java-publish.yml

name: Build and publish Java packages
on:
  release:
    # Trigger on published to include both stable and preview/beta releases
    types: [published]
  pull_request:
    branches:
      - main
      - release/**
    paths:
      - .github/workflows/java-publish.yml
  workflow_dispatch:
    inputs:
      mode:
        description: "Release mode"
        required: true
        type: choice
        default: dry_run
        options:
          - dry_run
          - release
      ref:
        description: "The branch, tag or SHA to checkout"
        required: false
        type: string

permissions:
  contents: read

jobs:
  linux-arm64:
    name: Build on Linux Arm64
    runs-on: ubuntu-24.04-arm64-8x
    timeout-minutes: 60
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - name: Check glibc version outside docker
        run: ldd --version
      - name: Build and run in Debian 10 Arm64 container
        run: |
          docker run --platform linux/arm64 -v ${{ github.workspace }}:/workspace -w /workspace debian:10 bash -c "

            set -ex
            # Update sources.list to use archive repositories for Debian 10 (EOL)
            echo 'deb http://archive.debian.org/debian/ buster main' > /etc/apt/sources.list
            echo 'deb http://archive.debian.org/debian-security buster/updates main' >> /etc/apt/sources.list
            echo 'deb http://archive.debian.org/debian/ buster-updates main' >> /etc/apt/sources.list
            apt-get update

            DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --assume-yes \
              apt-transport-https \
              ca-certificates \
              curl \
              gpg \
              bash \
              less \
              openssl \
              libssl-dev \
              pkg-config \
              libsqlite3-dev \
              libsqlite3-0 \
              libreadline-dev \
              git \
              cmake \
              dh-autoreconf \
              clang \
              g++ \
              libc++-dev \
              libc++abi-dev \
              libprotobuf-dev \
              libncurses5-dev \
              libncursesw5-dev \
              libudev-dev \
              libhidapi-dev \
              zip \
              unzip

            # https://github.com/databendlabs/databend/issues/8035
            PROTOC_ZIP=protoc-3.15.0-linux-aarch_64.zip
            curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.15.0/\$PROTOC_ZIP
            unzip -o \$PROTOC_ZIP -d /usr/local
            rm -f \$PROTOC_ZIP
            protoc --version

            curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain stable
            source \$HOME/.cargo/env
            cargo --version

            cd java/lance-jni

            # https://github.com/rustls/rustls/issues/1967
            export CC=clang
            export CXX=clang++
            ldd --version

            cargo build --release
          "
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: liblance_jni_linux_arm_64.zip
          path: java/lance-jni/target/release/liblance_jni.so
          retention-days: 1
          if-no-files-found: error
  linux-x86:
    name: Build on Linux x86-64
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - name: Check glibc version outside docker
        run: ldd --version
      - name: Build and run in Debian 10 X86-64 container
        run: |
          docker run --platform linux/amd64 -v ${{ github.workspace }}:/workspace -w /workspace debian:10 bash -c "

            set -ex
            # Update sources.list to use archive repositories for Debian 10 (EOL)
            echo 'deb http://archive.debian.org/debian/ buster main' > /etc/apt/sources.list
            echo 'deb http://archive.debian.org/debian-security buster/updates main' >> /etc/apt/sources.list
            echo 'deb http://archive.debian.org/debian/ buster-updates main' >> /etc/apt/sources.list
            apt-get update

            DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --assume-yes \
              apt-transport-https \
              ca-certificates \
              curl \
              gpg \
              bash \
              less \
              openssl \
              libssl-dev \
              pkg-config \
              libsqlite3-dev \
              libsqlite3-0 \
              libreadline-dev \
              git \
              cmake \
              dh-autoreconf \
              clang \
              g++ \
              libc++-dev \
              libc++abi-dev \
              libprotobuf-dev \
              libncurses5-dev \
              libncursesw5-dev \
              libudev-dev \
              libhidapi-dev \
              zip \
              unzip

            # https://github.com/databendlabs/databend/issues/8035
            PROTOC_ZIP=protoc-3.15.0-linux-x86_64.zip
            curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.15.0/\$PROTOC_ZIP
            unzip -o \$PROTOC_ZIP -d /usr/local
            rm -f \$PROTOC_ZIP
            protoc --version

            curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain stable
            source \$HOME/.cargo/env
            cargo --version

            cd java/lance-jni

            # https://github.com/rustls/rustls/issues/1967
            export CC=clang
            export CXX=clang++
            ldd --version

            cargo build --release
          "
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: liblance_jni_linux_x86_64.zip
          path: java/lance-jni/target/release/liblance_jni.so
          retention-days: 1
          if-no-files-found: error
  macos-arm64:
    name: Build on MacOS Arm64 and release
    runs-on: warp-macos-14-arm64-6x
    timeout-minutes: 60
    needs:
      - linux-arm64
      - linux-x86
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.ref || github.ref }}
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
      - name: Set up Java 11
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: corretto
          java-version: 11
          cache: "maven"
          server-id: ossrh
          server-username: SONATYPE_USER
          server-password: SONATYPE_TOKEN
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - uses: Homebrew/actions/setup-homebrew@50b8c2ab4a835c38897ed2c56c293b07167c0b59 # master 2026-03-07
      - name: Install dependencies
        run: |
          brew install protobuf
          brew install gpg
      - name: Download artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
      - name: Copy native libs
        run: |
          mkdir -p ./java/target/classes/nativelib/linux-x86-64 ./java/target/classes/nativelib/linux-aarch64
          cp ./liblance_jni_linux_x86_64.zip/liblance_jni.so ./java/target/classes/nativelib/linux-x86-64/liblance_jni.so
          cp ./liblance_jni_linux_arm_64.zip/liblance_jni.so ./java/target/classes/nativelib/linux-aarch64/liblance_jni.so
      - name: Set github
        run: |
          git config --global user.email "Lance Github Runner"
          git config --global user.name "dev+gha@lance.org"
      - name: Dry run
        if: |
          github.event_name == 'pull_request' ||
          inputs.mode == 'dry_run'
        working-directory: java
        run: |
          mvn --batch-mode -DskipTests -Drust.release.build=true package
      - name: Publish with Java 11
        if: |
          github.event_name == 'release' ||
          inputs.mode == 'release'
        working-directory: java
        run: |
          echo "use-agent" >> ~/.gnupg/gpg.conf
          echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
          export GPG_TTY=$(tty)
          mvn --batch-mode -DskipTests -Drust.release.build=true -DpushChanges=false -Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }} deploy -P deploy-to-ossrh -P shade-jar
        env:
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_TOKEN: ${{ secrets.SONATYPE_TOKEN }}
  report-failure:
    name: Report Workflow Failure
    runs-on: ubuntu-latest
    needs: [linux-arm64, linux-x86, macos-arm64]
    if: always() && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: ./.github/actions/create-failure-issue
        with:
          job-results: ${{ toJSON(needs) }}
          workflow-name: ${{ github.workflow }}