build-and-deploy.yml

name: CI/CD Process
on:
  workflow_call:
  workflow_dispatch:

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: ${{ !contains(github.ref, 'master') }}

jobs:
  # Prepare the environment for the build
  ci-preparation:
    runs-on: ubuntu-22.04
    outputs:
      makepkg-image: ${{ steps.makepkg-image.outputs.image-name }}
      build-ref: ${{ steps.ci-preparation.outputs.build-ref }}
      force-version: ${{ steps.force-version.outputs.version }}
      java-version: ${{ steps.java-version.outputs.java-version }}
      may-deploy: ${{ steps.may-deploy.outputs.may-deploy }}
      next-version: ${{ steps.compute-next-version.outputs.next-version }}
      will-release: ${{ steps.compute-next-version.outputs.will-release }}
    steps:
      - name: Compute the build ref
        id: ci-preparation
        run: echo "build-ref=${{ github.workflow }}-${{ github.event.number || github.ref }}" >> $GITHUB_OUTPUT
      - name: Determine whether this build may run deployments
        id: may-deploy
        run: |
          echo "may-deploy=${{
            !github.event.repository.fork && (
              github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
            )
          }}" >> $GITHUB_OUTPUT
      - name: Checkout
        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      - name: Compute the Java version
        id: java-version
        run: ruby -e 'puts("java-version=#{/^minJavaVersion\s*=\s*(\d+)$/.match(File.read("gradle.properties"))[1]}")' >> $GITHUB_OUTPUT
      - name: Install Node
        uses: actions/setup-node@v4.0.2
        with:
          node-version-file: package.json
      - name: Compute the next release version
        id: compute-next-version
        uses: nicolasfara/precompute-semantic-release-version-action@1.0.2
        with:
          github-token: ${{ github.token }}
      - name: Prepare a force version parameter for Gradle
        id: force-version
        run: |
          if [[ "${{ steps.compute-next-version.outputs.will-release }}" == "true" ]]; then
              echo 'version=-PforceVersion=${{ steps.compute-next-version.outputs.next-version }}' >> $GITHUB_OUTPUT
          fi
      - name: fetch the image name for makepkg
        id: makepkg-image
        run: echo "image-name=$(grep 'FROM danysk/makepkg' < deps-utils/Dockerfile | sed 's/FROM //')" >> $GITHUB_OUTPUT

  # Testing and static analysis
  build:
    needs:
      - ci-preparation
    strategy:
      fail-fast: false
      matrix:
        os: [ windows-2022, macos-14, ubuntu-22.04 ]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 180
    steps:
      - name: Checkout
        uses: danysk/action-checkout@0.2.17
      - uses: DanySK/build-check-deploy-gradle-action@2.4.18
        with:
          pre-build-command: true
          build-command: |
            ./gradlew kotlinUpgradeYarnLock --parallel
          check-command: |
            ./gradlew check --parallel || ./gradlew check --parallel
          clean-command: |
            ./gradlew clean --parallel || ./gradlew clean --parallel || true
          java-version: ${{ needs.ci-preparation.outputs.java-version }}
          should-run-codecov: ${{ contains('Linux', runner.os) }}
          should-deploy: false
          should-validate-wrapper: false

  # Builds the website and verifies link sanity
  build-website:
    needs:
      - ci-preparation
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: danysk/action-checkout@0.2.17
      - uses: DanySK/build-check-deploy-gradle-action@2.4.18
        with:
          retries-on-failure: 5
          wait-between-retries: 120
          build-command: |
            ./gradlew ${{ needs.ci-preparation.outputs.force-version }} hugoBuild performWebsiteStringReplacements --parallel && break
          check-command: true
          java-version: ${{ needs.ci-preparation.outputs.java-version }}
          should-run-codecov: false
          should-deploy: false
          should-validate-wrapper: false
      - name: Tar files
        run: tar -cvf website.tar build/website
      - name: Upload website
        uses: actions/upload-artifact@v4.3.3
        with:
          name: website-${{ github.sha }}
          path: website.tar
      - run: |
          # Temporarily disable checks on kdoc/javadoc: too many bugs in Dokka.
          # See:
          # https://github.com/Kotlin/dokka/issues/2320
          # https://github.com/Kotlin/dokka/issues/2321
          # https://github.com/Kotlin/dokka/issues/2322
          # https://github.com/Kotlin/dokka/issues/2323
          # Once everything gets fixed, lychee could simply run on '/website/**/*.html'
          FILES="$(
            find build/website/ -name '*.html' |
            grep -v /kdoc/ |
            grep -v /javadoc/ |
            grep -v /tags/ |
            sed -e 's#^build##'
          )"
          for file in $FILES; do
            # Ignore all meta tags containing absolute links
            perl -i -pe 's/<meta.*\"http.*\".*>//g' "build/$file"
          done
          for attempt in $(seq 1 5); do
            echo "Attempt $attempt/5"
            docker run --rm -v "$(pwd)/build/website:/website" -e GITHUB_TOKEN lycheeverse/lychee:0.10.3 $(echo "$FILES") --exclude-file /website/lycheeignore -m 100 --accept 403,429,500,502,503 && break
            if [ "$attempt" = "${{ inputs.retries-on-failure}}" ]; then false; else sleep 120; fi
          done

  # Create a staging repository on Central
  staging-repo:
    runs-on: ubuntu-22.04
    needs:
      - ci-preparation
    if: fromJSON(needs.ci-preparation.outputs.may-deploy)
    outputs:
      repo-id: ${{ steps.staging-repo.outputs.MavenCentral }}
    steps:
      - name: Checkout the repo
        uses: actions/checkout@v4.1.5
      - uses: DanySK/build-check-deploy-gradle-action@2.4.18
        with:
          maven-central-password: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          should-run-codecov: false
          should-deploy: true
          build-command: true
          check-command: true
          deploy-command: |
            ./gradlew ${{ needs.ci-preparation.outputs.force-version }} createStagingRepositoryOnMavenCentral --parallel
      - name: Save the staging repository ID
        id: staging-repo
        run: |
          [[ -f build/staging-repo-ids.properties ]] || (
            echo "Staging repositories ID file not found" &&
            exit 1
          )
          REPO_IDS=$(cat build/staging-repo-ids.properties)
          echo "Staging repositories IDs:\n$REPO_IDS"
          echo $REPO_IDS >> $GITHUB_OUTPUT


  # Assemble all artifacts and upload them
  assemble-and-upload:
    needs:
      - ci-preparation
      - staging-repo
    strategy:
      fail-fast: false
      matrix:
        os: [ windows-2022, macos-14, ubuntu-22.04 ]
    runs-on: ${{ matrix.os }}
    # Run if:
    # - The staging repository is ready
    # - The staging repository cannot be created as there is no access to secrets
    if: >-
      always() && (
        contains(needs.staging-repo.result, 'success') || (
          contains(needs.*.result, 'skipped') && !fromJSON(needs.ci-preparation.outputs.may-deploy)
        )
      )
    timeout-minutes: 120
    steps:
      - name: Checkout with full history
        uses: danysk/action-checkout@0.2.17
      - uses: DanySK/build-check-deploy-gradle-action@2.4.18
        with:
          signing-key: ${{ secrets.SIGNING_KEY }}
          signing-password: ${{ secrets.SIGNING_PASSWORD }}
          maven-central-password: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          should-run-codecov: false
          should-deploy: ${{ contains('Linux', runner.os) && needs.ci-preparation.outputs.may-deploy }}
          should-validate-wrapper: ${{ contains('Linux', runner.os) }}
          pre-build-command: |
            ./gradlew kotlinUpgradeYarnLock --parallel
          build-command: |
            ./gradlew ${{ needs.ci-preparation.outputs.force-version }} assemble --parallel
          check-command: true
          deploy-command: |
            [ -n "${{ needs.staging-repo.outputs.repo-id }}" ] || (
              echo "Staging repository ID not found" &&
              exit 1
            )
            ./gradlew\
              ${{ needs.ci-preparation.outputs.force-version }}\
              -PstagingRepositoryId=${{ needs.staging-repo.outputs.repo-id }}\
              uploadKotlinOSSRH uploadKotlinMultiplatform uploadJvm uploadJs close --parallel || \
            #
            # Drop the staging repository if the build is not a release
            #
            if [[ "${{ needs.ci-preparation.outputs.will-release }}" != "true" ]]; then
              ./gradlew -PstagingRepositoryId=${{ needs.staging-repo.outputs.repo-id }} drop --parallel
            fi
          clean-command: |
            # Clean the build directory on Win and Mac
            if [[ "${{ contains('Linux', runner.os) }}" == "false" ]]; then
              rm -rf build/shadow/*
            fi
      - name: Upload fatjars built on Linux
        if: ${{ runner.os == 'Linux' }}
        uses: actions/upload-artifact@v4.3.3
        with:
          name: fat-jars-${{ github.sha }}
          path: build/shadow/*
          if-no-files-found: error
      - name: Upload the PKGBUILD
        if: ${{ runner.os == 'Linux' }}
        uses: actions/upload-artifact@v4.3.3
        with:
          name: pkgbuild-${{ github.sha }}
          path: build/pkgbuild/PKGBUILD
          if-no-files-found: error
      - name: Upload platform-specific packages
        uses: actions/upload-artifact@v4.3.3
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
          path: build/package/*
          if-no-files-found: error

  test-windows-msi-installer:
    needs:
      - assemble-and-upload
      - ci-preparation
    runs-on: windows-2022
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    steps:
      - name: Download packages
        uses: actions/download-artifact@v4.1.7
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
      - name: Install packages
        shell: powershell
        run: |
          Get-ChildItem -Force | Format-Table -AutoSize
          foreach ($file in Get-ChildItem -Filter *.msi) {
            $log = "install.log"
            $procMain = Start-Process "msiexec" "/i `"$file`" /qn /l*! `"$log`"" -NoNewWindow -PassThru
            Start-Sleep -Seconds 1
            $procLog = Start-Process "powershell" "Get-Content -Path `"$log`" -Wait" -NoNewWindow -PassThru 
            $procMain.WaitForExit() 
            $procLog.Kill()
          }
      - name: Test installation
        shell: pwsh
        run: |
          Import-Module "$env:ChocolateyInstall/helpers/chocolateyInstaller.psm1"
          refreshenv
          alchemist --help

  test-linux-deb-installer:
    needs:
      - assemble-and-upload
      - ci-preparation
    runs-on: ubuntu-22.04
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    steps:
      - name: Download packages
        uses: actions/download-artifact@v4.1.7
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
      - name: Work around xdg bug https://bugs.archlinux.org/task/33316
        run: |
          sudo mkdir /usr/share/desktop-directories/
      - name: Install packages
        run: |
          ls -ahl
          sudo apt update -y
          sudo apt install gdebi-core
          for installer in *.deb; do
            sudo gdebi -n "$installer"
          done
      - name: Test installation
        run: alchemist --help

  test-linux-rpm-installer:
    needs:
      - assemble-and-upload
      - ci-preparation
    runs-on: ubuntu-22.04
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    container:
      image: fedora:41
    steps:
      - name: Download packages
        uses: actions/download-artifact@v4.1.7
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
      - name: Install packages
        run: |
          yum check-update || [ $? -eq 100 ]
          for installer in *.rpm; do
              yum -y localinstall "$installer"
          done
      - name: Test installation
        run: alchemist --help

  # Test PKGBUILD for AUR release
  verify-aur-package:
    needs:
      - ci-preparation
      - assemble-and-upload
    runs-on:  ubuntu-22.04
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    container:
      image: ${{ needs.ci-preparation.outputs.makepkg-image }}
      options: --user root
    steps:
      - name: Setup arch
        run: |
          pacman --noconfirm -Sy ruby
          sudo chmod 777 .
          # Work around Unable to download artifact(s): EACCES: permission denied, open '/__w/_temp/...
          # sudo chmod -R 777 /__w
          # Work around https://github.com/actions/checkout/issues/1169
          # sudo git config --system --add safe.directory /__w/Alchemist/Alchemist
      - name: Download the PKGBUILD
        uses: actions/download-artifact@v4.1.7
        with:
          pattern: pkgbuild-${{ github.sha }}
          merge-multiple: true
      - name: Check the PKGBUILD sanity
        run: |
          namcap PKGBUILD 2>&1
          namcap PKGBUILD 2>&1 | awk 'END { exit (NR > 0 ? NR : 0) }'
      - name: Download the RPM
        uses: actions/download-artifact@v4.1.7
        with:
          pattern: installer-package-${{ github.sha }}-${{ runner.os }}
          merge-multiple: true
      - name: Replace the URL with the local rpm
        run: |
          ruby -e '
            original_pkgbuild = File.read("PKGBUILD")
            version = original_pkgbuild.match(/pkgver=(.*)/)[1]
            pkgbuild_with_replaced_url = original_pkgbuild.gsub(
              /source=(.*)/,
              "source=(\"alchemist-#{version}-1.$CARCH.rpm\")"
            )
            File.write("PKGBUILD", pkgbuild_with_replaced_url)
          '
      - name: Makepkg
        run: |
          sudo -u builder bash -c 'makepkg -sf --noconfirm'
      - name: Check the package sanity
        run: |
          namcap *.pkg.tar* 2>&1 > namcap.log
          cat namcap.log
          ignored=(
            "W: Referenced library 'libjvm.so' is an uninstalled dependency"
            "W: Unused shared library '/usr/lib/libdl.so.2'"
            "W: Unused shared library '/usr/lib/libm.so.6'"
            "W: Unused shared library '/usr/lib/libnet.so'"
            "W: Unused shared library '/usr/lib/libpthread.so.0'"
            "W: Unused shared library '/usr/lib/librt.so.1'"
            "lacks GNU_PROPERTY_X86_FEATURE_1_SHSTK"
          )
          for i in $ignored; do
              echo "$i" >> ignored
          done
          ruby -e '
            ignored = File.read("ignored").lines.map(&:chomp)
            warnings = File.read("namcap.log").lines.reject { |line|
              ignored.any? { |i| line.include?(i) }
            }
            puts warnings.join("\n")
            exit warnings.size
          '
      - name: Test installation
        run: |
          pacman -U --noconfirm *alchemist-*.pkg.tar*
          alchemist --help

  # Performs a release if needed
  release:
    needs:
      - ci-preparation
      - build
      - build-website
      - staging-repo
      - verify-aur-package
      - test-linux-deb-installer
      - test-linux-rpm-installer
      - test-windows-msi-installer
    concurrency:
      # Only one release job at a time per branch, as only master releases.
      # Strictly sequential.
      group: release-${{ needs.ci-preparation.outputs.build-ref }}
      cancel-in-progress: false
    runs-on: ubuntu-22.04
    outputs:
      winget-deploy: ${{ steps.check-released.outputs.has-released }}
    if: >-
      !github.event.repository.fork
      && (
        github.event_name != 'pull_request'
        || github.event.pull_request.head.repo.full_name == github.repository
      )
    steps:
      - name: Checkout
        uses: actions/checkout@v4.1.5
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOYMENT_TOKEN }}
      - name: Checkout the docs
        if: contains(github.repository, 'AlchemistSimulator/Alchemist')
        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
        with:
          path: website
          fetch-depth: 0
          persist-credentials: true
          repository: AlchemistSimulator/alchemistsimulator.github.io
          token: ${{ secrets.DEPLOYMENT_TOKEN }}
      - name: Download website artifact
        uses: actions/download-artifact@v4.1.7
        with:
          name: website-${{ github.sha }}
      - name: Download packages
        uses: actions/download-artifact@v4.1.7
        with:
          pattern: installer-package-${{ github.sha }}*
          path: build/package/
          merge-multiple: true
      - name: Download fatJars
        uses: actions/download-artifact@v4.1.7
        with:
          name: fat-jars-${{ github.sha }}
          path: build/shadow/
          merge-multiple: true
      - name: Download the PKGBUILD
        uses: actions/download-artifact@v4.1.7
        with:
          pattern: pkgbuild-${{ github.sha }}
          path: pkgbuild/
          merge-multiple: true
      - name: Install Node
        uses: actions/setup-node@v4.0.2
        with:
          node-version-file: package.json
      - uses: DanySK/build-check-deploy-gradle-action@2.4.18
        env:
          STAGING_REPO_ID: ${{ needs.staging-repo.outputs.repo-id }}
          MAKEPKG_IMAGE: ${{ needs.ci-preparation.outputs.makepkg-image }}
        with:
          java-version: ${{ needs.ci-preparation.outputs.java-version }}
          build-command: |
            ls -ahl
            echo Copying the new website
            tar -xf website.tar
            echo Copying git information
            mv website/.git build/website/.git
            # git -C build/website/ status
            echo Removing old website
            rm -rf website
            echo Adding changes to the stage
            git -C build/website/ add .
            # git -C build/website/ status
          check-command: true
          deploy-command: |
            npm install
            npx semantic-release
          should-run-codecov: false
          should-deploy: true
          should-validate-wrapper: false
          github-token: ${{ secrets.DEPLOYMENT_TOKEN }}
          maven-central-password: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          signing-key: ${{ secrets.SIGNING_KEY }}
          signing-password: ${{ secrets.SIGNING_PASSWORD }}
          custom-secret-0: ${{ secrets.AUR_USERNAME }}
          custom-secret-1: ${{ secrets.AUR_EMAIL }}
          custom-secret-2: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
      - name: Check if a release was performed
        id: check-released
        # if a file named "RELEASED" is present in the repository, write "true" to the "has-released" output
        # Otherwise, write "false" to the same variable
        run: |
            if [ -f RELEASED ]; then
                echo A relase was successfully performed
                echo "has-released=true" >> "$GITHUB_OUTPUT"
            else
                echo No release was performed
                echo "has-released=false" >> "$GITHUB_OUTPUT"
            fi

  # Completes the release process for winget
  release-winget:
    needs:
      - ci-preparation
      - release
    concurrency:
      group: release-winget-${{ needs.ci-preparation.outputs.build-ref }}
      cancel-in-progress: false
    runs-on: windows-2022
    env:
      packageID: "Unibo.Alchemist"
    if: fromJSON(needs.release.outputs.winget-deploy)
    steps:
      - name: Install winget
        uses: Cyberboss/install-winget@v1
      - name: Install wingetcreate
        shell: pwsh
        run: Invoke-WebRequest https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
      - name: Check package availability
        shell: pwsh
        run: |
          .\wingetcreate.exe show $env:packageID
      - name: Update package
        shell: pwsh
        run: |
          $version = "${{ needs.ci-preparation.outputs.next-version }}"
          $packageVersion = if ($version.IndexOf("-") -ne -1) { $version.Substring(0, $version.IndexOf("-")) } else { $version }
          $installerUrl = "https://github.com/AlchemistSimulator/Alchemist/releases/download/$packageVersion/alchemist-$packageVersion.msi"
          $gitToken = "${{ secrets.DEPLOYMENT_TOKEN }}"
          .\wingetcreate.exe update $env:packageID --version $packageVersion --urls "$installerUrl" --submit --token $gitToken

  success:
    runs-on: ubuntu-22.04
    needs:
      - assemble-and-upload
      - build
      - build-website
      - ci-preparation
      - release
      - release-winget
      - staging-repo
      - verify-aur-package
      - test-linux-deb-installer
      - test-linux-rpm-installer
      - test-windows-msi-installer
    if: >-
      always() && (
        contains(join(needs.*.result, ','), 'failure')
        || !contains(join(needs.*.result, ','), 'cancelled')
      )
    steps:
      - name: Verify that there were no failures
        run: ${{ !contains(join(needs.*.result, ','), 'failure') }}