update workflow

.github/scripts/validate-release-artifacts.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob
+
+artifact_dir="${1:-output}"
+
+if [[ ! -d "$artifact_dir" ]]; then
+    echo "Artifact directory does not exist: $artifact_dir" >&2
+    exit 1
+fi
+
+declare -a expected=(
+    "ALL:jar"
+    "API:jar"
+    "Core:jar"
+    "DEV:jar"
+    "DefenseTech:jar"
+    "Generators:jar"
+    "MDK:zip"
+    "Tools:jar"
+    "Ultimate:jar"
+)
+
+listing="$(mktemp)"
+trap 'rm -f -- "$listing"' EXIT
+
+require_exact_entry() {
+    local entry="$1"
+    local artifact="$2"
+    if ! grep -Fqx "$entry" "$listing"; then
+        echo "Required entry '$entry' is missing from $artifact" >&2
+        exit 1
+    fi
+}
+
+require_matching_entry() {
+    local pattern="$1"
+    local description="$2"
+    local artifact="$3"
+    if ! grep -Eq "$pattern" "$listing"; then
+        echo "Required $description is missing from $artifact" >&2
+        exit 1
+    fi
+}
+
+for spec in "${expected[@]}"; do
+    classifier="${spec%%:*}"
+    extension="${spec##*:}"
+    matches=("$artifact_dir"/Mekanism-Community-Edition-*-"$classifier"."$extension")
+
+    if (( ${#matches[@]} != 1 )); then
+        echo "Expected exactly one $classifier artifact, found ${#matches[@]}." >&2
+        printf '  %s\n' "${matches[@]:-<none>}" >&2
+        exit 1
+    fi
+
+    artifact="${matches[0]}"
+    if (( $(wc -c < "$artifact") < 512 )); then
+        echo "Artifact is unexpectedly small: $artifact" >&2
+        exit 1
+    fi
+
+    jar tf "$artifact" | tr -d '\r' > "$listing"
+    if [[ ! -s "$listing" ]]; then
+        echo "Artifact is empty or unreadable: $artifact" >&2
+        exit 1
+    fi
+
+    case "$classifier" in
+        ALL|Core)
+            require_exact_entry 'mekanism/common/Mekanism.class' "$artifact"
+            ;;
+        API)
+            require_matching_entry '^mekanism/api/.*\.class$' 'compiled Mekanism API class' "$artifact"
+            ;;
+        DEV)
+            require_exact_entry 'mekanism/common/Mekanism.class' "$artifact"
+            require_exact_entry 'mekanism/common/Mekanism.java' "$artifact"
+            ;;
+        DefenseTech)
+            require_exact_entry 'defense/common/DefenseTech.class' "$artifact"
+            ;;
+        Generators)
+            require_exact_entry 'mekanism/generators/common/MekanismGenerators.class' "$artifact"
+            ;;
+        MDK)
+            require_matching_entry '^mekanism/api/.*\.java$' 'Mekanism API source' "$artifact"
+            ;;
+        Tools)
+            require_exact_entry 'mekanism/tools/common/MekanismTools.class' "$artifact"
+            ;;
+        Ultimate)
+            require_exact_entry 'mcmod.info' "$artifact"
+            if ! grep -q '\.class$' "$listing"; then
+                echo "::warning file=$artifact::Ultimate currently contains metadata only and will be published as beta."
+            fi
+            ;;
+    esac
+
+    echo "Validated $artifact"
+done

.github/workflows/gradle.yml

@@ -1,35 +1,131 @@
-# This workflow will build a Java project with Gradle
-# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle
-
-name: fullBuild
+name: Build and publish development artifacts
 
 on:
   push:
+    branches:
+      - '**'
     paths-ignore:
-    - '**/README.md'
-    - '**/Mekanism.txt'
+      - '**/README.md'
+      - '**/Mekanism.txt'
+  pull_request:
+    paths-ignore:
+      - '**/README.md'
+      - '**/Mekanism.txt'
+  # Trusted PRs run from the base branch's workflow so Maven credentials are
+  # available even when a team member opens the PR from a fork. The job-level
+  # trust check prevents unknown PRs from running under this event.
+  pull_request_target:
+    paths-ignore:
+      - '**/README.md'
+      - '**/Mekanism.txt'
   schedule:
     - cron: '0 12 1 * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ contains(fromJSON('["pull_request","pull_request_target"]'), github.event_name) }}
 
 jobs:
   build:
-
-    runs-on: ubuntu-latest
+    if: >-
+      ${{ (github.event_name == 'pull_request' &&
+      !contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)) ||
+      (github.event_name == 'pull_request_target' &&
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)) ||
+      !contains(fromJSON('["pull_request","pull_request_target"]'), github.event_name) }}
+    name: >-
+      Build (${{ github.event_name == 'pull_request' && 'GitHub-hosted' || 'self-hosted' }})
+    # Pull requests from repository owners, organization members, and explicit
+    # collaborators are trusted on our runner. All other PR code is isolated on
+    # a fresh GitHub-hosted runner. Pushes, schedules, and manual runs are
+    # maintainer-controlled and use the self-hosted runner.
+    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'self-hosted' }}
+    timeout-minutes: 90
 
     steps:
-      - uses: actions/checkout@v2
-      - name: Set up JDK 8
-        uses: actions/setup-java@v2
+      - name: Check out repository
+        uses: actions/checkout@v7
         with:
+          clean: true
+          fetch-depth: 0
+          persist-credentials: false
+          repository: >-
+            ${{ github.event_name == 'pull_request_target' &&
+            github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: >-
+            ${{ github.event_name == 'pull_request_target' &&
+            github.event.pull_request.head.sha || '' }}
+
+      - name: Set up JDK 8
+        uses: actions/setup-java@v6
+        with:
+          distribution: temurin
           java-version: '8'
-          distribution: 'adopt'
-      - name: Grant execute permission for gradlew
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          validate-wrappers: true
+
+      - name: Grant execute permission for Gradle
         run: chmod +x gradlew
-      - name: Build and Publish
-        run: ./gradlew fullbuild artifactoryPublish
+
+      - name: Remove stale packaged artifacts
+        shell: bash
+        run: |
+          mkdir -p output
+          find output -maxdepth 1 -type f \( -name '*.jar' -o -name '*.zip' \) -delete
+
+      - name: Build external pull request
+        if: github.event_name == 'pull_request'
+        run: ./gradlew --no-daemon --stacktrace clean fullBuild
+
+      - name: Build trusted team pull request
+        if: github.event_name == 'pull_request_target'
+        run: ./gradlew --no-daemon --stacktrace clean fullBuild
         env:
+          BUILD_VER: ${{ format('pr-{0}-{1}', github.event.pull_request.number, github.run_number) }}
+
+      - name: Build development version
+        if: >-
+          ${{ !contains(fromJSON('["pull_request","pull_request_target"]'), github.event_name) }}
+        run: ./gradlew --no-daemon --stacktrace clean fullBuild
+        env:
+          BUILD_VER: ${{ github.run_number }}
+
+      - name: Validate packaged artifacts
+        shell: bash
+        run: bash .github/scripts/validate-release-artifacts.sh
+
+      # Preserve the development Maven publication used by the external test
+      # servers. Trusted team PRs publish a unique pr-N-RUN version. Unknown PRs
+      # use pull_request on GitHub-hosted runners and never receive credentials.
+      - name: Publish development version to Maven
+        if: github.event_name != 'pull_request'
+        run: ./gradlew --no-daemon --stacktrace artifactoryPublish
+        env:
+          BUILD_VER: >-
+            ${{ github.event_name == 'pull_request_target' &&
+            format('pr-{0}-{1}', github.event.pull_request.number, github.run_number) || github.run_number }}
           MAVEN_URL: ${{ secrets.MAVEN_URL }}
           MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_TOKEN }}
           MAVEN_REPO: ${{ secrets.MAVEN_DEVREPO }}
-          BUILD_VER: ${{ github.run_number }}
+
+      # External contributors cannot publish to Maven, so retain their build
+      # output in Actions for review and testing. All trusted builds use Maven.
+      - name: Upload external pull request artifacts
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v7
+        with:
+          name: mekanism-ce-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            output/*.jar
+            output/*.zip
+          if-no-files-found: error
+          retention-days: 14
+          compression-level: 0

.github/workflows/maven.yml

@@ -1,29 +1,254 @@
-# This workflow will build a Java project with Gradle
-# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle
+name: Publish release
 
-name: Publish to Maven
 on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
 jobs:
   build:
-
+    name: Build, publish Maven, and attach GitHub assets
     runs-on: self-hosted
+    timeout-minutes: 90
+    environment: release
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up JDK 8
-      uses: actions/setup-java@v2
-      with:
-        java-version: '8'
-        distribution: 'adopt'
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
-    - name: Build and Publish
-      run: ./gradlew fullbuild artifactoryPublish
-      env:
+      - name: Check out release tag
+        uses: actions/checkout@v7
+        with:
+          clean: true
+          fetch-depth: 0
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Set up JDK 8
+        uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: '8'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          validate-wrappers: true
+
+      - name: Grant execute permission for Gradle
+        run: chmod +x gradlew
+
+      - name: Verify tag matches the project version
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          project_version="$(sed -n 's/^mod_version=//p' gradle.properties | tr -d '\r' | tail -n 1)"
+          if [[ -z "$project_version" || "$RELEASE_TAG" != "$project_version" ]]; then
+            echo "Release tag '$RELEASE_TAG' must equal gradle.properties mod_version '$project_version'." >&2
+            exit 1
+          fi
+
+      - name: Remove stale packaged artifacts
+        shell: bash
+        run: |
+          mkdir -p output
+          find output -maxdepth 1 -type f \( -name '*.jar' -o -name '*.zip' \) -delete
+
+      - name: Build release artifacts
+        run: ./gradlew --no-daemon --stacktrace clean fullBuild
+
+      - name: Validate packaged artifacts
+        shell: bash
+        run: bash .github/scripts/validate-release-artifacts.sh
+
+      - name: Publish release to Maven
+        run: ./gradlew --no-daemon --stacktrace artifactoryPublish
+        env:
           MAVEN_URL: ${{ secrets.MAVEN_URL }}
           MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_TOKEN }}
           MAVEN_REPO: ${{ secrets.MAVEN_REPO }}
+
+      - name: Attach artifacts to GitHub release
+        uses: Kira-NT/mc-publish@52307b03863581dec6b652b83e597aec02ebb075 # v3.3.1
+        with:
+          github-token: ${{ secrets.RELEASE_GITHUB_TOKEN }}
+          github-tag: ${{ github.event.release.tag_name }}
+          github-generate-changelog: false
+          files: |
+            output/*-ALL.jar
+            output/*-API.jar
+            output/*-Core.jar
+            output/*-DEV.jar
+            output/*-DefenseTech.jar
+            output/*-Generators.jar
+            output/*-MDK.zip
+            output/*-Tools.jar
+            output/*-Ultimate.jar
+          version: ${{ github.event.release.tag_name }}
+
+      - name: Save release artifacts for publishing jobs
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-${{ github.event.release.tag_name }}
+          path: |
+            output/*.jar
+            output/*.zip
+          if-no-files-found: error
+          # This artifact only passes the verified files to the parallel
+          # publishing jobs; GitHub Releases and Maven are the durable stores.
+          retention-days: 1
+          compression-level: 0
+
+  publish-modrinth-main:
+    name: Publish Modrinth main project
+    needs: build
+    runs-on: self-hosted
+    timeout-minutes: 30
+    environment: release
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: release-${{ github.event.release.tag_name }}
+          path: output
+
+      # Core is the primary file on the main project. The combined ALL artifact
+      # is intentionally distributed through GitHub and Maven, not Modrinth.
+      - name: Publish Mekanism Community Edition to Modrinth
+        uses: Kira-NT/mc-publish@52307b03863581dec6b652b83e597aec02ebb075 # v3.3.1
+        with:
+          modrinth-id: toGHjw6t
+          modrinth-token: ${{ secrets.MODRINTH_TOKEN }}
+          files: |
+            output/*-Core.jar
+            output/*-API.jar
+            output/*-DEV.jar
+            output/*-MDK.zip
+          name: Mekanism Community Edition ${{ github.event.release.tag_name }}
+          version: ${{ github.event.release.tag_name }}
+          version-type: ${{ github.event.release.prerelease && 'beta' || 'release' }}
+          changelog: ${{ github.event.release.body }}
+          loaders: forge
+          game-versions: '1.7.10'
+          game-version-filter: none
+          java: '8'
+          environment: client | server
+          retry-attempts: 2
+
+  publish-modrinth-modules:
+    name: Publish Modrinth (${{ matrix.name }})
+    needs: build
+    runs-on: self-hosted
+    timeout-minutes: 30
+    environment: release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: DefenseTech
+            project-id: qBExn86I
+            file: output/*-DefenseTech.jar
+            beta-only: false
+          - name: Generators
+            project-id: ksSEAhTL
+            file: output/*-Generators.jar
+            beta-only: false
+          - name: Tools
+            project-id: CD05L8Jr
+            file: output/*-Tools.jar
+            beta-only: false
+          - name: Ultimate
+            project-id: Q6fY4JVC
+            file: output/*-Ultimate.jar
+            beta-only: true
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: release-${{ github.event.release.tag_name }}
+          path: output
+
+      - name: Publish ${{ matrix.name }} to Modrinth
+        uses: Kira-NT/mc-publish@52307b03863581dec6b652b83e597aec02ebb075 # v3.3.1
+        with:
+          modrinth-id: ${{ matrix.project-id }}
+          modrinth-token: ${{ secrets.MODRINTH_TOKEN }}
+          files: ${{ matrix.file }}
+          name: Mekanism Community Edition - ${{ matrix.name }} ${{ github.event.release.tag_name }}
+          version: ${{ github.event.release.tag_name }}
+          version-type: ${{ matrix.beta-only && 'beta' || (github.event.release.prerelease && 'beta' || 'release') }}
+          changelog: ${{ github.event.release.body }}
+          loaders: forge
+          game-versions: '1.7.10'
+          game-version-filter: none
+          java: '8'
+          environment: client | server
+          modrinth-dependencies: toGHjw6t(required)
+          retry-attempts: 2
+
+  publish-curseforge:
+    name: Publish CurseForge (${{ matrix.name }})
+    needs: build
+    runs-on: self-hosted
+    timeout-minutes: 30
+    environment: release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Core
+            project-id: '399904'
+            file: output/*-Core.jar
+            dependencies: ''
+            beta-only: false
+          - name: DefenseTech
+            project-id: '1488821'
+            file: output/*-DefenseTech.jar
+            dependencies: mekanism-ce(required)
+            beta-only: false
+          - name: Generators
+            project-id: '813408'
+            file: output/*-Generators.jar
+            dependencies: mekanism-ce(required)
+            beta-only: false
+          - name: Tools
+            project-id: '813407'
+            file: output/*-Tools.jar
+            dependencies: mekanism-ce(required)
+            beta-only: false
+          - name: Ultimate
+            project-id: '872280'
+            file: output/*-Ultimate.jar
+            dependencies: mekanism-ce(required)
+            beta-only: true
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: release-${{ github.event.release.tag_name }}
+          path: output
+
+      - name: Publish ${{ matrix.name }} to CurseForge
+        uses: Kira-NT/mc-publish@52307b03863581dec6b652b83e597aec02ebb075 # v3.3.1
+        with:
+          curseforge-id: ${{ matrix.project-id }}
+          curseforge-token: ${{ secrets.CURSEFORGE_TOKEN }}
+          files: ${{ matrix.file }}
+          name: Mekanism Community Edition - ${{ matrix.name }} ${{ github.event.release.tag_name }}
+          version: ${{ github.event.release.tag_name }}
+          version-type: ${{ matrix.beta-only && 'beta' || (github.event.release.prerelease && 'beta' || 'release') }}
+          changelog: ${{ github.event.release.body }}
+          loaders: forge
+          game-versions: '1.7.10'
+          game-version-filter: none
+          java: '8'
+          environment: client | server
+          curseforge-dependencies: ${{ matrix.dependencies }}
+          retry-attempts: 2