1
1
name : Release
2
2
on :
3
3
workflow_dispatch :
4
+ inputs :
5
+ version :
6
+ description : ' Release version'
7
+ required : true
8
+ version-fragment :
9
+ description : ' Version fragment to increase for next development cycle'
10
+ required : true
11
+ default : ' minor'
12
+ type : choice
13
+ options :
14
+ - major
15
+ - minor
16
+ - patch
4
17
5
18
env :
6
19
BOT_USER_NAME : eclipse-cbi-bot
7
20
BOT_EMAIL : cbi-bot@eclipse.org
8
- JAVA_VERSION : ' 17 '
21
+ JAVA_VERSION : 17
9
22
JAVA_DISTRO : ' temurin'
10
23
11
24
concurrency :
12
25
group : ${{ github.workflow }}-${{ github.ref }}
13
- cancel-in-progress : true
14
-
15
- permissions : # added using https://github.com/step-security/secure-repo
16
- contents : read
26
+ cancel-in-progress : false
17
27
18
28
jobs :
19
- build :
20
- runs-on : ubuntu-latest
21
- # don't run this workflow in forks
22
- if : github.repository == 'eclipse-cbi/macos-notarization-service'
29
+ precheck :
30
+ runs-on : ubuntu-22.04
23
31
permissions :
24
32
contents : write
33
+ if : github.repository == 'eclipse-cbi/macos-notarization-service'
25
34
outputs :
26
- tag : ${{ steps.retrieve-tag.outputs.tag }}
27
- hash : ${{ steps.hash.outputs.hash }}
35
+ release-version : ${{ steps.prepare-release.outputs.RELEASE_VERSION }}
28
36
steps :
37
+ - name : Check ref
38
+ shell : bash
39
+ run : |
40
+ if [ "${{ github.ref }}" != "refs/heads/main" ]; then
41
+ echo "Release shall only be made from 'main' branch, triggered branch '${{ github.ref_name }}', aborting."
42
+ exit 1
43
+ fi
44
+
29
45
- name : Setup Git User
30
46
run : |
31
47
git config --global user.name '${{ env.BOT_USER_NAME }}'
34
50
- uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
35
51
with :
36
52
ref : ${{ github.ref }}
53
+ fetch-depth : 0
37
54
38
55
- name : Setup Java
39
56
uses : actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
@@ -42,70 +59,77 @@ jobs:
42
59
distribution : ${{ env.JAVA_DISTRO }}
43
60
cache : maven
44
61
45
- - name : Build Release
62
+ - name : Prepare release
63
+ id : prepare-release
64
+ shell : bash
46
65
run : |
47
- ./mvnw -ntp -B -Prelease release:clean release:prepare -Dmaven.test.skip=true
48
- ./mvnw -ntp -B -Pdist -Prelease -Psbom release:perform -Darguments="-Dmaven.deploy.skip=true" -Dgoals=package
49
- env :
50
- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
66
+ PROJECT_VERSION="$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)"
67
+ RELEASE_VERSION="${{ github.event.inputs.version }}"
51
68
52
- - id : retrieve-tag
53
- run : |
54
- echo "tag=$(git describe --tags --abbrev=0)" >> "$GITHUB_OUTPUT"
55
-
56
- - if : cancelled() || failure()
57
- run : ./mvnw -B -Prelease release:rollback
58
- env :
59
- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
69
+ echo "PROJECT_VERSION=$(echo $PROJECT_VERSION)" >> $GITHUB_OUTPUT
70
+ echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_OUTPUT
71
+
72
+ echo "Project version: $PROJECT_VERSION"
73
+ echo "Release version: $RELEASE_VERSION"
74
+
75
+ if git show-ref --tags --verify --quiet "refs/tags/v${RELEASE_VERSION}"; then
76
+ echo "Release Tag 'v${RELEASE_VERSION}' already exists, aborting."
77
+ exit 1
78
+ fi
79
+
80
+ if [ "$PROJECT_VERSION" != "$RELEASE_VERSION" ]; then
81
+ ./mvnw -B versions:set versions:commit -DnewVersion=$RELEASE_VERSION
82
+ git commit -a -m "Releasing version $RELEASE_VERSION"
83
+ git push origin ${{ github.ref }}
84
+ fi
60
85
61
- # Generate hashes used for provenance.
62
- - name : generate hash
63
- id : hash
64
- run : cd target/checkout/target/distributions && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
65
-
66
- - uses : actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
67
- with :
68
- path : target/checkout/target/distributions
69
-
70
-
71
- update_release_draft :
72
- needs : ['build']
86
+ release :
87
+ needs : ['precheck']
73
88
permissions :
74
89
contents : write
75
- pull-requests : read
76
- runs-on : ubuntu-latest
77
- steps :
78
- # Update the release notes for the released version
79
- - uses : release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5.25.0
80
- with :
81
- tag : ${{ needs.build.outputs.tag }}
82
- env :
83
- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
84
-
85
- provenance :
86
- needs : ['build']
87
- permissions :
88
90
actions : read
91
+ packages : write
89
92
id-token : write
90
- contents : write
91
- # Can't pin with hash due to how this workflow works.
92
- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
93
+ uses : jreleaser/release-action/.github/workflows/builder_slsa3.yml@java
93
94
with :
94
- base64-subjects : ${{ needs.build.outputs.hash }}
95
+ project-version : ${{ needs.precheck.outputs.release-version }}
96
+ branch : ${{ github.ref_name }}
97
+ jreleaser-version : ' 1.9.0'
98
+ java-version : 17
99
+ java-distribution : ' temurin'
100
+ rekor-log-public : true
101
+ secrets :
102
+ github-token : ${{ secrets.GITHUB_TOKEN }}
95
103
96
- upload-artifacts :
97
- # Upload the distribution and provenance to a GitHub release. They remain
98
- # available as build artifacts for a while as well.
99
- needs : ['build', 'provenance', 'update_release_draft']
100
- runs-on : ubuntu-latest
104
+ prepare-for-next-development-cycle :
105
+ runs-on : ubuntu-22.04
106
+ needs : ['precheck', 'release']
101
107
permissions :
102
108
contents : write
103
109
steps :
104
- - uses : actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
105
- - name : upload artifacts to release
106
- run : >
107
- gh release upload --repo ${{ github.repository }}
108
- ${{ needs.build.outputs.tag }}
109
- *.intoto.jsonl/* artifact/*
110
- env :
111
- GH_TOKEN : ${{ github.token }}
110
+ - name : Setup Git User
111
+ run : |
112
+ git config --global user.name '${{ env.BOT_USER_NAME }}'
113
+ git config --global user.email '${{ env.BOT_EMAIL }}'
114
+
115
+ - uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
116
+ with :
117
+ ref : ${{ github.ref }}
118
+
119
+ - name : Setup Java
120
+ uses : actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
121
+ with :
122
+ java-version : ${{ env.JAVA_VERSION }}
123
+ distribution : ${{ env.JAVA_DISTRO }}
124
+ cache : maven
125
+
126
+ - id : increase-semver
127
+ uses : ./.github/actions/increase-semver
128
+ with :
129
+ current-version : ${{ needs.precheck.outputs.release-version }}
130
+ version-fragment : ${{ github.event.inputs.version-fragment }}
131
+ - name : Update next development version in POMs
132
+ run : |
133
+ ./mvnw -B versions:set versions:commit -DnewVersion=${{ steps.increase-semver.outputs.next-version }}-SNAPSHOT -DgenerateBackupPoms=false
134
+ git commit -a -m "Prepare for next development cycle"
135
+ git push origin ${{ github.ref }}
0 commit comments