release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write   # cosign keyless (Sigstore OIDC)

jobs:
  build-linux:
    name: Build linux-x64 image
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout fork repo
        uses: actions/checkout@v4
        with:
          path: AprismJDK

      - name: Checkout upstream OpenJDK at pinned tag
        run: |
          git clone --depth 1 --branch jdk-25+10 \
            https://github.com/openjdk/jdk.git openjdk-25

      - name: Install build deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential autoconf zip unzip file \
            libx11-dev libxext-dev libxrender-dev libxrandr-dev \
            libxtst-dev libxt-dev libcups2-dev libfontconfig1-dev \
            libasound2-dev

      - name: Install boot JDK 25
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '25'

      - name: Apply patch series + overlay + agent jar
        working-directory: openjdk-25
        run: |
          bash ../AprismJDK/scripts/apply-patches.sh
          mkdir -p lib
          # Agent jar is rebuilt in CI from sources to avoid binary blobs
          cd ../AprismJDK
          ./gradlew :aprismate-agent:embedJar --no-daemon
          cp aprismate-agent/build/libs/aprismate.jar ../openjdk-25/lib/

      - name: Configure + make images (retry)
        working-directory: openjdk-25
        run: |
          bash configure \
            --with-boot-jdk="$(dirname "$(dirname "$(which javac)")")" \
            --with-debug-level=release \
            --with-jvm-variants=server \
            --enable-warnings-as-errors=no \
            --disable-javac-server \
            --with-vendor-name=AprismLab \
            --with-vendor-version-string=AJR \
            --with-vendor-url=https://github.com/AprismLab/AprismJDK \
            --with-vendor-bug-url=https://github.com/AprismLab/AprismJDK/issues \
            --with-vendor-vm-bug-url=https://github.com/AprismLab/AprismJDK/issues \
            --with-version-string=25.2.1
          for i in 1 2 3; do
            make images JOBS=$(nproc) LOG=info && break
            echo "retry $i failed; incremental retry"
          done
          ./build/*/images/jdk/bin/java -version

      - name: Package
        shell: bash
        run: |
          VERSION=$(grep aprismjdkVersion= AprismJDK/gradle.properties | cut -d= -f2 | sed 's/^v//')
          NAME="AprismJDK-${VERSION}-linux-x64-jdk"
          mv openjdk-25/build/*/images/jdk "$NAME"
          tar -czf "${NAME}.tar.gz" "$NAME"
          sha256sum "${NAME}.tar.gz" > SHA256SUMS-linux.txt
          cp AprismJDK/aprismate-agent/build/libs/aprismate.jar "aprismate-${VERSION}.jar"
          sha256sum "aprismate-${VERSION}.jar" >> SHA256SUMS-linux.txt

      - name: Cosign keyless sign
        uses: sigstore/cosign-installer@v3
      - name: Sign artifacts
        run: |
          cosign sign-blob --yes \
            --bundle AprismJDK-*.tar.gz.bundle \
            AprismJDK-*.tar.gz
          cosign sign-blob --yes \
            --bundle aprismate-*.jar.bundle \
            aprismate-*.jar

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-release
          path: |
            AprismJDK-*.tar.gz
            *.bundle
            SHA256SUMS-linux.txt
            aprismate-*.jar

  release:
    name: Create GitHub Release
    needs: [build-linux]
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          prerelease: true
          files: |
            AprismJDK-*.tar.gz
            *.bundle
            SHA256SUMS-*.txt
            aprismate-*.jar