release.yml

name: Release
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  common:
    uses: ./.github/workflows/build-common.yml

  # test-latest-deps is intentionally not included in the release workflows
  # because any time a new library version is released to maven central
  # it can fail due to test code incompatibility with the new library version,
  # or due to slight changes in emitted telemetry

  # muzzle is intentionally not included in the release workflows
  # because any time a new library version is released to maven central it can fail,
  # and this is not a reason to hold up the release

  release:
    environment: protected
    permissions:
      contents: write # for creating the release
      id-token: write # for signing artifacts with Sigstore
      attestations: write # for uploading attestations
    runs-on: ubuntu-latest
    needs:
      - common
    outputs:
      version: ${{ steps.create-github-release.outputs.version }}
      prior-version: ${{ steps.create-github-release.outputs.prior-version }}
    steps:
      - run: |
          if [[ $GITHUB_REF_NAME != release/* ]]; then
            echo this workflow should only be run against release branches
            exit 1
          fi

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set environment variables
        run: |
          version=$(.github/scripts/get-version.sh)
          if [[ $version =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
            major="${BASH_REMATCH[1]}"
            minor="${BASH_REMATCH[2]}"
            patch="${BASH_REMATCH[3]}"
          else
            echo "unexpected version: $version"
            exit 1
          fi
          if [[ $patch == 0 ]]; then
            if [[ $minor == 0 ]]; then
              prior_major=$((major - 1))
              prior_minor=$(grep -Po "^## Version $prior_major.\K[0-9]+" CHANGELOG.md | head -1)
              prior_version="$prior_major.$prior_minor"
            else
              prior_version="$major.$((minor - 1)).0"
            fi
          else
            prior_version="$major.$minor.$((patch - 1))"
          fi
          echo "VERSION=$version" >> $GITHUB_ENV
          echo "PRIOR_VERSION=$prior_version" >> $GITHUB_ENV

        # check out main branch to verify there won't be problems with merging the change log
        # at the end of this workflow
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          persist-credentials: false

      - name: Check that change log update was merged to main
        run: |
          if [[ $VERSION == *.0 ]]; then
            # not making a patch release
            if ! grep --quiet "^## Version $VERSION " CHANGELOG.md; then
              echo the pull request generated by prepare-release-branch.yml needs to be merged first
              exit 1
            fi
          fi

        # back to the release branch
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # tags are needed for the generate-release-contributors.sh script
          fetch-depth: 0
          persist-credentials: false

      - name: Free disk space
        run: .github/scripts/gha-free-disk-space.sh

      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
        with:
          distribution: temurin
          java-version-file: .java-version

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Build and publish artifacts
        env:
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
        # run: ./gradlew assemble spdxSbom publishToSonatype closeAndReleaseSonatypeStagingRepository
        run: ./gradlew assemble spdxSbom publishAllPublicationToReleaseRepoRepository generateReleaseBundle uploadReleaseBundle

      - name: Build and publish gradle plugins
        env:
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
          GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
          GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
        # Don't use publishToSonatype since we don't want to publish the marker artifact
        run: ./gradlew build publishPlugins publishPluginMavenPublicationToSonatypeRepository closeAndReleaseSonatypeStagingRepository
        working-directory: gradle-plugins

      - name: Collect SBOMs
        run: |
          mkdir sboms
          cp javaagent/build/spdx/*.spdx.json sboms
          zip opentelemetry-java-instrumentation-SBOM.zip sboms/*

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        name: Upload SBOMs
        with:
          name: opentelemetry-java-instrumentation-SBOM
          path: "sboms/*.json"

      - name: Generate release notes
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # CHANGELOG_SECTION.md is also used at the end of the release workflow
          # for copying the change log updates to main
          sed -n "0,/^## Version $VERSION /d;/^## Version /q;p" CHANGELOG.md \
            > /tmp/CHANGELOG_SECTION.md

          # the complex perl regex is needed because markdown docs render newlines as soft wraps
          # while release notes render them as line breaks
          perl -0pe 's/(?<!\n)\n *(?!\n)(?![-*] )(?![1-9]+\. )/ /g' /tmp/CHANGELOG_SECTION.md \
            > /tmp/release-notes.txt

          # conditional block not indented because of the heredoc
          if [[ $VERSION == *.0 ]]; then
          cat >> /tmp/release-notes.txt << EOF
          ### 🙇 Thank you

          This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

          EOF

          .github/scripts/generate-release-contributors.sh v$PRIOR_VERSION >> /tmp/release-notes.txt
          fi

      - name: Simplify paths for attaching
        run: |
          cp javaagent/build/libs/opentelemetry-javaagent-${VERSION}.jar opentelemetry-javaagent.jar
          cp javaagent/build/libs/opentelemetry-javaagent-${VERSION}.jar.asc opentelemetry-javaagent.jar.asc

      - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-path: |
            opentelemetry-javaagent.jar
            opentelemetry-java-instrumentation-SBOM.zip

      - id: create-github-release
        name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create --target $GITHUB_REF_NAME \
                            --title "Version $VERSION" \
                            --notes-file /tmp/release-notes.txt \
                            v$VERSION \
                            opentelemetry-javaagent.jar \
                            opentelemetry-javaagent.jar.asc \
                            opentelemetry-java-instrumentation-SBOM.zip

          # these are used as job outputs
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "prior-version=$PRIOR_VERSION" >> $GITHUB_OUTPUT

  documentation-audit:
    permissions:
      contents: read
      issues: write
    needs:
      - release
    uses: ./.github/workflows/documentation-synchronization-audit.yml

  post-release-updates:
    permissions:
      contents: write # for git push to PR branch
    runs-on: ubuntu-latest
    needs:
      - release
    steps:
      # add change log sync (if any) into this PR since the apidiff update
      # is required before any other PR can be merged anyway
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Copy change log section from release branch
        env:
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          sed -n "0,/^## Version $VERSION /d;/^## Version /q;p" CHANGELOG.md \
            > /tmp/changelog-section.md

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
          persist-credentials: true

      - name: Merge change log to main
        env:
          VERSION: ${{ needs.release.outputs.version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          release_date=$(gh release view v$VERSION --json publishedAt --jq .publishedAt | sed 's/T.*//')
          RELEASE_DATE=$release_date .github/scripts/merge-change-log-after-release.sh

      - name: Wait for release to be available in maven central
        env:
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          until curl --silent \
                     --show-error \
                     --output /dev/null \
                     --head \
                     --fail \
                     https://repo1.maven.org/maven2/io/opentelemetry/javaagent/opentelemetry-javaagent/$VERSION/opentelemetry-javaagent-$VERSION.jar
          do
            sleep 60
          done

      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
        with:
          distribution: temurin
          java-version-file: .java-version

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Update apidiff baseline
        env:
          VERSION: ${{ needs.release.outputs.version }}
          PRIOR_VERSION: ${{ needs.release.outputs.prior-version }}
        run: |
          ./gradlew japicmp -PapiBaseVersion=$PRIOR_VERSION -PapiNewVersion=$VERSION
          # Pin the apidiff baseline to the just-released version.
          sed -i "s/^val apidiffBaselineVersion = .*/val apidiffBaselineVersion = \"$VERSION\"/" version.gradle.kts
          ./gradlew --refresh-dependencies japicmp

      - name: Use CLA approved bot
        run: .github/scripts/use-cla-approved-bot.sh

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: otelbot-token
        with:
          client-id: ${{ vars.OTELBOT_CLIENT_ID }}
          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
          permission-pull-requests: write

      - name: Create pull request against main
        env:
          VERSION: ${{ needs.release.outputs.version }}
          # pull requests from secrets.GITHUB_TOKEN do not run workflows
          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
        run: |
          message="Post-release updates for $VERSION"
          body="Post-release updates for \`$VERSION\`."
          branch="otelbot/update-apidiff-baseline-to-released-version-${VERSION}"

          git checkout -b $branch
          git add CHANGELOG.md
          git add docs/apidiffs
          git add version.gradle.kts
          git commit -m "$message"
          git push --set-upstream origin $branch
          gh pr create \
            --title "$message" \
            --body "$body" \
            --base main