.github/workflows/release-java.yml

################################################################################
#  Licensed to the Apache Software Foundation (ASF) under one
#  or more contributor license agreements.  See the NOTICE file
#  distributed with this work for additional information
#  regarding copyright ownership.  The ASF licenses this file
#  to you under the Apache License, Version 2.0 (the
#  "License"); you may not use this file except in compliance
#  with the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
# limitations under the License.
################################################################################

name: Release Java

on:
  workflow_call:
  workflow_dispatch:

env:
  JDK_VERSION: 8

concurrency:
  group: release-java-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-native:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            os_name: linux
            arch: x86_64
            lib_name: libpaimon_vindex_jni.so
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
            os_name: linux
            arch: aarch64
            lib_name: libpaimon_vindex_jni.so
          - os: macos-latest
            target: aarch64-apple-darwin
            os_name: macos
            arch: aarch64
            lib_name: libpaimon_vindex_jni.dylib
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            os_name: windows
            arch: x86_64
            lib_name: paimon_vindex_jni.dll
    steps:
      - uses: actions/checkout@v6

      - name: Setup Rust toolchain
        run: |
          rustup update stable
          rustup default stable

      - name: Setup Python
        if: matrix.os_name == 'linux'
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Setup Linux zigbuild
        if: matrix.os_name == 'linux'
        run: pip install cargo-zigbuild

      - name: Build Linux JNI library
        if: matrix.os_name == 'linux'
        shell: bash
        run: |
          set -euo pipefail

          rustup target add "${{ matrix.target }}"
          unset ZSTD_SYS_USE_PKG_CONFIG

          cargo zigbuild --release -p paimon-vindex-jni --target "${{ matrix.target }}.2.17"

          artifact="target/${{ matrix.target }}/release/${{ matrix.lib_name }}"
          test -f "$artifact"

          version_info="$(readelf --version-info "$artifact")"
          max_glibc="$(
            printf '%s\n' "$version_info" \
              | grep -Eo 'GLIBC_[0-9][0-9.]*' \
              | sort -Vu \
              | tail -n1 \
              || true
          )"
          echo "Maximum required GLIBC version: ${max_glibc:-none}"

          if [[ -n "$max_glibc" ]]; then
            allowed_glibc="GLIBC_2.17"
            highest_glibc="$(printf '%s\n%s\n' "$allowed_glibc" "$max_glibc" | sort -Vu | tail -n1)"
            if [[ "$highest_glibc" != "$allowed_glibc" ]]; then
              echo "Linux GNU artifact requires $max_glibc, expected <= $allowed_glibc" >&2
              exit 1
            fi
          fi

      - name: Build JNI library
        if: matrix.os_name != 'linux'
        run: |
          rustup target add "${{ matrix.target }}"
          cargo build --release -p paimon-vindex-jni --target "${{ matrix.target }}"

      - name: Upload native library
        uses: actions/upload-artifact@v5
        with:
          name: native-${{ matrix.os_name }}-${{ matrix.arch }}
          path: target/${{ matrix.target }}/release/${{ matrix.lib_name }}

  deploy-staging:
    if: github.repository == 'apache/paimon-vector-index' && startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, '-rc')
    runs-on: ubuntu-latest
    needs: [build-native]
    steps:
      - uses: actions/checkout@v6

      - name: Download linux x86_64 native library
        uses: actions/download-artifact@v5
        with:
          name: native-linux-x86_64
          path: java/src/main/resources/native/linux/x86_64

      - name: Download linux aarch64 native library
        uses: actions/download-artifact@v5
        with:
          name: native-linux-aarch64
          path: java/src/main/resources/native/linux/aarch64

      - name: Download macOS aarch64 native library
        uses: actions/download-artifact@v5
        with:
          name: native-macos-aarch64
          path: java/src/main/resources/native/macos/aarch64

      - name: Download windows x86_64 native library
        uses: actions/download-artifact@v5
        with:
          name: native-windows-x86_64
          path: java/src/main/resources/native/windows/x86_64

      - name: Verify native libraries
        run: find java/src/main/resources/native -type f | sort

      - name: Set up JDK ${{ env.JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JDK_VERSION }}
          distribution: 'temurin'
          server-id: apache.releases.https
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.GPG_SECRET_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Show Maven version
        run: mvn --version

      - name: Deploy to Apache Nexus staging
        working-directory: java
        run: |
          REF="${{ github.ref_name }}"
          VERSION="${REF#v}"
          DESC="Apache Paimon Vector Index, version ${VERSION%-rc*}, release candidate ${VERSION#*-rc}"
          mvn clean deploy \
            -Prelease \
            -DskipTests \
            -DstagingDescription="$DESC"
        env:
          MAVEN_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
          MAVEN_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}