release.yml

name: Release to Maven Central

# Releases are started by hand, with the "Run workflow" button of this workflow
# (workflow_dispatch).
#
# The version is the day of the release, in YYYY-MM-DD form: the run computes it,
# pushes the matching tag, creates the GitHub release with the same name and only
# then publishes org.jmonkeyengine:jme3-testdata:<version> to Maven Central.
#
# Several releases on the same day are numbered by scripts/next-version.sh, which
# looks at the tags that already exist:
#
#   2026-09-19, 2026-09-19-2, 2026-09-19-3 ... and the counter resets the next
#   day: 2026-09-20, 2026-09-20-2 ...
#
# Finish the release in the Central Publisher Portal
# (https://central.sonatype.com/publishing/deployments), same as the engine.

on:
  workflow_dispatch:

# One release at a time, so that two runs can't come up with the same version.
concurrency:
  group: release
  cancel-in-progress: false

# Needed to push the tag/create the release and inspect prior publishing attempts.
permissions:
  contents: write
  actions: read

jobs:
  release:
    name: Tag, release and publish to Sonatype
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Check publishing credentials
        env:
          ORG_GRADLE_PROJECT_centralUsername: ${{ secrets.CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_centralPassword: ${{ secrets.CENTRAL_PASSWORD }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNING_PASSWORD }}
        run: |
          if [ "${ORG_GRADLE_PROJECT_centralUsername}" = "" ] || \
             [ "${ORG_GRADLE_PROJECT_centralPassword}" = "" ] || \
             [ "${ORG_GRADLE_PROJECT_signingKey}" = "" ] || \
             [ "${ORG_GRADLE_PROJECT_signingPassword}" = "" ]; then
            echo "Configure the following secrets to enable uploading to Sonatype:"
            echo "CENTRAL_USERNAME, CENTRAL_PASSWORD, SIGNING_KEY, SIGNING_PASSWORD"
            exit 1
          fi

      - name: Clone the repo
        uses: actions/checkout@v4
        with:
          # the version counter is computed from the tags that already exist
          fetch-depth: 0
          fetch-tags: true

      - name: Reserve or reuse the release version
        id: version
        run: |
          # Run IDs survive retries; a new dispatch still gets a new version.
          marker="Release workflow ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
          tags="$(git for-each-ref --format='%(objecttype)%09%(refname:strip=2)%09%(contents:subject)' refs/tags)"
          version="$(awk -F '\t' -v marker="$marker" '$1 == "tag" && $3 == marker { print $2 }' <<< "$tags")"

          if [ -n "$version" ]; then
            # Also reject multiple matching tags (the result would contain newlines).
            if [[ ! "$version" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}(-[0-9]+)?$ ]]; then
              echo "Invalid or ambiguous release tag for this workflow run." >&2
              exit 1
            fi
            if [ "$(git rev-parse "refs/tags/${version}^{commit}")" != "$GITHUB_SHA" ]; then
              echo "The release tag does not point to this workflow's commit." >&2
              exit 1
            fi
            echo "Reusing release ${version}"
          else
            version="$(bash scripts/next-version.sh)"
            git -c user.name='github-actions[bot]' \
                -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
                tag --annotate "$version" "$GITHUB_SHA" --message "$marker"
            git push origin "refs/tags/${version}"
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Create the GitHub release if needed
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          if ! gh release view "$VERSION" > /dev/null 2>&1; then
            gh release create "$VERSION" \
              --verify-tag --title "$VERSION" --generate-notes
          fi

      - name: Setup the java environment
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Publish and close the Sonatype staging repository
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
          ORG_GRADLE_PROJECT_centralUsername: ${{ secrets.CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_centralPassword: ${{ secrets.CENTRAL_PASSWORD }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNING_PASSWORD }}
        run: |
          if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
            # A later step (including cleanup) may have failed after publication.
            published="$(gh api --paginate \
              "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/jobs?filter=all&per_page=100" \
              --jq '.jobs[].steps[]? | select(.name == "Publish and close the Sonatype staging repository" and .conclusion == "success") | .conclusion')"
            if [ -n "$published" ]; then
              echo "Release ${VERSION} was already published successfully; skipping upload."
              exit 0
            fi
          fi
          ./gradlew publishToSonatype closeSonatypeStagingRepository \
            -PtestdataVersion="$VERSION" \
            --console=plain --stacktrace