release.yml

name: Release to Eclipse update site

on:
  push:
    tags: ['eclipse-plugin-*'] # release tags are prefixed with "eclipse-plugin-"

permissions:
  contents: read

concurrency:
  group: release-deploy
  cancel-in-progress: false

env:
  MAVEN_COMMAND: ./mvnw
  MAVEN_CLI_COMMON: "-e -B"

jobs:
  # Builds and tests the tagged commit and assembles the PGP-signed p2 repository.
  # "Publish site and update site to GitHub Pages" runs after this workflow succeeds and adds the
  # new version to https://dbunit.github.io/dbunit-eclipse-plugin/updates/.
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    environment: release
    outputs:
      version: ${{ steps.resolve.outputs.version }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/jdk-setup
        with:
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      # Guard against a mistyped tag releasing the wrong version: the POM is the
      # source of truth for what gets built, so the tag must encode exactly that
      # version. The resolved version also titles the GitHub Release below.
      # A release is built from the X.Y.Z-SNAPSHOT version: Tycho then replaces the
      # bundle and feature qualifier with project.build.outputTimestamp, which the
      # release prep sets, so X.Y.Z.vYYYYMMDD-HHMM is newer than every earlier CI and
      # nightly build of X.Y.Z. A plain X.Y.Z version would give unqualified bundles,
      # which Eclipse orders below those builds and never offers as an update.
      - name: Verify tag matches project version
        id: resolve
        env:
          TAG: ${{ github.ref_name }}
        run: |
          pom_version="$(${{ env.MAVEN_COMMAND }} -N help:evaluate -Dexpression=project.version -q -DforceStdout)"
          case "$pom_version" in
            *-SNAPSHOT)
              ;;
            *)
              echo "::error::Version '$pom_version' is not an X.Y.Z-SNAPSHOT version. Releases are built from the SNAPSHOT version. Refusing to release."
              exit 1
              ;;
          esac
          version="${pom_version%-SNAPSHOT}"
          expected="eclipse-plugin-${version}"
          if [ "$TAG" != "$expected" ]; then
            echo "::error::Tag '$TAG' does not match project version '$pom_version' (expected '$expected'). Refusing to release."
            exit 1
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "pom_version=${pom_version}" >> "$GITHUB_OUTPUT"

      - name: Install Xvfb for the UI tests
        run: |
          if ! command -v xvfb-run > /dev/null; then
            sudo apt-get update
            sudo apt-get install -y xvfb
          fi

      - name: Build, test, and PGP-sign the p2 repository
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: xvfb-run -a ${{ env.MAVEN_COMMAND }} ${{ env.MAVEN_CLI_COMMON }} clean verify -Psign

      - name: Stage the release assets
        env:
          VERSION: ${{ steps.resolve.outputs.version }}
          POM_VERSION: ${{ steps.resolve.outputs.pom_version }}
        run: |
          asset="dbunit-eclipse-plugin-${VERSION}-p2-repository.zip"
          mkdir -p dist
          cp "releng/org.dbunit.eclipse.repository/target/org.dbunit.eclipse.repository-${POM_VERSION}.zip" "dist/${asset}"
          (cd dist && sha256sum "${asset}" > "${asset}.sha256")

      - name: Keep the release assets for the GitHub Release job
        uses: actions/upload-artifact@v7
        with:
          name: release-assets
          path: dist/
          retention-days: 11

  # Publish a GitHub Release for the tag with the zipped p2 repository attached. The attached zip is
  # the durable storage of each released update site: the Pages workflow rebuilds the composite update
  # site from the assets of all releases. Notes are auto-generated by the GitHub Release Notes API from
  # merged PRs/commits since the previous tag. Isolated from the build job so contents:write is not
  # granted while the GPG key is in scope.
  github-release:
    needs: release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write # required to create the GitHub Release
    steps:
      - name: Download the release assets
        uses: actions/download-artifact@v8
        with:
          name: release-assets
          path: dist/

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }} # via env to avoid script injection
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          gh release create "$TAG" \
            --repo "${{ github.repository }}" \
            --title "$VERSION" \
            --generate-notes \
            --verify-tag \
            dist/*