ArchUnitJava/.github/workflows/release.yml at main · LukasNiessen/ArchUnitJava · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: Stage Maven Central release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Semantic version represented by an existing signed v-prefixed tag
        required: true
        type: string
      confirm:
        description: Enter "stage" to upload for Central validation without publishing
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: maven-central-staging
  cancel-in-progress: false

jobs:
  stage:
    if: inputs.confirm == 'stage'
    runs-on: ubuntu-latest
    environment: maven-central
    timeout-minutes: 30
    steps:
      - name: Check out the signed release tag
        uses: actions/checkout@v7
        with:
          ref: v${{ inputs.version }}
          fetch-depth: 0
      - name: Validate immutable tag and version
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: |
          [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          test "$GITHUB_REF_TYPE" = "branch"
          test "$GITHUB_REF_NAME" = "main"
          test "$(git cat-file -t "refs/tags/v$VERSION")" = "tag"
          test "$(git describe --tags --exact-match HEAD)" = "v$VERSION"
      - name: Set up Java, Central credentials, and signing key
        uses: actions/setup-java@v6
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
        with:
          distribution: temurin
          java-version: '25'
          cache: maven
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Verify release tag signature
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: git verify-tag "v$VERSION"
      - name: Materialize the non-snapshot release version
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: |
          ./mvnw --batch-mode --no-transfer-progress \
            org.codehaus.mojo:versions-maven-plugin:2.19.1:set \
            -DgenerateBackupPoms=false -DnewVersion="$VERSION"
          test "$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)" = "$VERSION"
      - name: Verify the exact release candidate
        shell: bash
        run: ./mvnw --batch-mode --no-transfer-progress -Prelease-candidate verify
      - name: Upload a signed user-managed Central deployment
        shell: bash
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
          MAVEN_GPG_KEY_FINGERPRINT: ${{ secrets.MAVEN_GPG_KEY_FINGERPRINT }}
        run: |
          ./mvnw --batch-mode --no-transfer-progress \
            -Prelease-candidate,release-sign,central-release \
            -Dgpg.keyname="$MAVEN_GPG_KEY_FINGERPRINT" deploy
      - name: Retain the submitted bundle for review
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: archunitjava-${{ inputs.version }}-central-bundle
          path: target/central-publishing/*.zip
          if-no-files-found: ignore
          retention-days: 7