create-release.yaml

name: Create Release
on:
  push:
    tags:
      - '**'
  pull_request:
    # Release a new SNAPSHOT version every time a PR is merged to v6.
    types: [closed]
    branches: ['v6']

jobs:
  release:
    name: Deploy
    if: >
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags'))
      || (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Unpack secrets
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          ./tools/decrypt_secret.sh
      - name: Deploy
        env:
          OKTA_DUMMY_CI_PW: ${{ secrets.OKTA_DUMMY_CI_PW }}
          WCS_DUMMY_CI_PW: ${{ secrets.WCS_DUMMY_CI_PW }}
          OKTA_CLIENT_SECRET: ${{ secrets.OKTA_CLIENT_SECRET }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
        run: |
          export GPG_TTY=$(tty)
          source ./passphrase.env # load $MAVEN_GPG_PASSHRASE for maven-gpg-plugin
          mvn -DskipTests clean package
          mvn -s settings.xml \
          -Dcentral-publishing.autoPublish=true \
          -Dcentral-publishing.waitUntil=published \
          deploy
      - name: Archive artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: jar-files
          path: "target/*.jar"
          retention-days: 1
  gh-release:
    name: Create a GitHub Release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
    runs-on: ubuntu-latest
    needs: [ release ]
    steps:
      - name: Download artifacts to append to release
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: jar-files
          path: target
      - name: Create a GitHub Release
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        with:
          generate_release_notes: true
          draft: true
          files: target/*.jar