release-validated.yml

name: Validated Release
run-name: "${{ inputs.dry_run && 'Dry-run for ' || 'Perform ' }}${{ inputs.release_type }} release of ${{ github.ref_name }} branch [${{ inputs.request_id || 'manual' }}]"

on:
  workflow_dispatch:
    inputs:
      release_type:
        type: choice
        description: The release type
        options:
          - "major"
          - "minor"
          - "patch"
          - "retag"
        default: "minor"
      dry_run:
        description: Perform the release dry-run
        required: true
        type: boolean
        default: true
      skip_tests:
        description: Skip pre-release tests (emergency releases only)
        required: false
        type: boolean
        default: false
      request_id:
        description: Unique correlation ID supplied by utils/release.sh
        required: false
        type: string
        default: ""
      source_sha:
        description: Exact source SHA expected by utils/release.sh
        required: false
        type: string
        default: ""

permissions:
  contents: write
  actions: read

jobs:
  validate-inputs:
    runs-on: ubuntu-latest
    outputs:
      release_version: ${{ steps.compute-version.outputs.release_version }}
      release_branch: ${{ steps.compute-version.outputs.release_branch }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.sha }}

      - name: Validate branch and compute versions
        id: compute-version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          BRANCH="${GITHUB_REF_NAME}"
          TYPE="${{ inputs.release_type }}"
          EXPECTED_SOURCE_SHA="${{ inputs.source_sha }}"

          echo "Current branch: $BRANCH"
          echo "Release type: $TYPE"

          if [ -n "$EXPECTED_SOURCE_SHA" ] && [ "$GITHUB_SHA" != "$EXPECTED_SOURCE_SHA" ]; then
            echo "::error::Dispatched SHA $GITHUB_SHA differs from requested SHA $EXPECTED_SOURCE_SHA"
            exit 1
          fi

          # Branch validation
          if [ "$TYPE" == "patch" ] || [ "$TYPE" == "retag" ]; then
            if [[ ! $BRANCH =~ ^release/[0-9]+\.[0-9]+\._$ ]]; then
              echo "::error::${TYPE^} can only be performed from 'release/*' branches (format: release/X.Y._)"
              exit 1
            fi
          else
            if [ "$BRANCH" != "main" ]; then
              echo "::error::Major or minor releases can only be performed from 'main' branch"
              exit 1
            fi
          fi

          # Compute release version from git tags
          if [ "$TYPE" == "retag" ]; then
            # For retag, find the most recent tag on this branch (the one to re-point)
            RELEASE_VERSION=$(git tag --merged HEAD --list 'v_*' | sed 's/^v_//' | sort -V | tail -1)
            if [ -z "$RELEASE_VERSION" ]; then
              echo "::error::No version tags found on this branch."
              exit 1
            fi
            if ! git rev-parse "v_${RELEASE_VERSION}" >/dev/null 2>&1; then
              echo "::error::Tag v_${RELEASE_VERSION} does not exist. Use a normal release to create a new tag."
              exit 1
            fi
            IS_DRAFT=$(gh release view "v_${RELEASE_VERSION}" --json isDraft --jq '.isDraft' 2>/dev/null || echo "not-found")
            if [ "$IS_DRAFT" == "false" ]; then
              echo "::error::GitHub release v_${RELEASE_VERSION} is already public. Retagging is not allowed."
              exit 1
            fi
          elif [ "$TYPE" == "major" ]; then
            RELEASE_VERSION=$(utils/compute-version.sh --release --major)
          elif [ "$TYPE" == "minor" ]; then
            RELEASE_VERSION=$(utils/compute-version.sh --release --minor)
          elif [ "$TYPE" == "patch" ]; then
            RELEASE_VERSION=$(utils/compute-version.sh --release --patch)
          else
            echo "::error::Invalid release type: $TYPE"
            exit 1
          fi

          RELEASE_BRANCH="release/${RELEASE_VERSION%.*}._"

          # Check if tag already exists (skip for retag, which requires it to exist)
          if [ "$TYPE" != "retag" ] && git rev-parse "v_${RELEASE_VERSION}" >/dev/null 2>&1; then
            echo "::error::Tag v_${RELEASE_VERSION} already exists"
            exit 1
          fi

          echo "Release version: $RELEASE_VERSION"
          echo "Release branch: $RELEASE_BRANCH"

          # Set outputs
          echo "release_version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
          echo "release_branch=$RELEASE_BRANCH" >> $GITHUB_OUTPUT

          # Output summary
          echo "## Release Validation" >> $GITHUB_STEP_SUMMARY
          echo "- **Release Type**: $TYPE" >> $GITHUB_STEP_SUMMARY
          echo "- **Branch**: $BRANCH" >> $GITHUB_STEP_SUMMARY
          echo "- **Release Version**: $RELEASE_VERSION" >> $GITHUB_STEP_SUMMARY
          echo "- **Release Branch**: $RELEASE_BRANCH" >> $GITHUB_STEP_SUMMARY
          echo "- **Tag**: v_$RELEASE_VERSION" >> $GITHUB_STEP_SUMMARY
          echo "- **Dry Run**: ${{ inputs.dry_run }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Skip Tests**: ${{ inputs.skip_tests }}" >> $GITHUB_STEP_SUMMARY

  pre-release-tests:
    needs: validate-inputs
    if: ${{ inputs.dry_run != true && inputs.skip_tests != true && inputs.release_type != 'retag' }}
    uses: ./.github/workflows/test_workflow.yml
    with:
      configuration: '["debug", "asan"]'

  pre-release-slow-tests:
    needs: validate-inputs
    if: ${{ inputs.dry_run != true && inputs.skip_tests != true && inputs.release_type != 'retag' }}
    uses: ./.github/workflows/test_workflow.yml
    with:
      configuration: '["debug", "asan"]'
      slow_tests: true

  create-release:
    needs: [validate-inputs, pre-release-tests, pre-release-slow-tests]
    if: always() && needs.validate-inputs.result == 'success' && (needs.pre-release-tests.result == 'success' || needs.pre-release-tests.result == 'skipped') && (needs.pre-release-slow-tests.result == 'success' || needs.pre-release-slow-tests.result == 'skipped')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      base_branch: ${{ steps.create-release.outputs.base_branch }}
      source_sha: ${{ steps.create-release.outputs.source_sha }}
      release_version: ${{ steps.create-release.outputs.release_version }}
      release_branch: ${{ steps.create-release.outputs.release_branch }}
    steps:
      - name: Check test results
        if: ${{ inputs.dry_run != true && inputs.skip_tests != true && inputs.release_type != 'retag' && (needs.pre-release-tests.result != 'success' || needs.pre-release-slow-tests.result != 'success') }}
        run: |
          echo "::error::Pre-release tests failed. Cannot proceed with release."
          exit 1

      - name: Setup SSH agent
        run: |
          eval $(ssh-agent -s)
          echo "${{ secrets.SSH_PUSH_SECRET }}" | ssh-add -
          mkdir -p ~/.ssh
          ssh-keyscan github.com >> ~/.ssh/known_hosts
          echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> $GITHUB_ENV
          echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> $GITHUB_ENV

      - name: Checkout repository
        run: git clone git@github.com:$GITHUB_REPOSITORY.git java-profiler

      - name: Configure git
        run: |
          cd java-profiler
          git config --global user.email "java-profiler@datadoghq.com"
          git config --global user.name "Datadog Java Profiler"
          git checkout -B "$GITHUB_REF_NAME" "$GITHUB_SHA"

      - name: Create release
        id: create-release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cd java-profiler

          if [ "${{ inputs.dry_run }}" == "true" ]; then
            DRY_RUN="--dry-run"
          else
            DRY_RUN=""
          fi

          TYPE="${{ inputs.release_type }}"
          ./.github/scripts/release.sh ${TYPE^^} $DRY_RUN

      - name: Output Release Summary
        if: ${{ inputs.dry_run != true }}
        run: |
          echo "## ✅ Release Created Successfully" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Release Details" >> $GITHUB_STEP_SUMMARY
          echo "- **Tag**: v_${{ needs.validate-inputs.outputs.release_version }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Branch**: ${{ needs.validate-inputs.outputs.release_branch }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Next Steps (Automatic)" >> $GITHUB_STEP_SUMMARY
          echo "1. 🔨 GitLab pipeline will build multi-platform artifacts" >> $GITHUB_STEP_SUMMARY
          echo "2. 📦 GitLab will publish to Maven Central" >> $GITHUB_STEP_SUMMARY
          echo "3. 🚀 GitHub workflows will create release when Maven artifacts are available" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Monitoring" >> $GITHUB_STEP_SUMMARY
          echo "- GitHub Releases: ${{ github.server_url }}/${{ github.repository }}/releases" >> $GITHUB_STEP_SUMMARY
          echo "- Maven Central: https://repo1.maven.org/maven2/com/datadoghq/ddprof/${{ needs.validate-inputs.outputs.release_version }}/" >> $GITHUB_STEP_SUMMARY

      - name: Output Dry-Run Summary
        if: ${{ inputs.dry_run == true }}
        run: |
          echo "## 🔍 Dry-Run Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "This was a dry-run. No changes were made." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Would have created:" >> $GITHUB_STEP_SUMMARY
          echo "- **Tag**: v_${{ needs.validate-inputs.outputs.release_version }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Branch**: ${{ needs.validate-inputs.outputs.release_branch }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "To perform the actual release, run this workflow again with **dry_run = false**" >> $GITHUB_STEP_SUMMARY