release.yml

name: Release

# Tags must match plugin.json. Build macOS arm64/x64, Windows x64 and Linux
# ARM64/x64 packages from the same revision, then upload a draft prerelease.
# The maintainer verifies the downloaded assets before publishing the draft.
# Contract 0 currently requires the matching Viva preview, not stable Lithe.
on:
  push:
    tags: ["v*"]

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  test:
    name: Rust checks and tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Test package resources
        run: node --test --test-timeout=60000 scripts/package/*.test.mjs
      - name: Check formatting
        run: cargo fmt --all --check
      - name: Lint
        run: cargo clippy --workspace --all-targets --locked -- -D warnings
      - name: Test
        run: cargo test --workspace --locked
      - name: Check the pinned plugin SDK release
        run: scripts/verify-sdk-lock.sh --download

  windows:
    name: Build Windows x64 backend
    env:
      # The plugin must run without a separately installed VC++ runtime.
      RUSTFLAGS: -C target-feature=+crt-static
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc
      - uses: Swatinem/rust-cache@v2
      - name: Test the native Windows backend
        run: cargo test --workspace --locked --target x86_64-pc-windows-msvc
      - name: Build the native Windows backend
        run: cargo build --release --locked -p lithe-java-backend --target x86_64-pc-windows-msvc
      - uses: actions/upload-artifact@v4
        with:
          name: windows-backend
          path: target/x86_64-pc-windows-msvc/release/lithe-java-backend.exe
          if-no-files-found: error
          retention-days: 7

  release:
    name: Publish ${{ github.ref_name }}
    needs: [test, windows, linux]
    runs-on: macos-26
    timeout-minutes: 60
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      # scripts/assemble-package.sh compiles the plugin backend for each
      # architecture it packages.
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin, x86_64-apple-darwin
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - uses: actions/download-artifact@v4
        with:
          name: windows-backend
          path: .artifacts/windows-backend
      - name: Check the tag matches plugin.json
        run: |
          set -euo pipefail
          version=$(plutil -extract version raw -o - io.github.lithe-idea.java-support/plugin.json)
          if [[ "$GITHUB_REF_NAME" != "v$version" ]]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match plugin.json version $version"
            exit 1
          fi
      - name: Build and verify both architectures
        run: |
          set -euo pipefail
          for arch in arm64 x86_64; do
            scripts/build-package.sh --arch "$arch"
          done
      - name: Verify Windows runtime dependencies
        run: |
          set -euo pipefail
          /usr/bin/objdump -p .artifacts/windows-backend/lithe-java-backend.exe > "$RUNNER_TEMP/windows-imports.txt"
          if grep -Ei 'DLL Name:.*(VCRUNTIME|MSVCP|libgcc|libstdc|libwinpthread)' "$RUNNER_TEMP/windows-imports.txt"; then
            echo "::error::Windows backend depends on a separately installed compiler runtime"
            exit 1
          fi
      - name: Assemble the Windows archive
        run: |
          set -euo pipefail
          archive=$(node scripts/package/build-windows.mjs .artifacts/windows-backend/lithe-java-backend.exe)
          mkdir -p dist
          cp "$archive" "$archive.sha256" dist/
      - uses: actions/download-artifact@v4
        with:
          pattern: java-linux-*
          merge-multiple: true
          path: dist
      - name: Archive and publish
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          checksums="$RUNNER_TEMP/checksums.txt"
          : > "$checksums"
          for arch in arm64 x86_64; do
            scripts/archive-package.sh --package ".artifacts/package/$arch/io.github.lithe-idea.java-support" \
              --arch "$arch" >> "$checksums"
          done
          notes="docs/releases/$GITHUB_REF_NAME.md"
          test -s "$notes"
          cp "$notes" "$RUNNER_TEMP/notes.md"
          {
            echo
            echo '### SHA-256'
            echo '```'
            sed 's#  dist/#  #' "$checksums"
            cat dist/*windows-x64.zip.sha256 dist/*linux-*.zip.sha256
            echo '```'
          } >> "$RUNNER_TEMP/notes.md"
          gh release create "$GITHUB_REF_NAME" dist/*.zip dist/*.zip.sha256 --verify-tag --draft --prerelease \
            --title "Java Support $GITHUB_REF_NAME" --notes-file "$RUNNER_TEMP/notes.md"

  linux:
    name: Build and run Linux ${{ matrix.arch }} package
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            arch: x64
          - os: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.os }}
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install packaging tools
        run: sudo apt-get update && sudo apt-get install -y zsh zip unzip
      - name: Restore checksum-verified downloads
        uses: actions/cache@v4
        with:
          path: |
            .artifacts/jdtls-downloads
            .artifacts/jdk-downloads
          key: linux-${{ matrix.arch }}-${{ hashFiles('third_party/*/manifest.json') }}
      - name: Test the native backend
        run: cargo test --workspace --locked
      - name: Build and verify the archive
        run: node scripts/package/build-linux.mjs "${{ matrix.arch }}"
      - name: Start the packaged backend and language server
        run: node scripts/package/smoke-linux.mjs dist/*-linux-${{ matrix.arch }}.zip
      - uses: actions/upload-artifact@v4
        with:
          name: java-linux-${{ matrix.arch }}
          path: |
            dist/*-linux-*.zip
            dist/*-linux-*.zip.sha256
          if-no-files-found: error
          retention-days: 7