babelqueue-java-pulsar/.github/workflows/release.yml at main · BabelQueue/babelqueue-java-pulsar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: Release

on:
  push:
    tags: [ "v*" ]

permissions:
  contents: write

env:
  BQ_CONFORMANCE_VERSION: "1.8.0"

jobs:
  # Secret-free: runs the tests, produces results.json and validates it. The PyPI package it
  # installs never shares a job with the GPG key or the Central credentials.
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
          cache: maven

      - name: Run tests
        run: mvn -B --no-transfer-progress verify
        env:
          BQ_CONFORMANCE_RESULTS: ${{ runner.temp }}/results.json

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Validate results.json
        run: |
          python3 -m pip install --quiet jsonschema==4.23.0
          python3 -I .github/scripts/check-conformance-results.py "$RUNNER_TEMP/results.json" \
            src/test/resources/conformance "$BQ_CONFORMANCE_VERSION"
          cp "$RUNNER_TEMP/results.json" results.json

      - uses: actions/upload-artifact@v4
        with:
          name: results
          path: results.json
          if-no-files-found: error

  release:
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
          cache: maven
          # Writes a settings.xml server entry `central` using the env vars below,
          # and imports the GPG key for signing.
          server-id: central
          server-username: CENTRAL_TOKEN_USERNAME
          server-password: CENTRAL_TOKEN_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      # Maven 3.10 writes maven-metadata-local.xml into the Central staging repo; Central then
      # rejects the bundle ("content that does NOT have a .pom file"). Pin 3.9 until the
      # central-publishing-maven-plugin handles it.
      - name: Install Maven 3.9
        run: |
          # Pinned SHA-512 of apache-maven-3.9.11-bin.tar.gz (matches archive.apache.org and Maven Central).
          BQ_MAVEN_SHA512="bcfe4fe305c962ace56ac7b5fc7a08b87d5abd8b7e89027ab251069faebee516b0ded8961445d6d91ec1985dfe30f8153268843c89aa392733d1a3ec956c9978"
          curl -fsSL -o "$RUNNER_TEMP/maven.tar.gz" https://archive.apache.org/dist/maven/maven-3/3.9.11/binaries/apache-maven-3.9.11-bin.tar.gz
          echo "$BQ_MAVEN_SHA512  $RUNNER_TEMP/maven.tar.gz" | sha512sum -c -
          tar xz -C "$RUNNER_TEMP" -f "$RUNNER_TEMP/maven.tar.gz"
          echo "$RUNNER_TEMP/apache-maven-3.9.11/bin" >> "$GITHUB_PATH"

      - uses: actions/download-artifact@v4
        with:
          name: results

      - name: Publish to Maven Central
        run: mvn -B --no-transfer-progress -v && mvn -B --no-transfer-progress -Prelease -DskipTests deploy
        env:
          CENTRAL_TOKEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
          CENTRAL_TOKEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: results.json