java-publish-snapshot.yml

name: Java Publish Snapshot to Maven Central

env:
  HUSKY: 0

on:
  schedule:
    - cron: "0 7 * * 1-5" # Mon-Fri at 07:00 UTC
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: publish-snapshot
  cancel-in-progress: false

jobs:
  resolve-source:
    name: Resolve immutable snapshot source
    runs-on: ubuntu-latest
    outputs:
      source_sha: ${{ steps.source.outputs.sha }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - id: source
        shell: bash
        run: |
          SHA=$(git rev-parse HEAD)
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"

  build-linux-arm64-classifier:
    name: Build Linux ARM64 snapshot classifier
    needs: resolve-source
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read
    outputs:
      version: ${{ steps.build.outputs.version }}
    defaults:
      run:
        shell: bash
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - name: Build and validate linux-arm64 classifier
        id: build
        run: |
          set -euo pipefail
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          node copilot-native/scripts/validate-native-host.mjs linux-arm64
          mvn -B -pl copilot-native package -DskipTests -Dcopilot.native.libc=glibc
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-linux-arm64.jar"
          PRIMARY_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION.jar"
          test -f "$JAR"
          node copilot-native/scripts/validate-native-artifact.mjs \
            classifier linux-arm64 "$JAR" "$(basename "$JAR")" ..
          node copilot-native/scripts/validate-native-artifact.mjs placeholder "$PRIMARY_JAR"
          MANIFEST="copilot-native/target/linux-arm64-$VERSION.sha256"
          HASH=$(sha256sum "$JAR" | cut -d ' ' -f 1)
          printf '%s  %s' "$HASH" "$(basename "$JAR")" > "$MANIFEST"
          node copilot-native/scripts/validate-native-artifact.mjs \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: java-native-linux-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-linux-arm64.jar
            java/copilot-native/target/linux-arm64-${{ steps.build.outputs.version }}.sha256
          if-no-files-found: error
          retention-days: 1

  build-linuxmusl-x64-classifier:
    name: Build Linux musl x64 snapshot classifier
    needs: resolve-source
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.build.outputs.version }}
    defaults:
      run:
        shell: bash
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"

      - name: Build and validate linuxmusl-x64 classifier
        id: build
        run: |
          set -euo pipefail
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          docker run --rm \
            --volume "$GITHUB_WORKSPACE:/workspace" \
            --volume "$HOME/.m2:/root/.m2" \
            --workdir /workspace/java \
            --env HOST_GID="$(id -g)" \
            --env HOST_UID="$(id -u)" \
            "eclipse-temurin:25-jdk-alpine" \
            sh -c "apk add --no-cache git java-cacerts maven nodejs npm &&
              export JAVA_TOOL_OPTIONS=-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts &&
              git config --global --add safe.directory /workspace &&
              node copilot-native/scripts/validate-native-host.mjs linuxmusl-x64 &&
              mvn -B -pl copilot-native package -DskipTests -Dcopilot.native.libc=musl &&
              chown -R \$HOST_UID:\$HOST_GID copilot-native/target"
          JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-linuxmusl-x64.jar"
          PRIMARY_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION.jar"
          test -f "$JAR"
          node copilot-native/scripts/validate-native-artifact.mjs \
            classifier linuxmusl-x64 "$JAR" "$(basename "$JAR")" ..
          node copilot-native/scripts/validate-native-artifact.mjs placeholder "$PRIMARY_JAR"
          MANIFEST="copilot-native/target/linuxmusl-x64-$VERSION.sha256"
          HASH=$(sha256sum "$JAR" | cut -d ' ' -f 1)
          printf '%s  %s' "$HASH" "$(basename "$JAR")" > "$MANIFEST"
          node copilot-native/scripts/validate-native-artifact.mjs \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: java-native-linuxmusl-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-linuxmusl-x64.jar
            java/copilot-native/target/linuxmusl-x64-${{ steps.build.outputs.version }}.sha256
          if-no-files-found: error
          retention-days: 1

  build-linuxmusl-arm64-classifier:
    name: Build Linux musl ARM64 snapshot classifier
    needs: resolve-source
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read
    outputs:
      version: ${{ steps.build.outputs.version }}
    defaults:
      run:
        shell: bash
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"

      - name: Build and validate linuxmusl-arm64 classifier
        id: build
        run: |
          set -euo pipefail
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          docker run --rm \
            --volume "$GITHUB_WORKSPACE:/workspace" \
            --volume "$HOME/.m2:/root/.m2" \
            --workdir /workspace/java \
            --env HOST_GID="$(id -g)" \
            --env HOST_UID="$(id -u)" \
            "eclipse-temurin:25-jdk-alpine" \
            sh -c "apk add --no-cache git java-cacerts maven nodejs npm &&
              export JAVA_TOOL_OPTIONS=-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts &&
              git config --global --add safe.directory /workspace &&
              node copilot-native/scripts/validate-native-host.mjs linuxmusl-arm64 &&
              mvn -B -pl copilot-native package -DskipTests -Dcopilot.native.libc=musl &&
              chown -R \$HOST_UID:\$HOST_GID copilot-native/target"
          JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-linuxmusl-arm64.jar"
          PRIMARY_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION.jar"
          test -f "$JAR"
          node copilot-native/scripts/validate-native-artifact.mjs \
            classifier linuxmusl-arm64 "$JAR" "$(basename "$JAR")" ..
          node copilot-native/scripts/validate-native-artifact.mjs placeholder "$PRIMARY_JAR"
          MANIFEST="copilot-native/target/linuxmusl-arm64-$VERSION.sha256"
          HASH=$(sha256sum "$JAR" | cut -d ' ' -f 1)
          printf '%s  %s' "$HASH" "$(basename "$JAR")" > "$MANIFEST"
          node copilot-native/scripts/validate-native-artifact.mjs \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: java-native-linuxmusl-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-linuxmusl-arm64.jar
            java/copilot-native/target/linuxmusl-arm64-${{ steps.build.outputs.version }}.sha256
          if-no-files-found: error
          retention-days: 1

  build-windows-x64-classifier:
    name: Build Windows x64 snapshot classifier
    needs: resolve-source
    runs-on: windows-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.build.outputs.version }}
    defaults:
      run:
        shell: pwsh
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - name: Build and validate win32-x64 classifier
        id: build
        run: |
          $sourceCommit = git rev-parse HEAD
          if ($sourceCommit -ne '${{ needs.resolve-source.outputs.source_sha }}') {
            throw "Checked out $sourceCommit instead of the resolved snapshot source."
          }
          node copilot-native/scripts/validate-native-host.mjs win32-x64
          mvn -B -pl copilot-native package -DskipTests
          $version = mvn help:evaluate "-Dexpression=project.version" -q "-DforceStdout"
          $jar = "copilot-native/target/copilot-sdk-java-runtime-$version-win32-x64.jar"
          $primaryJar = "copilot-native/target/copilot-sdk-java-runtime-$version.jar"
          if (-not (Test-Path -LiteralPath $jar -PathType Leaf)) {
            throw "Expected Windows classifier was not produced: $jar"
          }
          node copilot-native/scripts/validate-native-artifact.mjs classifier win32-x64 $jar ([IO.Path]::GetFileName($jar)) ..
          node copilot-native/scripts/validate-native-artifact.mjs placeholder $primaryJar
          $manifest = "copilot-native/target/win32-x64-$version.sha256"
          $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $jar).Hash.ToLowerInvariant()
          "$hash  $([IO.Path]::GetFileName($jar))" | Set-Content -NoNewline -Encoding ascii $manifest
          node copilot-native/scripts/validate-native-artifact.mjs checksum $jar $manifest ([IO.Path]::GetFileName($jar))
          "version=$version" | Add-Content $env:GITHUB_OUTPUT

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: java-native-win32-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-win32-x64.jar
            java/copilot-native/target/win32-x64-${{ steps.build.outputs.version }}.sha256
          if-no-files-found: error
          retention-days: 1

  build-windows-arm64-classifier:
    name: Build Windows ARM64 snapshot classifier
    needs: resolve-source
    runs-on: windows-11-arm
    permissions:
      contents: read
    outputs:
      version: ${{ steps.build.outputs.version }}
    defaults:
      run:
        shell: pwsh
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - name: Build and validate win32-arm64 classifier
        id: build
        run: |
          $sourceCommit = git rev-parse HEAD
          if ($sourceCommit -ne '${{ needs.resolve-source.outputs.source_sha }}') {
            throw "Checked out $sourceCommit instead of the resolved snapshot source."
          }
          node copilot-native/scripts/validate-native-host.mjs win32-arm64
          mvn -B -pl copilot-native package -DskipTests
          $version = mvn help:evaluate "-Dexpression=project.version" -q "-DforceStdout"
          $jar = "copilot-native/target/copilot-sdk-java-runtime-$version-win32-arm64.jar"
          $primaryJar = "copilot-native/target/copilot-sdk-java-runtime-$version.jar"
          if (-not (Test-Path -LiteralPath $jar -PathType Leaf)) {
            throw "Expected Windows ARM64 classifier was not produced: $jar"
          }
          node copilot-native/scripts/validate-native-artifact.mjs classifier win32-arm64 $jar ([IO.Path]::GetFileName($jar)) ..
          node copilot-native/scripts/validate-native-artifact.mjs placeholder $primaryJar
          $manifest = "copilot-native/target/win32-arm64-$version.sha256"
          $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $jar).Hash.ToLowerInvariant()
          "$hash  $([IO.Path]::GetFileName($jar))" | Set-Content -NoNewline -Encoding ascii $manifest
          node copilot-native/scripts/validate-native-artifact.mjs checksum $jar $manifest ([IO.Path]::GetFileName($jar))
          "version=$version" | Add-Content $env:GITHUB_OUTPUT

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: java-native-win32-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-win32-arm64.jar
            java/copilot-native/target/win32-arm64-${{ steps.build.outputs.version }}.sha256
          if-no-files-found: error
          retention-days: 1

  build-darwin-classifier:
    name: Build Darwin snapshot classifier
    needs: resolve-source
    runs-on: macos-26-agent-runtime
    permissions:
      contents: read
    outputs:
      version: ${{ steps.build.outputs.version }}
    defaults:
      run:
        shell: bash
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - name: Build and validate darwin-arm64 classifier
        id: build
        run: |
          set -euo pipefail
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          node copilot-native/scripts/validate-native-host.mjs darwin-arm64
          mvn -B -pl copilot-native package -DskipTests
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-darwin-arm64.jar"
          PRIMARY_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION.jar"
          test -f "$JAR"
          node copilot-native/scripts/validate-native-artifact.mjs \
            classifier darwin-arm64 "$JAR" "$(basename "$JAR")" ..
          node copilot-native/scripts/validate-native-artifact.mjs placeholder "$PRIMARY_JAR"
          MANIFEST="copilot-native/target/darwin-arm64-$VERSION.sha256"
          HASH=$(shasum -a 256 "$JAR" | cut -d ' ' -f 1)
          printf '%s  %s' "$HASH" "$(basename "$JAR")" > "$MANIFEST"
          node copilot-native/scripts/validate-native-artifact.mjs \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: java-native-darwin-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-darwin-arm64.jar
            java/copilot-native/target/darwin-arm64-${{ steps.build.outputs.version }}.sha256
          if-no-files-found: error
          retention-days: 1

  build-darwin-x64-classifier:
    name: Build Darwin x64 snapshot classifier
    needs: resolve-source
    runs-on: macos-15-intel
    permissions:
      contents: read
    outputs:
      version: ${{ steps.build.outputs.version }}
    defaults:
      run:
        shell: bash
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - name: Build and validate darwin-x64 classifier
        id: build
        run: |
          set -euo pipefail
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          node copilot-native/scripts/validate-native-host.mjs darwin-x64
          mvn -B -pl copilot-native package -DskipTests
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-darwin-x64.jar"
          PRIMARY_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION.jar"
          test -f "$JAR"
          node copilot-native/scripts/validate-native-artifact.mjs \
            classifier darwin-x64 "$JAR" "$(basename "$JAR")" ..
          node copilot-native/scripts/validate-native-artifact.mjs placeholder "$PRIMARY_JAR"
          MANIFEST="copilot-native/target/darwin-x64-$VERSION.sha256"
          HASH=$(shasum -a 256 "$JAR" | cut -d ' ' -f 1)
          printf '%s  %s' "$HASH" "$(basename "$JAR")" > "$MANIFEST"
          node copilot-native/scripts/validate-native-artifact.mjs \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: java-native-darwin-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            java/copilot-native/target/copilot-sdk-java-runtime-${{ steps.build.outputs.version }}-darwin-x64.jar
            java/copilot-native/target/darwin-x64-${{ steps.build.outputs.version }}.sha256
          if-no-files-found: error
          retention-days: 1

  deploy-snapshot:
    name: Publish SNAPSHOT to Maven Central
    needs:
      [
        resolve-source,
        build-linux-arm64-classifier,
        build-linuxmusl-x64-classifier,
        build-linuxmusl-arm64-classifier,
        build-windows-x64-classifier,
        build-windows-arm64-classifier,
        build-darwin-classifier,
        build-darwin-x64-classifier,
      ]
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ./java
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "25"
          distribution: "microsoft"
          cache: "maven"
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
      - name: Set up policy-capable npm
        run: node ../scripts/setup-npm.mjs

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: java-native-linux-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/java-native-linux-arm64

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: java-native-linuxmusl-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/java-native-linuxmusl-x64

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: java-native-linuxmusl-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/java-native-linuxmusl-arm64

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: java-native-win32-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/java-native-win32-x64

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: java-native-win32-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/java-native-win32-arm64

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: java-native-darwin-arm64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/java-native-darwin-arm64

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: java-native-darwin-x64-snapshot-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/java-native-darwin-x64

      - name: Verify version, source, and Linux ARM64 classifier
        id: linux-arm64-artifact
        run: |
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
          if [[ "$VERSION" != *"-SNAPSHOT" ]]; then
            echo "::error::This workflow only publishes SNAPSHOT versions. Current version: $VERSION"
            exit 1
          fi
          if [ "$VERSION" != "${{ needs.build-linux-arm64-classifier.outputs.version }}" ]; then
            echo "::error::Linux ARM64 classifier version does not match deploy version."
            exit 1
          fi
          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-linux-arm64"
          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-linux-arm64.jar"
          MANIFEST="$ARTIFACT_DIRECTORY/linux-arm64-$VERSION.sha256"
          test -f "$JAR"
          test -f "$MANIFEST"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            classifier linux-arm64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
          echo "linux_arm64_jar=$JAR" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "linux_arm64_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"

      - name: Verify version, source, and Windows classifier
        id: windows-artifact
        run: |
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION="${{ steps.linux-arm64-artifact.outputs.version }}"
          if [ "$VERSION" != "${{ needs.build-windows-x64-classifier.outputs.version }}" ]; then
            echo "::error::Windows classifier version does not match deploy version."
            exit 1
          fi
          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-win32-x64"
          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-win32-x64.jar"
          MANIFEST="$ARTIFACT_DIRECTORY/win32-x64-$VERSION.sha256"
          test -f "$JAR"
          test -f "$MANIFEST"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            classifier win32-x64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
          echo "windows_jar=$JAR" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "windows_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"

      - name: Verify version, source, and Linux musl x64 classifier
        id: linuxmusl-x64-artifact
        run: |
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION="${{ steps.linux-arm64-artifact.outputs.version }}"
          if [ "$VERSION" != "${{ needs.build-linuxmusl-x64-classifier.outputs.version }}" ]; then
            echo "::error::Linux musl x64 classifier version does not match deploy version."
            exit 1
          fi
          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-linuxmusl-x64"
          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-linuxmusl-x64.jar"
          MANIFEST="$ARTIFACT_DIRECTORY/linuxmusl-x64-$VERSION.sha256"
          test -f "$JAR"
          test -f "$MANIFEST"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            classifier linuxmusl-x64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
          echo "linuxmusl_x64_jar=$JAR" >> "$GITHUB_OUTPUT"
          echo "linuxmusl_x64_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"

      - name: Verify version, source, and Linux musl ARM64 classifier
        id: linuxmusl-arm64-artifact
        run: |
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION="${{ steps.linux-arm64-artifact.outputs.version }}"
          if [ "$VERSION" != "${{ needs.build-linuxmusl-arm64-classifier.outputs.version }}" ]; then
            echo "::error::Linux musl ARM64 classifier version does not match deploy version."
            exit 1
          fi
          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-linuxmusl-arm64"
          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-linuxmusl-arm64.jar"
          MANIFEST="$ARTIFACT_DIRECTORY/linuxmusl-arm64-$VERSION.sha256"
          test -f "$JAR"
          test -f "$MANIFEST"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            classifier linuxmusl-arm64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
          echo "linuxmusl_arm64_jar=$JAR" >> "$GITHUB_OUTPUT"
          echo "linuxmusl_arm64_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"

      - name: Verify version, source, and Darwin classifier
        id: darwin-artifact
        run: |
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION="${{ steps.windows-artifact.outputs.version }}"
          if [ "$VERSION" != "${{ needs.build-darwin-classifier.outputs.version }}" ]; then
            echo "::error::Darwin classifier version does not match deploy version."
            exit 1
          fi
          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-darwin-arm64"
          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-darwin-arm64.jar"
          MANIFEST="$ARTIFACT_DIRECTORY/darwin-arm64-$VERSION.sha256"
          test -f "$JAR"
          test -f "$MANIFEST"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            classifier darwin-arm64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
          echo "darwin_jar=$JAR" >> "$GITHUB_OUTPUT"
          echo "darwin_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"

      - name: Verify version, source, and Windows ARM64 classifier
        id: windows-arm64-artifact
        run: |
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION="${{ steps.windows-artifact.outputs.version }}"
          if [ "$VERSION" != "${{ needs.build-windows-arm64-classifier.outputs.version }}" ]; then
            echo "::error::Windows ARM64 classifier version does not match deploy version."
            exit 1
          fi
          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-win32-arm64"
          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-win32-arm64.jar"
          MANIFEST="$ARTIFACT_DIRECTORY/win32-arm64-$VERSION.sha256"
          test -f "$JAR"
          test -f "$MANIFEST"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            classifier win32-arm64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
          echo "windows_arm64_jar=$JAR" >> "$GITHUB_OUTPUT"
          echo "windows_arm64_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"

      - name: Verify version, source, and Darwin x64 classifier
        id: darwin-x64-artifact
        run: |
          SOURCE_COMMIT=$(git rev-parse HEAD)
          if [ "$SOURCE_COMMIT" != "${{ needs.resolve-source.outputs.source_sha }}" ]; then
            echo "::error::Checked out $SOURCE_COMMIT instead of the resolved snapshot source."
            exit 1
          fi
          VERSION="${{ steps.windows-artifact.outputs.version }}"
          if [ "$VERSION" != "${{ needs.build-darwin-x64-classifier.outputs.version }}" ]; then
            echo "::error::Darwin x64 classifier version does not match deploy version."
            exit 1
          fi
          ARTIFACT_DIRECTORY="${{ runner.temp }}/java-native-darwin-x64"
          JAR="$ARTIFACT_DIRECTORY/copilot-sdk-java-runtime-$VERSION-darwin-x64.jar"
          MANIFEST="$ARTIFACT_DIRECTORY/darwin-x64-$VERSION.sha256"
          test -f "$JAR"
          test -f "$MANIFEST"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            checksum "$JAR" "$MANIFEST" "$(basename "$JAR")"
          node "$GITHUB_WORKSPACE/java/copilot-native/scripts/validate-native-artifact.mjs" \
            classifier darwin-x64 "$JAR" "$(basename "$JAR")" "$GITHUB_WORKSPACE"
          echo "darwin_x64_jar=$JAR" >> "$GITHUB_OUTPUT"
          echo "darwin_x64_sha=$(cut -d ' ' -f 1 "$MANIFEST")" >> "$GITHUB_OUTPUT"

      - name: Build Linux classifier and deploy complete snapshot
        run: |
          VERSION="${{ steps.windows-artifact.outputs.version }}"
          mvn -B deploy -DskipTests -DskipITs -Pskip-test-harness -Dcopilot.native.libc=glibc \
            "-Dcopilot.native.external.linux.arm64.classifier.path=${{ steps.linux-arm64-artifact.outputs.linux_arm64_jar }}" \
            "-Dcopilot.native.external.linuxmusl.x64.classifier.path=${{ steps.linuxmusl-x64-artifact.outputs.linuxmusl_x64_jar }}" \
            "-Dcopilot.native.external.linuxmusl.arm64.classifier.path=${{ steps.linuxmusl-arm64-artifact.outputs.linuxmusl_arm64_jar }}" \
            "-Dcopilot.native.external.win32.classifier.path=${{ steps.windows-artifact.outputs.windows_jar }}" \
            "-Dcopilot.native.external.win32.arm64.classifier.path=${{ steps.windows-arm64-artifact.outputs.windows_arm64_jar }}" \
            "-Dcopilot.native.external.darwin.classifier.path=${{ steps.darwin-artifact.outputs.darwin_jar }}" \
            "-Dcopilot.native.external.darwin.x64.classifier.path=${{ steps.darwin-x64-artifact.outputs.darwin_x64_jar }}"
          LINUX_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-linux-x64.jar"
          test -f "$LINUX_JAR"
          node copilot-native/scripts/validate-native-artifact.mjs \
            classifier linux-x64 "$LINUX_JAR" "$(basename "$LINUX_JAR")" ..
          LINUX_SHA=$(sha256sum "$LINUX_JAR" | cut -d ' ' -f 1)
          GROUP_ID=$(mvn -q -pl copilot-native help:evaluate -Dexpression=project.groupId -DforceStdout)
          ARTIFACT_ID=$(mvn -q -pl copilot-native help:evaluate -Dexpression=project.artifactId -DforceStdout)
          POM_VERSION=$(mvn -q -pl copilot-native help:evaluate -Dexpression=project.version -DforceStdout)
          if [ -z "$GROUP_ID" ] || [ -z "$ARTIFACT_ID" ] || [ "$POM_VERSION" != "$VERSION" ]; then
            echo "::error::Unexpected copilot-native Maven coordinates: $GROUP_ID:$ARTIFACT_ID:$POM_VERSION (expected version $VERSION)"
            exit 1
          fi
          {
            echo "### Snapshot Publish"
            echo "- **Version:** $VERSION"
            echo "- **Source commit:** \`${{ needs.resolve-source.outputs.source_sha }}\`"
            echo "- **Repository:** Maven Central Snapshots"
            echo ""
            echo "#### Maven Coordinates"
            echo ""
            echo '```xml'
            echo "<dependency>"
            echo "    <groupId>$GROUP_ID</groupId>"
            echo "    <artifactId>$ARTIFACT_ID</artifactId>"
            echo "    <version>$POM_VERSION</version>"
            echo "</dependency>"
            echo '```'
            echo ""
            echo "#### Published Native Classifiers"
            echo ""
            echo "| Classifier | Build runner | Artifact | SHA-256 | Status |"
            echo "| --- | --- | --- | --- | --- |"
            echo "| \`linux-x64\` | \`ubuntu-latest\` | \`$(basename "$LINUX_JAR")\` | \`$LINUX_SHA\` | Published |"
            echo "| \`linux-arm64\` | \`ubuntu-24.04-arm\` | \`$(basename "${{ steps.linux-arm64-artifact.outputs.linux_arm64_jar }}")\` | \`${{ steps.linux-arm64-artifact.outputs.linux_arm64_sha }}\` | Published |"
            echo "| \`linuxmusl-x64\` | \`Alpine x64\` | \`$(basename "${{ steps.linuxmusl-x64-artifact.outputs.linuxmusl_x64_jar }}")\` | \`${{ steps.linuxmusl-x64-artifact.outputs.linuxmusl_x64_sha }}\` | Published |"
            echo "| \`linuxmusl-arm64\` | \`Alpine ARM64\` | \`$(basename "${{ steps.linuxmusl-arm64-artifact.outputs.linuxmusl_arm64_jar }}")\` | \`${{ steps.linuxmusl-arm64-artifact.outputs.linuxmusl_arm64_sha }}\` | Published |"
            echo "| \`win32-x64\` | \`windows-latest\` | \`$(basename "${{ steps.windows-artifact.outputs.windows_jar }}")\` | \`${{ steps.windows-artifact.outputs.windows_sha }}\` | Published |"
            echo "| \`win32-arm64\` | \`windows-11-arm\` | \`$(basename "${{ steps.windows-arm64-artifact.outputs.windows_arm64_jar }}")\` | \`${{ steps.windows-arm64-artifact.outputs.windows_arm64_sha }}\` | Published |"
            echo "| \`darwin-x64\` | \`macos-15-intel\` | \`$(basename "${{ steps.darwin-x64-artifact.outputs.darwin_x64_jar }}")\` | \`${{ steps.darwin-x64-artifact.outputs.darwin_x64_sha }}\` | Published |"
            echo "| \`darwin-arm64\` | \`macos-26\` | \`$(basename "${{ steps.darwin-artifact.outputs.darwin_jar }}")\` | \`${{ steps.darwin-artifact.outputs.darwin_sha }}\` | Published |"
          } >> "$GITHUB_STEP_SUMMARY"
        env:
          MAVEN_USERNAME: ${{ secrets.JAVA_MAVEN_CENTRAL_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.JAVA_MAVEN_CENTRAL_PASSWORD }}