publish.yml

name: Publish
on:
  workflow_dispatch: {}
  workflow_call: {}

permissions:
  contents: read

jobs:
  build:
    strategy:
      matrix:
        os: [macOS-latest, windows-latest, ubuntu-latest]
    runs-on: ${{matrix.os}}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      - name: Checkout the repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Validate Gradle Wrapper
        uses: gradle/wrapper-validation-action@f9c9c575b8b21b6485636a91ffecd10e558c62f6 # v3.5.0
      - name: Cache gradle
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('*.gradle.kts') }}
          restore-keys: |
            ${{ runner.os }}-gradle-
      - name: Cache konan
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/.konan
          key: ${{ runner.os }}-gradle-${{ hashFiles('*.gradle.kts') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Publish Mac Artifacts
        if: matrix.os == 'macOS-latest'
        run: ./gradlew publishMac --no-daemon --stacktrace
        env:
          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
          SIGNING_KEYID: ${{ secrets.SIGNING_KEYID }}
          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
      
      - name: Publish Linux Artifacts
        if: matrix.os == 'ubuntu-latest'
        run: ./gradlew publishLinux --no-daemon --stacktrace
        env:
          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
          SIGNING_KEYID: ${{ secrets.SIGNING_KEYID }}
          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}

      - name: Publish Windows Artifacts
        if: matrix.os == 'windows-latest'
        run: ./gradlew publishWindows --no-daemon --stacktrace
        env:
          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
          SIGNING_KEYID: ${{ secrets.SIGNING_KEYID }}
          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}

env:
  GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx3g"