java_release.yml

name: Java Release workflow

on:
  workflow_call:
    inputs:
      promote:
        type: boolean
        description: Promote release to stable (for release-* branches only)
        default: false
      draft-stable-releases:
        type: boolean
        description: Create stable GitHub releases as drafts
        default: false
      bypass-checks:
        type: boolean
        default: false
        description: Do not fail pipeline if checks failed
      style-checks-enabled:
        type: boolean
        default: true
        description: Enable style_checks
      style-checks-bypassed:
        type: boolean
        default: false
        description: Do not fail pipeline if style_checks failed
      code-checks-enabled:
        type: boolean
        default: true
        description: Enable code_checks
      code-checks-bypassed:
        type: boolean
        default: false
        description: Do not fail pipeline if code_checks failed
      ort-enabled:
        type: boolean
        default: true
        description: Enable ORT scanning
      ort-bypassed:
        type: boolean
        default: false
        description: Do not fail pipeline if ORT scan failed
      ort-version:
        type: string
        default: "85.0.0" # HACK: pin ORT version due to java.util.NoSuchElementException in 85.1.0
        description: ORT version to use
      ort-config-repository:
        type: string
        default: "https://github.com/oss-review-toolkit/ort-config.git"
        description: ORT config repository to use
      ort-config-revision:
        type: string
        default: "5650fed55a20397b9abb9017a0c6bb674dc8481d"
        description: ORT config revision to use
      trivy-enabled:
        type: boolean
        default: true
        description: Enable Trivy scanning
      trivy-bypassed:
        type: boolean
        default: false
        description: Do not fail pipeline if Trivy failed
      trivy-severity:
        type: string
        default: "CRITICAL,HIGH"
        description: Severities of vulnerabilities to fail the build
      trivy-severity-for-sarif:
        type: string
        default: "CRITICAL,HIGH"
        description: Severities of vulnerabilities in SARIF report
      trivy-limit-severities-for-sarif:
        type: boolean
        default: true
        description: By default SARIF format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to true and specify desired severities in the `trivy-severity-for-sarif` parameter
      java-version:
        type: string
        default: "17"
        description: Java version to use
      java-distribution:
        type: string
        default: "temurin"
        description: Java distribution to use
      maximize-build-space:
        type: boolean
        default: false
        description: Maximize build space by removing unwanted software
      runs-on:
        type: string
        description: Overrides jobs runs-on settings (json-encoded list)
        default: '["ubuntu-24.04"]'
      platforms:
        type: string
        description: Docker build platforms
        default: "linux/amd64"
      filter-version:
        type: string
        description: Operate within versions matched regex
        default: '[0-9]+\.[0-9]+'
      primary-branch-pattern:
        type: string
        description: Regex pattern for the primary branch. Matching branch uses development flow
        default: '^development$'
      release-branch-pattern:
        type: string
        description: Regex pattern for release branches. Branch name must end with X.Y to extract release line
        default: '^release-[0-9]+\.[0-9]+$'
      docker-development-tag:
        type: string
        description: Development tag for docker images
        default: 'development'

jobs:
  test:
    uses: ./.github/workflows/java_test.yml
    with:
      bypass-checks: ${{ inputs.bypass-checks }}
      style-checks-enabled: ${{ inputs.style-checks-enabled }}
      style-checks-bypassed: ${{ inputs.style-checks-bypassed }}
      code-checks-enabled: ${{ inputs.code-checks-enabled }}
      code-checks-bypassed: ${{ inputs.code-checks-bypassed }}
      ort-enabled: ${{ inputs.ort-enabled }}
      ort-bypassed: ${{ inputs.ort-bypassed }}
      ort-version: ${{ inputs.ort-version }}
      ort-config-repository: ${{ inputs.ort-config-repository }}
      ort-config-revision: ${{ inputs.ort-config-revision }}
      java-version: ${{ inputs.java-version }}
      java-distribution: ${{ inputs.java-distribution }}
      runs-on: ${{ inputs.runs-on }}

  dependency-graph:
    # Do not submit dependencies on private repos - GitHub Advanced Security is not enabled
    if: ${{ !github.event.repository.private }}
    runs-on: ${{ fromJSON(inputs.runs-on) }}
    permissions:
      contents: write # to submit dependency graph
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          lfs: true
      - uses: epam/ai-dial-ci/actions/java_prepare@4.7.2
        with:
          java-version: ${{ inputs.java-version }}
          java-distribution: ${{ inputs.java-distribution }}
      - uses: gradle/actions/dependency-submission@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
          dependency-graph: generate-and-submit # Default value is 'generate-submit-and-upload', but we don't need job artifacts here
        env:
          GPR_USERNAME: ${{ github.actor }}
          GPR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

  calculate_version:
    runs-on: ${{ fromJSON(inputs.runs-on) }}
    outputs:
      next-version: ${{ steps.semantic_versioning.outputs.next-version }}
      is-latest: ${{ steps.semantic_versioning.outputs.is-latest }}
      latest-stable-tag: ${{ steps.semantic_versioning.outputs.latest-stable-tag }}
      changelog-mode: ${{ steps.semantic_versioning.outputs.changelog-mode }}
    steps:
      - uses: epam/ai-dial-ci/actions/semantic_versioning@4.7.2
        id: semantic_versioning
        with:
          promote: ${{ inputs.promote }}
          filter-version: ${{ inputs.filter-version }}
          primary-branch-pattern: ${{ inputs.primary-branch-pattern }}
          release-branch-pattern: ${{ inputs.release-branch-pattern }}

  release:
    runs-on: ${{ fromJSON(inputs.runs-on) }}
    permissions:
      contents: write
      packages: write
      security-events: write
    needs:
      - calculate_version
      - test
    steps:
      - name: Maximize build space
        uses: nepalevov/maximize-build-space@046c48361370e2f3fa758bd2f10c6ce29109ef62 # v1.1.0
        if: ${{ inputs.maximize-build-space }}
        with:
          remove-dotnet: "true"
          remove-android: "true"
          remove-haskell: "true"
          remove-codeql: "true"
          remove-large-packages: "true"
          remove-cached-tools: "true"
          remove-swapfile: "true"
          remove-java: "true"
          remove-swift: "true"
          remove-julia: "true"
          remove-browsers: "true"
          remove-cloud-tools: "true"
          remove-kubernetes-tools: "true"
          remove-powershell: "true"
          remove-container-tools: "true"
          remove-rust: "true"
          remove-python: "true"
          remove-node: "true"
          remove-go: "true"
          remove-ruby: "true"
          docker-cleanup: "true"
          set-tmpdir: "true"
      - uses: epam/ai-dial-ci/actions/generate_release_notes@4.7.2
        with:
          latest-tag: ${{ needs.calculate_version.outputs.latest-stable-tag }}
          use-merge-base: ${{ needs.calculate_version.outputs.changelog-mode == 'merge-base' }}
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          lfs: true
          token: ${{ secrets.ACTIONS_BOT_TOKEN }}
      - uses: epam/ai-dial-ci/actions/java_prepare@4.7.2
        with:
          java-version: ${{ inputs.java-version }}
          java-distribution: ${{ inputs.java-distribution }}
      - name: Set version
        shell: bash
        run: |
          sed -i -E "s/^([ \t]*version[ \t]*=[ \t]*)[\"'].*[\"']/\1\"${{ needs.calculate_version.outputs.next-version }}\"/g" build.gradle
      - uses: epam/ai-dial-ci/actions/build_docker@4.7.2
        with:
          ghcr-username: ${{ github.actor }}
          ghcr-password: ${{ secrets.ACTIONS_BOT_TOKEN }}
          dockerhub-username: ${{ secrets.DOCKERHUB_LOGIN }}
          dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
          image-names: |
            ${{ env.IMAGE_NAME }}
            ghcr.io/${{ env.IMAGE_NAME }}
          image-tags: |
            type=raw,value=${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.next-version || inputs.docker-development-tag }}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/heads/release-') && needs.calculate_version.outputs.is-latest == 'true' }}
          push-enabled: true
          trivy-enabled: ${{ inputs.trivy-enabled }}
          bypass-checks: ${{ inputs.trivy-bypassed }}
          trivy-severity: ${{ inputs.trivy-severity }}
          trivy-severity-for-sarif: ${{ inputs.trivy-severity-for-sarif }}
          trivy-limit-severities-for-sarif: ${{ inputs.trivy-limit-severities-for-sarif }}
          gpr-username: ${{ github.actor }}
          gpr-password: ${{ secrets.GITHUB_TOKEN }}
          platforms: ${{ inputs.platforms }}
        env:
          IMAGE_NAME: ${{ github.repository }}
      - uses: epam/ai-dial-ci/actions/publish_tag_release@4.7.2
        if: ${{ startsWith(github.ref, 'refs/heads/release-') }}
        with:
          git-user-name: ${{ vars.ACTIONS_BOT_NAME || 'ai-dial-actions' }}
          git-user-email: ${{ vars.ACTIONS_BOT_EMAIL || '149404362+ai-dial-actions@users.noreply.github.com' }}
          tag-version: ${{ needs.calculate_version.outputs.next-version }}
          changelog-file: "/tmp/my_changelog" # comes from generate_release_notes step; TODO: beautify
          draft-stable-releases: ${{ inputs.draft-stable-releases }}
          make-latest: ${{ needs.calculate_version.outputs.is-latest == 'true' }}
          extra-commit-command: |
            git add build.gradle
            git commit -m '[skip ci] Update version' || true # upstream branch may already be updated