release.yml

# SPDX-FileCopyrightText: The devcontainer.java Authors
# SPDX-License-Identifier: 0BSD

name: Automated Release
on:
  push:
    branches: [main]
  workflow_dispatch:
# Serialize release runs. Each run's release-notes lower bound is the latest tag
# at the time its prepare job runs; two merges in quick succession would both
# read that bound before either run has tagged, producing overlapping notes.
# Queueing (no cancel) lets the earlier release finish and create its tag first,
# so the next run's notes start from that tag and carry only its own commits.
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false
jobs:
  prepare:
    name: Prepare Release
    runs-on: ubuntu-latest
    outputs:
      needed: ${{ steps.gate.outputs.needed }}
      version: ${{ steps.version.outputs.version }}
      previous: ${{ steps.gate.outputs.last }}
    steps:
      - name: Clone Git Repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
      - id: gate
        name: Check whether a release is needed
        uses: metio/ci/needs-release@749a4d81adf23ed252c309fa8bd94aec0e6b03c7 # 2026.7.15145237
        with:
          paths: src/main/java pom.xml
      - id: version
        name: Compute the next version
        if: steps.gate.outputs.needed == 'true'
        uses: metio/ci/calver@749a4d81adf23ed252c309fa8bd94aec0e6b03c7 # 2026.7.15145237
  release:
    needs: [prepare]
    if: needs.prepare.outputs.needed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write # create the GitHub Release
    steps:
      - id: checkout
        name: Clone Git Repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
      - id: timestamp
        name: Build Timestamp
        run: echo "iso8601=$(date --utc --iso-8601=seconds)" >> $GITHUB_OUTPUT
      - id: notes
        name: Generate Release Notes
        uses: metio/ci/release-notes@749a4d81adf23ed252c309fa8bd94aec0e6b03c7 # 2026.7.15145237
        with:
          version: ${{ needs.prepare.outputs.version }}
          previous: ${{ needs.prepare.outputs.previous }}
      - name: Append usage and verification footer
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          NOTES: ${{ steps.notes.outputs.file }}
        run: |
          cat >> "$NOTES" <<EOF

          ## Usage

          Pull the library from [Maven Central](https://central.sonatype.com/artifact/wtf.metio.devcontainer/devcontainer.java).
      - id: setup-java
        name: Set up Java
        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
        with:
          java-version: 25
          distribution: temurin
          cache: maven
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_TOKEN
      - id: gpg
        name: GPG Key
        uses: timheuer/base64-to-file@dfa5a5dd38803cb4f5c3a081eeb28e8362d43e9c # v2
        with:
          fileName: signing.key.asc
          fileDir: ${{ github.workspace }}
          encodedString: ${{ secrets.GPG_SECRET_KEY_BASE64 }}
      - id: pom-version
        name: Set Release Version
        run: mvn --batch-mode --define newVersion=${{ needs.prepare.outputs.version }} --define generateBackupPoms=false versions:set
      - id: deploy-maven
        name: Deploy Maven Artifact
        run: >
          mvn
          --batch-mode
          --activate-profiles release
          --define scmTag=${{ steps.sha.outputs.sha }}
          --define sign.keyFile=${{ steps.gpg.outputs.filePath }}
          --define sign.keyPass=${{ secrets.GPG_SECRET_KEY_PASSWORD }}
          --define project.build.outputTimestamp=${{ steps.timestamp.outputs.iso8601 }}
          deploy
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
      - id: create_release
        name: Create Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          tag_name: ${{ needs.prepare.outputs.version }}
          name: ${{ needs.prepare.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          draft: false
          prerelease: false
          body_path: ${{ steps.notes.outputs.file }}