Remove PR Labels

name: Remove PR Labels

on:
  pull_request_target:
    types: ["closed", "merged"]

jobs:
  remove-label:
    permissions:
      contents: read
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
    - uses: actions-ecosystem/action-remove-labels@v1
      with:
        labels: |
          awaiting-review


Mark stale issues and pull requests

# This workflow warns and then closes issues and PRs that have had no activity for a specified amount of time.
#
# You can adjust the behavior by modifying this file.
# For more information, see:
# https://github.com/actions/stale
name: Mark stale issues and pull requests

on:
  workflow_dispatch:
  schedule:
  - cron: '0 1 * * *'

jobs:
  stale:
    permissions:
      issues: write
      pull-requests: write
    name: Track and close stale issues/PRs
    runs-on: ubuntu-latest

    steps:
    - name: Track and close stale issues/PRs
      uses: actions/stale@v5
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        days-before-issue-stale: 183
        days-before-pr-stale: 183
        days-before-issue-close : 14
        days-before-pr-close: 14
        stale-issue-message: >
          Thank you for contributing to the IntelliJ repository!
          This issue has been marked as stale since it has not had any activity in the last 6 months. It will be closed in the next 14
          days unless any other activity occurs. If you think this issue is still relevant and should stay open, please post any comment here and the issue will no longer be marked as stale.
        close-issue-message: >
          This issue has been automatically closed due to inactivity. If you're still interested in pursuing this, please post `@bazelbuild/triage` in a comment here and we'll take a look. Thanks!
        stale-pr-message: >
          Thank you for contributing to the IntelliJ repository!
          This pull request has been marked as stale since it has not had any activity in the last 6 months. It will be closed in the next
          14 days unless any other activity occurs. If you think this PR is still relevant and should stay open, please post any comment here and the PR will no longer be marked as stale.
        close-pr-message: >
          This pull request has been automatically closed due to inactivity. If you're still interested in pursuing this, please post `@bazelbuild/triage` in a comment here and we'll take a look. Thanks!
        stale-issue-label: 'stale'
        exempt-issue-labels: 'not stale,awaiting-maintainer,P0,P1'
        close-issue-reason: "not_planned"
        stale-pr-label: 'stale'
        exempt-pr-labels: 'not stale,awaiting-review,P0,P1,copybara-exported'
        exempt-draft-pr: true
        operations-per-run: 500
        ascending: true


Check markdown links

on:
  schedule:
    - cron: '0 0 1 * *'

name: Check markdown links
jobs:
  linkChecker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
      - name: Link Checker
        uses: peter-evans/link-checker@v1
        with:
          args: -v -r *
      - name: Create Issue From File
        uses: peter-evans/create-issue-from-file@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_TITLE: Link Checker Report
          ISSUE_CONTENT_FILEPATH: ./link-checker/out.md
          ISSUE_LABELS: report, automated issue


Code Formatter & Update Leaderboard

name: Code Formatter & Update Leaderboard
on:
  push:
    branches:
      - master

jobs:
  run:
    name: Code Formatter & Update Leaderboard
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v2
        with:
          clean: false
          fetch-depth: 0

      - name: Setup python
        uses: actions/setup-python@v2
        with:
          python-version: '3.x'
          architecture: 'x64'

      - name: Black Code Formatter
        uses: lgeiger/black-action@master
        with:
          args: "."

      - name: Install dependencies and Update Leaderboard
        run: |
          python -m pip install pytz
          python -m pip install wordsegment
          python top.py
          python path.py

      - name: Commit changes
        uses: EndBug/add-and-commit@v6
        with:
          author_name: asdf2014
          author_email: asdf2014@apache.org
          message: "[Code Formatter & Update Leaderboard] by 🤖"
          path: "Codes README.md README-zh.md .idea/dictionaries/yuzhouwan.xml"
          pattern: "*.*"
          force: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


on:
  schedule:
    - cron: '0 12 * * 5'

jobs:
  run:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v2
        with:
          clean: false
          fetch-depth: 0

      - name: Setup python
        uses: actions/setup-python@v2
        with:
          python-version: '3.x'
          architecture: 'x64'

      - name: Choose a Question Randomly
        run: |
          python -m pip install pytz
          python -m pip install requests
          python Picker/random_picker.py

      - name: Commit changes
        uses: EndBug/add-and-commit@v6
        with:
          author_name: asdf2014
          author_email: asdf2014@apache.org
          message: "[Choose a Question Randomly] by 🤖"
          path: "Picker README.md README-zh.md"
          pattern: "*.*"
          force: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


CI

---
name: CI

env:
  # https://github.com/actions/virtual-environments/issues/1499
  MAVEN_CLI_OPTS: '-ntp --batch-mode --errors --fail-at-end --show-version -Dmaven.wagon.httpconnectionManager.ttlSeconds=60 -Dmaven.wagon.http.retryHandler.count=3 -Dstyle.color=always'
  TESTCONTAINERS_RYUK_DISABLED: 'true'
  CT_CHART_DIRS: 'contrib/charts/'
  CT_BUILD_ID: '${{ github.run_id }}'
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

on:
  pull_request:
  push:
    branches:
      - main
    paths-ignore:
      - 'README.md'
      - 'CHANGELOG.md'
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        env:
          # we keep 18.0.2 for backwards compatibility with RH-SSO 7.6
          - KEYCLOAK_VERSION: 18.0.2
          - KEYCLOAK_VERSION: 21.1.2
          - KEYCLOAK_VERSION: 22.0.4
          - KEYCLOAK_VERSION: 23.0.7
          - KEYCLOAK_VERSION: 24.0.5
    steps:
      - uses: actions/checkout@v4.1.7
        with:
          fetch-depth: 0

      - name: Setup java
        uses: actions/setup-java@v4.2.1
        with:
          distribution: 'temurin'
          java-version: 21

      - uses: actions/cache@v4.0.2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ matrix.env.KEYCLOAK_VERSION }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-maven-${{ matrix.env.KEYCLOAK_VERSION }}

      - name: Adapt sources for Keycloak versions < 23.0.0
        if: ${{ matrix.env.KEYCLOAK_VERSION < '23.0.0' }}
        run: |
          echo "COMPATIBILITY_PROFILE=-Ppre-keycloak23" >> $GITHUB_ENV

      - name: Adapt sources for Keycloak versions < 22.0.0 (jakarta -> javax)
        if: ${{ matrix.env.KEYCLOAK_VERSION < '22.0.0' }}
        run: |
          echo "COMPATIBILITY_PROFILE=-Ppre-keycloak22" >> $GITHUB_ENV
          echo "ADJUSTED_RESTEASY_VERSION=-Dresteasy.version=4.7.7.Final" >> $GITHUB_ENV

      - name: Adapt sources for Keycloak versions < 19.0.0
        if: ${{ matrix.env.KEYCLOAK_VERSION < '19.0.0' }}
        run: |
          echo "COMPATIBILITY_PROFILE=-Ppre-keycloak19" >> $GITHUB_ENV

      - name: Build & Test
        run: ./mvnw ${MAVEN_CLI_OPTS} -Dkeycloak.version=${{ matrix.env.KEYCLOAK_VERSION }} ${ADJUSTED_RESTEASY_VERSION} clean verify -Pcoverage ${COMPATIBILITY_PROFILE}

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4.5.0
        if: github.ref == 'refs/heads/main'
        with:
          file: "${{ github.workspace }}/target/site/jacoco/jacoco.xml"
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: ${{ !startsWith(github.event.ref, 'refs/tags/v') }}

      - name: Get latest keycloak version
        id: latest
        run: echo "::set-output name=VERSION::$(tail -n1 .env | cut -d= -f2)"

      - name: Login to Docker Hub
        uses: docker/login-action@v3.2.0
        if: startsWith(github.event.ref, 'refs/tags/v')
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Login to Quay.io
        uses: docker/login-action@v3.2.0
        if: startsWith(github.event.ref, 'refs/tags/v')
        with:
          registry: quay.io
          username: ${{ secrets.QUAYIO_USERNAME }}
          password: ${{ secrets.QUAYIO_PASSWORD }}

      - name: Expose GitHub Runtime
        uses: crazy-max/ghaction-github-runtime@v3.0.0

      - name: Set up Docker Build Metadata
        id: docker_meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: adorsys/keycloak-config-cli,quay.io/adorsys/keycloak-config-cli
          flavor: |
            latest=${{ !contains(github.ref_name, 'rc') && matrix.env.KEYCLOAK_VERSION == steps.latest.outputs.VERSION }}
            suffix=-${{ matrix.env.KEYCLOAK_VERSION }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,event=tag,pattern={{version}}
            type=raw,event=tag,value=latest,enable=${{ !contains(github.ref_name, 'rc') }}
          labels: |
            maintainer=adorsys GmbH & Co. KG

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.3.0

      - name: Build and push
        uses: docker/build-push-action@v6.1.0
        with:
          build-args: |-
            KEYCLOAK_VERSION=${{ matrix.env.KEYCLOAK_VERSION }}
            MAVEN_CLI_OPTS=${{ env.MAVEN_CLI_OPTS }} ${{ env.ADJUSTED_RESTEASY_VERSION }} ${{ env.COMPATIBILITY_PROFILE }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          context: .
          pull: ${{ startsWith(github.ref, 'refs/tags/v') }}
          push: ${{ startsWith(github.ref, 'refs/tags/v') }}
          platforms: linux/amd64${{ startsWith(github.ref, 'refs/tags/v') && ',linux/arm64' || '' }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          tags: ${{ steps.docker_meta.outputs.tags }}

      - name: Create Checksum
        run: |
          cp target/keycloak-config-cli.jar keycloak-config-cli-${{ matrix.env.KEYCLOAK_VERSION }}.jar
          sha256sum keycloak-config-cli-${{ matrix.env.KEYCLOAK_VERSION }}.jar > keycloak-config-cli-${{ matrix.env.KEYCLOAK_VERSION }}.jar.sha256

      - uses: actions/upload-artifact@v4.3.3
        with:
          name: keycloak-config-cli-${{ matrix.env.KEYCLOAK_VERSION }}
          if-no-files-found: error
          path: |
            keycloak-config-cli-${{ matrix.env.KEYCLOAK_VERSION }}.jar
            keycloak-config-cli-${{ matrix.env.KEYCLOAK_VERSION }}.jar.sha256

  build-pom-version:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        java: [17, 21]
    steps:
      - uses: actions/checkout@v4.1.7

      - name: Setup java ${{ matrix.java }}
        uses: actions/setup-java@v4.2.1
        with:
          distribution: 'temurin'
          java-version: ${{ matrix.java }}

      - uses: actions/cache@v4.0.2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-${{ matrix.java }}-maven-build-pom-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-${{ matrix.java }}-maven-build-pom

      - name: Adapt sources for Keycloak versions < 23.0.0
        if: ${{ matrix.env.KEYCLOAK_VERSION < '23.0.0' }}
        run: |
          echo "COMPATIBILITY_PROFILE=-Ppre-keycloak23" >> $GITHUB_ENV

      - name: Adapt sources for Keycloak versions < 22.0.0 (jakarta -> javax)
        if: ${{ matrix.env.KEYCLOAK_VERSION < '22.0.0' }}
        run: |
          echo "COMPATIBILITY_PROFILE=-Ppre-keycloak22" >> $GITHUB_ENV
          echo "ADJUSTED_RESTEASY_VERSION=-Dresteasy.version=4.7.7.Final" >> $GITHUB_ENV

      - name: Build & Test
        run: ./mvnw ${MAVEN_CLI_OPTS} ${ADJUSTED_RESTEASY_VERSION} clean verify ${COMPATIBILITY_PROFILE} -Djava.version=${{ matrix.java }}

  build-legacy:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        env:
          - KEYCLOAK_VERSION: 19.0.3
    steps:
      - uses: actions/checkout@v4.1.7

      - name: Setup java
        uses: actions/setup-java@v4.2.1
        with:
          distribution: 'temurin'
          java-version: '21'

      - uses: actions/cache@v4.0.2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-keycloak-legacy-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-keycloak-legacy
      - name: Adapt sources for Keycloak versions < 23.0.0
        if: ${{ matrix.env.KEYCLOAK_VERSION < '23.0.0' }}
        run: |
          echo "COMPATIBILITY_PROFILE=-Ppre-keycloak23" >> $GITHUB_ENV
      - name: Adapt sources for Keycloak versions < 22.0.0 (jakarta -> javax)
        if: ${{ matrix.env.KEYCLOAK_VERSION < '22.0.0' }}
        run: |
          echo "COMPATIBILITY_PROFILE=-Ppre-keycloak22" >> $GITHUB_ENV
          echo "ADJUSTED_RESTEASY_VERSION=-Dresteasy.version=4.7.7.Final" >> $GITHUB_ENV
      - name: Build & Test
        run: ./mvnw ${MAVEN_CLI_OPTS} -Dkeycloak.version=${{ matrix.env.KEYCLOAK_VERSION }} -Dkeycloak.dockerTagSuffix="-legacy" ${ADJUSTED_RESTEASY_VERSION} clean verify ${COMPATIBILITY_PROFILE}

  lint-other-files:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4.1.7

      - name: Lint .github/workflows/*.yaml files
        uses: ibiqlik/action-yamllint@v3.1.1
        with:
          strict: true
          file_or_dir: .github/workflows/
          config_data: |
            extends: default
            rules:
              line-length: disable
              truthy:
                check-keys: false

      - name: Fetch history
        run: git fetch --prune --unshallow

      - name: Set up Helm
        uses: azure/setup-helm@v4.2.0
        with:
          version: v3.4.0

      - uses: actions/setup-python@v5.1.0
        with:
          python-version: 3.7

      - uses: actions/cache@v4.0.2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-chart-testing-action
          restore-keys: |
            ${{ runner.os }}-pip-chart-testing-action

      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.6.1

      - name: Run chart-testing (lint)
        run: ct lint --config contrib/charts/ct.yaml

  create_release:
    name: Create Release
    runs-on: ubuntu-latest
    needs: [build]
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/download-artifact@v4.1.7
        with:
          path: assets

      - name: Create Release
        uses: softprops/action-gh-release@v2.0.6
        with:
          name: Release ${{ github.ref_name }}
          draft: false
          prerelease: ${{ contains(github.ref_name, 'rc') }}
          files: |
            assets/keycloak-config-cli-*/keycloak-config-cli-*.jar
            assets/keycloak-config-cli-*/keycloak-config-cli-*.jar.sha256
          body: |-
            # CHANGELOG

            * https://github.com/adorsys/keycloak-config-cli/blob/${{ github.ref_name }}/CHANGELOG.md

            ## DockerHub

            * https://hub.docker.com/r/adorsys/keycloak-config-cli/tags?name=${{ github.ref_name }}

            ## Quay.io

            * https://quay.io/repository/adorsys/keycloak-config-cli?tab=tags


ci

---
name: ci

on:
  push:
    branches:
      - main
    tags-ignore:
      - "*"
  pull_request:
    branches:
      - main
  workflow_dispatch: {}

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    uses: openrewrite/gh-automation/.github/workflows/ci-gradle.yml@main
    secrets:
      gradle_enterprise_access_key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
      ossrh_username: ${{ secrets.OSSRH_USERNAME }}
      ossrh_token: ${{ secrets.OSSRH_TOKEN }}
      ossrh_signing_key: ${{ secrets.OSSRH_SIGNING_KEY }}
      ossrh_signing_password: ${{ secrets.OSSRH_SIGNING_PASSWORD }}


comment-pr

name: comment-pr

# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
on:
  workflow_run:
    workflows: ["receive-pr"]
    types:
      - completed

# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
# Since this pull request has write permissions on the target repo, we should **NOT** execute any untrusted code.
jobs:
  post-suggestions:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    uses: openrewrite/gh-automation/.github/workflows/comment-pr.yml@main


Dependency Submission

name: Dependency Submission

on:
  workflow_run:
    workflows: ["publish"]
    types:
      - completed

permissions:
  contents: write

jobs:
  dependency-submission:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
      - name: Generate and submit dependency graph
        uses: gradle/actions/dependency-submission@v3
        env:
          # Exclude all dependencies that originate solely in the 'buildSrc' project
          DEPENDENCY_GRAPH_EXCLUDE_PROJECTS: ':buildSrc'
          # Exclude dependencies that are only resolved in test classpaths
          DEPENDENCY_GRAPH_EXCLUDE_CONFIGURATIONS: '.*[Tt]est(Compile|Runtime)Classpath'


nightly-ci

---
name: nightly-ci

on:
  schedule:
    - cron: 0 16 * * *

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    uses: openrewrite/gh-automation/.github/workflows/ci-gradle.yml@main
    secrets:
      gradle_enterprise_access_key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
      ossrh_username: ${{ secrets.OSSRH_USERNAME }}
      ossrh_token: ${{ secrets.OSSRH_TOKEN }}
      ossrh_signing_key: ${{ secrets.OSSRH_SIGNING_KEY }}
      ossrh_signing_password: ${{ secrets.OSSRH_SIGNING_PASSWORD }}


publish

---
name: publish

on:
  push:
    tags:
      - v[0-9]+.[0-9]+.[0-9]+
      - v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    uses: openrewrite/gh-automation/.github/workflows/publish-gradle.yml@main
    secrets:
      gradle_enterprise_access_key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
      ossrh_username: ${{ secrets.OSSRH_USERNAME }}
      ossrh_token: ${{ secrets.OSSRH_TOKEN }}
      ossrh_signing_key: ${{ secrets.OSSRH_SIGNING_KEY }}
      ossrh_signing_password: ${{ secrets.OSSRH_SIGNING_PASSWORD }}


receive-pr

name: receive-pr

on:
  pull_request:
    types: [opened, synchronize]
    branches:
      - main

concurrency:
  group: '${{ github.workflow }} @ ${{ github.ref }}'
  cancel-in-progress: true

# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
# Since this pull request receives untrusted code, we should **NOT** have any secrets in the environment.
jobs:
  upload-patch:
    uses: openrewrite/gh-automation/.github/workflows/receive-pr.yml@main
    with:
      recipe: 'org.openrewrite.recipes.OpenRewriteBestPracticesSubset'
      rewrite_yml: |
        ---
        type: specs.openrewrite.org/v1beta/recipe
        name: org.openrewrite.recipes.OpenRewriteBestPracticesSubset
        displayName: OpenRewrite best practices
        description: Best practices for OpenRewrite recipe development.
        recipeList:
          - org.openrewrite.recipes.JavaRecipeBestPracticesSubset
          - org.openrewrite.recipes.RecipeTestingBestPracticesSubset
          - org.openrewrite.recipes.RecipeNullabilityBestPractices
          #- org.openrewrite.java.OrderImports
          #- org.openrewrite.java.format.EmptyNewlineAtEndOfFile
          - org.openrewrite.staticanalysis.InlineVariable
          - org.openrewrite.staticanalysis.MissingOverrideAnnotation
          - org.openrewrite.staticanalysis.UseDiamondOperator
        ---
        type: specs.openrewrite.org/v1beta/recipe
        name: org.openrewrite.recipes.JavaRecipeBestPracticesSubset
        displayName: Java Recipe best practices
        description: Best practices for Java recipe development.
        preconditions:
          - org.openrewrite.java.search.FindTypes:
              fullyQualifiedTypeName: org.openrewrite.Recipe
              checkAssignability: true
        recipeList:
          - org.openrewrite.java.recipes.BlankLinesAroundFieldsWithAnnotations
          - org.openrewrite.java.recipes.ExecutionContextParameterName
          - org.openrewrite.java.recipes.MissingOptionExample
          - org.openrewrite.java.recipes.RecipeEqualsAndHashCodeCallSuper
          - org.openrewrite.java.recipes.UseTreeRandomId
          - org.openrewrite.staticanalysis.NeedBraces
          #- org.openrewrite.staticanalysis.RemoveSystemOutPrintln
        ---
        type: specs.openrewrite.org/v1beta/recipe
        name: org.openrewrite.recipes.RecipeTestingBestPracticesSubset
        displayName: Recipe testing best practices
        description: Best practices for testing recipes.
        preconditions:
          - org.openrewrite.java.search.FindTypes:
              fullyQualifiedTypeName: org.openrewrite.test.RewriteTest
              checkAssignability: true
        recipeList:
          - org.openrewrite.java.recipes.RewriteTestClassesShouldNotBePublic
          #- org.openrewrite.java.recipes.SelectRecipeExamples
          - org.openrewrite.java.recipes.SourceSpecTextBlockIndentation
          - org.openrewrite.java.testing.cleanup.RemoveTestPrefix
          - org.openrewrite.java.testing.cleanup.TestsShouldNotBePublic
          - org.openrewrite.staticanalysis.NeedBraces
          - org.openrewrite.staticanalysis.RemoveSystemOutPrintln


repository-backup

---
name: repository-backup
on:
  workflow_dispatch: {}
  schedule:
    - cron: 0 17 * * *

concurrency:
  group: backup-${{ github.ref }}
  cancel-in-progress: false

jobs:
  repository-backup:
    uses: openrewrite/gh-automation/.github/workflows/repository-backup.yml@main
    secrets:
      bucket_mirror_target: ${{ secrets.S3_GITHUB_REPOSITORY_BACKUPS_BUCKET_NAME }}
      bucket_access_key_id: ${{ secrets.S3_GITHUB_REPOSITORY_BACKUPS_ACCESS_KEY_ID }}
      bucket_secret_access_key: ${{ secrets.S3_GITHUB_REPOSITORY_BACKUPS_SECRET_ACCESS_KEY }}


Java CI

name: Java CI

on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Set up JDK 1.8
      uses: actions/setup-java@v1
      with:
        java-version: 1.8
    - name: Run unit tests with gradle
      run: ./gradlew test


Build Natives

name: Build Natives

on: [workflow_dispatch]

jobs:
  buildLinux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Set up JDK 1.8
        uses: actions/setup-java@v1
        with:
          java-version: 1.8
      - name: Install dependencies
        run: sudo apt install g++-mingw-w64 g++-mingw-w64-i686 g++-mingw-w64-x86-64 gcc-mingw-w64 gcc-mingw-w64-i686 gcc-mingw-w64-x86-64 libasound2-dev libdrm-dev libsdl2-dev libgbm-dev
      - name: Set env
        run: echo "NDK_HOME=$ANDROID_NDK_HOME" >> $GITHUB_ENV
      - name: Build natives
        run: |
          ./gradlew arc-core:jnigenBuild
          ./gradlew extensions:freetype:jnigenBuild
          ./gradlew backends:backend-sdl:jnigenBuild
      - name: Upload natives
        uses: actions/upload-artifact@v2
        with:
          name: Arc-core desktop natives
          path: |
            natives/natives-desktop/libs/libarc64.so
            natives/natives-desktop/libs/arc.dll
            natives/natives-desktop/libs/arc64.dll
            backends/backend-sdl/libs/linux64/libsdl-arc64.so
            backends/backend-sdl/libs/windows32/sdl-arc.dll
            backends/backend-sdl/libs/windows64/sdl-arc64.dll
            natives/natives-freetype-desktop/libs/libarc-freetype64.so
            natives/natives-freetype-desktop/libs/arc-freetype.dll
            natives/natives-freetype-desktop/libs/arc-freetype64.dll
      - name: Upload Android natives
        uses: actions/upload-artifact@v2
        with:
          name: Arc-core android natives
          path: |
            natives/natives-android/libs
            natives/natives-freetype-android/libs
  buildMac:
    runs-on: macos-11
    steps:
      - uses: actions/checkout@v1
      - name: Set up JDK 1.8
        uses: actions/setup-java@v1
        with:
          java-version: 1.8
      - name: Install dependencies
        run: |
          brew install sdl2
          brew install glew
      - name: Build natives
        env:
          MACOSX_DEPLOYMENT_TARGET: '10.9'
        run: |
          ./gradlew arc-core:jnigenBuild
          ./gradlew extensions:freetype:jnigenBuild
          ./gradlew backends:backend-sdl:jnigenBuild
      - name: Upload natives
        uses: actions/upload-artifact@v2
        with:
          name: Arc-core MacOS natives
          path: |
            natives/natives-desktop/libs/libarc64.dylib
            natives/natives-desktop/libs/libarcarm64.dylib
            natives/natives-freetype-desktop/libs/libarc-freetype64.dylib
            natives/natives-freetype-desktop/libs/libarc-freetypearm64.dylib
            backends/backend-sdl/libs/macosx64/libsdl-arc64.dylib
            backends/backend-sdl/libs/macosx64/libsdl-arcarm64.dylib
      - name: Upload iOS natives
        uses: actions/upload-artifact@v2
        with:
          name: Arc-core iOS natives
          path: |
            natives/natives-ios/libs/libarc.a
            natives/natives-freetype-ios/libs/libarc-freetype.a


Validate Gradle Wrapper

name: "Validate Gradle Wrapper"
on: [push, pull_request]

jobs:
  validation:
    name: "Validation"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: gradle/wrapper-validation-action@v2


MicroProfile Fault Tolerance Build

#/*
 #* Copyright (c) 2020 Contributors to the Eclipse Foundation
 #*
 #* See the NOTICE file(s) distributed with this work for additional
 #* information regarding copyright ownership.
 #*
 #* Licensed under the Apache License, Version 2.0 (the "License");
 #* You may not use this file except in compliance with the License.
 #* You may obtain a copy of the License at
 #*
 #*     http://www.apache.org/licenses/LICENSE-2.0
 #*
 #* Unless required by applicable law or agreed to in writing, software
 #* distributed under the License is distributed on an "AS IS" BASIS,
 #* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 #* See the License for the specific language governing permissions and
 #* limitations under the License.
 #*/

name: MicroProfile Fault Tolerance Build

on:
  push:
    paths-ignore:
      - 'editorconfig'
      - '.gitattributes'
      - '.gitignore'
      - 'CONTRIBUTING*'
      - 'CODEOWNERS'
      - 'KEYS'
      - 'LICENSE'
      - 'NOTICE'
      - 'README*'
      - 'site.yaml'
  pull_request:
    paths-ignore:
      - 'editorconfig'
      - '.gitattributes'
      - '.gitignore'
      - 'CONTRIBUTING*'
      - 'CODEOWNERS'
      - 'KEYS'
      - 'LICENSE'
      - 'NOTICE'
      - 'README*'
      - 'site.yaml'

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        java: [17, 21]
    name: build with jdk ${{matrix.java}}

    steps:
      - uses: actions/checkout@v2
        name: checkout
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - uses: actions/setup-java@v4
        name: set up jdk ${{matrix.java}}
        with:
          java-version: ${{matrix.java}}
          distribution: 'temurin'

      - name: build with maven
        run: mvn -ntp verify


Create Release

# Copyright (C) 2020 Dremio
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Projectnessie GitHub Release workflow

# Creates a release tag for the current in-tree version from the main or another branch.

# This workflow creates the git commits + git tag for a Nessie release.

# When this workflow pushes the release tag (e.g. `nessie-0.5.1`), the `release-publish.yml`
# workflow publishes the release artifacts.

# Projectnessie really prefers a linear git history - aka no merges. PRs must not be merged
# while the release workflow runs. In case the git history would not be linear, this workflow will
# fail without having uploaded/pushed any release artifacts.

# Secrets:
#   NESSIE_BUILDER  GH access-token to push the release-commits+tag to the branch,
#                   bypassing the required commit-hooks + review.

name: Create Release

on:
  # Manually triggered
  workflow_dispatch:
    inputs:
      releaseFromBranch:
        description: 'The branch name the release from, leave empty to release from latest commit on main.'
        required: false
      bumpType:
        description: 'Optional: bump patch, minor or major version (`patch`, `minor`, `major`). Default is `minor`.'
        required: true
        type: string
        default: "minor"

jobs:
  create-release:
    name: Create release
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    if: github.repository == 'projectnessie/nessie'
    env:
      RELEASE_FROM: ${{ github.event.inputs.releaseFromBranch }}
      BUMP_TYPE: ${{ github.event.inputs.bumpType }}

    steps:

    ### BEGIN runner setup
    - name: Checkout
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        ref: ${{ env.RELEASE_FROM }}
        fetch-depth: '0'
    - name: Setup Java, Gradle
      uses: ./.github/actions/dev-tool-java
    - name: Setup Go
      uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5
    ### END runner setup

    - name: Configure release-bot-user in git config
      run: |
        git config --global user.email "nessie-release-workflow-noreply@projectnessie.org"
        git config --global user.name "Nessie Release Workflow [bot]"

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3
      with:
        cache-disabled: true

    - name: Bump to release version
      run: ./gradlew :bumpVersion --bumpType ${{ env.BUMP_TYPE }} --bumpToRelease

    - name: Get release version
      run: |
        RELEASE_VERSION=$(cat version.txt)
        LAST_TAG=$(git describe --abbrev=0 --tags --match=nessie-*)

        echo "LAST_TAG=${LAST_TAG}" >> ${GITHUB_ENV}
        echo "RELEASE_VERSION=${RELEASE_VERSION}" >> ${GITHUB_ENV}
        echo "GIT_TAG=nessie-${RELEASE_VERSION}" >> ${GITHUB_ENV}

        cat <<! >> $GITHUB_STEP_SUMMARY
        ## About to release

        Version information right before the Git release tag and commit:

        | Name | Value |
        | --- | --- |
        | Nessie release version  | ${RELEASE_VERSION}            |
        | Git tag name            | \`nessie-${RELEASE_VERSION}\` |
        | Previous Git tag        | \`${LAST_TAG}\`               |
        | Release from branch     | ${RELEASE_FROM}               |
        | Bump type               | ${BUMP_TYPE}                  |
        | Before release Git HEAD | \`$(git rev-parse HEAD)\`     |
        !

    - name: Update .md files referencing latest Nessie version
      run: |
        LAST_VERSION="${LAST_TAG#nessie-}"
        LAST_VERSION_PATTERN="$(echo ${LAST_VERSION} | sed 's/\([^.]*\)[.]\([^.]*\)[.].*/\1\\.\2/')\\."

        for fn in SECURITY.md README.md site/docs/server-upgrade.md ; do
          sed -i "s/${LAST_VERSION_PATTERN}[^ ]*/${RELEASE_VERSION}/" ${fn}
        done

    # Two steps that verify that the README.md, SECURITY.md and server-upgrade.md files contain
    # information about the release, ignoring the patch version
    - name: Check release version number in text files
      run: |
        FAILS=""
        # version pattern without patch version
        VERSION_PATTERN="$(echo ${RELEASE_VERSION} | sed 's/\([^.]*\)[.]\([^.]*\)[.].*/\1\\.\2/')\\."
        grep -q " ${VERSION_PATTERN}" < site/docs/server-upgrade.md || FAILS="${FAILS} site/docs/server-upgrade.md"
        grep -q "^| ${VERSION_PATTERN}" < README.md || FAILS="${FAILS} README.md"
        grep -q "^| ${VERSION_PATTERN}.* .*check_mark.*$" < SECURITY.md || FAILS="${FAILS} SECURITY.md"
        if [[ -n ${FAILS} ]] ; then
          echo ${FAILS} "do not match the version pattern ${VERSION_PATTERN}."
          exit 1
        fi

    - name: Patch changelog
      run: ./gradlew :patchChangelog

    - name: Update site
      shell: bash
      working-directory: site
      run: |
        bin/release.sh ${RELEASE_VERSION}

    - name: Bump version in helm/nessie
      shell: bash
      run: |
        sed -i "s/^version: [0-9.]*$/version: ${RELEASE_VERSION}/" helm/nessie/Chart.yaml

    # Updates the site/docs/releases.md file, takes the first four lines (the big heading),
    # adds a heading with the version and a note referencing the release notes on GitHub,
    # followed by the Git change log, finalized with the remainder of the
    # previous site/docs/releases.md file.
    - name: Update releases.md file
      run: |
        head -4 site/docs/releases.md > /tmp/releases.md
        cat <<!  >> /tmp/releases.md
        ## ${RELEASE_VERSION} Release ($(date '+%B %d, %Y'))

        See [Release information on GitHub](https://github.com/projectnessie/nessie/releases/tag/nessie-${RELEASE_VERSION}).

        !

        # Add section from CHANGELOG.md for the version to release
        ./gradlew --quiet --console=plain getChangelog --no-header --no-links >> /tmp/releases.md
        echo "### Commits" >> /tmp/releases.md

        git log --perl-regexp --author '^(?!.*renovate|.*nessie-release-workflow).*$'\
          --format='format:* %s' ${LAST_TAG}..HEAD . |\
          grep -v '^\* \[release\] .*$' >> /tmp/releases.md || true

        tail +4 site/docs/releases.md >> /tmp/releases.md

        cp /tmp/releases.md site/docs/releases.md
        rm /tmp/releases.md

    - name: Update helm/README.md
      run: |
        go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
        $(go env GOPATH)/bin/helm-docs --chart-search-root=helm

    # Record the release-version in git and add the git tag for the release.
    - name: Record ${{ env.RELEASE_VERSION }} release in git
      run: |
        git commit -a -m "[release] release nessie-${RELEASE_VERSION}"
        git tag -f -a -m "Release ${RELEASE_VERSION} from ${RELEASE_FROM} with bump-type ${BUMP_TYPE}" ${GIT_TAG}

        cat <<! >> $GITHUB_STEP_SUMMARY
        ## Release version information

        Version information after the Git release tag:

        | Name | Value |
        | --- | --- |
        | Nessie release version | ${RELEASE_VERSION}        |
        | Git tag name           | \`${GIT_TAG}\`\           |
        | Previous Git tag       | \`${LAST_TAG}\`           |
        | Release from branch    | ${RELEASE_FROM}           |
        | Bump type              | ${BUMP_TYPE}              |
        | Release Git HEAD       | \`$(git rev-parse HEAD)\` |
        !

    # Bump to the next patch version as a SNAPSHOT
    - name: Bump to next patch version
      run: ./gradlew :bumpVersion --bumpType patch

    - name: Get next patch version
      run: |
        NEXT_VERSION="$(cat version.txt)"
        echo "NEXT_VERSION=${NEXT_VERSION}" >> ${GITHUB_ENV}
        echo "NEXT_VERSION_NO_SNAPSHOT=${NEXT_VERSION%-SNAPSHOT}" >> ${GITHUB_ENV}

    - name: Next version information
      run: |
        cat <<! >> $GITHUB_STEP_SUMMARY
        ## Next development version information

        | Name | Value |
        | --- | --- |
        | Nessie development version | ${NEXT_VERSION}           |
        | \`version.txt\` content    | \`$(cat version.txt)\`    |
        | Git HEAD                   | \`$(git rev-parse HEAD)\` |
        !

      # Record the next development iteration in Git
    - name: Record next development version in Git
      run: git commit -a -m "[release] next development iteration ${NEXT_VERSION}"

    # Push the 2 git commits and git tag. If this one fails, some other commit was pushed to the
    # 'main' branch and break the linear history for the Nessie git repo.
    # The `release-publish.yml` job will run when the release tag `nessie-x.y.z` has been pushed.
    - name: Push tag + branch
      run: |
        # Push directly using the remote repo URL, which includes the secret so this job can push to the repo
        UPSTREAM="https://${{ secrets.NESSIE_BUILDER }}@github.com/${GITHUB_REPOSITORY}.git"

        # Move the default auth settings in ~/.gitconfig out of the way, so the git-push can use the token
        git config --rename-section http.https://github.com/ http.https://save.github.com/

        # Push changes to docs to site-docs branch
        (cd site/build/site-docs ; git push --no-verify "${UPSTREAM}" HEAD:site-docs)

        git push --no-verify "${UPSTREAM}" HEAD:${GITHUB_REF} ${GIT_TAG}

        # Move the default auth settings in ~/.gitconfig back
        git config --rename-section http.https://save.github.com/ http.https://github.com/


Publish release

# Copyright (C) 2020 Dremio
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Publishes all Nessie release artifacts and creates a Nessie release in GitHub.
#
# Triggered when a `nessie-*` tag is being pushed.
#
# GitHub environment name: release
#
# This workflow uses separate GH workflow jobs intentionally to be able to re-run
# failed "release targets" (Maven Central, Swaggerhub, GHCR, Helm) and not let
# the whole release fail (and force a completely new release).
#
# Jobs:
#    Prepare -->--+
#                 |
#                 +-->-- Publish to Maven Central -->--+
#                 |                                    |
#                 +-->-- Publish OpenAPI ----------->--+
#                 |                                    |
#                 +-->-- Publish Docker images ----->--+
#                 |                                    |
#                 +-->-- Publish Helm Chart -------->--+
#                                                      |
#                                                      +-->-- GitHub Release notes
#

name: Publish release

on:
  push:
    tags:
      - nessie-*

  workflow_dispatch:
    inputs:
      releaseTag:
        description: 'Release tag name to re-release'
        required: true

jobs:
  prepare:
    name: Prepare
    outputs:
      release-version: ${{ steps.get_version.outputs.release-version }}
      git-tag: ${{ steps.get_version.outputs.git-tag }}
    runs-on: ubuntu-22.04
    environment: release
    timeout-minutes: 10
    steps:
      # GH doesn't provide just the tag name, so this step strips `/refs/tags/nessie-` from `GITHUB_REF`
      # and provides the outputs for the Git tag and the release-version derived from it, in case of a manual run,
      # uses the input `releaseTag` as the input tag name.
      - name: Get release version
        id: get_version
        run: |
          if [[ "${{ github.event_name }}" == "push" ]] ; then
            V="${GITHUB_REF/refs\/tags\/}"
          else
            V="${{ github.event.inputs.releaseTag }}"
          fi
          # check if tag matches patterns like nessie-0.5, nessie-0.10.4.3-alpha1, etc
          if [[ ${V} =~ ^nessie-[0-9]+[.][0-9.]*[0-9](-[a-zA-Z0-9]+)?$ ]]; then
            echo "release-version=${V/nessie-}" >> ${GITHUB_OUTPUT}
            echo "git-tag=${V}" >> ${GITHUB_OUTPUT}
          else
            echo "Tag must start with nessie- followed by a valid version (got tag ${V}, ref is ${GITHUB_REF} )"
            exit 1
          fi

  publish-maven-central:
    name: Publish to Maven Central
    runs-on: ubuntu-22.04
    environment: release
    timeout-minutes: 150
    needs:
      - prepare
    env:
      RELEASE_VERSION: ${{needs.prepare.outputs.release-version}}
      ARTIFACTS: build-artifacts
    steps:
      ### BEGIN runner setup
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'push' }}
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'workflow_dispatch' }}
        with:
          ref: refs/tags/${{ github.event.inputs.releaseTag }}
      - name: Setup runner
        uses: ./.github/actions/setup-runner
      - name: Setup Java, Gradle
        uses: ./.github/actions/dev-tool-java
        with:
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
      ### END runner setup

      - name: Prepare artifacts directory
        run: rm -rf "${ARTIFACTS}" ; mkdir -p "${ARTIFACTS}"

      - name: Gradle build
        run: |
          # 2 Retries - due to Gradle's old and unfixed CME bug
          ./gradlew --no-scan compileAll jar || ./gradlew --no-scan compileAll jar || ./gradlew --no-scan compileAll jar

      - name: Check Licenses
        run: ./gradlew --no-scan aggregatedLicenseReportsZip

      # Deploys Maven artifacts. Build and test steps were already ran in previous steps.
      # Not running tests, because the environment contains secrets.
      - name: Publish Maven artifacts for release
        env:
          # To release with Gradle
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_ACCESS_ID }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_TOKEN }}
          # To release commits that used Maven to build
          MAVEN_USERNAME: ${{ secrets.OSSRH_ACCESS_ID }}
          MAVEN_OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
        run: |
          # 2 Retries - to mitigate "HTTP/502 Bad Gateway" issues
          ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease -Puber-jar --no-scan --stacktrace || \
            ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease -Puber-jar --no-scan --stacktrace || \
            ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease -Puber-jar --no-scan --stacktrace

      - name: Generate changelog
        run: ./gradlew --no-scan --quiet --console=plain getChangelog --no-header --no-links > "${ARTIFACTS}/nessie-changelog-${RELEASE_VERSION}.md"

      - name: Collect artifacts
        run: |
          mv servers/quarkus-server/build/nessie-quarkus-${RELEASE_VERSION}-runner.jar "${ARTIFACTS}"
          mv cli/cli/build/libs/nessie-cli-${RELEASE_VERSION}.jar "${ARTIFACTS}"
          mv tools/server-admin/build/nessie-server-admin-tool-${RELEASE_VERSION}-runner.jar "${ARTIFACTS}"
          mv gc/gc-tool/build/executable/nessie-gc.jar "${ARTIFACTS}/nessie-gc-${RELEASE_VERSION}.jar"
          cp tools/aggregated-license-report/build/distributions/nessie-aggregated-license-report-${RELEASE_VERSION}.zip "${ARTIFACTS}"

      - name: Archive release artifacts
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
        with:
          name: nessie-release-artifacts
          path: build-artifacts
          if-no-files-found: error

  publish-images:
    name: Publish images
    runs-on: ubuntu-22.04
    environment: release
    timeout-minutes: 60
    needs:
      - prepare
    steps:
      ### BEGIN runner setup
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'push' }}
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'workflow_dispatch' }}
        with:
          ref: refs/tags/${{ github.event.inputs.releaseTag }}
      - name: Setup runner
        uses: ./.github/actions/setup-runner
      - name: Setup Java, Gradle
        uses: ./.github/actions/dev-tool-java
      ### END runner setup

      - name: Gradle build
        run: |
          # 2 Retries - due to Gradle's old and unfixed CME bug
          ./gradlew --no-scan compileAll jar || ./gradlew --no-scan compileAll jar || ./gradlew --no-scan compileAll jar

      - name: Docker login
        run: |
          echo '${{ secrets.GITHUB_TOKEN }}' | docker login ghcr.io -u $ --password-stdin

      - name: Publish Nessie Server
        run: |
          tools/dockerbuild/build-push-images.sh \
            -g ":nessie-quarkus" \
            -p "servers/quarkus-server" \
            -d "Dockerfile-server" \
            ghcr.io/projectnessie/nessie

      - name: Publish Nessie GC
        run: |
          tools/dockerbuild/build-push-images.sh \
            -g ":nessie-gc-tool" \
            -p "gc/gc-tool" \
            -d "Dockerfile-gctool" \
            ghcr.io/projectnessie/nessie-gc

      - name: Publish Nessie Server Admin Tool
        run: |
          tools/dockerbuild/build-push-images.sh \
            -g ":nessie-server-admin-tool" \
            -p "tools/server-admin" \
            -d "Dockerfile-admintool" \
            ghcr.io/projectnessie/nessie-server-admin

  publish-helm:
    name: Publish Helm Chart
    runs-on: ubuntu-22.04
    environment: release
    timeout-minutes: 60
    needs:
      - prepare
    env:
      RELEASE_VERSION: ${{needs.prepare.outputs.release-version}}
    steps:
      ### BEGIN runner setup
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'push' }}
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'workflow_dispatch' }}
        with:
          ref: refs/tags/${{ github.event.inputs.releaseTag }}
      - name: Install Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4
        with:
          version: v3.6.3
      ### END runner setup

      - name: Package Nessie Helm chart
        run: |
          helm package helm/nessie --version ${RELEASE_VERSION}
          mv nessie-${RELEASE_VERSION}.tgz nessie-helm-${RELEASE_VERSION}.tgz

      - name: Publish Nessie Helm chart to Helm Repo
        run: |
          wget https://raw.githubusercontent.com/projectnessie/charts.projectnessie.org/main/index.yaml
          helm repo index . --merge index.yaml --url https://github.com/projectnessie/nessie/releases/download/nessie-${RELEASE_VERSION}
          echo ${{ secrets.CI_REPORTS_TOKEN }} | gh auth login --with-token
          index_sha=$(gh api -X GET /repos/projectnessie/charts.projectnessie.org/contents/index.yaml --jq '.sha')
          gh api -X PUT /repos/projectnessie/charts.projectnessie.org/contents/index.yaml -f message="Publishing Nessie Helm chart ${RELEASE_VERSION}" -f content=$(base64 -w0 index.yaml) -f sha=${index_sha} || true

      - name: Archive Helm chart artifact
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
        with:
          name: nessie-release-helm
          path: ./nessie-helm-*.tgz
          if-no-files-found: error

  publish-openapi:
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    environment: release
    needs:
      - prepare
    env:
      RELEASE_VERSION: ${{needs.prepare.outputs.release-version}}
    steps:
      ### BEGIN runner setup
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'push' }}
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'workflow_dispatch' }}
        with:
          ref: refs/tags/${{ github.event.inputs.releaseTag }}
      - name: Setup runner
        uses: ./.github/actions/setup-runner
      - name: Setup Java, Gradle
        uses: ./.github/actions/dev-tool-java
      ### END runner setup

      - name: Gradle build
        run: |
          # 2 Retries - due to Gradle's old and unfixed CME bug
          ./gradlew --no-scan :nessie-model:jar || ./gradlew --no-scan :nessie-model:jar || ./gradlew --no-scan :nessie-model:jar

      - name: Copy OpenAPI yaml
        run: cp api/model/build/generated/openapi/META-INF/openapi/openapi.yaml ./nessie-openapi-${RELEASE_VERSION}.yaml

      - name: Archive OpenAPI artifact
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
        with:
          name: nessie-release-openapi
          path: ./nessie-openapi-*.yaml
          if-no-files-found: error

      - name: Update SwaggerHub
        uses: smartbear/swaggerhub-cli@20e5eaf4866bbbc44d72e9eb8a48a942c0d9e43b # v0.9.0
        env:
          XDG_CONFIG_HOME: "/tmp"
          SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }}
          SWAGGERHUB_URL: "https://api.swaggerhub.com"
        with:
          args: api:create projectnessie/nessie -f ./nessie-openapi-${{ env.RELEASE_VERSION }}.yaml --published=publish --setdefault --visibility=public

  create-github-release:
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    environment: release
    needs:
      - prepare
      - publish-maven-central
      - publish-images
      - publish-helm
      - publish-openapi
    env:
      RELEASE_VERSION: ${{needs.prepare.outputs.release-version}}
      GIT_TAG: ${{needs.prepare.outputs.git-tag}}
      NOTES_FILE: current-release-notes.md
    steps:
      ### BEGIN runner setup
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'push' }}
        with:
          fetch-depth: 0
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        if: ${{ github.event_name == 'workflow_dispatch' }}
        with:
          fetch-depth: 0
          ref: refs/tags/${{ github.event.inputs.releaseTag }}
      ### END runner setup

      - name: Create dir
        run: mkdir current-release-artifacts

      - name: Get release + OpenAPI + Helm chart artifacts
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4
        with:
          path: current-release-artifacts
          merge-multiple: true

      - name: Create release notes file for GitHub release
        run: |
          LAST_TAG=$(git describe --abbrev=0 --tags "--match=nessie-*" ${GIT_TAG}^1)

          tools/releases/create-gh-release-notes.sh \
            -n ${NOTES_FILE} \
            -l ${LAST_TAG} \
            -t ${GIT_TAG} \
            -r ${RELEASE_VERSION} \
            -c current-release-artifacts/nessie-changelog-${RELEASE_VERSION}.md

          rm current-release-artifacts/nessie-changelog-${RELEASE_VERSION}.md

          cat "${NOTES_FILE}" >> $GITHUB_STEP_SUMMARY

      - name: GitHub login
        run: echo ${{ secrets.GITHUB_TOKEN }} | gh auth login --with-token

      - name: Create Nessie release in GitHub
        run: gh release create ${GIT_TAG} --notes-file ${NOTES_FILE} --title "Nessie ${RELEASE_VERSION}" current-release-artifacts/*


Bump version

# Copyright (C) 2020 Dremio
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Projectnessie Update development version on 'main' (or another branch) to the next
# patch/minor/major version as a -SNAPSHOT version.

# Manually triggered workflow, takes the optional "bumpType" and "bumpBranch" arguments.
# This workflow creates a Git commit to bump the development version.

# Secrets:
#   NESSIE_BUILDER  GH access-token to push the release-commits+tag to the branch,
#                   bypassing the required commit-hooks + review.

name: Bump version

on:
  # Manually triggered
  workflow_dispatch:
    inputs:
      bumpType:
        description: 'Bump what (`patch`, `minor`, `major`), defaults to `patch`'
        required: true
        type: string
        default: "patch"
      bumpBranch:
        description: 'The branch name to bump the version in, leave empty to bump the version on the `main` branch.'
        required: true
        type: string
        default: "main"

jobs:
  create-release:
    name: Bump version
    runs-on: ubuntu-22.04
    if: github.repository == 'projectnessie/nessie'
    env:
      BUMP_ON_BRANCH: ${{ github.event.inputs.bumpBranch }}
      BUMP_TYPE: ${{ github.event.inputs.bumpType }}

    steps:

    ### BEGIN runner setup
    - name: Checkout
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        ref: ${{ env.BUMP_ON_BRANCH }}
    - name: Setup Java, Gradle
      uses: ./.github/actions/dev-tool-java
    ### END runner setup

    - name: Get previous version information
      run: echo "PREVIOUS_VERSION=$(cat version.txt)" >> ${GITHUB_ENV}

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3
      env:
        # Same as for ci.yml
        GRADLE_BUILD_ACTION_CACHE_KEY_ENVIRONMENT: java-17
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB: nessie-ci
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB_INSTANCE: ci
      with:
        cache-read-only: true

    - name: Bump to version
      run: ./gradlew :bumpVersion --bumpType ${{ env.BUMP_TYPE }}

    - name: Get bumped version information
      run: |
        echo "BUMPED_VERSION=$(cat version.txt)" >> ${GITHUB_ENV}
        echo "BUMPED_VERSION_NO_SNAPSHOT=${BUMPED_VERSION%-SNAPSHOT}" >> ${GITHUB_ENV}

    - name: Configure bump-version-bot-user in git config
      run: |
        git config --global user.email "nessie-bump-version-workflow-noreply@projectnessie.org"
        git config --global user.name "Nessie Bump Version Workflow [bot]"

    # Record the next development iteration in git
    - name: Record next development version in git
      run: git commit -a -m "[bump-version] bump to ${BUMPED_VERSION}"

    - name: Version information
      run: |
        cat <<! >> $GITHUB_STEP_SUMMARY
        ## Version information

        | **Previous Nessie version** | ${PREVIOUS_VERSION}       |
        | **Current Nessie version**  | ${BUMPED_VERSION}         |
        | **Bump type**               | ${BUMP_TYPE}              |
        | Git HEAD                    | \`$(git rev-parse HEAD)\` |
        !

    # Push the Git commit. If this one fails, some other commit was pushed to the
    # 'main' branch and break the linear history for the Nessie git repo.
    - name: Push Git commit
      run: |
        # Push directly using the remote repo URL, which includes the secret so this job can push to the repo
        UPSTREAM="https://${{ secrets.NESSIE_BUILDER }}@github.com/${GITHUB_REPOSITORY}.git"

        # Move the default auth settings in ~/.gitconfig out of the way, so the git-push can use the token
        git config --rename-section http.https://github.com/ http.https://save.github.com/

        git push --no-verify "${UPSTREAM}" HEAD:${GITHUB_REF}

        # Move the default auth settings in ~/.gitconfig back
        git config --rename-section http.https://save.github.com/ http.https://github.com/


Newer Java versions

name: Newer Java versions

on:
  pull_request:
    types: [labeled, opened, synchronize, reopened]
  schedule:
    # Run daily on week days
    - cron:  '0 4 * * 1-5'
  workflow_dispatch:

# For the main branch: let all CI runs complete, one after the other. This has a couple advantages:
# * Site deployments happen in commit-order
# * Saved Gradle cache are persisted in commit-order
# * (Potentially) more GH runners available for PRs
concurrency:
  # PRs: 1 CI run concurrently / older ones are cancelled
  # main branch: 1 CI run concurrently / all commits / no cancellation
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  java:
    name: Exercise Java version
    runs-on: ubuntu-22.04
    timeout-minutes: 90
    if: (github.repository == 'projectnessie/nessie' && github.event_name != 'pull_request') || contains(github.event.pull_request.labels.*.name, 'pr-newer-java')
    strategy:
      max-parallel: 1
      matrix:
        include:
          - java-version: 21
    env:
      SPARK_LOCAL_IP: localhost

    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - name: Setup runner
      uses: ./.github/actions/setup-runner
      with:
        more-memory: 'true'
    - name: Setup Java, Gradle
      uses: ./.github/actions/dev-tool-java
      with:
        java-version: ${{ matrix.java-version }}

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3
      env:
        # Same as for ci.yml
        GRADLE_BUILD_ACTION_CACHE_KEY_ENVIRONMENT: java-17
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB: nessie-ci
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB_INSTANCE: ci
      with:
        cache-read-only: true

    - name: Gradle / compile
      run: |
        ./gradlew \
          spotlessCheck \
          compileAll \
          -x :nessie-quarkus:compileAll \
          -x :nessie-server-admin-tool:compileAll \
          -x :nessie-events-quarkus:compileAll \
          --scan

    - name: Gradle / Compile Quarkus
      run: |
        ./gradlew \
          :nessie-quarkus:compileAll \
          :nessie-server-admin-tool:compileAll \
          :nessie-events-quarkus:compileAll \
          --scan

    - name: Gradle / unit test
      run: ./gradlew test --scan

    - name: Gradle / check incl. integ-test
      run: ./gradlew check --scan

    - name: Gradle / assemble + publish local
      run: ./gradlew assemble publishToMavenLocal --scan

    - name: Gradle / build tools integration tests
      run: ./gradlew buildToolsIntegrationTest

    - name: Capture Test Reports
      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
      if: ${{ failure() }}
      with:
        name: test-results
        path: |
          **/build/reports/*
          **/build/test-results/*
        retention-days: 7


Publish in-development builds from main

name: Publish in-development builds from main

on:
  schedule:
    # Run daily on week days
    - cron:  '0 11,23 * * 1-5'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  publish-to-maven:
    name: Publish to Maven Central
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    env:
      SPARK_LOCAL_IP: localhost
    if: github.repository == 'projectnessie/nessie'

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: '0'
      - name: Setup runner
        uses: ./.github/actions/setup-runner
      - name: Setup Java, Gradle
        uses: ./.github/actions/dev-tool-java

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3
        with:
          cache-disabled: true

      - name: List projects
        run: ./gradlew projects

      - name: Gradle / publish snapshot
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_ACCESS_ID }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_TOKEN }}
        run: |
          # 2 Retries - due to Gradle's old and unfixed CME bug
          ./gradlew compileAll jar || \
            ./gradlew compileAll jar || \
            ./gradlew compileAll jar

          # 2 Retries - due to Gradle's old and unfixed CME bug
          ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease -Puber-jar || \
            ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease -Puber-jar || \
            ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease -Puber-jar

  publish-images:
    name: Publish Images
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    env:
      SPARK_LOCAL_IP: localhost
    if: github.repository == 'projectnessie/nessie'

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: '0'
      - name: Setup runner
        uses: ./.github/actions/setup-runner
      - name: Setup Java, Gradle
        uses: ./.github/actions/dev-tool-java

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3
        with:
          cache-disabled: true

      - name: List projects
        run: ./gradlew projects

      - name: Gradle / build
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
        run: |
          # 2 Retries - due to Gradle's old and unfixed CME bug
          ./gradlew compileAll jar || \
            ./gradlew compileAll jar || \
            ./gradlew compileAll jar

      - name: Docker images publishing
        run: |
          echo '${{ secrets.GITHUB_TOKEN }}' | docker login ghcr.io -u $ --password-stdin
          tools/dockerbuild/build-push-images.sh \
            -g ":nessie-quarkus" \
            -p "servers/quarkus-server" \
            ghcr.io/projectnessie/nessie-unstable
          tools/dockerbuild/build-push-images.sh \
            -g ":nessie-gc-tool" \
            -p "gc/gc-tool" \
            -d "Dockerfile-gctool" \
            ghcr.io/projectnessie/nessie-gc-unstable
          tools/dockerbuild/build-push-images.sh \
            -g ":nessie-server-admin-tool" \
            -p "tools/server-admin" \
            -d "Dockerfile-admintool" \
            ghcr.io/projectnessie/nessie-server-admin-unstable


macOS Build Check

# Copyright (C) 2022 Dremio
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Projectnessie GitHub Pull-Request / macOS CI

name: macOS Build Check

on:
  pull_request:
    types: [labeled, opened, synchronize, reopened]
  schedule:
    # Run daily on week days
    - cron:  '0 4 * * 1-5'
  workflow_dispatch:

# For the main branch: let all CI runs complete, one after the other. This has a couple advantages:
# * Site deployments happen in commit-order
# * Saved Gradle cache are persisted in commit-order
# * (Potentially) more GH runners available for PRs
concurrency:
  # PRs: 1 CI run concurrently / older ones are cancelled
  # main branch: 1 CI run concurrently / all commits / no cancellation
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  java:
    name: Java/Gradle macOS
    runs-on: macos-14
    timeout-minutes: 60
    if: (github.repository == 'projectnessie/nessie' && github.event_name != 'pull_request') || contains(github.event.pull_request.labels.*.name, 'pr-macos-win')
    env:
      SPARK_LOCAL_IP: localhost
      CI_MAC: "true"

    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - name: Setup Java, Gradle
      uses: ./.github/actions/dev-tool-java

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3
      env:
        # Same as for ci.yml
        GRADLE_BUILD_ACTION_CACHE_KEY_ENVIRONMENT: java-17
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB: nessie-ci
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB_INSTANCE: ci
      with:
        cache-read-only: true

    - name: Gradle / compile
      run: ./gradlew assemble --scan

    - name: Gradle / unit test
      env:
        SPARK_LOCAL_IP: localhost
      run: ./gradlew test --scan

    - name: Capture Test Reports
      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
      if: ${{ failure() }}
      with:
        name: test-results
        path: |
          **/build/reports/*
          **/build/test-results/*
        retention-days: 3


Windows Build Check

# Copyright (C) 2022 Dremio
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Projectnessie GitHub Pull-Request / macOS CI

name: Windows Build Check

on:
  pull_request:
    types: [labeled, opened, synchronize, reopened]
  schedule:
    # Run daily on week days
    - cron:  '0 4 * * 1-5'
  workflow_dispatch:

# For the main branch: let all CI runs complete, one after the other. This has a couple advantages:
# * Site deployments happen in commit-order
# * Saved Gradle cache are persisted in commit-order
# * (Potentially) more GH runners available for PRs
concurrency:
  # PRs: 1 CI run concurrently / older ones are cancelled
  # main branch: 1 CI run concurrently / all commits / no cancellation
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  java:
    name: Java/Gradle Windows
    runs-on: windows-2022
    timeout-minutes: 60
    if: (github.repository == 'projectnessie/nessie' && github.event_name != 'pull_request') || contains(github.event.pull_request.labels.*.name, 'pr-macos-win')
    env:
      SPARK_LOCAL_IP: localhost

    steps:
    - name: Git line ending config
      # This is a workaround to pass the ui/ project's prettier configuration, which has the strict
      # rule to allow only LF as the line ending.
      run: |
        git config --global core.autocrlf false
        git config --global core.eol lf

    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        repository: cdarlint/winutils
        path: hadoop-winutils
        ref: d018bd9c919dee1448b95519351cc591a6338a00

    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - name: Setup Java, Gradle
      uses: ./.github/actions/dev-tool-java

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3
      env:
        # Same as for ci.yml
        GRADLE_BUILD_ACTION_CACHE_KEY_ENVIRONMENT: java-17
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB: nessie-ci
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB_INSTANCE: ci
      with:
        cache-read-only: true

    - name: Gradle / compile
      run: ./gradlew assemble --scan


Synchronize Container Registries

name: Synchronize Container Registries

on:
  workflow_run:
    workflows:
      - 'Publish release'
      - 'Publish in-development builds from main'
    types:
      - completed
  workflow_dispatch:

jobs:
  sync:
    name: Synchronize Container Registries
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    if: github.repository == 'projectnessie/nessie'

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Sync images
        env:
          REGCLIENT_VERSION: 0.6.1
          QUAY_IO_USER: ${{ secrets.QUAY_IO_USER }}
          QUAY_IO_TOKEN: ${{ secrets.QUAY_IO_TOKEN }}
          GHCR_IO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
        run: |
          curl -L https://github.com/regclient/regclient/releases/download/v${REGCLIENT_VERSION}/regsync-linux-amd64 > regsync
          sha512sum -c .github/docker-sync/regsync.sha512
          chmod 755 regsync

          ./regsync -v info -c .github/docker-sync/regsync.yml once