release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  native-libraries:
    name: Build native library (${{ matrix.resource-directory }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            resource-directory: linux-x86_64
            library-name: libpbivnorm.so
            platform: linux
          - runner: macos-15-intel
            resource-directory: macos-x86_64
            library-name: libpbivnorm.dylib
            platform: macos
          - runner: macos-14
            resource-directory: macos-aarch64
            library-name: libpbivnorm.dylib
            platform: macos

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install macOS Fortran compiler
        if: matrix.platform == 'macos'
        run: |
          if ! command -v gfortran >/dev/null 2>&1; then
            brew install gcc
          fi
          compiler="$(command -v gfortran || true)"
          if [ -z "$compiler" ]; then
            compiler="$(find "$(brew --prefix gcc)/bin" -maxdepth 1 -type f -name 'gfortran-*' | sort | tail -n 1)"
          fi
          test -n "$compiler"
          echo "GFORTRAN=$compiler" >> "$GITHUB_ENV"

      - name: Build native pbivnorm library
        run: |
          resourceDirectory="src/main/resources/native/${{ matrix.resource-directory }}"
          mkdir -p "$resourceDirectory"
          if [ "${{ matrix.platform }}" = "macos" ]; then
            "$GFORTRAN" -dynamiclib -O2 -std=legacy -ffixed-line-length-none \
              -static-libgfortran -static-libquadmath -static-libgcc \
              src/main/fortran/pbivnorm.f \
              -o "$resourceDirectory/${{ matrix.library-name }}"
            otool -L "$resourceDirectory/${{ matrix.library-name }}"
            if otool -L "$resourceDirectory/${{ matrix.library-name }}" \
              | grep -E 'libgfortran|libquadmath|/opt/homebrew|/usr/local/opt'; then
              echo "The bundled dylib must not depend on a Homebrew runtime." >&2
              exit 1
            fi
          else
            gfortran -shared -fPIC -O2 -std=legacy -ffixed-line-length-none \
              src/main/fortran/pbivnorm.f \
              -o "$resourceDirectory/${{ matrix.library-name }}"
          fi

      - name: Upload native library
        run: |
          artifactDirectory="release-native/${{ matrix.resource-directory }}"
          mkdir -p "$artifactDirectory"
          cp "src/main/resources/native/${{ matrix.resource-directory }}/${{ matrix.library-name }}" \
            "$artifactDirectory/${{ matrix.library-name }}"

      - name: Upload native library
        uses: actions/upload-artifact@v4
        with:
          name: pbivnorm-${{ matrix.resource-directory }}
          path: release-native
          if-no-files-found: error

  release:
    name: Build and publish release artifacts
    runs-on: ubuntu-latest
    needs: native-libraries

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 22
          cache: maven
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Validate release tag
        id: version
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Expected a semantic-version tag such as v1.0.2, got: $GITHUB_REF_NAME" >&2
            exit 1
          fi
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "Release tags must point to a commit reachable from main." >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Make Maven wrapper executable
        run: chmod +x mvnw

      - name: Materialize and validate release POM versions
        env:
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
        run: bash scripts/validate-release-poms.sh "$RELEASE_VERSION"

      - name: Collect native pbivnorm libraries
        uses: actions/download-artifact@v4
        with:
          pattern: pbivnorm-*
          path: src/main/resources/native
          merge-multiple: true

      - name: Verify, sign and publish to Maven Central
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
        run: >-
          ./mvnw -B -ntp -Pcentral-release
          -Drevision=${{ steps.version.outputs.version }}
          clean deploy

      - name: Collect release artifacts and generate checksums
        run: |
          mkdir release-artifacts
          cp thegreeklab-core/target/thegreeklab-*.jar release-artifacts/
          cp thegreeklab-visualization/target/thegreeklab-visualization-*.jar release-artifacts/
          cd release-artifacts
          sha256sum \
            thegreeklab-${{ steps.version.outputs.version }}.jar \
            thegreeklab-${{ steps.version.outputs.version }}-sources.jar \
            thegreeklab-${{ steps.version.outputs.version }}-javadoc.jar \
            thegreeklab-visualization-${{ steps.version.outputs.version }}.jar \
            thegreeklab-visualization-${{ steps.version.outputs.version }}-sources.jar \
            thegreeklab-visualization-${{ steps.version.outputs.version }}-javadoc.jar \
            > SHA256SUMS

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          assets=(
            "release-artifacts/thegreeklab-$VERSION.jar"
            "release-artifacts/thegreeklab-$VERSION-sources.jar"
            "release-artifacts/thegreeklab-$VERSION-javadoc.jar"
            "release-artifacts/thegreeklab-visualization-$VERSION.jar"
            "release-artifacts/thegreeklab-visualization-$VERSION-sources.jar"
            "release-artifacts/thegreeklab-visualization-$VERSION-javadoc.jar"
            "release-artifacts/SHA256SUMS"
          )

          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            gh release upload "$GITHUB_REF_NAME" "${assets[@]}" --clobber
          else
            gh release create "$GITHUB_REF_NAME" "${assets[@]}" \
              --verify-tag \
              --title "theGreekLab $GITHUB_REF_NAME" \
              --generate-notes
          fi