java-release.yml

name: Build Java Release
on:
  push:
    tags:
      # if you change this pattern, make sure jobs.strip-tag still works
      - 'release/java/v[0-9]+.[0-9]+.[0-9]+'

permissions: {}

jobs:
  ci:
    uses: ./.github/workflows/java-build.yml

  strip-tag:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: process tag
        id: version
        env:
          TAG: ${{ github.ref_name }}
        run: |
          echo "version=${TAG#"release/java/v"}" >> $GITHUB_OUTPUT

  build:
    runs-on: ubuntu-latest
    needs: [ci, strip-tag]
    permissions:
      id-token: write # to sign with sigstore
    steps:
      - name: checkout tag
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Set up JDK 11
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          java-version: 11 
          distribution: 'temurin'

      - name: Build project
        working-directory: ./java
        env:
          VERSION: ${{ needs.strip-tag.outputs.version }}
        run: |
          # override the version in gradle.properties
          # we have to do some post processing with pgp signatures, cause those secrets aren't online yet
          ./gradlew clean createReleaseBundle -Pversion=${VERSION} -Prelease -PskipPgpSigning
      - name: Upload build artifacts
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: project-release-artifacts
          path: ./java/build/libs/protobuf-specs-*-bundle.jar
          if-no-files-found: error

  create-release:
    runs-on: ubuntu-latest
    needs: [build]
    permissions:
      contents: write # To draft a release
    steps:
      - name: Download gradle release artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: project-release-artifacts
          path: ./release/
      - name: Create release
        env:
          REF_NAME: ${{ github.ref_name }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create -t "${REF_NAME}" ${REF_NAME} ./release/*