java.yml

name: Java

on:
  workflow_dispatch:
  pull_request:
    branches: [main]
    paths:
      - 'Cargo.toml'
      - 'src/**'
      - 'bindings/c/**'
      - 'bindings/java/**'
      - 'tests/fonts/IronpressCjkVertical.ttf'
      - 'assets/NotoSans-Regular.ttf'
      - 'scripts/bump-version.sh'
      - 'scripts/check-release-versions.sh'
      - '.github/workflows/java.yml'
  push:
    branches: [main]
    paths:
      - 'Cargo.toml'
      - 'src/**'
      - 'bindings/c/**'
      - 'bindings/java/**'
      - 'tests/fonts/IronpressCjkVertical.ttf'
      - 'assets/NotoSans-Regular.ttf'
      - 'scripts/bump-version.sh'
      - 'scripts/check-release-versions.sh'
      - '.github/workflows/java.yml'
  release:
    types: [published]

permissions:
  contents: read

env:
  JAVA_VERSION: '17'
  RUST_VERSION: '1.88.0'

jobs:
  native-linux:
    name: Native library - ${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-x86-64
            runner: ubuntu-24.04
            image: quay.io/pypa/manylinux_2_28_x86_64:2026.05.07-2@sha256:443eabd378e140996780a772e12c1a1ef10551da933fe76d74a1bab61f68a7b7
          - platform: linux-aarch64
            runner: ubuntu-24.04-arm
            image: quay.io/pypa/manylinux_2_28_aarch64:2026.05.07-2@sha256:a435288af93def166dc59b5d052fa20ce59d76c6f38e8ad105767262d36843f0
    runs-on: ${{ matrix.runner }}
    container:
      image: ${{ matrix.image }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - name: Build the native library
        run: cargo build --release -p ironpress-ffi
      - name: Verify the glibc compatibility floor
        run: bindings/c/verify-glibc-floor.sh target/release/libironpress_ffi.so 2.28
      - uses: actions/upload-artifact@v7
        with:
          name: ironpress-java-${{ matrix.platform }}
          path: target/release/libironpress_ffi.so
          if-no-files-found: error
          retention-days: 1

  native-desktop:
    name: Native library - ${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: darwin-x86-64
            runner: macos-15-intel
            library: target/release/libironpress_ffi.dylib
          - platform: darwin-aarch64
            runner: macos-15
            library: target/release/libironpress_ffi.dylib
          - platform: win32-x86-64
            runner: windows-2022
            library: target/release/ironpress_ffi.dll
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - name: Build the native library
        run: cargo build --release -p ironpress-ffi
      - uses: actions/upload-artifact@v7
        with:
          name: ironpress-java-${{ matrix.platform }}
          path: ${{ matrix.library }}
          if-no-files-found: error
          retention-days: 1

  package:
    name: Package Maven artifact
    needs: [native-linux, native-desktop]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    outputs:
      version: ${{ steps.version.outputs.value }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
          cache-dependency-path: bindings/java/pom.xml
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-linux-x86-64
          path: bindings/java/native/linux-x86-64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-linux-aarch64
          path: bindings/java/native/linux-aarch64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-darwin-x86-64
          path: bindings/java/native/darwin-x86-64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-darwin-aarch64
          path: bindings/java/native/darwin-aarch64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-win32-x86-64
          path: bindings/java/native/win32-x86-64
      - name: Read the package version
        id: version
        shell: bash
        run: |
          value="$(sed -n 's/^[[:space:]]*<version>\([^<]*\)<\/version>.*/\1/p' \
            bindings/java/pom.xml | head -n 1)"
          echo "value=${value}" >> "${GITHUB_OUTPUT}"
      - name: Verify release metadata
        run: scripts/check-release-versions.sh
      - name: Build and test the Maven artifact
        run: >-
          mvn -B -f bindings/java/pom.xml clean verify
          -Dironpress.customFont=${{ github.workspace }}/assets/NotoSans-Regular.ttf
          -Dironpress.fontPack=${{ github.workspace }}/tests/fonts/IronpressCjkVertical.ttf
      - name: Verify the JAR layout
        run: >-
          bindings/java/verify-package.sh
          bindings/java/target/ironpress-${{ steps.version.outputs.value }}.jar
          ${{ steps.version.outputs.value }}
      - name: Verify reproducible release artifacts
        shell: bash
        run: |
          mkdir -p "${RUNNER_TEMP}/ironpress-java-reference"
          cp bindings/java/target/ironpress-${{ steps.version.outputs.value }}*.jar \
            "${RUNNER_TEMP}/ironpress-java-reference/"
          mvn -B -f bindings/java/pom.xml -Prelease clean verify \
            -DskipTests -Dgpg.skip=true
          for artifact in bindings/java/target/ironpress-${{ steps.version.outputs.value }}*.jar; do
            cmp "$artifact" \
              "${RUNNER_TEMP}/ironpress-java-reference/$(basename "$artifact")"
          done
      - name: Stage the tested Maven bundle
        shell: bash
        run: |
          mkdir -p bindings/java/artifacts
          cp bindings/java/target/ironpress-${{ steps.version.outputs.value }}*.jar \
            bindings/java/artifacts/
          cp bindings/java/pom.xml \
            bindings/java/artifacts/ironpress-${{ steps.version.outputs.value }}.pom
      - uses: actions/upload-artifact@v7
        with:
          name: ironpress-maven-${{ steps.version.outputs.value }}
          path: bindings/java/artifacts
          if-no-files-found: error
          retention-days: 1

  consumer:
    name: Packaged consumer - ${{ matrix.platform }}
    needs: package
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-x86-64
            runner: ubuntu-24.04
          - platform: linux-aarch64
            runner: ubuntu-24.04-arm
          - platform: darwin-x86-64
            runner: macos-15-intel
          - platform: darwin-aarch64
            runner: macos-15
          - platform: win32-x86-64
            runner: windows-2022
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-maven-${{ needs.package.outputs.version }}
          path: bindings/java/artifacts
      - name: Install and exercise the packaged JAR
        shell: bash
        run: >-
          bindings/java/test-package.sh
          bindings/java/artifacts/ironpress-${{ needs.package.outputs.version }}.jar
          ${{ needs.package.outputs.version }}
          assets/NotoSans-Regular.ttf
          tests/fonts/IronpressCjkVertical.ttf

  publish:
    name: Publish Maven artifact
    if: github.event_name == 'release'
    needs: [package, consumer]
    runs-on: ubuntu-24.04
    # Central may spend up to 30 minutes waiting for the published state.
    timeout-minutes: 45
    environment: release
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_TOKEN
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-maven-${{ needs.package.outputs.version }}
          path: bindings/java/reference
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-linux-x86-64
          path: bindings/java/native/linux-x86-64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-linux-aarch64
          path: bindings/java/native/linux-aarch64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-darwin-x86-64
          path: bindings/java/native/darwin-x86-64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-darwin-aarch64
          path: bindings/java/native/darwin-aarch64
      - uses: actions/download-artifact@v8
        with:
          name: ironpress-java-win32-x86-64
          path: bindings/java/native/win32-x86-64
      - name: Rebuild the tested Maven bundle
        shell: bash
        run: |
          mvn -B -f bindings/java/pom.xml -Prelease clean verify \
            -DskipTests -Dgpg.skip=true
          for artifact in bindings/java/target/ironpress-${{ needs.package.outputs.version }}*.jar; do
            cmp "$artifact" \
              "bindings/java/reference/$(basename "$artifact")"
          done
          cmp bindings/java/pom.xml \
            bindings/java/reference/ironpress-${{ needs.package.outputs.version }}.pom
      - name: Sign and publish to Maven Central
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
          MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
        run: >-
          mvn -B -f bindings/java/pom.xml -Prelease -DskipTests
          -Dgpg.signer=bc deploy