release.yml

name: Release

on:
  push:
    branches:
      - master
  workflow_dispatch:
    inputs:
      gradle_args:
        description: "Extra Gradle args for the release run, for example: --stacktrace"
        required: false
        default: ""
        type: string
      gradle_log_level:
        description: "Gradle log level used by workflow Gradle invocations"
        required: false
        default: info
        type: choice
        options:
          - quiet
          - warn
          - lifecycle
          - info
          - debug
      skip_verification:
        description: "Skip the verification build, then run the release directly"
        required: false
        default: false
        type: boolean
      run_release_task_tests:
        description: "Allow tests to run inside the Gradle release task"
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  packages: write

concurrency:
  group: release-master
  cancel-in-progress: false

jobs:
  release:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (
        !contains(github.event.head_commit.message, '[Gradle Release Plugin]') &&
        !contains(github.event.head_commit.message, '[skip ci]') &&
        !contains(github.event.head_commit.message, '[ci skip]') &&
        !contains(github.event.head_commit.message, '[no ci]') &&
        !contains(github.event.head_commit.message, '[skip actions]') &&
        !contains(github.event.head_commit.message, '[actions skip]') &&
        !contains(github.event.head_commit.message, 'skip-checks:true')
      )
    runs-on: ubuntu-latest
    timeout-minutes: 120

    env:
      GRADLE_OPTS: >-
        -Dorg.gradle.daemon=false
        -Dorg.gradle.internal.http.connectionTimeout=120000
        -Dorg.gradle.internal.http.socketTimeout=300000
      EXTRA_GRADLE_ARGS: ${{ github.event.inputs.gradle_args || '' }}
      GRADLE_LOG_LEVEL: ${{ github.event.inputs.gradle_log_level || 'info' }}
      SKIP_VERIFICATION: ${{ github.event.inputs.skip_verification || 'false' }}
      RUN_RELEASE_TASK_TESTS: ${{ github.event_name != 'workflow_dispatch' || inputs.run_release_task_tests }}
      TESTCONTAINERS_RYUK_DISABLED: "true"

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_GITHUB_TOKEN || github.token }}

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: false

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Verify Docker environment
        if: env.SKIP_VERIFICATION != 'true'
        run: |
          docker version
          docker info

      - name: Run verification build
        if: env.SKIP_VERIFICATION != 'true'
        run: |
          ./gradlew --no-configuration-cache build --stacktrace "--$GRADLE_LOG_LEVEL"

      - name: Collect diagnostics on failure
        if: failure() && env.SKIP_VERIFICATION != 'true'
        run: |
          set +e
          diagnostics_dir="build/github-diagnostics"
          mkdir -p "${diagnostics_dir}/docker"

          docker ps -a | tee "${diagnostics_dir}/docker/containers.txt"
          docker images | tee "${diagnostics_dir}/docker/images.txt"

          mapfile -t container_ids < <(docker ps -aq)
          for container_id in "${container_ids[@]}"; do
            container_name="$(docker inspect --format '{{.Name}}' "${container_id}" 2>/dev/null | sed 's#^/##')"
            if [ -z "${container_name}" ]; then
              container_name="${container_id}"
            fi
            safe_name="$(printf '%s' "${container_name}" | tr -c 'A-Za-z0-9_.-' '_')"
            docker inspect "${container_id}" > "${diagnostics_dir}/docker/${safe_name}.inspect.json" 2>&1
            docker logs "${container_id}" > "${diagnostics_dir}/docker/${safe_name}.stdout-stderr.log" 2>&1
          done

          if find . -path '*/build/test-results/*' -type f -name '*.xml' -print -quit | grep -q .; then
            while IFS= read -r result_file; do
              echo "--- ${result_file} ---"
              sed -n '1,240p' "${result_file}"
            done < <(find . -path '*/build/test-results/*' -type f -name '*.xml' -print | sort)
          fi

      - name: Upload test reports and container logs
        if: failure() && env.SKIP_VERIFICATION != 'true'
        uses: actions/upload-artifact@v4
        with:
          name: test-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            **/build/reports/tests/
            **/build/test-results/
            **/build/reports/problems/
            build/github-diagnostics/
          if-no-files-found: ignore
          retention-days: 14

      - name: Write signing key
        env:
          SIGNING_KEY_ASC: ${{ secrets.SIGNING_KEY_ASC }}
        run: |
          printf '%s' "$SIGNING_KEY_ASC" > "$RUNNER_TEMP/signing-key.asc"

      - name: Capture release metadata
        run: |
          release_version="$(awk -F= '/^[[:space:]]*version[[:space:]]*=/{gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2; exit}' gradle.properties)"
          if [ -z "$release_version" ]; then
            echo "Could not read version from gradle.properties" >&2
            exit 1
          fi
          release_version="${release_version%-SNAPSHOT}"
          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"

      - name: Run release
        id: run_release
        timeout-minutes: 90
        env:
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
          SIGNING_KEY_FILE: ${{ runner.temp }}/signing-key.asc
          SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
        run: |
          release_args=()
          if [ "$SKIP_VERIFICATION" = "true" ] || [ "$RUN_RELEASE_TASK_TESTS" != "true" ]; then
            release_args=(-x test)
          fi
          ./gradlew --no-configuration-cache release --stacktrace "--$GRADLE_LOG_LEVEL" "${release_args[@]}" $EXTRA_GRADLE_ARGS

      - name: Write release publish summary
        if: always() && env.RELEASE_VERSION != ''
        env:
          RELEASE_OUTCOME: ${{ steps.run_release.outcome }}
        run: |
          group_id="org.openprojectx.spring.cloud.proxy"
          version="${RELEASE_VERSION}"
          artifacts=(
            "app"
            "core"
            "spring-cloud-proxy-spring-boot-autoconfigure"
            "spring-cloud-proxy-spring-boot-starter"
          )

          {
            if [ "$RELEASE_OUTCOME" = "success" ]; then
              echo "## Release publish summary"
            else
              echo "## Release publish attempt"
            fi
            echo
            echo "- Version: \`${version}\`"
            echo "- Release result: \`${RELEASE_OUTCOME}\`"
            echo "- Maven group: \`${group_id}\`"
            echo
            if [ "$RELEASE_OUTCOME" != "success" ]; then
              echo "> The release step did not complete successfully. The artifacts below are planned coordinates; inspect the Gradle log for partial uploads."
              echo
            fi
            echo "| Artifact | Maven coordinate | Maven Central |"
            echo "|---|---|---|"
            for artifact in "${artifacts[@]}"; do
              coordinate="${group_id}:${artifact}:${version}"
              central_url="https://central.sonatype.com/artifact/${group_id}/${artifact}/${version}"
              echo "| \`${artifact}\` | \`${coordinate}\` | [artifact](${central_url}) |"
            done
            echo
            echo "> Maven Central search can lag briefly after Sonatype release completes."
          } >> "$GITHUB_STEP_SUMMARY"