publication.yml

name: 'Publication'

on:
  push:
    branches:
      - main
  release:
    types: [published]

jobs:
  build-native-jars:
    name: 'Build Native JARs / ${{ matrix.display }}'
    strategy:
      matrix:
        include:
          - display: 'linux-amd64 (vec1+avx2)'
            os: ubuntu-latest
            platform: linux-amd64
            container: registry.access.redhat.com/ubi8/ubi:latest
            shell: bash
            vec1_enabled: 'ON'
            vec1_x86_avx2: 'ON'
          - display: 'linux-aarch64 (vec1)'
            os: ubuntu-24.04-arm
            platform: linux-aarch64
            container: registry.access.redhat.com/ubi8/ubi:latest
            shell: bash
            vec1_enabled: 'ON'
            vec1_x86_avx2: 'OFF'
          - display: 'linux-amd64-musl (vec1+avx2)'
            os: ubuntu-latest
            platform: linux-amd64-musl
            container: alpine:3.20
            shell: sh
            vec1_enabled: 'ON'
            vec1_x86_avx2: 'ON'
          - display: 'darwin-aarch64 (vec1)'
            os: macos-15
            platform: darwin-aarch64
            shell: bash
            vec1_enabled: 'ON'
            vec1_x86_avx2: 'OFF'
          - display: 'windows-amd64 (vec1+avx2)'
            os: windows-latest
            platform: windows-amd64
            shell: bash
            vec1_enabled: 'ON'
            vec1_x86_avx2: 'ON'
    runs-on: ${{ matrix.os }}
    container: ${{ matrix.container }}
    defaults:
      run:
        shell: ${{ matrix.shell }}
    timeout-minutes: 60
    env:
      SELEKT_LIBC: ${{ contains(matrix.platform, 'musl') && 'musl' || '' }}

    steps:
      - name: 'Install system packages'
        shell: sh
        run: |
          if [ "${{ runner.os }}" = "Linux" ]; then
            if command -v apk > /dev/null 2>&1; then
              apk update
              apk add --no-cache bash git gcc g++ musl-dev make curl tar sed gnupg file perl linux-headers cmake diffutils tcl unzip openjdk17
            else
              dnf update -y
              dnf install -y git gcc gcc-c++ libstdc++-static glibc-devel make curl tar sed bash gnupg file perl kernel-headers cmake diffutils tcl unzip
            fi
          elif [ "${{ runner.os }}" = "macOS" ]; then
            brew install make tcl-tk mimalloc
          elif [ "${{ runner.os }}" = "Windows" ]; then
            choco install mingw make magicsplat-tcl-tk -y --no-progress
          fi

      - name: 'Configure Windows Perl'
        if: runner.os == 'Windows'
        shell: cmd
        run: |
          C:\msys64\usr\bin\bash.exe -lc "pacman --noconfirm -S perl make"
          C:\msys64\usr\bin\bash.exe -lc "echo | cpan Locale::Maketext::Simple Pod::Usage"
          C:\msys64\usr\bin\bash.exe -lc "perl -e 'use Locale::Maketext::Simple; use Pod::Usage; print qq{OK\n}'"

      - name: 'Build mimalloc'
        if: runner.os != 'macOS'
        run: |
          cd /tmp
          curl -L https://github.com/microsoft/mimalloc/archive/refs/tags/v3.1.6.tar.gz -o mimalloc.tar.gz
          tar xzf mimalloc.tar.gz
          cd mimalloc-3.1.6
          mkdir -p out/release
          cd out/release
          if [ "${{ runner.os }}" = "Windows" ]; then
            cmake ../.. -G "MinGW Makefiles" -DCMAKE_BUILD_TYPE=Release -DMI_BUILD_SHARED=OFF -DMI_BUILD_STATIC=ON -DMI_BUILD_TESTS=OFF
            cmake --build . --target mimalloc-static
            mkdir -p "C:/mimalloc/lib" "C:/mimalloc/include"
            cp libmimalloc.a "C:/mimalloc/lib/"
            cp ../../include/mimalloc.h "C:/mimalloc/include/"
          else
            cmake ../.. -DCMAKE_BUILD_TYPE=Release -DMI_BUILD_SHARED=OFF -DMI_BUILD_STATIC=ON -DMI_BUILD_TESTS=OFF -DMI_LOCAL_DYNAMIC_TLS=ON
            make -j$(nproc) mimalloc-static
            mkdir -p /usr/local/lib /usr/local/include
            cp libmimalloc.a /usr/local/lib/libmimalloc.a
            cp ../../include/mimalloc.h /usr/local/include/mimalloc.h
          fi

      - name: 'Setup MSVC'
        if: runner.os == 'Windows'
        uses: ilammy/msvc-dev-cmd@v1

      - name: 'Setup Java 17'
        if: "!contains(matrix.platform, 'musl')"
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: 'Set JAVA_HOME'
        run: |
          if [ "${{ runner.os }}" = "Linux" ]; then
            if command -v apk > /dev/null 2>&1; then
              echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk" >> $GITHUB_ENV
            elif [ "$(uname -m)" = "aarch64" ]; then
              echo "JAVA_HOME=$JAVA_HOME_17_ARM64" >> $GITHUB_ENV
            else
              echo "JAVA_HOME=$JAVA_HOME_17_X64" >> $GITHUB_ENV
            fi
          elif [ "${{ runner.os }}" = "macOS" ]; then
            echo "JAVA_HOME=$(/usr/libexec/java_home -v 17)" >> $GITHUB_ENV
          elif [ "${{ runner.os }}" = "Windows" ]; then
            echo "JAVA_HOME=${JAVA_HOME_17_X64//\\//}" >> $GITHUB_ENV
          fi

      - name: 'Setup Android SDK'
        if: "!contains(matrix.platform, 'linux-aarch64') && !contains(matrix.platform, 'musl')"
        uses: android-actions/setup-android@v4

      - name: 'Setup Android SDK (aarch64)'
        if: matrix.platform == 'linux-aarch64'
        run: |
          mkdir -p "$HOME/.android/sdk/cmdline-tools"
          curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o /tmp/cmdline-tools.zip
          unzip -q /tmp/cmdline-tools.zip -d "$HOME/.android/sdk/cmdline-tools"
          mv "$HOME/.android/sdk/cmdline-tools/cmdline-tools" "$HOME/.android/sdk/cmdline-tools/latest"
          yes | "$HOME/.android/sdk/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null 2>&1 || true
          echo "ANDROID_HOME=$HOME/.android/sdk" >> $GITHUB_ENV
          echo "ANDROID_SDK_ROOT=$HOME/.android/sdk" >> $GITHUB_ENV

      - name: 'Setup Android SDK (musl)'
        if: contains(matrix.platform, 'musl')
        run: |
          mkdir -p "$HOME/.android/sdk/platforms" "$HOME/.android/sdk/build-tools" "$HOME/.android/sdk/licenses"
          echo "" > "$HOME/.android/sdk/licenses/android-sdk-license"
          echo "24333f8a63b6825ea9c5514f83c2829b004d1fee" >> "$HOME/.android/sdk/licenses/android-sdk-license"
          echo "" > "$HOME/.android/sdk/licenses/android-sdk-preview-license"
          echo "84831b9409646a918e30573bab4c9c91346d8abd" >> "$HOME/.android/sdk/licenses/android-sdk-preview-license"
          echo "" > "$HOME/.android/sdk/licenses/android-sdk-arm-dbt-license"
          echo "d56f5187479451eabf01fb78af6dfcb131a6481e" >> "$HOME/.android/sdk/licenses/android-sdk-arm-dbt-license"
          echo "24333f8a63b6825ea9c5514f83c2829b004d1fee" >> "$HOME/.android/sdk/licenses/android-sdk-arm-dbt-license"
          echo "ANDROID_HOME=$HOME/.android/sdk" >> $GITHUB_ENV
          echo "ANDROID_SDK_ROOT=$HOME/.android/sdk" >> $GITHUB_ENV

      - name: 'Checkout'
        run: |
          git config --global --add safe.directory /__w/selekt/selekt
          git clone --depth 2 --recurse-submodules https://github.com/${{ github.repository }} .
          git checkout ${{ github.sha }}

      - name: 'Configure Git'
        if: runner.os == 'Linux'
        run: |
          git config --global --add safe.directory /__w/selekt/selekt

      - name: 'Configure Gradle'
        run: |
          echo 'org.gradle.caching=false' >> gradle.properties
          echo 'org.gradle.configuration-cache=false' >> gradle.properties
          echo "org.gradle.java.home=${JAVA_HOME}" >> gradle.properties

      - name: 'Build'
        env:
          LDFLAGS: '-s'
          MACOSX_DEPLOYMENT_TARGET: ${{ runner.os == 'macOS' && '12.0' || '' }}
          CMAKE_PREFIX_PATH: ${{ runner.os == 'Windows' && 'C:/mimalloc' || '' }}
          SELEKT_ENABLE_VEC1: ${{ matrix.vec1_enabled }}
          SELEKT_VEC1_ENABLE_X86_AVX2: ${{ matrix.vec1_x86_avx2 }}
        run: |
          if [ "${{ runner.os }}" = "macOS" ]; then
            export CC=clang
            export CXX=clang++
          elif [ "${{ runner.os }}" = "Linux" ]; then
            export CC=gcc
            export CXX=g++
          fi
          if [ "${{ github.event_name }}" = "push" ]; then
            ./gradlew :selekt-sqlite3-sqlcipher:jar
          elif [ "${{ github.event_name }}" = "release" ]; then
            ./gradlew -Prelease \
              :selekt-sqlite3-sqlcipher:jar
          fi

      - name: 'Verify native library'
        run: |
          LIB=$(find SQLite3/build/intermediates/libs \( -name 'libselekt.*' -o -name 'selekt.dll' \) -type f | head -1)
          if [ -z "$LIB" ]; then
            echo "ERROR: No native library found in build output."
            exit 1
          fi
          echo "Found native library: $LIB"
          file "$LIB"
          ABS_LIB=$(cd "$(dirname "$LIB")" && pwd)/$(basename "$LIB")
          cat > /tmp/LoadTest.java << 'JAVA'
          public class LoadTest {
              public static void main(String[] args) {
                  System.load(args[0]);
                  System.out.println("OK: Native library loaded successfully.");
              }
          }
          JAVA
          java /tmp/LoadTest.java "$ABS_LIB"

      - name: 'Upload native JAR'
        uses: actions/upload-artifact@v7.0.1
        with:
          name: selekt-sqlcipher-${{ matrix.platform }}
          path: selekt-sqlite3-sqlcipher/build/libs/*.jar

  build-native-jar-musl-aarch64:
    name: 'Build Native JARs (linux-aarch64-musl)'
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
    steps:
      - name: 'Checkout'
        uses: actions/checkout@v6
        with:
          fetch-depth: 2
          submodules: recursive

      - name: 'Build in Alpine container'
        run: |
          docker run --rm \
            -v "${{ github.workspace }}:/workspace" \
            -w /workspace \
            -e SELEKT_LIBC=musl \
            -e SELEKT_ENABLE_VEC1=ON \
            -e SELEKT_VEC1_ENABLE_X86_AVX2=OFF \
            -e CC=gcc \
            -e CXX=g++ \
            -e LDFLAGS='-s' \
            alpine:3.20 sh -c '
              set -e
              apk update
              apk add --no-cache bash git gcc g++ musl-dev make curl tar sed gnupg file perl linux-headers cmake diffutils tcl unzip openjdk17

              # Build mimalloc
              cd /tmp
              curl -L https://github.com/microsoft/mimalloc/archive/refs/tags/v3.1.6.tar.gz -o mimalloc.tar.gz
              tar xzf mimalloc.tar.gz
              cd mimalloc-3.1.6
              mkdir -p out/release
              cd out/release
              cmake ../.. -DCMAKE_BUILD_TYPE=Release -DMI_BUILD_SHARED=OFF -DMI_BUILD_STATIC=ON -DMI_BUILD_TESTS=OFF -DMI_LOCAL_DYNAMIC_TLS=ON
              make -j$(nproc) mimalloc-static
              mkdir -p /usr/local/lib /usr/local/include
              cp libmimalloc.a /usr/local/lib/libmimalloc.a
              cp ../../include/mimalloc.h /usr/local/include/mimalloc.h

              # Configure and build
              cd /workspace
              git config --global --add safe.directory /workspace
              export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
              export ANDROID_HOME="$HOME/.android/sdk"
              export ANDROID_SDK_ROOT="$ANDROID_HOME"
              mkdir -p "$ANDROID_HOME/platforms" "$ANDROID_HOME/build-tools" "$ANDROID_HOME/licenses"
              echo "" > "$ANDROID_HOME/licenses/android-sdk-license"
              echo "24333f8a63b6825ea9c5514f83c2829b004d1fee" >> "$ANDROID_HOME/licenses/android-sdk-license"
              echo "" > "$ANDROID_HOME/licenses/android-sdk-preview-license"
              echo "84831b9409646a918e30573bab4c9c91346d8abd" >> "$ANDROID_HOME/licenses/android-sdk-preview-license"
              echo "" > "$ANDROID_HOME/licenses/android-sdk-arm-dbt-license"
              echo "d56f5187479451eabf01fb78af6dfcb131a6481e" >> "$ANDROID_HOME/licenses/android-sdk-arm-dbt-license"
              echo "24333f8a63b6825ea9c5514f83c2829b004d1fee" >> "$ANDROID_HOME/licenses/android-sdk-arm-dbt-license"

              echo "org.gradle.caching=false" >> gradle.properties
              echo "org.gradle.configuration-cache=false" >> gradle.properties
              echo "org.gradle.java.home=${JAVA_HOME}" >> gradle.properties
              if [ "${{ github.event_name }}" = "push" ]; then
                ./gradlew :selekt-sqlite3-sqlcipher:jar
              elif [ "${{ github.event_name }}" = "release" ]; then
                ./gradlew -Prelease :selekt-sqlite3-sqlcipher:jar
              fi

              # Verify native library loads
              LIB=$(find SQLite3/build/intermediates/libs -name "libselekt.*" -type f | head -1)
              echo "Found native library: $LIB"
              file "$LIB"
              ABS_LIB=$(cd "$(dirname "$LIB")" && pwd)/$(basename "$LIB")
              cat > /tmp/LoadTest.java << 'JAVA'
              public class LoadTest {
                  public static void main(String[] args) {
                      System.load(args[0]);
                      System.out.println("OK: Native library loaded successfully.");
                  }
              }
              JAVA
              java /tmp/LoadTest.java "$ABS_LIB"
            '

      - name: 'Upload native JAR'
        uses: actions/upload-artifact@v7.0.1
        with:
          name: selekt-sqlcipher-linux-aarch64-musl
          path: selekt-sqlite3-sqlcipher/build/libs/*.jar

  publish-native:
    name: Publish to OSSRH
    runs-on: ubuntu-latest
    needs: [build-native-jars, build-native-jar-musl-aarch64]
    timeout-minutes: 120

    steps:
      - name: 'Checkout'
        uses: actions/checkout@v6
        with:
          fetch-depth: 2
          submodules: false

      - name: 'Setup Java 17'
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: 'Set JAVA_HOME'
        run: |
          if [[ "${{ runner.os }}" == "Linux" ]]; then
            echo "JAVA_HOME=$JAVA_HOME_17_X64" >> $GITHUB_ENV
          elif [[ "${{ runner.os }}" == "macOS" ]]; then
            echo "JAVA_HOME=$(/usr/libexec/java_home -v 17)" >> $GITHUB_ENV
          fi

      - name: 'Configure Gradle'
        run: |
          echo 'org.gradle.caching=false' >> gradle.properties
          echo 'org.gradle.configuration-cache=false' >> gradle.properties

      - name: 'Download all native JARs'
        uses: actions/download-artifact@v8
        with:
          pattern: selekt-sqlcipher-*
          path: selekt-sqlite3-sqlcipher/build/artifacts
          merge-multiple: false

      - name: 'Prepare JARs for publication'
        run: |
          mkdir -p selekt-sqlite3-sqlcipher/build/libs
          find selekt-sqlite3-sqlcipher/build/artifacts -name '*.jar' -exec mv {} selekt-sqlite3-sqlcipher/build/libs/ \;
          echo "JARs ready for publication:"
          ls -la selekt-sqlite3-sqlcipher/build/libs/

      - name: 'Build uber JAR'
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            ./gradlew :selekt-sqlite3-sqlcipher:uberJar
          elif [ "${{ github.event_name }}" = "release" ]; then
            ./gradlew -Prelease :selekt-sqlite3-sqlcipher:uberJar
          fi
          echo "Uber JAR contents:"
          jar tf selekt-sqlite3-sqlcipher/build/libs/selekt-sqlite3-sqlcipher-*.jar | grep jni/ | head -20

      - name: 'Publish to OSSRH'
        if: github.event_name == 'release' && github.event.action == 'published'
        env:
          JAVA_HOME: ${{ steps.setup-java-17.outputs.java-home }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_KEY }}
          ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.GPG_KEY_ID }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_KEY_PASSPHRASE }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_USER_TOKEN_PASSWORD }}
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_USER_TOKEN_USERNAME }}
        run: |
          ./gradlew \
            -Prelease \
            :selekt-sqlite3-sqlcipher:publishNativePublicationToSonatypeRepository \
            closeAndReleaseSonatypeStagingRepository \
            -x jar

  publish:
    name: 'Publish'
    runs-on: ubuntu-latest
    timeout-minutes: 120
    env:
      SELEKT_ENABLE_VEC1: 'ON'
      SELEKT_VEC1_ENABLE_X86_AVX2: 'ON'

    steps:
      - name: 'Install system packages'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends clang gcc make sed tcl

      - name: 'Checkout'
        uses: actions/checkout@v6
        with:
          fetch-depth: 2
          submodules: recursive

      - name: 'Setup Java 17'
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: 'Setup Java 25'
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 25

      - name: 'Set JAVA_HOME'
        run: |
          if [[ "${{ runner.os }}" == "Linux" ]]; then
            echo "JAVA_HOME=$JAVA_HOME_17_X64" >> $GITHUB_ENV
          elif [[ "${{ runner.os }}" == "macOS" ]]; then
            echo "JAVA_HOME=$(/usr/libexec/java_home -v 17)" >> $GITHUB_ENV
          fi

      - name: 'Configure Gradle'
        run: |
          echo 'org.gradle.caching=false' >> gradle.properties
          echo 'org.gradle.configuration-cache=false' >> gradle.properties
          echo "org.gradle.java.home=${JAVA_HOME}" >> gradle.properties

      - name: 'Unit tests'
        run: ./gradlew :selekt-android:testDebugUnitTest :selekt-java:test :selekt-jdbc:test :selekt-sqlite3-classes:testJava17 :selekt-sqlite3-classes:testJava25 :selekt-common:test -x integrationTest ${{ env.SCAN }}

      - name: 'Build Selekt Android'
        run: |
          ./gradlew clean \
            :OpenSSL:assembleArm64-v8a \
            :OpenSSL:assembleArmeabi-v7a \
            :OpenSSL:assembleX86 \
            :OpenSSL:assembleX86_64
          ./gradlew :SQLite3:amalgamate
          ./gradlew assembleRelease

      - name: 'Build Selekt JVM'
        run: |
          ./gradlew :selekt-jdbc:jar :selekt-jvm:jar ${{ env.SCAN }}

      - name: 'Publish release to OSSRH'
        if: github.event_name == 'release' && github.event.action == 'published'
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_KEY }}
          ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.GPG_KEY_ID }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_KEY_PASSPHRASE }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_USER_TOKEN_PASSWORD }}
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_USER_TOKEN_USERNAME }}
        run: |
          ./gradlew \
            -Prelease \
            publishMainPublicationToSonatypeRepository \
            closeAndReleaseSonatypeStagingRepository