release-on-tag.yml

name: Release on Tag

on:
  push:
    tags:
      - 'release/[0-9]*.[0-9]*.[0-9]*'

permissions:
  contents: write
  pull-requests: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Java, Central creds and GPG
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          # JDK 25 activates the jtd-codegen profile ([24,)) so the
          # json-java21-jtd-codegen and jtd2jar modules join the reactor
          # and are published too (issue #165).
          java-version: '25'
          cache: maven
          server-id: central
          # setup-java expects ENVIRONMENT VARIABLE NAMES here, not values;
          # the values are provided via the env block below (issue #156).
          server-username: CENTRAL_USERNAME
          server-password: CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: GPG_PASSPHRASE
        env:
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#release/}" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release with notes
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          body: |
            ## Maven Central Artifacts

            All reactor modules are published under `io.github.simbo1905.json` at version `${{ steps.version.outputs.version }}`: [`java.util.json`](https://central.sonatype.com/artifact/io.github.simbo1905.json/java.util.json), [`java.util.json.jsonpath`](https://central.sonatype.com/artifact/io.github.simbo1905.json/java.util.json.jsonpath), [`java.util.json.jtd`](https://central.sonatype.com/artifact/io.github.simbo1905.json/java.util.json.jtd), [`java.util.json.jtd.codegen`](https://central.sonatype.com/artifact/io.github.simbo1905.json/java.util.json.jtd.codegen), [`jtd2jar`](https://central.sonatype.com/artifact/io.github.simbo1905.json/jtd2jar), [`json-compatibility-suite`](https://central.sonatype.com/artifact/io.github.simbo1905.json/json-compatibility-suite), [`json-java21-api-tracker`](https://central.sonatype.com/artifact/io.github.simbo1905.json/json-java21-api-tracker).

            ## Docker Image

            Pre-built distroless container image available on GitHub Container Registry:

            ```bash
            docker pull ghcr.io/${{ github.repository_owner }}/java.util.json.java21/jtd2jar:${{ steps.version.outputs.version }}
            docker pull ghcr.io/${{ github.repository_owner }}/java.util.json.java21/jtd2jar:latest
            ```

            See [jtd2jar/README.md](https://github.com/${{ github.repository }}/blob/main/jtd2jar/README.md) for usage.

      - name: Build and Deploy to Central (release profile)
        id: deploy
        env:
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
        run: |
          KN="${{ secrets.GPG_KEYNAME }}"
          EXTRA=""
          if [ -n "$KN" ]; then EXTRA="-Dgpg.keyname=$KN"; fi
          if mvn -B -ntp -P release \
            -Dgpg.passphrase="${{ secrets.GPG_PASSPHRASE }}" \
            $EXTRA \
            clean deploy; then
            echo "Central deploy succeeded (fresh publish)."
          else
            # Idempotency guard (issue #160): a deployment of this exact
            # version may already be live on Maven Central (e.g. after a
            # re-tag). Maven Central versions are immutable; "already
            # exists" means the release is live, so treat it as success.
            V="${{ steps.version.outputs.version }}"
            if curl -fsSL -o /dev/null \
                "https://repo1.maven.org/maven2/io/github/simbo1905/json/parent/${V}/parent-${V}.pom" \
              && curl -fsSL -o /dev/null \
                "https://repo1.maven.org/maven2/io/github/simbo1905/json/java.util.json/${V}/java.util.json-${V}.pom"; then
              echo "Artifacts for ${V} are already live on Maven Central; treating duplicate-publish as success." | tee -a "$GITHUB_STEP_SUMMARY"
            else
              echo "Central deploy failed and artifacts for ${V} are NOT live on Maven Central." | tee -a "$GITHUB_STEP_SUMMARY"
              exit 1
            fi
          fi

      - name: Configure Git identity
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Create branch from tag for PR
        id: prbranch
        run: |
          BRANCH_NAME="release-bot-$(date +%Y%m%d-%H%M%S)"
          git checkout -B "$BRANCH_NAME" $GITHUB_SHA
          git push origin "$BRANCH_NAME"
          echo "branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT"

      - name: Open PR back to main
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh pr create \
            --title "chore: merge release ${{ github.ref_name }} to main" \
            --body "Automated PR created from tag ${{ github.ref_name }}." \
            --base main \
            --head "${{ steps.prbranch.outputs.branch }}" \
          || echo "PR already exists or nothing to compare"

  docker-publish:
    name: Publish Docker image to GHCR
    runs-on: ubuntu-latest
    needs: release
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 25
        uses: actions/setup-java@v4
        with:
          distribution: oracle
          java-version: '25'
          cache: 'maven'

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#release/}" >> "$GITHUB_OUTPUT"

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: jtd2jar/Dockerfile
          push: true
          tags: |
            ghcr.io/${{ github.repository_owner }}/java.util.json.java21/jtd2jar:${{ steps.version.outputs.version }}
            ghcr.io/${{ github.repository_owner }}/java.util.json.java21/jtd2jar:latest