build.yml

name: Build Universal Java Runtime (aarch64	, x64)

on:
  workflow_dispatch:
    inputs:
      release:
        required: true
        type: choice
        description: JDK Release
        options:
          - jdk-21.0.8+9
          - jdk-21.0.7+6
          - jdk-21.0.9+10
          - jdk-21.0.13+9
          - jdk-22.0.2+9
          - jdk-23.0.2+7
          - jdk-24.0.1+9
          - jdk-25.0.3+9
          - jdk-25.0.4.1+1
          - jdk-25.0.5+8
      arch:
        required: true
        type: string
        description: JDK Architectures
        default: '["aarch64","x64"]'
      deploy:
        required: true
        type: boolean
        description: Deploy to Maven repository
        default: true

jobs:
  download:
    name: Download JDK Release
    runs-on: macos-latest
    strategy:
      matrix:
        arch: ${{ fromJSON(inputs.arch) }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Restore Cache
        id: restore-cache
        uses: actions/cache/restore@v4
        with:
          key: |
            ${{ inputs.release }}-${{ matrix.arch }}
          path: |
            ./${{ matrix.arch }}
      - name: Download JDK
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: |
          curl -fLs "https://api.adoptium.net/v3/binary/version/${{ inputs.release }}/mac/${{ matrix.arch }}/jdk/hotspot/normal/eclipse" -o "./${{ inputs.release }}-${{ matrix.arch }}"
      - name: Extract JDK
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: |
          mkdir ./${{ matrix.arch }}
          tar -zvx -C ./${{ matrix.arch }} -f "./${{ inputs.release }}-${{ matrix.arch }}"
      - name: Download JMODs
        if: steps.restore-cache.outputs.cache-hit != 'true'
        run: |
          # Since JDK 24 the Temurin JDK no longer includes the jmods folder (JEP 493) which is required for jlink
          # with --add-modules ALL-MODULE-PATH. JMODs are published as a separate archive instead.
          if [[ -d "./${{ matrix.arch }}/${{ inputs.release }}/Contents/Home/jmods" ]] ; then
            exit 0
          fi
          curl -fLs "https://api.adoptium.net/v3/binary/version/${{ inputs.release }}/mac/${{ matrix.arch }}/jmods/hotspot/normal/eclipse" -o "./${{ inputs.release }}-${{ matrix.arch }}-jmods"
          mkdir ./${{ matrix.arch }}/jmods
          tar -zx --strip-components=1 -C ./${{ matrix.arch }}/jmods -f "./${{ inputs.release }}-${{ matrix.arch }}-jmods"
      - name: Save Cache
        uses: actions/cache/save@v4
        with:
          key: ${{ inputs.release }}-${{ matrix.arch }}
          path: |
            ./${{ matrix.arch }}

  lipo:
    permissions:
      id-token: write
      contents: read
      attestations: write
    name: Create Universal Binary
    runs-on: macos-latest
    needs: download
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Restore Cache
        uses: actions/cache/restore@v4
        with:
          key: |
            ${{ inputs.release }}-${{ fromJSON(inputs.arch)[0] }}
          path: |
            ./${{ fromJSON(inputs.arch)[0] }}
      - name: Restore Cache
        uses: actions/cache/restore@v4
        with:
          key: |
            ${{ inputs.release }}-${{ fromJSON(inputs.arch)[1] }}
          path: |
            ./${{ fromJSON(inputs.arch)[1] }}
      - name: Run script
        run: |
          UNIVERSAL_JDK=$(pwd)/${{ inputs.release }}-universal
          ARM64_JDK=$(pwd)/${{ fromJSON(inputs.arch)[0] }}/${{ inputs.release }}
          X86_64_JDK=$(pwd)/${{ fromJSON(inputs.arch)[1] }}/${{ inputs.release }}
          
          # Use jmods bundled with the JDK (before JDK 24) or downloaded separately (JDK 24 and later)
          ARM64_JMODS=${ARM64_JDK}/Contents/Home/jmods
          [[ -d ${ARM64_JMODS} ]] || ARM64_JMODS=$(dirname ${ARM64_JDK})/jmods
          X86_64_JMODS=${X86_64_JDK}/Contents/Home/jmods
          [[ -d ${X86_64_JMODS} ]] || X86_64_JMODS=$(dirname ${X86_64_JDK})/jmods

          ${ARM64_JDK}/Contents/Home/bin/jlink --module-path ${ARM64_JMODS} --add-modules ALL-MODULE-PATH --strip-debug --no-man-pages --no-header-files --compress=2 --output ${ARM64_JDK}/Contents/jre
          rm -rf ${ARM64_JDK}/Contents/Home
          mv ${ARM64_JDK}/Contents/jre ${ARM64_JDK}/Contents/Home

          ${X86_64_JDK}/Contents/Home/bin/jlink --module-path ${X86_64_JMODS} --add-modules ALL-MODULE-PATH --strip-debug --no-man-pages --no-header-files --compress=2 --output ${X86_64_JDK}/Contents/jre
          rm -rf ${X86_64_JDK}/Contents/Home
          mv ${X86_64_JDK}/Contents/jre ${X86_64_JDK}/Contents/Home
          
          # We ditto both in case there is something present in one but not both.
          ditto -vV ${ARM64_JDK} ${UNIVERSAL_JDK}
          ditto -vV ${X86_64_JDK} ${UNIVERSAL_JDK}
          
          for subdir in MacOS Home/bin Home/lib ; do
            pushd ${UNIVERSAL_JDK}/Contents/${subdir}
            find . -type f | while read file ; do
              FILE_TYPE=$(file "${file}")
              [[ ${FILE_TYPE} =~ "Mach-O" ]] || continue
              if [[ -f "${ARM64_JDK}/Contents/${subdir}/${file}" && -f "${X86_64_JDK}/Contents/${subdir}/${file}" ]] ; then
                  lipo -output ${file} -create ${ARM64_JDK}/Contents/${subdir}/${file} ${X86_64_JDK}/Contents/${subdir}/${file}
              fi
            done
            popd
          done
          
          sed -i '' 's:x86_64:x86_64+arm64:' ${UNIVERSAL_JDK}/Contents/Home/release
          ditto -c -k --keepParent --sequesterRsrc ${UNIVERSAL_JDK} ${UNIVERSAL_JDK}.zip
      - name: Archive
        uses: actions/upload-artifact@v4
        with:
          name: ${{ inputs.release }}
          path: '${{ inputs.release }}-universal.zip'
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: '${{ inputs.release }}-universal.zip'

  deploy:
    name: Deploy to Maven Repository
    if: inputs.deploy
    runs-on: ubuntu-latest
    needs: lipo
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Download universal runtime
        # The artifact is extracted on download, yielding <release>-universal.zip
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.release }}
      - name: Configure Maven settings
        run: |
          mkdir -p ~/.m2
          cat > ~/.m2/settings.xml <<EOF
          <settings>
            <servers>
              <server>
                <id>maven.cyberduck.io-release</id>
                <username>\${env.MAVEN_S3_ACCESS_KEY}</username>
                <password>\${env.MAVEN_S3_SECRET_KEY}</password>
              </server>
            </servers>
          </settings>
          EOF
      - name: Deploy
        env:
          MAVEN_S3_ACCESS_KEY: ${{ secrets.MAVEN_S3_ACCESS_KEY }}
          MAVEN_S3_SECRET_KEY: ${{ secrets.MAVEN_S3_SECRET_KEY }}
        run: |
          # jdk-25.0.5+8 -> 25.0.5
          VERSION=$(echo "${{ inputs.release }}" | sed -E 's/^jdk-//; s/\+.*$//')
          mvn --batch-mode deploy:deploy-file \
            -DgroupId=net.temurin \
            -DartifactId=jdk \
            -Dversion=${VERSION} \
            -Dpackaging=zip \
            -DrepositoryId=maven.cyberduck.io-release \
            -Durl=s3://repo.maven.cyberduck.io/releases/ \
            -Dfile=${{ inputs.release }}-universal.zip