build-win.yml

name: Java app image Windows

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      sem-version:
        description: 'Version'
        required: false

permissions:
  contents: write
  packages: write

env:
  JAVA_DIST: 'zulu'
  JAVA_VERSION: '22.0.2+9'

defaults:
  run:
    shell: bash

jobs:
  prepare:
    name: Determines the versions strings for the binaries
    runs-on: [ubuntu-latest]
    outputs:
      semVerStr: ${{ steps.determine-version.outputs.version }}
      semVerNum: ${{steps.determine-number.outputs.number}}
    steps:
      - id: determine-version
        shell: pwsh
        run: |
          if ( '${{github.event_name}}' -eq 'release') {
            echo 'version=${{ github.event.release.tag_name}}' >> "$env:GITHUB_OUTPUT"
            exit 0
          } elseif ('${{inputs.sem-version}}') {
            echo 'version=${{ inputs.sem-version}}' >> "$env:GITHUB_OUTPUT"
            exit 0
          }
          Write-Error "Version neither via input nor by tag specified. Aborting"
          exit 1
      - id: determine-number
        run: |
          SEM_VER_NUM=$(echo "${{ steps.determine-version.outputs.version }}" | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/')
          echo "number=${SEM_VER_NUM}" >> "$GITHUB_OUTPUT"

  build-binary:
    name: Build java app image
    needs: [prepare]
    runs-on: windows-latest
    env:
        artifact-name: cryptomator-cli-${{ needs.prepare.outputs.semVerStr }}-win-x64.zip
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DIST }}
      - name: Set version
        run: mvn versions:set -DnewVersion=${{ needs.prepare.outputs.semVerStr }}
      - name: Run maven
        run: mvn -B clean package -DskipTests
      - name: Patch target dir
        run: |
          cp LICENSE.txt target
          cp target/cryptomator-*.jar target/mods
      - name: Run jlink
        run: >
          "${JAVA_HOME}/bin/jlink"
          --verbose
          --output target/runtime
          --module-path "${JAVA_HOME}/jmods"
          --add-modules java.base,java.compiler,java.naming,java.xml
          --strip-native-commands
          --no-header-files
          --no-man-pages
          --strip-debug
          --compress zip-6
      - name: Run jpackage
        run: >
          "${JAVA_HOME}/bin/jpackage"
          --verbose
          --type app-image
          --runtime-image target/runtime
          --input target/libs
          --module-path target/mods
          --module org.cryptomator.cli/org.cryptomator.cli.CryptomatorCli
          --dest target
          --name cryptomator-cli
          --vendor "Skymatic GmbH"
          --copyright "(C) 2016 - 2024 Skymatic GmbH"
          --app-version "${{ needs.prepare.outputs.semVerNum }}"
          --java-options "-Dorg.cryptomator.cli.version=${{ needs.prepare.outputs.semVerStr }}"
          --java-options "--enable-native-access=org.cryptomator.jfuse.win"
          --java-options "-Xss5m"
          --java-options "-Xmx256m"
          --java-options "-Dfile.encoding=\"utf-8\""
          --win-console
      - uses: actions/upload-artifact@v4
        with:
          name: cryptomator-cli-win-x64
          path: ./target/cryptomator-cli
          if-no-files-found: error
      - name: TODO Sign binaries
        run: echo TODO
      - name: Zip binary for release
        shell: pwsh
        run: Compress-Archive -Path .\target\cryptomator-cli -DestinationPath .\${{ env.artifact-name}}
      - name: Create detached GPG signature with key 615D449FE6E6A235
        run: |
          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a ./${{ env.artifact-name}}
        env:
          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
      - name: Publish artefact on GitHub Releases
        if: startsWith(github.ref, 'refs/tags/') && github.event.action == 'published'
        uses: softprops/action-gh-release@v2
        with:
          fail_on_unmatched_files: true
          token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
          files: |
            ${{ env.artifact-name}}
            cryptomator-cli-*.asc