name: jpa-release

# The release gate. Every item in docs/jpa/support-matrix.md's gate table has a job or an assertion
# here, and JpaReleaseManifest parses that document so a gate removed from the docs fails the build
# rather than quietly ceasing to be checked.

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # One job per PostgreSQL major, because one job for three majors was one job for one major.
  #
  # `-Pjpa.matrix.versions=16,17,18` reached JpaPlatformContractSupport.start(), which started
  # selectedVersions().get(0) — so twenty-eight integration classes ran against PG16 and nothing
  # ran against 17 or 18, while docs/jpa/support-matrix.md recorded all three as "full contract
  # suite, release lane". A JSONB mapping, a Hibernate dialect difference or a Flyway upgrade that
  # only breaks on 18 shipped with a green release.
  #
  # start() now fails closed on a multi-version selection, so the fan-out is not optional: the
  # matrix is the only way the three majors get covered, and removing a major from it removes the
  # evidence rather than quietly reusing another major's.
  jpa-release-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        postgresql: ["16", "17", "18"]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the full JPA release gate on PostgreSQL ${{ matrix.postgresql }}
        working-directory: src
        run: >-
          ./gradlew
          jpaReleaseGate
          -Pjpa.matrix.versions=${{ matrix.postgresql }}
          --no-daemon
          --stacktrace
      - name: Record which major this evidence covers
        if: always()
        working-directory: src
        run: |
          mkdir -p build/jpa-release-evidence
          {
            echo "sha=${{ github.sha }}"
            echo "ref=${{ github.ref }}"
            echo "postgresql-major=${{ matrix.postgresql }}"
            echo "task=jpaReleaseGate"
          } > "build/jpa-release-evidence/manifest-${{ matrix.postgresql }}.properties"
      - name: Upload the release evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
        with:
          name: jpa-release-evidence-pg${{ matrix.postgresql }}
          path: |
            src/build/jpa-release-evidence/manifest-${{ matrix.postgresql }}.properties
            src/adapter/outbound/persistence-jpa/build/test-results/**/*.xml
          retention-days: 30
          if-no-files-found: error

  # The promotion decision. Three majors' evidence, and all three must come from this SHA — an
  # aggregate that accepted a re-run artifact from another commit would promote a release on
  # evidence produced by different code.
  jpa-release-promotion:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: jpa-release-gate
    steps:
      - name: Download every major's evidence
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # actions/download-artifact@v4.3.0
        with:
          pattern: jpa-release-evidence-pg*
          path: evidence
      - name: Require all three majors, all from this SHA
        run: |
          set -euo pipefail
          missing=0
          for major in 16 17 18; do
            manifest=$(find evidence -name "manifest-${major}.properties" -print -quit)
            if [ -z "${manifest}" ]; then
              echo "::error::no release evidence for PostgreSQL ${major}"
              missing=1
              continue
            fi
            sha=$(sed -n 's/^sha=//p' "${manifest}")
            if [ "${sha}" != "${{ github.sha }}" ]; then
              echo "::error::PostgreSQL ${major} evidence is from ${sha}, not ${{ github.sha }}"
              missing=1
            fi
          done
          if [ "${missing}" -ne 0 ]; then
            echo "::error::the release gate covers three PostgreSQL majors; promotion needs all three"
            exit 1
          fi
          echo "PostgreSQL 16, 17 and 18 evidence all present and all from ${{ github.sha }}."

  jpa-architecture-and-docs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Verify architecture boundaries and the support matrix
        working-directory: src
        run: >-
          ./gradlew
          verifyCleanArchitectureDependencies
          verifyOneTypePerFile
          :app-bootstrap:test --tests '*CleanArchitectureTest'
          :adapter:outbound:persistence-jpa:test --tests '*JpaReleaseManifestTest'
          --no-daemon
          --stacktrace