java-publish.yml

name: Build and publish Java packages
on:
  release:
    # Trigger on published to include both stable and preview/beta releases
    types: [published]
  pull_request:
    branches:
      - main
      - release/**
    paths:
      - .github/workflows/java-publish.yml
  workflow_dispatch:
    inputs:
      mode:
        description: "Release mode"
        required: true
        type: choice
        default: dry_run
        options:
          - dry_run
          - release
      ref:
        description: "The branch, tag or SHA to checkout"
        required: false
        type: string

permissions:
  contents: read

jobs:
  build-linux:
    name: Build on Linux ${{ matrix.arch }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86-64
            runner: ubuntu-24.04
            docker_platform: linux/amd64
            protoc_arch: x86_64
            artifact: liblance_jni_linux_x86_64.zip
          - arch: arm64
            runner: ubuntu-24.04-arm64-8x
            docker_platform: linux/arm64
            protoc_arch: aarch_64
            artifact: liblance_jni_linux_arm_64.zip
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - name: Check glibc version outside docker
        run: ldd --version
      - name: Build and run in Debian 10 container
        run: |
          docker run --platform ${{ matrix.docker_platform }} -v ${{ github.workspace }}:/workspace -w /workspace debian:10 bash -c "

            set -ex
            # Update sources.list to use archive repositories for Debian 10 (EOL)
            echo 'deb http://archive.debian.org/debian/ buster main' > /etc/apt/sources.list
            echo 'deb http://archive.debian.org/debian-security buster/updates main' >> /etc/apt/sources.list
            echo 'deb http://archive.debian.org/debian/ buster-updates main' >> /etc/apt/sources.list
            apt-get update

            DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --assume-yes \
              apt-transport-https \
              ca-certificates \
              curl \
              gpg \
              bash \
              less \
              openssl \
              libssl-dev \
              pkg-config \
              libsqlite3-dev \
              libsqlite3-0 \
              libreadline-dev \
              git \
              cmake \
              dh-autoreconf \
              clang \
              g++ \
              libc++-dev \
              libc++abi-dev \
              libprotobuf-dev \
              libncurses5-dev \
              libncursesw5-dev \
              libudev-dev \
              libhidapi-dev \
              zip \
              unzip

            # https://github.com/databendlabs/databend/issues/8035
            PROTOC_ZIP=protoc-3.15.0-linux-${{ matrix.protoc_arch }}.zip
            curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.15.0/\$PROTOC_ZIP
            unzip -o \$PROTOC_ZIP -d /usr/local
            rm -f \$PROTOC_ZIP
            protoc --version

            curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain stable
            source \$HOME/.cargo/env
            cargo --version

            cd java/lance-jni

            # https://github.com/rustls/rustls/issues/1967
            export CC=clang
            export CXX=clang++
            ldd --version

            cargo build --release --locked
          "
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ matrix.artifact }}
          path: java/lance-jni/target/release/liblance_jni.so
          retention-days: 1
          if-no-files-found: error
  build-macos:
    name: Build on MacOS Arm64
    runs-on: warp-macos-14-arm64-6x
    timeout-minutes: 60
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
      - uses: Homebrew/actions/setup-homebrew@50b8c2ab4a835c38897ed2c56c293b07167c0b59 # master 2026-03-07
      - name: Install dependencies
        run: brew install protobuf
      - name: Build native lib
        working-directory: java/lance-jni
        run: cargo build --release --locked
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: liblance_jni_darwin_aarch64.zip
          path: java/lance-jni/target/release/liblance_jni.dylib
          retention-days: 1
          if-no-files-found: error
  publish:
    name: Publish Java packages
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs:
      - build-linux
      - build-macos
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Set up Java 11
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: corretto
          java-version: 11
          cache: "maven"
          server-id: ossrh
          server-username: SONATYPE_USER
          server-password: SONATYPE_TOKEN
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - name: Download artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
      - name: Copy native libs
        run: |
          mkdir -p ./java/target/classes/nativelib/linux-x86-64 \
            ./java/target/classes/nativelib/linux-aarch64 \
            ./java/target/classes/nativelib/darwin-aarch64
          cp ./liblance_jni_linux_x86_64.zip/liblance_jni.so ./java/target/classes/nativelib/linux-x86-64/liblance_jni.so
          cp ./liblance_jni_linux_arm_64.zip/liblance_jni.so ./java/target/classes/nativelib/linux-aarch64/liblance_jni.so
          cp ./liblance_jni_darwin_aarch64.zip/liblance_jni.dylib ./java/target/classes/nativelib/darwin-aarch64/liblance_jni.dylib
      - name: Set github
        run: |
          git config --global user.email "Lance Github Runner"
          git config --global user.name "dev+gha@lance.org"
      - name: Dry run
        if: |
          github.event_name == 'pull_request' ||
          inputs.mode == 'dry_run'
        working-directory: java
        run: |
          mvn --batch-mode -DskipTests -Dskip.build.jni=true package
      - name: Publish with Java 11
        if: |
          github.event_name == 'release' ||
          inputs.mode == 'release'
        working-directory: java
        run: |
          echo "use-agent" >> ~/.gnupg/gpg.conf
          echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
          export GPG_TTY=$(tty)
          mvn --batch-mode -DskipTests -Dskip.build.jni=true -DpushChanges=false -Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }} deploy -P deploy-to-ossrh
        env:
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_TOKEN: ${{ secrets.SONATYPE_TOKEN }}
  report-failure:
    name: Report Workflow Failure
    runs-on: ubuntu-latest
    needs: [build-linux, build-macos, publish]
    if: always() && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: ./.github/actions/create-failure-issue
        with:
          job-results: ${{ toJSON(needs) }}
          workflow-name: ${{ github.workflow }}