java-publish-maven.yml

name: "Java Publish to Maven Central"

env:
  # Disable Husky Git hooks in CI to prevent local development hooks
  # (e.g., pre-commit formatting checks) from running during automated
  # workflows that perform git commits and pushes.
  HUSKY: 0

on:
  workflow_dispatch:
    inputs:
      releaseVersion:
        description: "Release version (e.g., 1.0.0). If empty, derives from pom.xml by removing -SNAPSHOT"
        required: false
        type: string
      developmentVersion:
        description: "Next development version (e.g., 1.0.1-SNAPSHOT). If empty, increments patch version"
        required: false
        type: string
      prerelease:
        description: "Is this a prerelease?"
        type: boolean
        required: false
        default: false
  workflow_call:
    inputs:
      releaseVersion:
        description: "Release version (e.g., 1.0.0). If empty, derives from pom.xml by removing -SNAPSHOT"
        required: false
        type: string
      developmentVersion:
        description: "Next development version (e.g., 1.0.1-SNAPSHOT). If empty, increments patch version"
        required: false
        type: string
      prerelease:
        description: "Is this a prerelease?"
        type: boolean
        required: false
        default: false
    secrets:
      JAVA_RELEASE_TOKEN:
        required: true
      JAVA_RELEASE_GITHUB_TOKEN:
        required: true
      JAVA_MAVEN_CENTRAL_USERNAME:
        required: true
      JAVA_MAVEN_CENTRAL_PASSWORD:
        required: true
      JAVA_GPG_SECRET_KEY:
        required: true
      JAVA_GPG_PASSPHRASE:
        required: true

permissions:
  contents: write
  id-token: write

concurrency:
  group: publish-maven
  cancel-in-progress: false

jobs:
  preflight:
    name: Preflight checks
    runs-on: ubuntu-latest
    steps:
      - name: Verify JAVA_RELEASE_TOKEN can push to repository
        run: |
          # JAVA_RELEASE_TOKEN is used by actions/checkout and for:
          #   - git push origin main (doc updates)
          #   - mvn release:prepare -DpushChanges=true (release commits + tags)
          #   - git revert + push (rollback on failure)
          # It must have push (contents:write) permission on this repo.
          PUSH=$(gh api repos/${{ github.repository }} --jq '.permissions.push // false')
          if [ "$PUSH" != "true" ]; then
            echo "::error::JAVA_RELEASE_TOKEN lacks push permission on ${{ github.repository }}. It is required for pushing release commits and tags to main."
            exit 1
          fi
          echo "JAVA_RELEASE_TOKEN push access OK"
        env:
          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_TOKEN }}

      - name: Verify JAVA_RELEASE_GITHUB_TOKEN can trigger workflows
        run: |
          # JAVA_RELEASE_GITHUB_TOKEN is used for:
          #   - gh workflow run release-changelog.lock.yml (requires actions:write)
          # Check the token's OAuth scopes for 'workflow' (classic PAT) or
          # attempt a workflow dispatch with a non-existent ref to verify write access
          # (fine-grained PAT — these don't expose scopes via X-OAuth-Scopes).
          SCOPES=$(gh api -i user 2>&1 | grep -i '^x-oauth-scopes:' | tr '[:upper:]' '[:lower:]' || true)
          if echo "$SCOPES" | grep -q 'workflow'; then
            echo "JAVA_RELEASE_GITHUB_TOKEN has 'workflow' scope (classic PAT)"
          elif [ -z "$SCOPES" ]; then
            # Fine-grained PAT: no X-OAuth-Scopes header returned.
            # Attempt a workflow dispatch against a non-existent ref. If the token
            # has actions:write, the API returns 422 (validation failed on ref).
            # If it lacks the permission, the API returns 403.
            HTTP_CODE=$(gh api -X POST \
              "repos/${{ github.repository }}/actions/workflows/release-changelog.lock.yml/dispatches" \
              -f ref="preflight-check-nonexistent-ref" \
              -f 'inputs[tag]=preflight-check' \
              --silent -i 2>&1 | head -1 | grep -oE '[0-9]{3}' || echo "000")
            if [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "000" ]; then
              echo "::error::JAVA_RELEASE_GITHUB_TOKEN lacks actions:write permission on ${{ github.repository }}. It cannot trigger the changelog generation workflow."
              exit 1
            fi
            # 422 = has write access but ref doesn't exist (expected), 204 would mean it dispatched (shouldn't happen with fake ref)
            echo "JAVA_RELEASE_GITHUB_TOKEN actions:write access OK (fine-grained PAT, dispatch returned HTTP ${HTTP_CODE})"
          else
            echo "::error::JAVA_RELEASE_GITHUB_TOKEN lacks 'workflow' scope. Found scopes: ${SCOPES}. It needs this scope to trigger changelog generation via gh workflow run."
            exit 1
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_GITHUB_TOKEN }}

  publish-maven:
    name: Publish Java SDK to Maven Central
    needs: preflight
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ./java
    outputs:
      version: ${{ steps.versions.outputs.release_version }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          token: ${{ secrets.JAVA_RELEASE_TOKEN }}

      - name: Configure Git for Maven Release
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - uses: ./.github/actions/setup-copilot

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.JAVA_GPG_SECRET_KEY }}
          gpg-passphrase: JAVA_GPG_PASSPHRASE

      - name: Determine versions
        id: versions
        working-directory: ./java
        run: |
          CURRENT_VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          echo "Current pom.xml version: $CURRENT_VERSION"

          # Determine release version
          if [ -n "${{ inputs.releaseVersion }}" ]; then
            RELEASE_VERSION="${{ inputs.releaseVersion }}"
          else
            # Remove -SNAPSHOT suffix if present
            RELEASE_VERSION="${CURRENT_VERSION%-SNAPSHOT}"
          fi
          echo "Release version: $RELEASE_VERSION"

          # Determine next development version
          if [ -n "${{ inputs.developmentVersion }}" ]; then
            DEV_VERSION="${{ inputs.developmentVersion }}"
            if [[ "$DEV_VERSION" != *-SNAPSHOT ]]; then
              echo "::error::developmentVersion '${DEV_VERSION}' must end with '-SNAPSHOT' (e.g., '${DEV_VERSION}-SNAPSHOT'). The maven-release-plugin requires the next development version to be a snapshot."
              exit 1
            fi
          else
            # Split version: supports "0.1.32", "0.1.32-preview.0", "0.1.32-java.0", and "0.1.32-java-preview.0" formats
            # Validate RELEASE_VERSION format explicitly to provide clear errors
            if ! echo "$RELEASE_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-(preview|(beta-)?java(-preview)?)\.[0-9]+)?$'; then
              echo "Error: RELEASE_VERSION '$RELEASE_VERSION' is invalid. Expected format: M.M.P, M.M.P-preview.N, M.M.P-java.N, M.M.P-java-preview.N, M.M.P-beta-java.N, or M.M.P-beta-java-preview.N (e.g., 1.2.3, 1.2.3-preview.0, 1.2.3-java.0, 1.2.3-java-preview.0, 1.2.3-beta-java.0, or 1.2.3-beta-java-preview.0)." >&2
              exit 1
            fi
            # Extract the base M.M.P portion (before any qualifier)
            BASE_VERSION=$(echo "$RELEASE_VERSION" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
            QUALIFIER=$(echo "$RELEASE_VERSION" | sed "s|^${BASE_VERSION}||")
            IFS='.' read -r MAJOR MINOR PATCH <<< "$BASE_VERSION"
            NEXT_PATCH=$((PATCH + 1))
            DEV_VERSION="${MAJOR}.${MINOR}.${NEXT_PATCH}${QUALIFIER}-SNAPSHOT"
          fi
          echo "Next development version: $DEV_VERSION"

          echo "release_version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
          echo "dev_version=$DEV_VERSION" >> $GITHUB_OUTPUT

          echo "### Version Summary" >> $GITHUB_STEP_SUMMARY
          echo "- **Release version:** $RELEASE_VERSION" >> $GITHUB_STEP_SUMMARY
          echo "- **Next development version:** $DEV_VERSION" >> $GITHUB_STEP_SUMMARY

      - name: Update documentation with release version
        id: update-docs
        working-directory: ./java
        run: |
          VERSION="${{ steps.versions.outputs.release_version }}"

          # Update release version in README.md (supports any version qualifier like -java.N, -java-preview.N, -beta-java.N)
          sed -i "s|<version>[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\(-[a-z][a-z0-9-]*\.[0-9][0-9]*\)*</version>|<version>${VERSION}</version>|g" README.md
          sed -i "s|copilot-sdk-java:[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\(-[a-z][a-z0-9-]*\.[0-9][0-9]*\)*|copilot-sdk-java:${VERSION}|g" README.md

          # Update snapshot versions in README.md (must run AFTER release version seds
          # because the release copilot-sdk-java: pattern partially matches inside snapshot
          # strings — the snapshot-specific seds override with the correct DEV_VERSION)
          DEV_VERSION="${{ steps.versions.outputs.dev_version }}"
          sed -i "s|<version>[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\(-[a-z][a-z0-9-]*\.[0-9][0-9]*\)*-SNAPSHOT</version>|<version>${DEV_VERSION}</version>|g" README.md
          sed -i "s|copilot-sdk-java:[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\(-[a-z][a-z0-9-]*\.[0-9][0-9]*\)*-SNAPSHOT|copilot-sdk-java:${DEV_VERSION}|g" README.md

          # Update version in jbang-example.java
          sed -i "s|copilot-sdk-java:[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\(-[a-z][a-z0-9-]*\.[0-9][0-9]*\)*|copilot-sdk-java:${VERSION}|g" jbang-example.java
          sed -i 's|copilot-sdk-java:${project\.version}|copilot-sdk-java:'"${VERSION}"'|g' jbang-example.java

          # Commit the documentation changes before release:prepare (requires clean working directory)
          git add README.md jbang-example.java
          git commit -m "docs: update version references to ${VERSION}"

          # Save the commit SHA for potential rollback
          echo "docs_commit_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

          git push origin main

      - name: Prepare Release
        working-directory: ./java
        run: |
          mvn -B release:prepare \
            -DreleaseVersion=${{ steps.versions.outputs.release_version }} \
            -DdevelopmentVersion=${{ steps.versions.outputs.dev_version }} \
            -DtagNameFormat=java/v@{project.version} \
            -DpushChanges=true \
            -Darguments="-DskipTests"
        env:
          MAVEN_USERNAME: ${{ secrets.JAVA_MAVEN_CENTRAL_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.JAVA_MAVEN_CENTRAL_PASSWORD }}
          JAVA_GPG_PASSPHRASE: ${{ secrets.JAVA_GPG_PASSPHRASE }}

      - name: Perform Release and Deploy to Maven Central
        working-directory: ./java
        run: |
          mvn -B release:perform \
            -Dgoals="deploy" \
            -Darguments="-DskipTests -Prelease"
        env:
          MAVEN_USERNAME: ${{ secrets.JAVA_MAVEN_CENTRAL_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.JAVA_MAVEN_CENTRAL_PASSWORD }}
          JAVA_GPG_PASSPHRASE: ${{ secrets.JAVA_GPG_PASSPHRASE }}

      - name: Rollback documentation commit on failure
        if: failure() && steps.update-docs.outputs.docs_commit_sha != ''
        working-directory: ./java
        run: |
          echo "Release failed, rolling back documentation commit..."
          git revert --no-edit ${{ steps.update-docs.outputs.docs_commit_sha }}
          git push origin main

          # Also run Maven release:rollback to clean up any partial release state
          mvn -B release:rollback || true

  github-release:
    name: Create GitHub Release
    needs: [preflight, publish-maven]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Create GitHub Release
        run: |
          VERSION="${{ needs.publish-maven.outputs.version }}"
          GROUP_ID="com.github"
          ARTIFACT_ID="copilot-sdk-java"
          CURRENT_TAG="java/v${VERSION}"

          if gh release view "${CURRENT_TAG}" >/dev/null 2>&1; then
            echo "Release ${CURRENT_TAG} already exists. Skipping creation."
            exit 0
          fi

          # Generate release notes from template
          export VERSION GROUP_ID ARTIFACT_ID
          RELEASE_NOTES=$(envsubst < $GITHUB_WORKSPACE/.github/workflows/java.notes.template)

          # Get the previous tag for generating notes
          # grep returns exit 1 when no lines match (first release), so
          # append "|| true" to prevent pipefail from aborting the script.
          PREV_TAG=$(git tag --list 'java/v*' --sort=-version:refname \
            | grep -Fxv "${CURRENT_TAG}" \
            | head -n 1 || true)

          echo "Current tag: ${CURRENT_TAG}"
          echo "Previous tag: ${PREV_TAG}"

          # Build the gh release command
          GH_ARGS=("${CURRENT_TAG}")
          GH_ARGS+=("--title" "GitHub Copilot SDK for Java ${VERSION}")
          GH_ARGS+=("--notes" "${RELEASE_NOTES}")
          GH_ARGS+=("--generate-notes")

          if [ -n "$PREV_TAG" ]; then
            GH_ARGS+=("--notes-start-tag" "$PREV_TAG")
          fi

          ${{ inputs.prerelease == true && 'GH_ARGS+=("--prerelease")' || '' }}

          gh release create "${GH_ARGS[@]}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Trigger changelog generation
        run: gh workflow run release-changelog.lock.yml -f tag="java/v${{ needs.publish-maven.outputs.version }}"
        env:
          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_GITHUB_TOKEN }}

  deploy-site:
    name: Deploy Documentation Site
    needs: [preflight, publish-maven, github-release]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Trigger site deployment on standalone repo
        run: |
          VERSION="${{ needs.publish-maven.outputs.version }}"
          TAG="java/v${VERSION}"
          PUBLISH_AS_LATEST=true
          if [ "${{ inputs.prerelease }}" = "true" ]; then
            PUBLISH_AS_LATEST=false
          fi
          echo "Triggering site deployment for version ${VERSION} (tag: ${TAG})"
          gh workflow run deploy-site.yml \
            --repo github/copilot-sdk-java \
            -f version="${VERSION}" \
            -f publish_as_latest="${PUBLISH_AS_LATEST}" \
            -f monorepo_tag="${TAG}"
          echo "### Site Deployment" >> $GITHUB_STEP_SUMMARY
          echo "Triggered deploy-site.yml on github/copilot-sdk-java for version ${VERSION}" >> $GITHUB_STEP_SUMMARY
        env:
          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_GITHUB_TOKEN }}