From ad9b3218c9188ffa3c060213331953eb7ee971d5 Mon Sep 17 00:00:00 2001
From: Matthew Pope <popematt@amazon.com>
Date: Mon, 22 Apr 2024 12:27:35 -0700
Subject: [PATCH 1/3] Use CodeBuild-hosted GitHub Actions runners for perf test
 and automated publishing

---
 ...n-java-performance-regression-detector.yml | 28 ++++++++++++---
 .../workflows/publish-release-artifacts.yml   | 26 +++++---------
 build.gradle.kts                              | 34 +++++++++++++++----
 3 files changed, 60 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/ion-java-performance-regression-detector.yml b/.github/workflows/ion-java-performance-regression-detector.yml
index 41b242b974..3a82653bb2 100644
--- a/.github/workflows/ion-java-performance-regression-detector.yml
+++ b/.github/workflows/ion-java-performance-regression-detector.yml
@@ -46,10 +46,30 @@ jobs:
           name: ${{env.test_data_id}}
           path: testData
 
+  select-runner-type:
+    # If you want to use codebuild runners for your personal fork, follow the instructions to set
+    # up a codebuild project. https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html
+    # Then, create a repository variable for your fork named `CODEBUILD_PROJECT_NAME` with the name
+    # of the project you created.
+    name: Select Runner Type
+    runs-on: ubuntu-latest
+    # We want to run on external PRs, but not on internal ones as push automatically builds
+    # H/T: https://github.com/Dart-Code/Dart-Code/commit/612732d5879730608baa9622bf7f5e5b7b51ae65
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != 'amazon-ion/ion-java'
+    env:
+      use-codebuild: ${{ vars.CODEBUILD_PROJECT_NAME != '' || github.repository_owner == 'amazon-ion' }}
+      codebuild-project-name: ${{ vars.CODEBUILD_PROJECT_NAME != '' && vars.CODEBUILD_PROJECT_NAME || 'ion-java' }}
+      al2-arm: "codebuild-${{ vars.CODEBUILD_PROJECT_NAME != '' && vars.CODEBUILD_PROJECT_NAME || 'ion-java' }}-${{ github.run_id }}-${{ github.run_attempt }}-arm-3.0-large"
+    outputs:
+      runner-type: ${{ env.use-codebuild && env.al2_arm || "ubuntu-latest" }}
+    steps:
+      - name: Dump Config
+        run: echo '${{ toJSON(env) }}'
+
   detect-regression:
     name: Detect Regression
-    runs-on: ubuntu-latest
-    needs: generate-test-data
+    runs-on: ${{ needs.select-runner-type.outputs.runner-type }}
+    needs: [ generate-test-data, select-runner-type ]
     strategy:
       matrix:
         test-data: ['nestedStruct', 'nestedList', 'sexp', 'realWorldDataSchema01', 'realWorldDataSchema02', 'realWorldDataSchema03']
@@ -57,11 +77,11 @@ jobs:
       fail-fast: false
 
     steps:
-      - name: Set up JDK 11
+      - name: Set up JDK 17
         uses: actions/setup-java@v4.2.1
         with:
           distribution: 'corretto'
-          java-version: 11
+          java-version: 17
 
       - name: Checkout ion-java-benchmark-cli
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
diff --git a/.github/workflows/publish-release-artifacts.yml b/.github/workflows/publish-release-artifacts.yml
index fd4ba6816f..40171fbc2b 100644
--- a/.github/workflows/publish-release-artifacts.yml
+++ b/.github/workflows/publish-release-artifacts.yml
@@ -25,11 +25,16 @@ permissions:
   contents: read
 
 jobs:
-  check-tag:
-    # First, a sanity check to ensure that the library version matches the release version
-    runs-on: ubuntu-latest
+  publish-to-github-release:
+    # only run if `check-tag` completes successfully
+    needs: check-tag
+    runs-on: "codebuild-ion-java-${{ github.run_id }}-${{ github.run_attempt }}-arm-3.0-large"
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v3.6.0
+        with:
+          submodules: recursive
       - name: Validate project version matches tag
         shell: bash
         run: |
@@ -39,21 +44,9 @@ jobs:
           echo "Project Version: $PROJECT_VERSION"
           echo "Release Tag: $RELEASE_TAG"
           [ "$PROJECT_VERSION" = "$RELEASE_TAG" ] || exit 1
-  publish-to-github-release:
-    # only run if `check-tag` completes successfully
-    needs: check-tag
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-        # TODO: replace with artifact upload/download -- make sure there's no race condition with other builds also
-        # uploading an artifact.
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v3.6.0
-        with:
-          submodules: recursive
       - uses: gradle/gradle-build-action@8baac4c8ef753599f92eeb509c246d09d6250fa6 # v3.3.0
         with:
-          arguments: build cyclonedxBom
+          arguments: build cyclonedxBom publishToSonatype closeAndReleaseSonatypeStagingRepository
       - name: Upload Jar to GitHub release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -64,4 +57,3 @@ jobs:
         run: |
           gh release upload "v$(<project.version)" "build/libs/ion-java-$(<project.version).jar"
           gh release upload "v$(<project.version)" "build/reports/bom.json"
-  # TODO: Add `publish-to-maven-central` job
diff --git a/build.gradle.kts b/build.gradle.kts
index e909992fee..ea31b24f79 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -6,7 +6,6 @@ import org.gradle.kotlin.dsl.support.zipTo
 import org.jetbrains.kotlin.gradle.dsl.KotlinCompile
 import org.jetbrains.kotlin.gradle.dsl.KotlinJvmOptions
 import proguard.gradle.ProGuardTask
-import java.net.URI
 import java.time.Instant
 import java.util.Properties
 
@@ -23,6 +22,10 @@ plugins {
     kotlin("jvm") version "1.9.0"
     java
     `maven-publish`
+
+    // There are newer versions available, but they are not guaranteed to support Java 8.
+    id("io.github.gradle-nexus.publish-plugin") version "1.3.0"
+
     jacoco
     signing
     id("com.github.johnrengelman.shadow") version "8.1.1"
@@ -69,6 +72,7 @@ group = "com.amazon.ion"
 version = File(project.rootDir.path + "/project.version").readLines().single()
 description = "A Java implementation of the Amazon Ion data notation."
 
+val isCI: Boolean = System.getenv("CI") == "true"
 val githubRepositoryUrl = "https://github.com/amazon-ion/ion-java/"
 val isReleaseVersion: Boolean = !version.toString().endsWith("SNAPSHOT")
 val generatedResourcesDir = "$buildDir/generated/main/resources"
@@ -115,7 +119,7 @@ val sourceRepoRemoteName: String by lazy {
 
     var name = "$git remote".runCommand().lines().firstOrNull { it.isSourceRepo() }
 
-    if (System.getenv("CI") == "true") {
+    if (isCI) {
         // When running on a CI environment e.g. GitHub Actions, we might need to automatically add the remote
         if (name == null) {
             name = "ci_source_repository"
@@ -504,12 +508,20 @@ publishing {
             }
         }
     }
-    repositories.mavenCentral {
-        credentials {
-            username = properties["ossrhUsername"].toString()
-            password = properties["ossrhPassword"].toString()
+}
+
+nexusPublishing {
+    // Documentation for this plugin, see https://github.com/gradle-nexus/publish-plugin/blob/v1.3.0/README.md
+    this.repositories {
+        sonatype {
+            nexusUrl.set(uri("https://aws.oss.sonatype.org/service/local/staging/deploy/maven2/"))
+            // For CI environments, the username and password should be stored in
+            // ORG_GRADLE_PROJECT_sonatypeUsername and ORG_GRADLE_PROJECT_sonatypePassword respectively.
+            if (!isCI) {
+                username.set(properties["ossrhUsername"].toString())
+                password.set(properties["ossrhPassword"].toString())
+            }
         }
-        url = URI.create("https://aws.oss.sonatype.org/service/local/staging/deploy/maven2")
     }
 }
 
@@ -519,5 +531,13 @@ signing {
     // if signing.keyId, signing.password, signing.secretKeyRingFile, etc are
     // not present in gradle.properties.
     isRequired = isReleaseVersion
+
+    if (isCI) {
+        val signingKeyId: String? by project
+        val signingKey: String? by project
+        val signingPassword: String? by project
+        useInMemoryPgpKeys(signingKeyId, signingKey, signingPassword)
+    }
+
     sign(publishing.publications["IonJava"])
 }

From bc84ae500ded5905946be5ea9e019eb9c1dce030 Mon Sep 17 00:00:00 2001
From: Matthew Pope <popematt@amazon.com>
Date: Mon, 22 Apr 2024 12:53:03 -0700
Subject: [PATCH 2/3] Update a src file to trigger the performance workflow

---
 src/main/java/com/amazon/ion/Span.java | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)

diff --git a/src/main/java/com/amazon/ion/Span.java b/src/main/java/com/amazon/ion/Span.java
index c40bb6173e..1b1d742959 100644
--- a/src/main/java/com/amazon/ion/Span.java
+++ b/src/main/java/com/amazon/ion/Span.java
@@ -1,18 +1,5 @@
-/*
- * Copyright 2007-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License").
- * You may not use this file except in compliance with the License.
- * A copy of the License is located at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * or in the "license" file accompanying this file. This file is distributed
- * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
- * express or implied. See the License for the specific language governing
- * permissions and limitations under the License.
- */
-
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
 package com.amazon.ion;
 
 import com.amazon.ion.facet.Faceted;

From 09c34f44d7929f833b38115d888635127848c6f0 Mon Sep 17 00:00:00 2001
From: Matthew Pope <popematt@amazon.com>
Date: Mon, 22 Apr 2024 12:54:37 -0700
Subject: [PATCH 3/3] Fix incorrect string quoting in performance workflow

---
 .github/workflows/ion-java-performance-regression-detector.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ion-java-performance-regression-detector.yml b/.github/workflows/ion-java-performance-regression-detector.yml
index 3a82653bb2..37d9dccc31 100644
--- a/.github/workflows/ion-java-performance-regression-detector.yml
+++ b/.github/workflows/ion-java-performance-regression-detector.yml
@@ -61,7 +61,7 @@ jobs:
       codebuild-project-name: ${{ vars.CODEBUILD_PROJECT_NAME != '' && vars.CODEBUILD_PROJECT_NAME || 'ion-java' }}
       al2-arm: "codebuild-${{ vars.CODEBUILD_PROJECT_NAME != '' && vars.CODEBUILD_PROJECT_NAME || 'ion-java' }}-${{ github.run_id }}-${{ github.run_attempt }}-arm-3.0-large"
     outputs:
-      runner-type: ${{ env.use-codebuild && env.al2_arm || "ubuntu-latest" }}
+      runner-type: ${{ env.use-codebuild && env.al2_arm || 'ubuntu-latest' }}
     steps:
       - name: Dump Config
         run: echo '${{ toJSON(env) }}'