sailing-analytics/.github/workflows/release.yml

name: release
on:
  push:
    paths-ignore:
      - 'wiki/**'
      - '.github/workflows/*'
      - '**/*.md'
      - 'README.md'
      - 'docs/**'
  # Run for pull requests only once an approving review has been submitted.
  # The build for a PR (which may originate from an untrusted fork) therefore
  # never executes before a maintainer has vetted the exact code. Secrets are
  # released to the PR build via the "privileged-pr-build" environment gate
  # (see the "environment" key on the build job below).
  pull_request_review:
    types: [submitted]
  workflow_dispatch:
    inputs:
      skip_tests:
        description: Skip tests (set to "true" to skip all tests)
        default: 'false'
      local_target_platform:
        description: Build with a local target platform (set to "true" to use local target platform)
        default: 'false'
      runner_cpus:
        description: Empty means ubuntu-latest, usually 4 CPUs with little disk/memory, but if you have runners named ubuntu-latest-Xcpu, it can be 4, 8, 16, and 64 as well, using, e.g., ubuntu-latest-16cpu; default is ubuntu-latest
        default: ''
      firefox_version:
        description: Version to use for Selenium tests; default is 137.0, but could, e.g., be "141.0" or "latest"
        default: '140.0'

jobs:
  # The "changes" job will cause the "build" job to get skipped for trivial changes
  changes:
    permissions: {}
    # Only run for push, manual dispatch, or a PR review that is an approval.
    # A non-approving review (comment / changes-requested) must not trigger a build.
    if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'approved' }}
    runs-on: ubuntu-latest
    outputs:
      should_run: ${{ steps.filter.outputs.code }}
    steps:
      - uses: actions/checkout@v4
        with:
          # On an approving review, evaluate the filter against the reviewed PR
          # head commit rather than the base branch.
          ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - id: filter
        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3
        with:
          filters: |
            code:
              - '!wiki/**'
              - '!.github/workflows/*'
              - '!**/*.md'
              - '!README.md'
              - '!docs/**'

  build:
    needs: changes
    if: ${{ needs.changes.outputs.should_run == 'true' || github.event_name == 'workflow_dispatch' }}
    # For a PR review-triggered run, reference the "privileged-pr-build"
    # environment so its protection rules (a required-reviewer team) must pass
    # before the job is sent to a runner and before any secrets are released.
    # For push / workflow_dispatch the name evaluates to an empty string, which
    # GitHub treats as "no environment" — those runs are NOT gated and use the
    # repository-level secrets exactly as before. The environment deliberately
    # holds no secrets of its own: because same-named secrets resolve
    # environment > repository, leaving it empty means the repository-level
    # values are used, so secret rotation stays in a single place.
    environment:
      name: ${{ github.event_name == 'pull_request_review' && 'privileged-pr-build' || '' }}
    permissions:
      contents: write
      checks: write
      actions: read
    runs-on: ${{ github.event.inputs.runner_cpus != '' && format('ubuntu-latest-{0}cpu', github.event.inputs.runner_cpus) || 'ubuntu-latest' }}
    steps:
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@v1.3.1
        with:
          # this might remove tools that are actually needed,
          # if set to "true" but frees about 6 GB
          tool-cache: false
          # all of these default to true, but feel free to set to
          # "false" if necessary for your workflow
          android: false
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: false
          swap-storage: true
      - name: Allocate swap space
        shell: bash
        run: |
          sudo dd if=/dev/zero of=/mnt/large-swapfile bs=1G count=30
          sudo chmod 600 /mnt/large-swapfile
          sudo mkswap /mnt/large-swapfile
          sudo chown root:root /mnt/large-swapfile
          sudo swapon /mnt/large-swapfile
      - name: Create TMP space under /mnt/tmp
        shell: bash
        run: |
          sudo mkdir /mnt/tmp
          sudo chmod 777 /mnt/tmp
      - name: Collect Workflow Telemetry
        uses: catchpoint/workflow-telemetry-action@94c3c3d9567a0205de6da68a76c428ce4e769af1 # v2.0.0
        with:
          comment_on_pr: false
      - name: Setup firefox
        id: setup-firefox
        uses: browser-actions/setup-firefox@5914774dda97099441f02628f8d46411fcfbd208 # v1.7.0
        with:
          firefox-version: ${{  github.event.inputs.firefox_version == '' && '140.0' || github.event.inputs.firefox_version }}
      - run: |
          echo Installed firefox versions: ${{ steps.setup-firefox.outputs.firefox-version }}
          ${{ steps.setup-firefox.outputs.firefox-path }} --version
      - name: Check out the repository to the runner
        uses: actions/checkout@v4
        with:
          fetch-depth: '500'
          # On an approving review, build the reviewed PR head commit (which may
          # come from an untrusted fork) rather than the base branch, and do not
          # leave the GITHUB_TOKEN in .git/config where that PR code could read
          # it. For push / workflow_dispatch these evaluate to the previous
          # defaults, so existing runs are unchanged.
          ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || github.sha }}
          persist-credentials: ${{ github.event_name != 'pull_request_review' }}
      - name: Install JDK 8
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '8'
          mvn-toolchain-id: 'JavaSE-1.8'
      - name: Install JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '17'
          mvn-toolchain-id: 'JavaSE-17'
      - name: Install JDK 25
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '25'
          mvn-toolchain-id: 'JavaSE-25'
      - name: Setup Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
        with:
          log-accepted-android-sdk-licenses: 'false'
          cmdline-tools-version: 9123335  # This corresponds to human-friendly version number 8.0
      - name: Start MongoDB
        uses: supercharge/mongodb-github-action@315db7fe45ac2880b7758f1933e6e5d59afd5e94 #v1.12.1
        with:
          mongodb-version: 7.0
      - name: Start RabbitMQ
        uses: Namoshek/rabbitmq-github-action@80a182e44c7f60bc3417a8689d6a24fe9d08b27b #v1.2.0
        with:
          version: '3.8.9'
          ports: '5672:5672'
      - shell: bash
        env: # Or as an environment variable
          TMP: /mnt/tmp
          AWS_S3_TEST_S3ACCESSID: ${{ secrets.AWS_S3_TEST_S3ACCESSID }}
          AWS_S3_TEST_S3ACCESSKEY: ${{ secrets.AWS_S3_TEST_S3ACCESSKEY }}
          GEONAMES_ORG_USERNAMES: ${{ secrets.GEONAMES_ORG_USERNAMES }}
          GOOGLE_MAPS_AUTHENTICATION_PARAMS: ${{ secrets.GOOGLE_MAPS_AUTHENTICATION_PARAMS }}
          POLAR_DATA_BASE_URL: ${{ vars.POLAR_DATA_BASE_URL }}
          POLAR_DATA_BEARER_TOKEN: ${{ secrets.POLAR_DATA_BEARER_TOKEN }}
          APP_PARAMETERS: "-Daws.region=eu-west-1"
          JAVA8_HOME: ${{env.JAVA_HOME_8_X64}}
          JAVA17_HOME: ${{env.JAVA_HOME_17_X64}}
        run: |
            ./configuration/buildAndUpdateProduct.sh -x ${{ github.event.inputs.runner_cpus == '' && '4' || github.event.inputs.runner_cpus }} ${{ github.event.inputs.skip_tests == 'true' && '-t' || '' }} ${{ github.event.inputs.local_target_platform == 'true' && '-v' || '' }} build 2>&1
      - name: show disk stats
        if: always()
        run: df -h
      - name: Upload build log
        uses: actions/upload-artifact@v4
        if: always()
        with:
            name: build.log
            path: build.log
            retention-days: 90
      - name: Collect Test Reports
        uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5 # v1.9.1
        if: always()
        with:
          name: Maven Tests
          path: '**/TEST-*.xml' 
          max-annotations: '1'
          list-suites: failed
          list-tests: failed
          reporter: java-junit
          fail-on-error: true
      - name: Build Release
        if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
        shell: bash
        run: |
          ./configuration/buildAndUpdateProduct.sh -u -L ${{ github.event.inputs.skip_tests == 'true' && '-n untested' || '' }} release
      - name: Determine release name
        run: |
          echo "SIMPLE_VERSION_INFO=$( basename dist/* )" >>${GITHUB_ENV}
      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
            name: test-results
            path: |
                **/surefire-reports/**
            retention-days: 90
      - name: Upload distribution artifact
        uses: actions/upload-artifact@v4
        if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
        with:
            name: ${{ env.SIMPLE_VERSION_INFO }}
            path: dist/**/*
            retention-days: 90
      - name: Create Release
        id: create_release
        if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
        with:
          tag_name: ${{ env.SIMPLE_VERSION_INFO }}
          target_commitish: ${{ github.ref_name }}
          name: ${{ env.SIMPLE_VERSION_INFO }}
          draft: false
          prerelease: false
      - name: Upload Release Asset tar.gz
        id: upload-release-asset-tar-gz
        if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps 
          asset_path: ./dist/${{ env.SIMPLE_VERSION_INFO }}/${{ env.SIMPLE_VERSION_INFO }}.tar.gz
          asset_name: ${{ env.SIMPLE_VERSION_INFO }}.tar.gz
          asset_content_type: application/x-tar
      - name: Upload Release Asset release_notes.txt
        id: upload-release-asset-release-notes-txt
        if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps 
          asset_path: ./dist/${{ env.SIMPLE_VERSION_INFO }}/release-notes.txt
          asset_name: release-notes.txt
          asset_content_type: text/plain
      - name: Trigger CI job
        env:
          CI_JOB_USERNAME: ${{ vars.CI_JOB_USERNAME }}
          CI_JOB_PASSWORD: ${{ secrets.CI_JOB_PASSWORD }}
          CI_JOB_TOKEN: ${{ secrets.CI_JOB_TOKEN }}
        if: ${{ always() && env.CI_JOB_USERNAME != '' && env.CI_JOB_PASSWORD != '' && env.CI_JOB_TOKEN != '' }}
        shell: bash
        run: |
          if [[ "${{ github.ref }}" =~ refs/heads/releases/.* ]]; then
            JOB=$( echo "${{ github.ref }}" | sed -e 's/^refs\/heads\/releases\///' )
          else
            JOB=$( echo "${{ github.ref }}" | sed -e 's/^refs\/heads\///' )
          fi
          echo "Identified CI job: ${JOB}"
          curl -u "${{ vars.CI_JOB_USERNAME }}:${{ secrets.CI_JOB_PASSWORD}}" ${{ vars.CI_BASE_URL }}/job/${JOB}/build?token=${{ secrets.CI_JOB_TOKEN }}

  build-gate:
    permissions: {}
    needs: [changes, build]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - run: |
          if [[ "${{ needs.build.result }}" == "success" ]]; then
            echo "Build passed."
          elif [[ "${{ needs.build.result }}" == "skipped" && "${{ needs.changes.outputs.should_run }}" == "false" ]]; then
            echo "No relevant changes — skipping is OK."
          elif [[ "${{ needs.changes.result }}" == "skipped" ]]; then
            echo "Pipeline did not apply to this event (e.g. a non-approving review) — nothing to gate."
          else
            echo "Build failed or was cancelled."
            exit 1
          fi