-files-found: error
          # We need to include hidden files because integration tests use
          # .meta.json and .project.json files.
          include-hidden-files: true

  test-jar:
    name: Test Java JAR
    needs: [build-jar]
    runs-on: ${{ matrix.os }}
    env:
      # Only `cargo metadata` runs here, which the runner's preinstalled
      # toolchain handles without installing the pinned one.
      RUSTUP_TOOLCHAIN: stable
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
          - windows-latest
          - windows-11-arm
          - macos-15-intel # x86
          - macos-latest # arm64

    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.14"
      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          # TODO: Use temurin 25 systematically when this issue resolves
          #       https://github.com/adoptium/adoptium-support/issues/1402
          java-version: ${{ matrix.os == 'windows-11-arm' && '21' || '25' }} # our build target is Java 8+
          distribution: temurin

      - name: Download JARs
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: jars
          path: target/java
      - name: Download version.txt
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: version
      - name: List .jar files and more
        run: |
          find . -iname "*.jar"
          ls -la -- *
          ls -la target/*
          ls -la target/java/*
          ls -la target/java/target/*

      - name: Test Java JAR
        run: |
          python bindings/java/scripts/java-builder.py \
              ${{ startsWith(github.ref, 'refs/tags/') && '--release-jar-version' || '' }} \
              test

  ci-gate:
    name: Java CI Gate
    needs: [plan, compile-bindings, build-jar, test-jar]
    if: needs.plan.outputs.gate == 'true' && !cancelled()
    runs-on: ubuntu-slim
    steps:
      - run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
            exit 1
          fi

  release:
    # Nightly tags do not trigger CI since they are created in CI
    name: Release
    needs: [build-jar, test-jar]
    # Releases deploy on v* tags; SNAPSHOTs only when requested manually
    if: startsWith(github.ref, 'refs/tags/') || inputs.publish_snapshot
    environment: maven-central
    runs-on: ubuntu-24.04
    env:
      # Only `cargo metadata` runs here, which the runner's preinstalled
      # toolchain handles without installing the pinned one.
      RUSTUP_TOOLCHAIN: stable
    permissions:
      id-token: write # for actions/attest
      attestations: write # for actions/attest
      artifact-metadata: write # for actions/attest

    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.14"
      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: "25" # our build target is Java 8+
          distribution: temurin
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Download native bindings
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: jars
          path: target/java
      - name: Download Maven plugin JAR
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: maven-plugin-jar
          path: target/java-plugin
      - name: Download version.txt
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: version
      - name: List .jar files and more
        run: |
          find . -iname "*.jar"
          find target/java-plugin/target/it/

      - name: Deploy Java bindings
        run: python bindings/java/scripts/java-builder.py deploy
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_TOKEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}

      # After deploy: `mvn deploy` reruns the package phase, which may rebuild
      # the jars, so attest the files that were actually uploaded.
      - name: Generate artifact attestation
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: |
            target/java/target/*.jar
            target/java-plugin/target/*.jar