release.yml

# Release: publish the kplusplus v2 artifact set outward.
#
#   * The Gradle plugin (com.monkopedia.kplusplus.compiler) -> the Gradle Plugin Portal
#     AND the Central Portal (so both `gradlePluginPortal()` and `mavenCentral()` consumers
#     resolve `id("...") version "..."`). The `krapper` native tool binary is BUNDLED INSIDE
#     this plugin jar (0.4.0 model), not shipped as a separate coordinate.
#   * The FIR kotlinc-plugin jar -> the Central Portal.
#
# Everything is GPG-signed (vanniktech in-memory key) and uploaded to the Central Portal, which
# AUTO-RELEASES the deployment once it passes validation (automaticRelease = true; a bundle that
# fails validation is not released). See docs/releasing.md for the GitHub Secrets + cut steps.
name: Release
on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      # :krapper regenerates its own Clang-AST bindings with the tool bundled in the last
      # released plugin. The generated wrapper #includes <clang/AST/...> and is built against
      # LLVM 22 — it only compiles against LLVM 22 (the cross-major C++ API drift proven in the
      # portability probe), and apt.llvm.org puts those headers under /usr/lib/llvm-22/include,
      # NOT the distro default path. So install LLVM 22 from apt.llvm.org (not the distro's
      # clang) and surface its include/lib dirs via CPATH/LD_LIBRARY_PATH so the wrapper
      # compile, the klinker link, and runtime all resolve. LLVM is a hard requirement — the
      # settings probe reads the LLVM major + libdir from llvm-config and fails fast if absent.
      - name: Install LLVM/Clang 22 (apt.llvm.org)
        run: |
          set -euxo pipefail
          sudo apt-get update
          sudo apt-get install -y wget lsb-release gnupg ca-certificates software-properties-common
          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
          chmod +x /tmp/llvm.sh
          sudo /tmp/llvm.sh 22 all
          sudo ln -sf "$(command -v clang++-22)"     /usr/local/bin/clang++
          sudo ln -sf "$(command -v clang-22)"       /usr/local/bin/clang
          sudo ln -sf "$(command -v llvm-config-22)" /usr/local/bin/llvm-config
          echo "clang++: $(clang++ --version | head -1); llvm-config: $(llvm-config --version)"
          echo "CPATH=$(llvm-config --includedir)" >> "$GITHUB_ENV"
          echo "LD_LIBRARY_PATH=$(llvm-config --libdir)" >> "$GITHUB_ENV"

      # Build the native tool binary so the publish steps can BUNDLE it into the plugin jar
      # (the 0.4.0 distribution model — the released plugin carries its own tool; consumers no
      # longer resolve a separate coordinate). :krapper is always in the build (LLVM is a hard
      # requirement) and links against the LLVM installed above.
      - name: Build the tool binary (to bundle into the plugin)
        run: >-
          ./gradlew :krapper:linkReleaseExecutableKlinker --no-configuration-cache

      # --- Publish the Gradle plugin (tools bundled) to the Gradle Plugin Portal ---
      # publishPlugins uses gradle.publish.key / gradle.publish.secret. Runs ONLY on an actual
      # release event: the Plugin Portal rejects re-publishing an existing version, so a manual
      # workflow_dispatch re-run (e.g. to retry a failed Central upload) skips this step and does
      # Central only. -Pkpp.bundleTools.krapper=<abs-path> packs the just-built binary into the
      # plugin jar (see compiler/gradle/build.gradle.kts + extractBundledTool in the plugin).
      - name: Publish Gradle plugin to the Plugin Portal
        if: github.event_name == 'release'
        run: >-
          ./gradlew -p compiler :kplusplus-compiler-gradle:publishPlugins
          -Pgradle.publish.key=${{ secrets.GRADLE_PUBLISH_KEY }}
          -Pgradle.publish.secret=${{ secrets.GRADLE_PUBLISH_SECRET }}
          -Pkpp.bundleTools.krapper=$GITHUB_WORKSPACE/krapper/build/bin/klinker/krapperRelease/krapper

      # --- Publish the plugin set (tools bundled) to the Central Portal (auto-released) ---
      # `-p compiler publishToMavenCentral` uploads ONLY the compiler build's coordinates — the
      # Gradle plugin (+ marker) and the FIR plugin jar — as one signed bundle. The native tool
      # binary rides INSIDE the plugin jar (bundleTools), so there are NO standalone tool
      # Central artifacts anymore (that whole classified-binary path is gone — it was the source
      # of the 0.3.0 firefight). vanniktech reads the Portal token + the in-memory GPG key from
      # the ORG_GRADLE_PROJECT_* env vars below.
      - name: Publish to the Central Portal (auto-release on validation)
        env:
          # Reuse the EXISTING repo secrets (from the v1 pipeline). The Central Portal user token
          # (central.sonatype.com) maps onto the OSSRH_USERNAME/OSSRH_TOKEN pair; OSSRH_GPG_SECRET_KEY
          # is the same armored key v1 used.
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.OSSRH_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.OSSRH_TOKEN }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
        run: >-
          ./gradlew -p compiler publishToMavenCentral --no-configuration-cache
          -Pkpp.bundleTools.krapper=$GITHUB_WORKSPACE/krapper/build/bin/klinker/krapperRelease/krapper

      - name: Release notes
        run: |
          echo "Published the kplusplus plugin set (native tool bundled in the plugin jar) to"
          echo "the Central Portal (auto-released on validation) and the Gradle Plugin Portal."
          echo "Check status at https://central.sonatype.com (Deployments)."