release.yml

---
name: Release

permissions:
  contents: write
  packages: write
  statuses: write
  checks: write

on:
  workflow_dispatch:

jobs:
  release:
    permissions:
      contents: write
      id-token: write
      attestations: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: webfactory/ssh-agent@v0.10.0
        with:
          ssh-private-key: ${{ secrets.MAVEN_RELEASE_SSH_KEY }}
      - uses: actions/setup-java@v5
        with:
          java-version: "25"
          distribution: "temurin"
          cache: "maven"
          server-id: central
          server-username: OSSRH_USERNAME
          server-password: OSSRH_TOKEN
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Publish package to Maven Central
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          mvn -B -ntp -Dstyle.color=always release:prepare -P sign
          cat release.properties
          RELEASE_TAG=$(grep '^scm.tag=' release.properties | cut -d'=' -f2)
          echo "RELEASE_TAG=${RELEASE_TAG}" >> "$GITHUB_ENV"
          echo "RELEASE_VERSION=${RELEASE_TAG#v}" >> "$GITHUB_ENV"
          mvn -B -ntp -Dstyle.color=always release:perform -P sign -DconnectionUrl=scm:git:https://github.com/${{ github.repository }}.git
          echo "Released ${RELEASE_TAG} 🚀" >> "$GITHUB_STEP_SUMMARY"
        env:
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}

      - name: Generate build provenance attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            target/checkout/mjml-java-core/target/mjml-java-core-${{ env.RELEASE_VERSION }}.jar
            target/checkout/mjml-java-resolvers/target/mjml-java-resolvers-${{ env.RELEASE_VERSION }}.jar
            target/checkout/mjml-java-spring/target/mjml-java-spring-${{ env.RELEASE_VERSION }}.jar

      - name: Generate SBOM attestation (core)
        uses: actions/attest-sbom@v4
        with:
          subject-path: target/checkout/mjml-java-core/target/mjml-java-core-${{ env.RELEASE_VERSION }}.jar
          sbom-path: target/checkout/mjml-java-core/target/bom.json

      - name: Generate SBOM attestation (resolvers)
        uses: actions/attest-sbom@v4
        with:
          subject-path: target/checkout/mjml-java-resolvers/target/mjml-java-resolvers-${{ env.RELEASE_VERSION }}.jar
          sbom-path: target/checkout/mjml-java-resolvers/target/bom.json

      - name: Generate SBOM attestation (spring)
        uses: actions/attest-sbom@v4
        with:
          subject-path: target/checkout/mjml-java-spring/target/mjml-java-spring-${{ env.RELEASE_VERSION }}.jar
          sbom-path: target/checkout/mjml-java-spring/target/bom.json

      - name: Stage SBOMs for release upload
        run: |
          mkdir -p sboms
          for module in mjml-java-core mjml-java-resolvers mjml-java-spring; do
            cp "target/checkout/${module}/target/bom.json" "sboms/${module}-${RELEASE_VERSION}-bom.json"
            cp "target/checkout/${module}/target/bom.xml"  "sboms/${module}-${RELEASE_VERSION}-bom.xml"
          done

      - name: Update docs with released version
        run: |
          # Strip leading 'v' if present (e.g., v1.0.1 -> 1.0.1)
          RELEASE_VERSION="${RELEASE_TAG#v}"

          FILES=(
            README.md
            docs/docs/getting-started/installation.md
            docs/docs/guides/resolvers.md
            docs/docs/guides/spring-boot.md
          )
          for f in "${FILES[@]}"; do
            if [ -f "$f" ]; then
              # Replace any semver or semver-SNAPSHOT with the released version
              sed -i "s/[0-9]\+\.[0-9]\+\.[0-9]\+\(-SNAPSHOT\)\{0,1\}/${RELEASE_VERSION}/g" "$f"
            fi
          done

          if git diff --quiet; then
            echo "No doc version changes needed"
          else
            git add "${FILES[@]}"
            git commit -m "docs: update version references to ${RELEASE_VERSION}"
            git push
          fi

      - name: Create GitHub Release
        run: |
          # Find previous release tag
          PREV_TAG=$(git describe --tags --abbrev=0 "${RELEASE_TAG}^" 2>/dev/null || echo "")

          if [ -n "$PREV_TAG" ]; then
            COMMITS=$(git log "${PREV_TAG}..${RELEASE_TAG}" --pretty=format:"- %s" \
              | grep -v '\[maven-release-plugin\]')
          else
            COMMITS=$(git log "${RELEASE_TAG}" --pretty=format:"- %s" \
              | grep -v '\[maven-release-plugin\]')
          fi

          # Generate release notes via Claude API, fall back to raw commits on failure
          NOTES=$(curl -sf https://api.anthropic.com/v1/messages \
            -H "x-api-key: ${ANTHROPIC_API_KEY}" \
            -H "anthropic-version: 2023-06-01" \
            -H "content-type: application/json" \
            -d "$(jq -n --arg commits "$COMMITS" '{
              model: "claude-haiku-4-5-20251001",
              max_tokens: 1024,
              messages: [{role: "user", content: ("Categorize these git commits into GitHub release notes. Use these sections as needed: ## New Features, ## Bug Fixes, ## Dependency Updates, ## Other Changes. Use bulleted markdown lists. Only include sections that have entries. Do not add any preamble or explanation, just the categorized notes.\n\nCommits:\n" + $commits)}]
            }')" | jq -r '.content[0].text') || NOTES="${COMMITS}"

          gh release create "${RELEASE_TAG}" \
            --title "${RELEASE_TAG}" \
            --notes "${NOTES}" \
            --latest \
            sboms/*
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}