release.yaml

name: Release Verify

on:
  push:
    branches:
      - '**'
    paths:
      - '.github/workflows/release.yaml'
      - '.github/workflows/check.yaml'
      - '.github/workflows/publish.yaml'
      - '.github/workflows/prepare-release.yaml'
      - 'scripts/compile.ts'
      - 'scripts/checksum.ts'
      - 'scripts/platforms.ts'
      - 'scripts/release.ts'
      - 'scripts/publish-release.ts'
      - 'scripts/prepare-release.ts'
      - 'scripts/smoke.ts'
      - 'docs/installation.md'
      - 'LICENSE*'
      - 'tests/compile.test.ts'
      - 'tests/release.test.ts'
      - 'tests/publish-release.test.ts'
      - 'tests/prepare-release.test.ts'
      - 'package.json'
      - 'bun.lockb'
      - 'bump.config.ts'
      - '.bun-version'
  workflow_dispatch:
  workflow_call:
    inputs:
      publish:
        description: 验收通过后创建标签并发布
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: release-${{ inputs.publish && 'publish' || github.ref }}
  cancel-in-progress: ${{ !inputs.publish }}

jobs:
  metadata:
    name: 校验版本与发布目标
    runs-on: ubuntu-24.04
    outputs:
      matrix: ${{ steps.metadata.outputs.matrix }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: .bun-version
      - name: 校验版本并生成产物清单
        id: metadata
        run: bun scripts/release.ts metadata ${{ inputs.publish && '--publish' || '' }}
      - name: 检查发布请求、主分支与已有版本
        if: inputs.publish
        env:
          GH_TOKEN: ${{ github.token }}
        run: bun scripts/publish-release.ts check

  checks:
    needs: metadata
    if: inputs.publish || github.event_name == 'workflow_dispatch'
    uses: ./.github/workflows/check.yaml
    with:
      ref: ${{ github.sha }}
      publish: ${{ inputs.publish || false }}

  build:
    name: 验收 ${{ matrix.name }}
    needs: metadata
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.metadata.outputs.matrix) }}
    env:
      GRADLE_USER_HOME: ${{ github.workspace }}/.cache/gradle
      RELEASE_BINARY: ${{ matrix.binary }}
      RELEASE_PLATFORM: ${{ matrix.name }}
      BUN_TARGET: ${{ matrix.target }}
    steps:
      - name: 检出待验收提交
        uses: actions/checkout@v5
        with:
          ref: ${{ github.sha }}
      - name: 安装固定版本 Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: .bun-version
      - name: 安装 JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'
      - name: 安装固定版本 Gradle
        uses: gradle/actions/setup-gradle@v5
        with:
          gradle-version: '8.14'
      - name: 缓存隔离的 Maven 仓库
        uses: actions/cache@v5
        with:
          path: ${{ runner.temp }}/java-run-maven-repository
          key: ${{ runner.os }}-${{ runner.arch }}-release-maven-${{ hashFiles('tests/fixtures/**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-release-maven-
      - name: 按锁文件安装依赖
        run: bun install --frozen-lockfile
      - name: 构建待发布二进制
        shell: bash
        run: |
          bun run compile --target="$BUN_TARGET" --outfile="dist/$RELEASE_BINARY"
      - name: JDK 21 完整运行验收
        shell: bash
        env:
          JAVA_RUN_MAVEN_REPOSITORY: ${{ runner.temp }}/java-run-maven-repository
          JAVA_RUN_GRADLE_HOME: ${{ env.GRADLE_USER_HOME }}
        run: bun scripts/smoke.ts --cli="dist/$RELEASE_BINARY" --suite=full
      - name: 安装 JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'
      - name: 打包与 JDK 17 解压产物验收
        shell: bash
        env:
          JAVA_RUN_MAVEN_REPOSITORY: ${{ runner.temp }}/java-run-maven-repository
          JAVA_RUN_GRADLE_HOME: ${{ env.GRADLE_USER_HOME }}
        run: bun scripts/release.ts package "$RELEASE_PLATFORM"
      - name: 上传已验收压缩包
        uses: actions/upload-artifact@v6
        with:
          name: package-${{ matrix.name }}
          path: dist/${{ matrix.archive }}
          if-no-files-found: error
          overwrite: true

  artifacts:
    name: 汇总与校验已验收产物
    needs: build
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.sha }}
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: .bun-version
      - name: 汇总构建产物
        uses: actions/download-artifact@v7
        with:
          pattern: package-*
          merge-multiple: true
          path: dist
      - name: 校验五种产物并生成 SHA-256
        run: bun scripts/release.ts checksums
      - name: 核对文件校验和
        working-directory: dist
        run: sha256sum --check SHA256SUMS
      - name: 生成发布说明预览
        run: |
          bun scripts/release.ts notes > release-notes.md
          cat release-notes.md >> "$GITHUB_STEP_SUMMARY"
      - name: 保存已校验产物
        uses: actions/upload-artifact@v6
        with:
          name: release-with-checksums
          path: dist/*
          if-no-files-found: error
          overwrite: true

  release:
    name: 创建标签并发布已验收产物
    needs: [metadata, checks, artifacts]
    if: inputs.publish
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: .bun-version
      - uses: actions/download-artifact@v7
        with:
          name: release-with-checksums
          path: dist
      - name: 核对待上传文件
        working-directory: dist
        run: sha256sum --check SHA256SUMS
      - name: 创建标签、上传草稿资产并公开版本
        run: bun scripts/publish-release.ts publish