docview/.github/workflows/release.yml at main · ghosthack/docview · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: Optional version to build the dry-run bundle as (not committed)
        required: false
        type: string

permissions:
  contents: read

# Manual dry runs get their own group, so they can never displace a pending
# release (GitHub keeps only one pending run per group).
concurrency:
  group: maven-central-${{ github.event_name == 'release' && 'release' || 'dry-run' }}
  cancel-in-progress: false

jobs:
  validate:
    if: github.event_name == 'release' && github.event.release.prerelease == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21
          cache: maven
      - name: Validate release tag
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          VERSION="$(./mvnw -q -N help:evaluate -Dexpression=project.version -DforceStdout)"
          if [[ "$VERSION" == *-SNAPSHOT ]]; then
            echo "::error::Cannot release snapshot version $VERSION"
            exit 1
          fi
          if [[ "$RELEASE_TAG" != "v$VERSION" ]]; then
            echo "::error::Release tag $RELEASE_TAG must match project version v$VERSION"
            exit 1
          fi

  build:
    needs: validate
    uses: ./.github/workflows/ci.yml
    with:
      ref: ${{ github.event.release.tag_name }}

  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}
      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21
          cache: maven
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Deploy to Maven Central
        run: ./mvnw -B clean deploy -P release -DskipTests
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

  # Manual runs only build and sign the Central bundle (never uploaded) so it
  # can be inspected and validated without publishing. The job only gets
  # placeholder Central credentials, so it cannot upload anything.
  bundle-dry-run:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21
          cache: maven
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Build Central bundle without publishing
        run: |
          ./mvnw -v
          if [[ -n "$DRY_RUN_VERSION" ]]; then
            ./mvnw -B -q versions:set -DnewVersion="$DRY_RUN_VERSION" -DgenerateBackupPoms=false
          fi
          # skipPublishing would also skip bundling, so let the upload fail
          # against an unreachable URL instead and keep the bundle it built.
          ./mvnw -B clean deploy -P release -DskipTests -DcentralBaseUrl=http://127.0.0.1:9 || true
          test -f target/central-publishing/central-bundle.zip
          unzip -Z -v target/central-publishing/central-bundle.zip | grep -E '^(Central directory entry|  file system or operating system of origin|  version of encoding software|  minimum software version|  general purpose bit flag|  compression method|  file name|There is)' || true
          unzip -l target/central-publishing/central-bundle.zip
        env:
          DRY_RUN_VERSION: ${{ inputs.version }}
          MAVEN_CENTRAL_USERNAME: dry-run
          MAVEN_CENTRAL_PASSWORD: dry-run
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      - uses: actions/upload-artifact@v4
        with:
          name: central-bundle
          path: target/central-publishing/central-bundle.zip