# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
# This workflow will build a package using Gradle and then publish it to GitHub packages when a release is created
# For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#Publishing-using-gradle

name: Release

on:
  release:
    types: [ created ]

jobs:
  build:
    runs-on: macos-latest
    environment: release

    permissions:
      contents: write
      packages: write

    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Verify publication configuration
        run: ./gradlew jreleaserConfig
        env:
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Clean Build with Gradle
        run: ./gradlew clean build
        env:
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
          GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
          SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}

      - name: Publish to Maven Central Portal
        id: publish
        run: ./gradlew publish jreleaserFullRelease --info --stacktrace -Djreleaser.verbose=true
        env:
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
          SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}

      - name: Query Central Portal for validation errors
        if: failure()
        shell: bash
        env:
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
        run: |
          set -euo pipefail
          
          OUTPUT_PROPS="build/jreleaser/output.properties"
          
          if [[ ! -f "$OUTPUT_PROPS" ]]; then
            echo "::error title=File Missing::The file '$OUTPUT_PROPS' does not exist."
            exit 1
          fi
          
          DEPLOY_ID=$(grep '^deploymentId=' "$OUTPUT_PROPS" | cut -d= -f2 || true)
          if [[ -z "$DEPLOY_ID" ]]; then
            echo "::error title=Missing Deployment ID::The 'deploymentId' key was not found in '$OUTPUT_PROPS'."
            exit 1
          fi
          
          echo "Portal deploymentId: $DEPLOY_ID"
          
          if [ -z "$OSSRH_USERNAME" ]; then
            echo "::error title='OSSRH_USERNAME' is not set."
            exit 1
          fi
  
          if [ -z "$OSSRH_TOKEN" ]; then
            echo "::error title='OSSRH_TOKEN' is not set."
            exit 1
          fi
          
          AUTH=$(printf "%s:%s" "$OSSRH_USERNAME" "$OSSRH_TOKEN" | base64)
          echo "::add-mask::$AUTH"
          
          STATUS_JSON=$(curl -sS \
            -H "Authorization: Bearer $AUTH" \
            -H "Content-Type: application/json" \
            -X POST \
            "https://central.sonatype.com/api/v1/publisher/status?id=$DEPLOY_ID")
          
          echo "$STATUS_JSON" | jq .
          
          echo "$STATUS_JSON" | jq -r '.errors[]?.message' |
            while read -r MSG; do
              echo "::error title=Sonatype validation::$MSG"
            done
          
          {
            echo "### Sonatype Central Portal validation result"
            echo
            echo '```json'
            echo "$STATUS_JSON"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload JReleaser artefacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: jreleaser-logs
          path: |
            build/jreleaser/trace.log
            build/jreleaser/output.properties