java-test.yaml

name: java-test

on:
  push:
    branches:
      - main
      - master
    tags:
      - '*'
  pull_request:
    branches:
      - main
    paths:
      - "java/**"
      # The consistency runner reads this shared manifest, so a golden-only
      # change must re-run this workflow.
      - "tests/consistency/**"
      - ".github/workflows/java-test.yaml"
  workflow_dispatch:

jobs:
  test-and-build:
    permissions:
      actions: write  # for styfle/cancel-workflow-action to cancel/stop running workflows
      contents: read  # for actions/checkout to fetch code
    name: "${{ matrix.root-pom }} on JDK ${{ matrix.java }} for the classifier ${{ matrix.classifier }}"
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            classifier: linux-aarch_64
            java: 8
            root-pom: 'pom.xml'
          - os: windows-latest
            classifier: windows-x86_64
            java: 8
            root-pom: 'pom.xml'
          - os: macos-latest
            classifier: osx-x86_64
            java: 8
            root-pom: 'pom.xml'
          - os: macos-latest
            classifier: osx-aarch_64
            java: 8
            root-pom: 'pom.xml'
    runs-on: ${{ matrix.os }}
    env:
      ROOT_POM: ${{ matrix.root-pom }}
    steps:
      - uses: actions/checkout@v7

      - name: 'Set up JDK ${{ matrix.java }}'
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
        with:
          java-version: ${{ matrix.java }}
          distribution: 'zulu'
          cache: 'maven'

      - uses: actions/setup-python@v7
        with:
          python-version: '3.10'

      - name: Install rust nightly toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: 1.91
          override: true
          components: clippy, rustfmt

      - name: Setup linux-aarch_64 rust target
        if: "contains(matrix.classifier, 'linux-aarch_64')"
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
          # Setup for cargo
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV

      - name: 'Test'
        shell: bash
        working-directory: java
        run: make test

      - name: 'Build and Deploy'
        shell: bash
        working-directory: java
        run: mvn clean package -DskipTests=true -Djni.classifier=${{ matrix.classifier }} -Dcargo-build.profile=release

      - name: 'Upload artifact'
        uses: actions/upload-artifact@v7
        with:
          name: kcl-lib-${{ matrix.classifier }}
          path: |
            java/target/classes/native

  build-centos7:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
    needs: [ test-and-build ]
    env:
      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Download windows x86_64 lib
        uses: actions/download-artifact@v8
        with:
          name: kcl-lib-windows-x86_64
          path: java/native

      - name: Download linux aarch_64 lib
        uses: actions/download-artifact@v8
        with:
          name: kcl-lib-linux-aarch_64
          path: java/native

      - name: Download darwin x86_64 lib
        uses: actions/download-artifact@v8
        with:
          name: kcl-lib-osx-x86_64
          path: java/native

      - name: Download darwin aarch_64 lib
        uses: actions/download-artifact@v8
        with:
          name: kcl-lib-osx-aarch_64
          path: java/native

      - name: Run tests and package in CentOS 7 container
        run: |
          docker run --rm -v ${{ github.workspace }}/java:/work kcllang/kcl-java-builder-centos7:latest bash -c "
            cd /work &&
            rustup default stable &&
            mvn package -DskipTests=true -Dcargo-build.profile=release
          "

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: kcl-lib
          path: java/target/*.jar

  deploy:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
    needs: [ test-and-build, build-centos7 ]
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up JDK 8
        uses: actions/setup-java@v6.1.0
        with:
          distribution: 'temurin'
          java-version: '8'
          server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
          settings-path: ${{ github.workspace }} # location for the settings.xml file

      - name: Download Jar
        uses: actions/download-artifact@v8
        with:
          name: kcl-lib
          path: java/release

      - name: Release to Github Packages
        if: "startsWith(github.ref, 'refs/tags/')"
        working-directory: java
        run: |
          JAR_FILE=$(find ./release -name "*.jar" ! -name "*sources.jar")
          echo "Deploying $JAR_FILE"
          mvn deploy:deploy-file \
            -Dfile=$JAR_FILE \
            -DpomFile=./pom.xml \
            -DrepositoryId=github \
            -Durl=https://maven.pkg.github.com/kcl-lang/lib \
            -s $GITHUB_WORKSPACE/settings.xml

        env:
          GITHUB_TOKEN: ${{ github.token }}

  # Maven Central publishing. Requires the four secrets listed in
  # java/pom.xml's `central` profile comment to be set in repo settings.
  # The job is skipped (not failed) when any secret is missing so the
  # workflow can land the scaffold without red builds, and quietly
  # enables Central publishing once the operator fills them in.
  # The secrets context is unavailable in job-level `if` conditions, so
  # the presence of the Central Portal credentials is computed here and
  # consumed by deploy-central through job outputs. Skipped entirely on
  # non-tag runs.
  check-central-secrets:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    outputs:
      present: ${{ steps.check.outputs.present }}
    steps:
      - id: check
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
          MAVEN_CENTRAL_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          MAVEN_CENTRAL_GPG_PASSPHRASE: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}
        run: |
          if [ -n "$MAVEN_CENTRAL_USERNAME" ] && [ -n "$MAVEN_CENTRAL_TOKEN" ] &&
             [ -n "$MAVEN_CENTRAL_GPG_PRIVATE_KEY" ] && [ -n "$MAVEN_CENTRAL_GPG_PASSPHRASE" ]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "Central Portal secrets not configured; skipping the publish job"
            echo "present=false" >> "$GITHUB_OUTPUT"
          fi

      # Probes the credentials against the Central Portal before the (slow)
      # deploy-central job burns a full Rust rebuild on a doomed publish.
      # A GET is rejected with 401 when auth fails and 500 once auth passes,
      # since the upload endpoint only accepts POST multipart bodies.
      - name: Probe Central Portal credentials
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
        run: |
          set -uo pipefail
          # Diagnostics only — never prints the secret. Length, a short
          # digest and a whitespace check tell a malformed secret apart from
          # a valid one without exposing either value.
          for v in MAVEN_CENTRAL_USERNAME MAVEN_CENTRAL_TOKEN; do
            val="${!v}"
            echo "::group::$v"
            echo "bytes: $(printf %s "$val" | wc -c | tr -d ' ')"
            echo "sha256[0:8]: $(printf %s "$val" | sha256sum | cut -c1-8)"
            if [ -z "$val" ]; then
              echo "state: EMPTY"
            elif [ "$val" != "$(printf %s "$val" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')" ]; then
              echo "state: leading/trailing WHITESPACE — this breaks HTTP Basic auth"
            else
              echo "state: clean"
            fi
            echo "::endgroup::"
          done
          code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 20 \
            -u "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_TOKEN" \
            https://central.sonatype.com/api/v1/publisher/upload) || code="000"
          echo "Central Portal credential probe: HTTP $code (401 = credentials rejected, 500 = auth OK / endpoint rejects GET)"
          if [ "$code" = "401" ]; then
            echo "::error::Central Portal rejected MAVEN_CENTRAL_USERNAME/MAVEN_CENTRAL_TOKEN"
            exit 1
          fi

  deploy-central:
    runs-on: ubuntu-latest

    permissions:
      contents: read
    needs: [ test-and-build, build-centos7, check-central-secrets ]
    if: >-
      startsWith(github.ref, 'refs/tags/') &&
      needs.check-central-secrets.outputs.present == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up JDK 8 + Central Portal credentials + GPG key
        uses: actions/setup-java@v6.1.0
        env:
          # setup-java v6 treats server-username/server-password as *names of
          # environment variables to read*, not as literal credentials. The
          # deprecated inputs take the value here, emit ${env.<value>} into
          # settings.xml, and Maven then resolves an empty user and password —
          # which Central Portal rejects with an empty-bodied 401. The v6
          # inputs below need the variables above to actually be exported.
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
        with:
          distribution: 'temurin'
          java-version: '8'
          # Writes <server id="central"> into $GITHUB_WORKSPACE/settings.xml
          # with username/password read from the env vars above.
          server-id: central
          server-username-env-var: MAVEN_CENTRAL_USERNAME
          server-password-env-var: MAVEN_CENTRAL_TOKEN
          settings-path: ${{ github.workspace }}
          # Imports the GPG key into the runner's keyring and stores the
          # passphrase where maven-gpg-plugin picks it up.
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_PRIVATE_KEY }}
          gpg-passphrase: ${{ secrets.MAVEN_CENTRAL_GPG_PASSPHRASE }}

      - name: Install Rust (cargo exec plugin re-builds the JNI lib)
        uses: actions-rs/toolchain@v1
        with:
          toolchain: 1.91
          override: true

      - name: Install Python (build.py runs under python3)
        uses: actions/setup-python@v7
        with:
          python-version: '3.10'

      - name: Build, sign, and publish to Maven Central
        working-directory: java
        env:
          # settings.xml references these by name; Maven expands ${env.X}
          # when it reads the file, so they must be exported here too, not
          # just during the setup-java step that wrote the file.
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
        run: |
          # -P central activates maven-gpg-plugin (signs all artifacts)
          # and central-publishing-maven-plugin (uploads via Central
          # Portal REST API with autoPublish=true). -DskipTests avoids
          # re-running JUnit; -Dcargo-build.profile=release matches the
          # release-mode binary the test-and-build job produced.
          mvn deploy -P central \
            -DskipTests=true \
            -Dcargo-build.profile=release \
            -s $GITHUB_WORKSPACE/settings.xml