release_and_packages.yml

name: Publish Releases & Packages

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

# Least privilege at the top, widened per job. The old file granted
# contents: write and packages: write to every job, so the Maven job could have
# pushed packages and the container job could have written the repository.
permissions:
  contents: read

# FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 was set here and does nothing. It is not a
# variable the runner reads; the action runtime is chosen by each action's
# own action.yml. Bumping the actions below is the actual fix.

jobs:
  publish-releases:
    name: Compile Native Binaries & ZIP Drop-in
    # ubuntu-22.04 was retired as a GitHub-hosted image. A job pinned to a
    # withdrawn label never gets a runner. ubuntu-latest moves with the fleet,
    # and the compiler is JDK 8 via setup-java, so the host image does not
    # constrain the build.
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7

      # setup-java v3 runs on the Node 16 action runtime, which current runners
      # refuse to execute. That failure lands on this step, inside this job,
      # which is where the reported failure appeared. v4 runs on Node 20.
      - name: Setup Java 8
        uses: actions/setup-java@v5
        with:
          java-version: '8'
          distribution: 'temurin'
          cache: 'maven'

      # -B for non-interactive log output. -DskipTests because this repository
      # has no src/test, so surefire only costs time.
      - name: Compile Native Binaries (Maven)
        run: mvn -B clean package -DskipTests

      # pom.xml binds maven-jar-plugin to target/dist and binds the dependency
      # plugin's copy-dependencies goal to prepare-package writing target/lib,
      # so both directories exist after a successful package.
      #
      # The previous version ended every copy with "|| true" and zipped
      # whatever survived. If the build layout ever changed, every copy would
      # fail silently and this step would either ship an empty archive or die
      # on zip's own "nothing to do" with no explanation. Required paths now
      # fail loudly; genuinely optional ones stay optional and say so.
      - name: Package ZIP Drop-in
        run: |
          set -euo pipefail
          mkdir -p release-pkg

          for required in target/dist target/lib configs scripts; do
            if [ ! -d "$required" ]; then
              echo "::error::$required is missing. The build layout changed or mvn package did not produce it."
              exit 1
            fi
          done

          cp -r target/dist/* release-pkg/
          cp -r target/lib release-pkg/
          cp -r configs release-pkg/
          cp -r scripts release-pkg/

          # Launch scripts are a convenience, not a build output.
          cp launch_*.sh release-pkg/ 2>/dev/null || echo "no launch_*.sh at repository root, continuing"

          if [ -z "$(ls -A release-pkg)" ]; then
            echo "::error::release-pkg is empty, refusing to publish an empty archive."
            exit 1
          fi

          cd release-pkg
          REF_NAME="${{ github.ref_name }}"
          SAFE_REF_NAME="${REF_NAME//\//-}"
          zip -r "../OriginalMS-${SAFE_REF_NAME}.zip" .

      - name: Upload Release Artifact
        # v1 is a Node 16 action. v2 runs on Node 20.
        uses: softprops/action-gh-release@v3
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          files: OriginalMS-*.zip

  publish-docker:
    name: Publish GitHub Container Package (GHCR)
    runs-on: ubuntu-latest
    needs: publish-releases
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7

      # The old version probed for a Dockerfile and set a flag that gated every
      # step below it. With no Dockerfile the job skipped everything and
      # reported SUCCESS, so a workflow named "Publish GitHub Container
      # Package" could publish nothing and still go green. The Dockerfile is
      # required here, so its absence is an error rather than a quiet skip.
      - name: Require a Dockerfile
        run: |
          if [ ! -f Dockerfile ]; then
            echo "::error::No Dockerfile at the repository root. This job exists to publish a container image."
            exit 1
          fi

      # build-push-action drives buildx. Runner images ship it, but relying on
      # a preinstalled tool makes this job depend on image contents rather than
      # on anything declared here.
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # The image path is lowercase literal on purpose: GHCR rejects uppercase
      # repository names, and github.repository_owner is "BiosSystem".
      - name: Sanitize image tag
        id: sanitize
        run: |
          REF_NAME="${{ github.ref_name }}"
          echo "safe_tag=${REF_NAME//\//-}" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          tags: ghcr.io/biossystem/originalms:latest,ghcr.io/biossystem/originalms:${{ steps.sanitize.outputs.safe_tag }}
          cache-from: type=gha
          cache-to: type=gha,mode=max