release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag to build and release (e.g. 1.0.1)'
        required: false
        default: '1.0.1'

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  POWERSHELL_TELEMETRY_OPTOUT: '1'
  DOTNET_CLI_TELEMETRY_OPTOUT: '1'
  DOTNET_NOLOGO: '1'

jobs:
  build-attest-release:
    name: Build, Attest & Release
    runs-on: windows-latest
    timeout-minutes: 30
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Run Automated Security & Adversarial Test Suite (PowerShell 7)
        shell: pwsh
        run: |
          .\tests\Test-JvmSecurity.ps1 -Detailed

      - name: Run Cross-Shell Compatibility Verification (Windows PowerShell 5.1)
        shell: powershell
        run: |
          .\tests\Test-JvmSecurity.ps1 -Suite Registry
          .\tests\Test-JvmSecurity.ps1 -Suite ShellErgonomics
          .\tests\Test-JvmSecurity.ps1 -Suite Portability

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@87b7050bc53ea08284295505d98d2aa94301e852 # v4.2.0
        with:
          dotnet-version: '8.0.x'

      - name: Install WiX Toolset v4
        shell: pwsh
        run: |
          dotnet tool install --global wix --version 4.0.6
          wix extension add --global WixToolset.Util.wixext/4.0.6
          "$HOME/.dotnet/tools" | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
          wix --version

      - name: Resolve Release Version and Tag
        id: resolve-version
        shell: pwsh
        env:
          INPUT_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
          GITHUB_REF_TYPE: ${{ github.ref_type }}
        run: |
          $ver = $env:INPUT_VERSION
          $refName = $env:GITHUB_REF_NAME
          $refType = $env:GITHUB_REF_TYPE

          $semverRegex = '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$'

          # Only parse the ref_name if this action was triggered explicitly by a genuine git Tag push
          if ($refType -eq "tag" -and $refName -match '^v?([0-9]+\.[0-9]+\.[0-9]+.*)') {
              $rawVer = $matches[1]
              if ($rawVer -notmatch $semverRegex -or $rawVer -match '\.\.') {
                  Write-Error "Git tag '$refName' does not match strict semantic versioning format."
                  exit 1
              }
              $ver = $rawVer
              $tag = "v$ver"
          } elseif ($ver) {
              $cleanVer = $ver.TrimStart('v')
              if ($cleanVer -notmatch $semverRegex -or $cleanVer -match '\.\.') {
                  Write-Error "Input version '$ver' does not match strict semantic versioning format."
                  exit 1
              }
              $ver = $cleanVer
              $tag = "v$ver"
          } else {
              $bat = Get-Content "jvm.bat" -Raw
              if ($bat -match 'set "JVM_VERSION=([^"]+)"') {
                  $ver = $matches[1].Trim()
              } else {
                  $ver = "1.0.1"
              }
              if ($ver -notmatch $semverRegex -or $ver -match '\.\.') {
                  Write-Error "Resolved JVM_VERSION '$ver' does not match strict semantic versioning format."
                  exit 1
              }
              $tag = "v$ver"
          }
          Write-Host "Resolved Version: $ver"
          Write-Host "Resolved Tag:     $tag"
          "version=$ver" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          "tag=$tag"     | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

      - name: Build Standalone MSIs (x64 & arm64)
        shell: pwsh
        env:
          RELEASE_VERSION: ${{ steps.resolve-version.outputs.version }}
        run: |
          $ver = $env:RELEASE_VERSION
          .\packages\msi\build-msi.ps1 -Version $ver -Arch all

      - name: Run Integration Test Suite (x64)
        shell: pwsh
        env:
          RELEASE_VERSION: ${{ steps.resolve-version.outputs.version }}
        run: |
          $ver = $env:RELEASE_VERSION
          .\packages\msi\test-msi.ps1 -MsiPath "packages/msi/jvm-windows-$ver-x64.msi"

      - name: Build Chocolatey Package (.nupkg)
        shell: pwsh
        env:
          RELEASE_VERSION: ${{ steps.resolve-version.outputs.version }}
        run: |
          $ver = $env:RELEASE_VERSION
          .\packages\choco\build-choco.ps1 -Version $ver

      - name: Create Portable Zip Distribution
        shell: pwsh
        env:
          RELEASE_VERSION: ${{ steps.resolve-version.outputs.version }}
        run: |
          $ver = $env:RELEASE_VERSION
          $zipName = "packages/msi/jvm-windows-$ver-portable.zip"
          $itemsToCompress = @("jvm.bat", "assets", "LICENSE", "README.md", "uninstall.ps1", "install.ps1") | Where-Object { Test-Path -LiteralPath $_ }
          Compress-Archive -LiteralPath $itemsToCompress -DestinationPath $zipName -Force
          Write-Host "Created portable archive: $zipName"

      - name: Stage Release Artifacts
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path "dist" -Force | Out-Null
          Copy-Item "packages\msi\jvm-windows-*.msi" -Destination "dist\" -Force
          Copy-Item "packages\msi\jvm-windows-*.zip" -Destination "dist\" -Force
          Copy-Item "packages\choco\jvm-windows.*.nupkg" -Destination "dist\" -Force
          
          # Safely copy only the files that actually exist to prevent step crashes
          @("jvm.bat", "install.ps1", "uninstall.ps1", "README.md", "LICENSE") | Where-Object { Test-Path -LiteralPath $_ } | ForEach-Object {
              Copy-Item -LiteralPath $_ -Destination "dist\" -Force
          }
          
          Write-Host "Staged release artifacts in dist/:"
          Get-ChildItem -LiteralPath "dist" | ForEach-Object {
              if ($_.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
                  throw "Security violation (CWE-59): Staged release artifact '$($_.Name)' is a reparse point."
              }
              Write-Host "  $($_.Name) ($([math]::Round($_.Length / 1KB, 1)) KB)" -ForegroundColor Cyan
          }

      - name: Generate Checksums (SHA256SUMS.txt)
        shell: pwsh
        run: |
          $distFiles = Get-ChildItem -LiteralPath "dist" -File | Where-Object { $_.Name -ne "SHA256SUMS.txt" }
          $sha256 = [System.Security.Cryptography.SHA256]::Create()
          try {
              $checksumLines = foreach ($item in $distFiles) {
                  $fs = [System.IO.File]::OpenRead($item.FullName)
                  try {
                      $hash = ([System.BitConverter]::ToString($sha256.ComputeHash($fs)) -replace '-', '').ToLower()
                  } finally {
                      $fs.Close()
                      $fs.Dispose()
                  }
                  Write-Host "$hash  $($item.Name)"
                  "$hash  $($item.Name)"
              }
              [System.IO.File]::WriteAllLines((Join-Path (Resolve-Path -LiteralPath "dist").Path "SHA256SUMS.txt"), $checksumLines, [System.Text.UTF8Encoding]::new($false))
          } finally {
              $sha256.Dispose()
          }

      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
        with:
          subject-path: "dist/*"

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
        with:
          tag_name: ${{ steps.resolve-version.outputs.tag }}
          target_commitish: ${{ github.sha }}
          name: ${{ steps.resolve-version.outputs.tag }}
          files: dist/*
          generate_release_notes: true
          draft: false
          prerelease: false

      - name: Upload Release Artifacts
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: jvm-release-artifacts
          path: dist/*
          if-no-files-found: error