build-linux.yml

name: Java app image Linux

on:
  schedule:
    - cron: '0 10 10 * *'
  workflow_call:
    inputs:
      semVerNum:
        type: string
        description: 'The Major.Minor.Patch part of the version'
        required: true
      revisionNum:
        type: string
        description: 'The revision number'
        required: true
      semVerSuffix:
        type: string
        description: 'The suffix of the version, including dash'
        required: true
      upload-to-draft:
        type: boolean
        default: true
    outputs:
      sha256-linux-zip-x64:
        description: "SHA256 sum of the x64 zip"
        value: ${{ jobs.collect-sha256sums.outputs.x64-sha256sum}}
      sha256-linux-zip-aarch64:
        description: "SHA256 sum of the aarch64 zip"
        value: ${{ jobs.collect-sha256sums.outputs.aarch64-sha256sum}}
  workflow_dispatch:
    inputs:
      semVerNum:
        description: 'The Major.Minor.Patch part of the version'
        required: false
      revisionNum:
        description: 'The revision number'
        required: false
      semVerSuffix:
        description: 'The suffix of the version, including dash'
        required: false
        default: '-SNAPSHOT'

permissions:
  contents: write

env:
  JAVA_DIST: 'temurin'
  JAVA_VERSION: '25.0.4+7'
  VERSION_NUM: ${{ inputs.semVerNum || '99.99.99' }}
  VERSION_SUFFIX: ${{ inputs.semVerSuffix || '' }}

defaults:
  run:
    shell: bash

jobs:
  build-binary:
    name: Build java app image
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            architecture: x64
            native-access-lib: 'org.cryptomator.jfuse.linux.amd64'
          - os: ubuntu-24.04-arm
            architecture: aarch64
            native-access-lib: 'org.cryptomator.jfuse.linux.aarch64'
    runs-on: ${{ matrix.os }}
    env:
      ARTIFACT_NAME: cryptomator-cli-${{ inputs.semVerNum || '99.99.99' }}${{ inputs.semVerSuffix || '' }}-linux-${{ matrix.architecture }}.zip
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 #v4.8.0
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DIST }}
      - name: Set version
        run: ./mvnw versions:set -DnewVersion="${VERSION_NUM}${VERSION_SUFFIX}"
      - name: Run maven
        run: ./mvnw -B clean package -DskipTests
      - name: Patch target dir
        run: |
          cp target/cryptomator-*.jar target/mods
      - name: Run jlink
        run: |
          envsubst < dist/jlink.args > target/jlink.args
          "${JAVA_HOME}/bin/jlink" '@./target/jlink.args'
      - name: Run jpackage
        run: |
          envsubst < dist/jpackage.args > target/jpackage.args
          "${JAVA_HOME}/bin/jpackage" '@./target/jpackage.args'
        env:
          JP_APP_VERSION: ${{ env.VERSION_NUM }}
          APP_VERSION: ${{ env.VERSION_NUM }}${{ env.VERSION_SUFFIX }}
          NATIVE_ACCESS_PACKAGE: ${{ matrix.native-access-lib }}
      - name: Update app dir
        run: |
          cp LICENSE.txt target/cryptomator-cli
          cp target/cryptomator-cli_completion.sh target/cryptomator-cli
      - name: Run integration tests against the app image
        run: ./mvnw -B verify -DskipITs=false
      - name: Zip binary for release
        run: |
          zip -r "./${ARTIFACT_NAME}" ./cryptomator-cli
          mv "./${ARTIFACT_NAME}" ..
        working-directory: target
      - name: Create detached GPG signature with key 615D449FE6E6A235
        run: |
          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a ./${ARTIFACT_NAME}
        env:
          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: cryptomator-cli-linux-${{ matrix.architecture }}
          path: |
            ${{ env.ARTIFACT_NAME }}
            cryptomator-*.asc
          if-no-files-found: error
      - name: Publish zip on GitHub Releases
        if: inputs.upload-to-draft
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          draft: true
          fail_on_unmatched_files: true
          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
          files: |
            ${{ env.ARTIFACT_NAME }}
            cryptomator-*.asc

  collect-sha256sums:
    name: Collect AppImage checksums
    runs-on: ubuntu-latest
    needs: [build-binary]
    if: inputs.upload-to-draft
    outputs:
      x64-sha256sum: ${{ steps.sha256sum.outputs.x64-sha256sum }}
      aarch64-sha256sum: ${{ steps.sha256sum.outputs.aarch64-sha256sum }}
    steps:
      - name: Download zip artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: cryptomator-cli-linux-*
          path: clis
      - name: Compute SHA256 sums
        id: sha256sum
        run: |
          read -ra X64_SUM < <(sha256sum clis/cryptomator-cli-linux-x64/cryptomator-cli-*-x64.zip)
          read -ra AARCH64_SUM < <(sha256sum clis/cryptomator-cli-linux-aarch64/cryptomator-*-aarch64.zip)
          echo "x64-sha256sum=${X64_SUM[0]}" >> "$GITHUB_OUTPUT"
          echo "aarch64-sha256sum=${AARCH64_SUM[0]}" >> "$GITHUB_OUTPUT"