ci-release.yaml

# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
name: Release CI

on:
  workflow_dispatch:
    inputs:
      release-version:
        required: false
        default: ''
        description: >-
          Release version (e.g. 5.7.0 or 5.7.0-rc.1).
          Leave empty to let Maven compute it from the current SNAPSHOT version.
        type: string
      development-version:
        required: false
        default: ''
        description: >-
          Next development version (e.g. 5.8.0-SNAPSHOT).
          Leave empty for automatic increment (e.g. 5.7.1-SNAPSHOT or 5.7.0-rc.2-SNAPSHOT).
        type: string
      dry-run:
        required: false
        default: false
        description: >-
          Perform a dry run without pushing changes or creating releases.
        type: boolean

permissions: { }

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout Repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # tag=v7.0.0
        with:
          token: ${{ !inputs.dry-run && secrets.BOT_RELEASE_GITHUB_TOKEN || github.token }}
          fetch-depth: 0

      - name: Set up JDK
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # tag=v5.4.0
        with:
          distribution: 'temurin'
          java-version: '25'
          cache: 'maven'

      - name: Configure Git
        run: |
          git config user.name "dependencytrack-bot"
          git config user.email "106437498+dependencytrack-bot@users.noreply.github.com"

      - name: Perform Maven Release
        env:
          INPUT_RELEASE_VERSION: ${{ inputs.release-version }}
          INPUT_DEVELOPMENT_VERSION: ${{ inputs.development-version }}
          INPUT_DRY_RUN: ${{ inputs.dry-run }}
        run: |-
          MAVEN_ARGS="-B"
          if [[ -n "${INPUT_RELEASE_VERSION}" ]]; then
            MAVEN_ARGS="${MAVEN_ARGS} -DreleaseVersion=${INPUT_RELEASE_VERSION}"
          fi
          if [[ -n "${INPUT_DEVELOPMENT_VERSION}" ]]; then
            MAVEN_ARGS="${MAVEN_ARGS} -DdevelopmentVersion=${INPUT_DEVELOPMENT_VERSION}"
          fi
          if [[ "${INPUT_DRY_RUN}" == "true" ]]; then
            MAVEN_ARGS="${MAVEN_ARGS} -DdryRun=true"
          fi
          export MAVEN_ARGS

          mvn release:prepare

      - name: Create GitHub Release
        if: ${{ !inputs.dry-run }}
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_GITHUB_TOKEN }}
        run: |
          RELEASE_VERSION=$(git describe --tags --abbrev=0)
          echo "Release version: ${RELEASE_VERSION}"

          PRERELEASE_FLAG=""
          if [[ "${RELEASE_VERSION}" == *-* ]]; then
            PRERELEASE_FLAG="--prerelease"
          fi

          gh release create "${RELEASE_VERSION}" \
            --draft \
            --generate-notes \
            ${PRERELEASE_FLAG}