release.yml

name: Java Buildpack Client Release

on:
  pull_request:
    types: [closed]
    paths:
      - '.github/project.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  release:
    runs-on: ubuntu-latest
    name: release
    if: ${{github.event.pull_request.merged == true}}

    steps:
      - uses: radcortez/project-metadata-action@main
        name: Retrieve project metadata
        id: metadata
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          metadata-file-path: '.github/project.yml'

      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17
          cache: 'maven'
          server-id: central
          server-username: MAVEN_USERNAME # Sonatype "snowdrop-team" usertoken: username
          server-password: MAVEN_PASSWORD # Sonatype "snowdrop-team" usertoken: password

      - name: Configure Git author
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
      - name: Set release version in the samples and readme
        run: |
          find ./samples/ -iwholename "*/pack.java" | while read f; do
            sed -i "s/dev.snowdrop:buildpack-client:.*/dev.snowdrop:buildpack-client:${{steps.metadata.outputs.current-version}}\}/g" $f
            git add $f
          done
          sed -i "s/dev.snowdrop:buildpack-client:.*/dev.snowdrop:buildpack-client:${{steps.metadata.outputs.current-version}}\}/g" README.md
          sed -i "s/<version>.*<\/version>/<version>${{steps.metadata.outputs.current-version}}<\/version>/g" README.md
          git add README.md
          git commit -m "chore: set release version: ${{steps.metadata.outputs.current-version}} in samples and README.md"
      - name: Maven release ${{steps.metadata.outputs.current-version}}
        run: |
          debug_key_material() {
            local label="$1"
            local value="$2"
            local length="${#value}"
            local prefix="${value:0:8}"
            local last_char=""
            local first_line=""
            local last_line=""
            local begin_count end_count private_begin_count public_begin_count
            local second_line=""
            local separator_line="none"
            local second_line_empty="false"
            local second_line_has_colon="false"
            local sha256=""

            if [ -n "$value" ]; then
              last_char="${value: -1}"
              first_line=$(printf '%s' "$value" | head -n 1)
              last_line=$(printf '%s' "$value" | tail -n 1)
              second_line=$(printf '%s' "$value" | sed -n '2p')
              if [ -z "$second_line" ]; then
                second_line_empty="true"
              fi
              if [[ "$second_line" == *":"* ]]; then
                second_line_has_colon="true"
              fi
              separator_line=$(printf '%s\n' "$value" | awk 'NR > 1 && $0 == "" { print NR; exit }')
              if [ -z "$separator_line" ]; then
                separator_line="none"
              fi
              sha256=$(printf '%s' "$value" | sha256sum | awk '{print $1}')
            fi

            local actual_lf_count actual_cr_count actual_tab_count
            local escaped_lf_count escaped_cr_count escaped_tab_count

            actual_lf_count=$(printf '%s' "$value" | tr -cd '\n' | wc -c | tr -d ' ')
            actual_cr_count=$(printf '%s' "$value" | tr -cd '\r' | wc -c | tr -d ' ')
            actual_tab_count=$(printf '%s' "$value" | tr -cd '\t' | wc -c | tr -d ' ')

            escaped_lf_count=$(printf '%s' "$value" | grep -o '\\n' | wc -l | tr -d ' ' || true)
            escaped_cr_count=$(printf '%s' "$value" | grep -o '\\r' | wc -l | tr -d ' ' || true)
            escaped_tab_count=$(printf '%s' "$value" | grep -o '\\t' | wc -l | tr -d ' ' || true)

            begin_count=$(printf '%s' "$value" | grep -c '^-----BEGIN ' | tr -d ' ' || true)
            end_count=$(printf '%s' "$value" | grep -c '^-----END ' | tr -d ' ' || true)
            private_begin_count=$(printf '%s' "$value" | grep -c '^-----BEGIN PGP PRIVATE KEY BLOCK-----$' | tr -d ' ' || true)
            public_begin_count=$(printf '%s' "$value" | grep -c '^-----BEGIN PGP PUBLIC KEY BLOCK-----$' | tr -d ' ' || true)

            echo "[gpg-debug] ${label}.length=${length}"
            echo "[gpg-debug] ${label}.prefix8=${prefix}"
            echo "[gpg-debug] ${label}.lastChar=$(printf '%q' "$last_char")"
            echo "[gpg-debug] ${label}.actualCounts lf=${actual_lf_count} cr=${actual_cr_count} tab=${actual_tab_count}"
            echo "[gpg-debug] ${label}.escapedCounts \\n=${escaped_lf_count} \\r=${escaped_cr_count} \\t=${escaped_tab_count}"
            echo "[gpg-debug] ${label}.firstLine=${first_line}"
            echo "[gpg-debug] ${label}.lastLine=${last_line}"
            echo "[gpg-debug] ${label}.armorBlocks begin=${begin_count} end=${end_count} privateBegin=${private_begin_count} publicBegin=${public_begin_count}"
            echo "[gpg-debug] ${label}.armorStructure secondLineEmpty=${second_line_empty} secondLineHasColon=${second_line_has_colon} separatorLine=${separator_line}"
            echo "[gpg-debug] ${label}.sha256=${sha256}"
          }

          debug_key_material "rawKey" "${GPG_SECRET_KEY_RAW}"

          if [[ "${GPG_SECRET_KEY_RAW}" == *"BEGIN PGP"* ]]; then
            export MAVEN_GPG_KEY="${GPG_SECRET_KEY_RAW}"
          else
            echo "Decoding Base64 GPG secret key..."
            export MAVEN_GPG_KEY=$(echo -n "${GPG_SECRET_KEY_RAW}" | base64 --decode)
          fi

          # Normalize ASCII armor for BC signer: ensure required blank line
          # between armor headers and base64 payload.
          export MAVEN_GPG_KEY=$(printf '%s\n' "${MAVEN_GPG_KEY}" | awk '
            BEGIN { state = 0; inserted = 0 }
            /^-----BEGIN PGP [A-Z ]+-----$/ {
              print
              state = 1
              next
            }
            state == 1 {
              if ($0 == "") {
                print
                state = 2
                next
              }
              if (index($0, ":") > 0) {
                print
                next
              }
              print ""
              print
              state = 2
              inserted = 1
              next
            }
            { print }
            END {
              if (inserted == 1) {
                # no-op marker to keep awk exit success explicit
                ;
              }
            }
          ')

          debug_key_material "mavenGpgKey" "${MAVEN_GPG_KEY}"
          if [[ "${MAVEN_GPG_KEY}" == *"BEGIN PGP"* ]]; then
            echo "[gpg-debug] mavenGpgKey.containsBeginPgp=true"
          else
            echo "[gpg-debug] mavenGpgKey.containsBeginPgp=false"
          fi

          mvn -B release:prepare -Prelease -Darguments="-DskipTests -Dgpg.signer=bc" -DreleaseVersion=${{steps.metadata.outputs.current-version}} -DdevelopmentVersion=${{steps.metadata.outputs.next-version}}
          mvn -B release:perform -Darguments="-DperformRelease -DskipTests -Dgpg.signer=bc" -DperformRelease -Prelease
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          GPG_SECRET_KEY_RAW: ${{ secrets.GPG_SECRET_KEY }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      - name: Set dev version in the samples and readme
        run: |
          find ./samples/ -iwholename "*/pack.java" | while read f; do
            sed -i "s/dev.snowdrop:buildpack-client:.*/dev.snowdrop:buildpack-client:${{steps.metadata.outputs.next-version}}\}/g" $f
            git add $f
          done
          git commit -m "chore: set dev version: ${{steps.metadata.outputs.next-version}} in samples and README.md"
      - name: Push changes to ${{github.base_ref}} branch
        run: |
          git push
          git push origin ${{steps.metadata.outputs.current-version}}