ci.yaml

name: Java CI with Maven

on:
  push:
    branches:
    - develop
    - main
    paths:
    - src/**
    - examples/**
    - pom.xml
    - rontolisp-maven-plugin/**
    # The wrapper's Maven version names the default lifecycle bindings the
    # plugin's offline fixture must match, so a bump needs this workflow.
    - .mvn/**
    - .github/workflows/ci.yaml
  pull_request:
    branches:
    - develop
    - main
    paths:
    - src/**
    - pom.xml
    - rontolisp-maven-plugin/**
    - .mvn/**
    - .github/workflows/ci.yaml
  # On demand, so the suite can be re-run against an unchanged tree. Timing work needs
  # that: runner speed varies by up to 1.4x between runs, which is larger than most of
  # the effects being measured, and `gh run rerun` refuses these runs.
  workflow_dispatch: {}
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v7
    - name: Install OpenBlas
      run: sudo apt-get install -y libopenblas0-pthread
    - name: Set up GraalVM 25
      uses: graalvm/setup-graalvm@v1
      with:
        java-version: '25'
        distribution: 'graalvm'
        cache: maven
    # WasmLispCompilerIntegrationTest runs wasmtime as a host process instead of in the
    # shared container (see HostWasmtime). Pin the same version the container image pins
    # so the two runners stay comparable, and fail here rather than let the class skip:
    # @EnabledIf would drop all 1010 of its tests silently, which reads as a speedup.
    - name: Install wasmtime
      uses: bytecodealliance/actions/wasmtime/setup@v1
      with:
        version: "v47.0.3"
    - name: Verify wasmtime
      run: |
        wasmtime --version
        test "$(wasmtime --version | awk '{print $2}' | cut -d. -f1)" -ge 46
    # Compiling each module -- not the Java-side codegen -- is where this job's time
    # goes: the class's summed case time is 2997 s against a cold cache and 171 s
    # against a warm one. wasmtime already parallelises that compile across every
    # core, which is why raising the JUnit thread count never moved the job: one
    # wasmtime process alone saturates a 4 vCPU runner. The corpus is stable between
    # runs, so carrying its cache is the way to stop paying for it.
    #
    # Restore the newest previous cache even when the key misses: entries are keyed
    # per module, so a commit that changed codegen still hits for every module it did
    # not change.
    #
    # Keying on the sources that decide what the modules are, rather than on the sha,
    # keeps this from hoarding: a commit that leaves them alone hits exactly and
    # uploads nothing. Do NOT try to bound the directory with wasmtime's own size
    # limit -- measured, it left the 1.5 GB unchanged and only cost hit rate (a warm
    # re-run went from 10.5 s to 46.8 s). Watch the size step below instead; the
    # budget shared with the Maven caches is 10 GB.
    - name: Cache the wasmtime compiled modules
      uses: actions/cache@v6
      with:
        path: ~/.cache/wasmtime
        key: wasmtime-modules-${{ runner.os }}-${{ hashFiles('src/main/**', 'src/test/java/am/ik/rontolisp/codegen/wasm/**') }}
        restore-keys: |
          wasmtime-modules-${{ runner.os }}-
    - name: Unit Tests
      # No parallelism flag: CoreCountParallelismStrategy derives the intra-class
      # parallelism from the runner's core count, which is the 4 this step used to
      # pass by hand, and follows the runner if that ever changes. The run prints
      # the value it picked ("[rontolisp] JUnit parallelism = ...").
      #
      # Do not tune this against a single run: runner speed varies by up to 1.4x
      # between runs, which is larger than any effect measured here so far (4 and 8
      # came out at 2186 s and 2215 s -- indistinguishable). Compare only runs whose
      # parallelism-independent classes agree, e.g. JvmLispCompilerTest, and whose
      # printed parallelism matches.
      run: ./mvnw -V --no-transfer-progress clean test
    # What the next run will have to restore, and the number to watch if this job
    # ever starts evicting the Maven caches.
    - name: Report the wasmtime cache size
      if: always()
      run: du -sh ~/.cache/wasmtime || true
  native-image:
    needs: test
    strategy:
      matrix:
        include: ${{ github.event_name == 'pull_request' && fromJSON('[{"os":"ubuntu-latest","artifact-name":"rontolisp-linux-amd64"}]') || fromJSON('[{"os":"ubuntu-latest","artifact-name":"rontolisp-linux-amd64"},{"os":"ubuntu-24.04-arm","artifact-name":"rontolisp-linux-arm64"},{"os":"macos-latest","artifact-name":"rontolisp-darwin-arm64"}]') }}
    runs-on: ${{ matrix.os }}
    steps:
    - uses: actions/checkout@v7
    - name: Set up GraalVM 25
      uses: graalvm/setup-graalvm@v1
      with:
        java-version: '25'
        distribution: 'graalvm'
        cache: maven
    - name: Build native image
      run: ./mvnw -V --no-transfer-progress -Pnative clean package -DskipTests
    - name: Install wasmtime
      uses: bytecodealliance/actions/wasmtime/setup@v1
      with:
        version: "latest"
    - name: Verify native image
      run: |
        set -e
        ./target/rontolisp -v
        # Run the ci-spec.yaml cases through the native binary in all four
        # backend modes (interpreter / JVM / WASM Preview 1 / WASM as a WASI 0.2
        # component), each of them twice: default kernels and --simd, which is a
        # different packed-array representation rather than a faster route to the
        # same one (.kb/vec.md). The driver reports the exact failing case by
        # name and leg, so there is no positional expected file to keep in sync.
        ./mvnw -V --no-transfer-progress \
          -Dtest=CiSpecE2eTest -DfailIfNoTests=false \
          -Drontolisp.binary="$PWD/target/rontolisp" \
          test
    - name: Rename binary
      if: github.event_name != 'pull_request'
      run: mv target/rontolisp target/${{ matrix.artifact-name }}
    - name: Upload artifact
      if: github.event_name != 'pull_request'
      uses: actions/upload-artifact@v7
      with:
        name: ${{ matrix.artifact-name }}
        path: target/${{ matrix.artifact-name }}
  release:
    needs: native-image
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v7
    - name: Set up GraalVM 25
      uses: graalvm/setup-graalvm@v1
      with:
        java-version: '25'
        distribution: 'graalvm'
        cache: maven
    - name: Extract version
      id: version
      run: |
        VERSION=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)
        if [[ "$VERSION" == *-SNAPSHOT ]]; then
          IS_SNAPSHOT=true
        else
          IS_SNAPSHOT=false
        fi
        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
        echo "is_snapshot=$IS_SNAPSHOT" >> "$GITHUB_OUTPUT"
    - name: Download all artifacts
      uses: actions/download-artifact@v8
      with:
        path: artifacts
    - name: Build executable JAR
      run: ./mvnw -V --no-transfer-progress -DskipTests clean package
    # Move the snapshot tag onto this commit and leave the release itself alone, so
    # the action below UPDATES it in place (it overwrites the assets) instead of the
    # release being recreated from scratch.
    #
    # Do NOT go back to `gh release delete --cleanup-tag` + create: that is a
    # non-atomic replace, and the create half failing takes the published release
    # with it. It did (run 30629526919: the delete succeeded, the create got a
    # spurious 403 that the action refuses to retry), which left the repo with no
    # release and no tag at all -- and the install commands in README.md and
    # doc/{en,ja}/getting-started/build.md point at
    # releases/download/<version>/rontolisp-*, so they 404 for as long as that
    # lasts. Updating in place makes a failed run degrade to "assets are one commit
    # stale" rather than "the download links are dead".
    - name: Move the snapshot tag to this commit
      if: steps.version.outputs.is_snapshot == 'true'
      env:
        GH_TOKEN: ${{ github.token }}
        VERSION: ${{ steps.version.outputs.version }}
      run: |
        set -e
        # Force-update the ref; if the tag does not exist yet (first run, or a
        # previous run deleted it), create it.
        gh api -X PATCH "repos/${{ github.repository }}/git/refs/tags/${VERSION}" \
          -f "sha=${{ github.sha }}" -F force=true \
        || gh api -X POST "repos/${{ github.repository }}/git/refs" \
             -f "ref=refs/tags/${VERSION}" -f "sha=${{ github.sha }}"
    - name: Create release
      uses: softprops/action-gh-release@v3
      with:
        tag_name: ${{ steps.version.outputs.version }}
        target_commitish: ${{ github.sha }}
        prerelease: ${{ steps.version.outputs.is_snapshot }}
        name: ${{ steps.version.outputs.is_snapshot == 'true' && format('{0} (snapshot)', steps.version.outputs.version) || steps.version.outputs.version }}
        files: |
          artifacts/rontolisp-linux-amd64/rontolisp-linux-amd64
          artifacts/rontolisp-linux-arm64/rontolisp-linux-arm64
          artifacts/rontolisp-darwin-arm64/rontolisp-darwin-arm64
          target/rontolisp-${{ steps.version.outputs.version }}-exec.jar
  # Every example in examples/examples.yaml, on every backend it declares. It runs
  # AFTER `release` on purpose: the suite is long and a red example must not hold the
  # binary back -- by the time this starts, the release assets are already published.
  # `release` is itself guarded on `event_name != 'pull_request'`, so this is skipped
  # on PRs, which is the accepted trade for that ordering.
  #
  # Nothing ran this suite before: the `test` job runs `clean test`, where no exec jar
  # exists so the class aborts, and `native-image` runs only CiSpecE2eTest -- which is
  # why a Clack :raw-body change left a Worker example answering 500 unnoticed.
  examples:
    needs: release
    runs-on: ubuntu-latest
    # The slowest legs compile WASM modules, and wasmtime spreads that across every
    # core -- so a 4 vCPU runner is far off the ~26 min this takes on a big machine.
    # Bound it rather than let a hang bill the 6-hour default.
    timeout-minutes: 180
    steps:
    - uses: actions/checkout@v7
    - name: Set up GraalVM 25
      uses: graalvm/setup-graalvm@v1
      with:
        java-version: '25'
        distribution: 'graalvm'
        cache: maven
    # The `wasm` RUN backend executes the compiled module; the compile-only backends do
    # not need it. Same pin as the test job, so a failure here means the example rather
    # than the runtime.
    - name: Install wasmtime
      uses: bytecodealliance/actions/wasmtime/setup@v1
      with:
        version: "v47.0.3"
    # Both caches are RESTORE + SAVE rather than one `actions/cache`, and both saves
    # run on `always()`. actions/cache only writes its cache when the job SUCCEEDS,
    # and this is the one job in the pipeline that is allowed to be red -- a single
    # broken example would otherwise mean no cache is ever written, so every run
    # re-downloads the 63 MB dist and recompiles every module. The whole point of
    # placing this job after `release` is that its failures are cheap; that only
    # holds if a failure still leaves the caches warm.
    #
    # Same reasoning as the test job's cache: the module compile, not the codegen, is
    # where the time goes, and the corpus is stable between runs.
    - name: Restore the wasmtime compiled modules
      id: wasmtime-cache
      uses: actions/cache/restore@v6
      with:
        path: ~/.cache/wasmtime
        key: wasmtime-examples-${{ runner.os }}-${{ hashFiles('src/main/**', 'examples/**') }}
        restore-keys: |
          wasmtime-examples-${{ runner.os }}-
    # 34 examples ql:quickload their systems (clack, lack, tiny-routes, ningle, ...).
    # Carrying the dist keeps the run off the network, so a red job means an example
    # broke rather than that a dist moved under it.
    - name: Restore the Quicklisp dist
      id: quicklisp-cache
      uses: actions/cache/restore@v6
      with:
        path: ~/.rontolisp/quicklisp
        key: quicklisp-${{ runner.os }}-${{ hashFiles('examples/examples.yaml') }}
        restore-keys: |
          quicklisp-${{ runner.os }}-
    # Drive the suite with the binary that was just PUBLISHED, not a fresh build: it
    # needs no native-image run here, each of the 253 legs starts in milliseconds
    # instead of paying JVM startup, and a green run is then a statement about the
    # artifact users are downloading.
    - name: Download the released binary
      uses: actions/download-artifact@v8
      with:
        name: rontolisp-linux-amd64
        path: bin
    - name: Run every example
      run: |
        set -e
        chmod +x bin/rontolisp-linux-amd64
        ./mvnw -V --no-transfer-progress \
          -Dtest=ExamplesE2eTest -DfailIfNoTests=false \
          -Drontolisp.binary="$PWD/bin/rontolisp-linux-amd64" \
          test
    # `cache-hit` is true only on an EXACT key match, so a run restored through a
    # restore-key still saves under its own key -- which is what carries a new
    # example's modules and a new dependency's sources forward.
    - name: Save the wasmtime compiled modules
      if: always() && steps.wasmtime-cache.outputs.cache-hit != 'true'
      uses: actions/cache/save@v6
      with:
        path: ~/.cache/wasmtime
        key: ${{ steps.wasmtime-cache.outputs.cache-primary-key }}
    - name: Save the Quicklisp dist
      if: always() && steps.quicklisp-cache.outputs.cache-hit != 'true'
      uses: actions/cache/save@v6
      with:
        path: ~/.rontolisp/quicklisp
        key: ${{ steps.quicklisp-cache.outputs.cache-primary-key }}
  # The Maven plugin is outside the root reactor, so `./mvnw test` never sees it. It
  # needs the core installed by coordinates, which is why this is a job of its own rather
  # than a step of `test`, and it runs the REAL-Maven E2E: the phase ordering that lets
  # src/main/java compile against the Lisp classes cannot be seen any other way.
  maven-plugin:
    needs: test
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v7
    - name: Set up JDK 25
      uses: actions/setup-java@v6
      with:
        java-version: '25'
        distribution: 'liberica'
        cache: maven
    - name: Install rontolisp
      run: ./mvnw -V --no-transfer-progress install -DskipTests
    - name: Install the plugin
      run: ./mvnw -V --no-transfer-progress -f rontolisp-maven-plugin/pom.xml install -DskipTests
    - name: Test the plugin
      run: ./mvnw -V --no-transfer-progress -f rontolisp-maven-plugin/pom.xml -Drontolisp.plugin.e2e=true test

  deploy:
    needs: test
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
    - uses: actions/checkout@v7
    - name: Import Secrets
      id: secrets
      uses: hashicorp/vault-action@v4.0.0
      with:
        exportToken: true
        method: jwt
        url: ${{ secrets.VAULT_ADDR }}
        role: cicd
        secrets: |
          kv/data/cicd/maven_central username | MAVEN_CENTRAL_USERNAME ;
          kv/data/cicd/maven_central password | MAVEN_CENTRAL_PASSWORD ;
          kv/data/cicd/gpg secring | GPG_SECRING ;
          kv/data/cicd/gpg passphrase | GPG_PASSPHRASE ;
    - name: Set up JDK 25
      uses: actions/setup-java@v6
      with:
        java-version: '25'
        distribution: 'liberica'
        cache: maven
        gpg-private-key: ${{ steps.secrets.outputs.GPG_SECRING }}
        gpg-passphrase: ${{ steps.secrets.outputs.GPG_PASSPHRASE }}
    - name: Generates Maven Settings
      uses: s4u/maven-settings-action@v4.0.0
      with:
        servers: |
          [{
              "id": "central",
              "username": "${{ steps.secrets.outputs.MAVEN_CENTRAL_USERNAME }}",
              "password": "${{ steps.secrets.outputs.MAVEN_CENTRAL_PASSWORD }}"
          }]
    - name: Deploy to Maven Central
      run: |
        set -e
        mvn -V \
            generate-sources \
            javadoc:jar \
            source:jar \
            package \
            org.apache.maven.plugins:maven-gpg-plugin:3.0.1:sign \
            deploy \
            --no-transfer-progress \
            -Dgpg.passphrase=${GPG_PASSPHRASE} \
            -DskipTests=true
    # The Maven plugin is its own reactor and depends on the core by coordinates, so it
    # goes after -- the step above ran the full lifecycle, which installed what it needs.
    - name: Deploy rontolisp-maven-plugin to Maven Central
      run: |
        set -e
        mvn -V -f rontolisp-maven-plugin/pom.xml \
            javadoc:jar \
            source:jar \
            package \
            org.apache.maven.plugins:maven-gpg-plugin:3.0.1:sign \
            deploy \
            --no-transfer-progress \
            -Dgpg.passphrase=${GPG_PASSPHRASE} \
            -DskipTests=true
    - name: Revoke token
      if: always()
      run: |
        curl -X POST -s -H "X-Vault-Token: ${VAULT_TOKEN}" ${{ secrets.VAULT_ADDR }}/v1/auth/token/revoke-self || true