publish.yml

name: Publish

# Both publications come from a *single* Gradle invocation, so they share one
# staging repository and one close/release: either both coordinates become public
# or neither does. That is only possible because zenoh-flat-jni is a Kotlin
# Multiplatform library — one dependency declaration resolves per target, so an
# Android-enabled build produces both publications correctly.

on:
  workflow_call:
    inputs:
      snapshot:
        required: true
        type: boolean
        description: "If the publication is for a snapshot version."
        default: false
      branch:
        description: Branch, tag or commit to publish from
        type: string
        required: false
      maven_publish:
        type: boolean
        required: false
        default: true

# The native libraries are not built here: they ship inside the
# org.eclipse.zenoh:zenoh-flat-jni artifact this SDK depends on, already
# cross-compiled and verified by that repository's release. This workflow only
# compiles Kotlin and publishes.
#
# Third-party actions are pinned to a commit, with the version in a trailing
# comment: a tag is mutable, and a moved tag runs code nobody reviewed. Actions
# under eclipse-zenoh/ are ours and stay on a branch.
jobs:
  publish_package:
    name: Publish to Maven Central
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.branch }}

      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: 11

      # v5, not v6: v6 moved caching into a proprietary component under Gradle's
      # own terms of use, which is not ours to accept for an Eclipse project.
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

      # Assembles the artifact and generates its POM without uploading, so a
      # `maven_publish: false` rehearsal actually proves something. Only the
      # remote upload below is gated.
      #
      # `--refresh-dependencies` because zenohFlatJniVersion is a snapshot that
      # the job before this one may have just replaced. Gradle caches changing
      # modules for 24 hours and setup-gradle restores that cache, so without it
      # this could compile against yesterday's copy while publishing a POM that
      # names the coordinate now holding today's.
      - name: Assemble and verify the publication
        run: ./gradlew publishJvmPublicationToMavenLocal publishAndroidReleasePublicationToMavenLocal --info --refresh-dependencies -Pandroid=true

      - name: Set pub mode env var
        # Note: This step is intended to allow publishing snapshot packages.
        # It allows to optionally append the property -PSNAPSHOT to the gradle
        # publication task on the next step, resulting in the package version
        # following the convention '<version>-SNAPSHOT'.
        run: |
          if [[ "${{ inputs.snapshot }}" == "true" ]]; then
            echo "PUB_MODE=-PSNAPSHOT" >> $GITHUB_ENV
          else
            echo "RELEASE=closeAndReleaseSonatypeStagingRepository" >> $GITHUB_ENV
          fi

      - if: ${{ inputs.maven_publish == true }}
        name: Gradle Publish JVM Package to Maven Central repository
        run: |
          ./gradlew publishJvmPublicationToSonatypeRepository \
                    publishAndroidReleasePublicationToSonatypeRepository \
                    ${{ env.RELEASE }} --info --refresh-dependencies \
                    -PremotePublication=true -Pandroid=true ${{ env.PUB_MODE }}
        env:
          CENTRAL_SONATYPE_TOKEN_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME}}
          CENTRAL_SONATYPE_TOKEN_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          ORG_GPG_KEY_ID: ${{ secrets.ORG_GPG_KEY_ID }}
          ORG_GPG_SUBKEY_ID: ${{ secrets.ORG_GPG_SUBKEY_ID }}
          ORG_GPG_PRIVATE_KEY: ${{ secrets.ORG_GPG_PRIVATE_KEY }}
          ORG_GPG_PASSPHRASE: ${{ secrets.ORG_GPG_PASSPHRASE }}

      - name: "Upload gradle problems report"
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: problem-reports-${{ github.job }}.zip
          path: ${{ github.workspace }}/build/reports/problems/

  # Everything above runs inside this repository's own build. What a user gets
  # is the published coordinate and whatever it transitively pulls in — which is
  # where a snapshot has failed before, by naming a zenoh-flat-jni that did not
  # exist. So resolve it as an outsider would and run it.
  #
  # Snapshots only: a release goes to a staging repository and is not public at
  # this point.
  consumer_test:
    name: Consume the published snapshot
    needs: publish_package
    if: ${{ inputs.snapshot == true && inputs.maven_publish == true }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.branch }}

      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: 11

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

      # A separate Gradle build with no path or composite dependency on this
      # one, resolving from the snapshot repository with `--refresh-dependencies`
      # so a cached copy of the same coordinates cannot stand in for what was
      # just uploaded.
      - name: Resolve and run it
        working-directory: ci/consumer-smoke-test
        run: |
          set -euo pipefail
          version="$(tr -d '[:space:]' < "$GITHUB_WORKSPACE/version.txt")-SNAPSHOT"
          echo "Consuming org.eclipse.zenoh:zenoh-java:$version" >> "$GITHUB_STEP_SUMMARY"
          ../../gradlew run --no-daemon --refresh-dependencies -PcandidateVersion="$version"