maven-deploy.yml

name: Deploy to Maven Central

# Controls when the action will run. 
on:
  push:
    tags:
    - "v[0-9]+.[0-9]+"

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Set up GnuPG
      env:
        GPG_EXECUTABLE: gpg
        GPG_SECRET_KEYS: ${{ secrets.GPG_SECRET_KEYS }}
        GPG_OWNERTRUST: ${{ secrets.GPG_OWNERTRUST }}
      run: |
        mkdir -m 700 ~/.gnupg/
        echo 'use-agent' > ~/.gnupg/gpg.conf
        echo 'pinentry-mode loopback' >> ~/.gnupg/gpg.conf
        echo 'allow-loopback-pinentry' > ~/.gnupg/gpg-agent.conf
        echo $GPG_SECRET_KEYS | base64 --decode | $GPG_EXECUTABLE  --yes --batch --import
        echo $GPG_OWNERTRUST | base64 --decode | $GPG_EXECUTABLE  --yes --batch --import-ownertrust

    - name: Checkout Source
      uses: actions/checkout@v6

    - name: Set up JDK 17
      uses: actions/setup-java@v5
      with:
        distribution: 'adopt'
        java-version: 17

    - name: Get Date
      id: get-date
      run: |
        echo "date=$(/bin/date -u "+%Y-%m-%dT%H:%M:%S")" >> $GITHUB_OUTPUT
      shell: bash

    - name: Cache maven repository
      uses: actions/cache@v5
      with:
        path: ~/.m2/repository
        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
        restore-keys: ${{ runner.os }}-maven

    - name: Restore CVD Database from Cache
      uses: actions/cache/restore@v5
      with:
        path: |
          ~/.m2/repository/org/owasp/dependency-check-data
        key: ${{ runner.os }}-maven-owasp-cvedb-${{ steps.get-date.outputs.date }}
        restore-keys: ${{ runner.os }}-maven-owasp-cvedb

    - name: Update CVD Database
      continue-on-error: true
      env:
        NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
      run: |
        mvn -B -DnvdApiDelay=6000 --settings scripts/maven-ci-settings.xml org.owasp:dependency-check-maven:update-only

    - name: Save CVD Database to Cache
      uses: actions/cache/save@v5
      with:
        path: |
          ~/.m2/repository/org/owasp/dependency-check-data
        key: ${{ runner.os }}-maven-owasp-cvedb-${{ steps.get-date.outputs.date }}


    - name: Build with Maven
      env:
        GPG_EXECUTABLE: gpg
        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
        OSSINDEX_TOKEN: ${{ secrets.OSSINDEX_TOKEN }}
        OSSINDEX_USERNAME: ${{ secrets.OSSINDEX_USERNAME }}
        SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
        SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
      run: mvn -B deploy -P release -DautoUpdate=false --settings scripts/maven-ci-settings.xml