java-sdk.yml

name: Java SDK CI

on:
  push:
    branches: [ main, master ]
    paths:
      - 'java/**'
      - 'meta/**'
      - '.github/workflows/java-sdk.yml'
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
  pull_request:
    branches: [ main, master ]
    paths:
      - 'java/**'
      - 'meta/**'
      - '.github/workflows/java-sdk.yml'
  workflow_dispatch:

jobs:
  build:
    runs-on: ${{ matrix.os }}
    
    strategy:
      fail-fast: false
      matrix:
        # Test on multiple JDK versions for compatibility
        java-version: ['21', '25']
        # Primary OS is Linux, optionally test on Windows/macOS
        os: [ubuntu-latest]
        include:
          # Also test on Windows with baseline JDK
          - os: windows-latest
            java-version: '21'
          # Also test on macOS with baseline JDK
          - os: macos-latest
            java-version: '21'

    defaults:
      run:
        working-directory: java

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          submodules: recursive

      - name: Set up JDK ${{ matrix.java-version }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java-version }}
          distribution: 'temurin'
          cache: maven

      - name: Build with Maven
        run: mvn -B compile

      - name: Run tests
        run: mvn -B test

      - name: Package
        run: mvn -B package -DskipTests

      - name: Generate JaCoCo report
        if: matrix.java-version == '21' && matrix.os == 'ubuntu-latest'
        run: mvn -B jacoco:report

      - name: Upload coverage to Codecov
        if: matrix.java-version == '21' && matrix.os == 'ubuntu-latest'
        uses: codecov/codecov-action@v5
        with:
          files: java/target/site/jacoco/jacoco.xml
          flags: java
          name: java-coverage
        continue-on-error: true

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: test-results-java-${{ matrix.java-version }}-${{ matrix.os }}
          path: java/target/surefire-reports/
          retention-days: 7

      # Upload JAR only once (from baseline JDK build on Linux)
      # Java's "build once, run anywhere" means one JAR works on all JVMs
      - name: Upload JAR artifact
        if: matrix.java-version == '21' && matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v6
        with:
          name: json-structure-java-sdk
          path: |
            java/target/*.jar
            !java/target/*-sources.jar
            !java/target/*-javadoc.jar
          retention-days: 30

      - name: Upload sources JAR
        if: matrix.java-version == '21' && matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v6
        with:
          name: json-structure-java-sdk-sources
          path: java/target/*-sources.jar
          retention-days: 30
          if-no-files-found: ignore

  lint:
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: java

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: maven

      - name: Check code style
        run: mvn -B checkstyle:check
        continue-on-error: true

      - name: Verify no unused dependencies
        run: mvn -B dependency:analyze
        continue-on-error: true

  publish:
    name: Publish to Maven Central
    runs-on: ubuntu-latest
    needs: [build, lint]
    if: startsWith(github.ref, 'refs/tags/v')

    defaults:
      run:
        working-directory: java

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: maven
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Check for Maven Central credentials
        id: check-secret
        run: |
          if [ -z "${{ secrets.MAVEN_USERNAME }}" ] || [ -z "${{ secrets.MAVEN_PASSWORD }}" ]; then
            echo "has_credentials=false" >> $GITHUB_OUTPUT
            echo "::warning::Maven Central credentials are not set. Skipping publish."
          else
            echo "has_credentials=true" >> $GITHUB_OUTPUT
          fi

      - name: Extract version from tag
        id: get_version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "Extracted version: $VERSION"

      - name: Set version in pom.xml
        if: steps.check-secret.outputs.has_credentials == 'true'
        run: mvn -B versions:set -DnewVersion=${{ steps.get_version.outputs.VERSION }} -DgenerateBackupPoms=false

      - name: Publish to Maven Central
        if: steps.check-secret.outputs.has_credentials == 'true'
        run: mvn -B deploy -DskipTests -Prelease
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}

      - name: Skip publish warning
        if: steps.check-secret.outputs.has_credentials == 'false'
        run: |
          echo "⚠️ Skipping Maven Central publish: credentials are not configured."
          echo "To enable publishing, add the following secrets to the repository settings:"
          echo "  - MAVEN_USERNAME: Your Maven Central username"
          echo "  - MAVEN_PASSWORD: Your Maven Central password/token"
          echo "  - MAVEN_GPG_PRIVATE_KEY: Your GPG private key for signing"
          echo "  - MAVEN_GPG_PASSPHRASE: Your GPG passphrase"