release.yml

name: Release

on:
  push:
    tags:
      - '*'

jobs:
  build-jar:
    name: Build JVM
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Prepare java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 24

      - name: Install Clojure
        uses: DeLaGuardo/setup-clojure@13.6.1
        with:
          cli: '1.12.0.1530'
          bb: '1.12.200'

      - name: Get latest tag
        id: latest-tag
        uses: WyriHaximus/github-action-get-previous-tag@v1

      - name: Generate jar
        run: bb prod-jar

      - name: Upload jar
        uses: actions/upload-artifact@v4
        with:
          path: eca.jar
          name: eca.jar

      - name: Generate sha256
        run: sha256sum eca.jar | awk '{print $1}' > eca.jar.sha256

      - name: Upload sha256
        uses: actions/upload-artifact@v4
        with:
          path: eca.jar.sha256
          name: eca.jar.sha256

  linux-amd64:
    name: Build native linux amd64 binary
    needs: [ build-jar]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: eca.jar

      - name: Install clojure build tools
        uses: DeLaGuardo/setup-clojure@13.6.1
        with:
          cli: '1.12.0.1530'
          bb: '1.12.200'

      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: '24'
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Linux native image
        env:
          ECA_JAR: "eca.jar"
          ECA_XMX: "-J-Xmx6g"
        run: |
          bb native-cli

      - name: Zip binary
        run: zip eca-native-linux-amd64.zip eca

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-linux-amd64.zip
          name: eca-native-linux-amd64.zip

      - name: Generate sha256
        run: sha256sum eca-native-linux-amd64.zip | awk '{print $1}' > eca-native-linux-amd64.zip.sha256

      - name: Upload sha256
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-linux-amd64.zip.sha256
          name: eca-native-linux-amd64.zip.sha256

  linux-amd64-static:
    name: Build native linux amd64 static binary
    needs: [ build-jar]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: eca.jar

      - name: Install clojure build tools
        uses: DeLaGuardo/setup-clojure@13.6.1
        with:
          cli: '1.12.0.1530'
          bb: '1.12.200'

      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: '24'
          distribution: 'graalvm'
          native-image-musl: 'true'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build static Linux native image
        env:
          ECA_JAR: "eca.jar"
          ECA_XMX: "-J-Xmx6g"
          ECA_STATIC: true
          ECA_MUSL: true
        run: |
          bb native-cli

      - name: Zip binary
        run: zip eca-native-static-linux-amd64.zip eca

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-static-linux-amd64.zip
          name: eca-native-static-linux-amd64.zip

      - name: Generate sha256
        run: sha256sum eca-native-static-linux-amd64.zip | awk '{print $1}' > eca-native-static-linux-amd64.zip.sha256

      - name: Upload sha256
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-static-linux-amd64.zip.sha256
          name: eca-native-static-linux-amd64.zip.sha256

  linux-aarch64:
    name: Build native linux aarch64 binary
    needs: [ build-jar]
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: eca.jar

      - name: Install clojure build tools
        uses: DeLaGuardo/setup-clojure@13.6.1
        with:
          cli: '1.12.0.1530'
          bb: '1.12.200'

      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: '24'
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Linux native image
        env:
          ECA_JAR: "eca.jar"
          ECA_XMX: "-J-Xmx6g"
        run: |
          bb native-cli

      - name: Zip binary
        run: zip eca-native-linux-aarch64.zip eca

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-linux-aarch64.zip
          name: eca-native-linux-aarch64.zip

      - name: Generate sha256
        run: sha256sum eca-native-linux-aarch64.zip | awk '{print $1}' > eca-native-linux-aarch64.zip.sha256

      - name: Upload sha256
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-linux-aarch64.zip.sha256
          name: eca-native-linux-aarch64.zip.sha256

  macos-amd64:
    name: Build native MacOS amd64 binary
    needs: [ build-jar]
    runs-on: macos-15-intel
    env:
      CSC_LINK: ${{ secrets.CSC_LINK }}
      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
    steps:
      - name: Ensure signing secrets are set
        if: github.repository == 'editor-code-assistant/eca'
        run: |
          if [ -z "$CSC_LINK" ]; then
            echo "::error::CSC_LINK secret is empty, binary would be released unsigned"
            exit 1
          fi
          if [ -z "$APPLE_ID" ]; then
            echo "::error::APPLE_ID secret is empty, binary would be released without notarization"
            exit 1
          fi

      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: eca.jar

      - name: Install clojure build tools
        uses: DeLaGuardo/setup-clojure@13.6.1
        with:
          cli: '1.12.0.1530'
          bb: '1.12.200'

      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: '24'
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Import Developer ID certificate
        if: env.CSC_LINK != ''
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ env.CSC_LINK }}
          p12-password: ${{ env.CSC_KEY_PASSWORD }}

      - name: Build MacOS native image
        env:
          ECA_JAR: "eca.jar"
          ECA_XMX: "-J-Xmx6g"
        run: |
          bb native-cli

      - name: Codesign native binary
        if: env.CSC_LINK != ''
        run: |
          IDENTITY=$(security find-identity -v -p codesigning | awk -F'"' '/Developer ID Application/ {print $2; exit}')
          if [[ -z "$IDENTITY" ]]; then
            echo "::error::No Developer ID Application identity found in keychain"
            exit 1
          fi
          echo "Signing with: $IDENTITY"
          # Sign in an isolated directory so codesign does not walk sibling
          # files in the repo root as "subcomponents".
          TMPSIGN=$(mktemp -d)
          cp ./eca "$TMPSIGN/eca"
          cp build/entitlements.mac.plist "$TMPSIGN/entitlements.plist"
          (cd "$TMPSIGN" && codesign --force --options runtime --timestamp \
            --entitlements entitlements.plist \
            --sign "$IDENTITY" ./eca)
          codesign -dvvv "$TMPSIGN/eca"
          mv "$TMPSIGN/eca" ./eca
          rm -rf "$TMPSIGN"

      - name: Zip binary
        run: zip eca-native-macos-amd64.zip eca

      - name: Notarize zipped binary
        if: env.APPLE_ID != ''
        run: |
          xcrun notarytool submit eca-native-macos-amd64.zip \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --wait

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-macos-amd64.zip
          name: eca-native-macos-amd64.zip

      - name: Generate sha256
        run: |
          set -euo pipefail
          shasum -a 256 eca-native-macos-amd64.zip | awk '{print $1}' > eca-native-macos-amd64.zip.sha256

      - name: Upload sha256
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-macos-amd64.zip.sha256
          name: eca-native-macos-amd64.zip.sha256

  macos-aarch64:
    name: Build native MacOS aarch64 binary
    needs: [ build-jar]
    runs-on: macos-14
    env:
      CSC_LINK: ${{ secrets.CSC_LINK }}
      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
    steps:
      - name: Ensure signing secrets are set
        if: github.repository == 'editor-code-assistant/eca'
        run: |
          if [ -z "$CSC_LINK" ]; then
            echo "::error::CSC_LINK secret is empty, binary would be released unsigned"
            exit 1
          fi
          if [ -z "$APPLE_ID" ]; then
            echo "::error::APPLE_ID secret is empty, binary would be released without notarization"
            exit 1
          fi

      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: eca.jar

      - name: Install clojure build tools
        uses: DeLaGuardo/setup-clojure@13.6.1
        with:
          cli: '1.12.0.1530'
          bb: '1.12.200'

      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: '24'
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Import Developer ID certificate
        if: env.CSC_LINK != ''
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ env.CSC_LINK }}
          p12-password: ${{ env.CSC_KEY_PASSWORD }}

      - name: Build MacOS native image
        env:
          ECA_JAR: "eca.jar"
          ECA_XMX: "-J-Xmx6g"
        run: |
          bb native-cli

      - name: Codesign native binary
        if: env.CSC_LINK != ''
        run: |
          IDENTITY=$(security find-identity -v -p codesigning | awk -F'"' '/Developer ID Application/ {print $2; exit}')
          if [[ -z "$IDENTITY" ]]; then
            echo "::error::No Developer ID Application identity found in keychain"
            exit 1
          fi
          echo "Signing with: $IDENTITY"
          # Sign in an isolated directory so codesign does not walk sibling
          # files in the repo root as "subcomponents".
          TMPSIGN=$(mktemp -d)
          cp ./eca "$TMPSIGN/eca"
          cp build/entitlements.mac.plist "$TMPSIGN/entitlements.plist"
          (cd "$TMPSIGN" && codesign --force --options runtime --timestamp \
            --entitlements entitlements.plist \
            --sign "$IDENTITY" ./eca)
          codesign -dvvv "$TMPSIGN/eca"
          mv "$TMPSIGN/eca" ./eca
          rm -rf "$TMPSIGN"

      - name: Zip binary
        run: zip eca-native-macos-aarch64.zip eca

      - name: Notarize zipped binary
        if: env.APPLE_ID != ''
        run: |
          xcrun notarytool submit eca-native-macos-aarch64.zip \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --wait

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-macos-aarch64.zip
          name: eca-native-macos-aarch64.zip

      - name: Generate sha256
        run: |
          set -euo pipefail
          shasum -a 256 eca-native-macos-aarch64.zip | awk '{print $1}' > eca-native-macos-aarch64.zip.sha256

      - name: Upload sha256
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-macos-aarch64.zip.sha256
          name: eca-native-macos-aarch64.zip.sha256

  windows-amd64:
    name: Build native Windows binary
    needs: [ build-jar]
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: eca.jar

      - name: configure Pagefile
        uses: al-cheb/configure-pagefile-action@v1.2
        with:
          minimum-size: 8GB
          maximum-size: 16GB

      - name: Prepare java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 24

      - name: Install clojure build tools
        uses: DeLaGuardo/setup-clojure@13.6.1
        with:
          cli: '1.12.0.1530'
          bb: '1.12.200'

      - name: Install MSVC
        uses: ilammy/msvc-dev-cmd@v1

      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: '24'
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Windows native image
        env:
          ECA_JAR: eca.jar
          ECA_XMX: "-J-Xmx7g"
        run: |
          bb native-cli

      - name: Zip binary
        run: |
          jar -cMf eca-native-windows-amd64.zip eca.exe

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-windows-amd64.zip
          name: eca-native-windows-amd64.zip

      - name: Generate sha256
        run: sha256sum eca-native-windows-amd64.zip | awk '{print $1}' > eca-native-windows-amd64.zip.sha256

      - name: Upload sha256
        uses: actions/upload-artifact@v4
        with:
          path: eca-native-windows-amd64.zip.sha256
          name: eca-native-windows-amd64.zip.sha256

  release:
    name: Create Release
    environment: prod-release
    needs: [build-jar, linux-amd64, linux-amd64-static, linux-aarch64, macos-amd64, macos-aarch64, windows-amd64]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Get latest tag
        id: latest-tag
        uses: WyriHaximus/github-action-get-previous-tag@v1

      - name: Install Babashka
        run: curl -s https://raw.githubusercontent.com/borkdude/babashka/master/install | sudo bash

      - name: Retrieve last changelog entry
        id: changelog
        run: |
          echo 'CHANGELOG_BODY<<EOF' >> $GITHUB_ENV
          bb get-last-changelog-entry ${{ steps.latest-tag.outputs.tag}} >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV

      - name: Create Release
        id: create_release
        uses: softprops/action-gh-release@v2
        with:
          token: ${{ secrets.ECA_TOKEN }}
          tag_name: ${{ steps.latest-tag.outputs.tag}}
          body: ${{ env.CHANGELOG_BODY }}

  upload-to-release:
    name: Upload artifacts to release
    needs: [release]
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Get latest tag
        id: latest-tag
        uses: WyriHaximus/github-action-get-previous-tag@v1

      - uses: actions/download-artifact@v4

      - name: Upload jar
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca.jar/eca.jar
          asset_name: eca.jar
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload jar sha256
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca.jar.sha256/eca.jar.sha256
          asset_name: eca.jar.sha256
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload Linux amd64 native binary
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-linux-amd64.zip/eca-native-linux-amd64.zip
          asset_name: eca-native-linux-amd64.zip
          tag: ${{ steps.latest-tag.outputs.tag }}

      - name: Upload Linux amd64 native sha256
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-linux-amd64.zip.sha256/eca-native-linux-amd64.zip.sha256
          asset_name: eca-native-linux-amd64.zip.sha256
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload static Linux amd64 native binary
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-static-linux-amd64.zip/eca-native-static-linux-amd64.zip
          asset_name: eca-native-static-linux-amd64.zip
          tag: ${{ steps.latest-tag.outputs.tag }}

      - name: Upload static Linux amd64 native sha256
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-static-linux-amd64.zip.sha256/eca-native-static-linux-amd64.zip.sha256
          asset_name: eca-native-static-linux-amd64.zip.sha256
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload Linux aarch64 native binary
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-linux-aarch64.zip/eca-native-linux-aarch64.zip
          asset_name: eca-native-linux-aarch64.zip
          tag: ${{ steps.latest-tag.outputs.tag }}

      - name: Upload Linux aarch64 native sha256
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-linux-aarch64.zip.sha256/eca-native-linux-aarch64.zip.sha256
          asset_name: eca-native-linux-aarch64.zip.sha256
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload MacOS amd64 native binary
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-macos-amd64.zip/eca-native-macos-amd64.zip
          asset_name: eca-native-macos-amd64.zip
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload MacOS amd64 native sha256
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-macos-amd64.zip.sha256/eca-native-macos-amd64.zip.sha256
          asset_name: eca-native-macos-amd64.zip.sha256
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload MacOS aarch64 native binary
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-macos-aarch64.zip/eca-native-macos-aarch64.zip
          asset_name: eca-native-macos-aarch64.zip
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload MacOS aarch64 native sha256
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-macos-aarch64.zip.sha256/eca-native-macos-aarch64.zip.sha256
          asset_name: eca-native-macos-aarch64.zip.sha256
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload Windows native binary
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-windows-amd64.zip/eca-native-windows-amd64.zip
          asset_name: eca-native-windows-amd64.zip
          tag: ${{ steps.latest-tag.outputs.tag}}

      - name: Upload Windows native sha256
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.ECA_TOKEN }}
          file: eca-native-windows-amd64.zip.sha256/eca-native-windows-amd64.zip.sha256
          asset_name: eca-native-windows-amd64.zip.sha256
          tag: ${{ steps.latest-tag.outputs.tag}}