release.yml

name: Release

# Cutting a release is a tag push: `git tag v0.1.0 && git push origin v0.1.0`.
# The tag's version (v0.1.0 -> 0.1.0) is injected via -PVERSION, so the committed
# gradle.properties stays at -SNAPSHOT. Publishes every library module to Maven
# Central (Central Portal, signed, auto-released) and opens a GitHub Release.
#
# Requires these org-level secrets (already configured on devslab-kr; shared with
# the ssrf-guard / api-log / easy-paging release workflows):
#   MAVEN_CENTRAL_USERNAME / MAVEN_CENTRAL_PASSWORD  — Central Portal token
#   SIGNING_KEY / SIGNING_KEY_ID / SIGNING_KEY_PASSWORD — ASCII-armored GPG key
# If the org secrets are scoped to "selected repositories", grant this repo access.

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-*"

permissions:
  contents: write

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      # The build's Java toolchain pins vendor = GraalVM (build.gradle.kts), so the
      # runner must provide a GraalVM JDK 21 — a temurin JDK makes Gradle fail with
      # "Cannot find a Java installation … matching {vendor=GraalVM Community}".
      # Mirrors build.yml so the release path and the CI path use the same JDK.
      - name: Set up Java 21 (GraalVM CE)
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '21'
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Derive version from tag
        id: ver
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"

      - name: Build and test
        run: ./gradlew build --no-configuration-cache --stacktrace -PVERSION=${{ steps.ver.outputs.version }}

      - name: Publish to Maven Central
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          # SIGNING_KEY_ID is the 16-char long form, but Gradle's PgpKeyId only
          # accepts the 8-char short form — trim to the last 8 (same as the
          # ssrf-guard / api-log release workflows).
          SIGNING_KEY_ID_RAW: ${{ secrets.SIGNING_KEY_ID }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_KEY_PASSWORD }}
        run: |
          export ORG_GRADLE_PROJECT_signingInMemoryKeyId="${SIGNING_KEY_ID_RAW: -8}"
          ./gradlew publishAndReleaseToMavenCentral \
            --no-configuration-cache \
            --stacktrace \
            -PVERSION=${{ steps.ver.outputs.version }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true
          name: ${{ github.ref_name }}
          fail_on_unmatched_files: false
          # Glob across every module's build/libs/ so the release page picks up
          # all 16 library modules without per-module entries.
          files: |
            **/build/libs/*.jar
            **/build/libs/*.asc