33 push :
44 pull_request_target :
55 types : [labeled]
6+
7+ env :
8+ JAVA_VERSION : 25
9+
610jobs :
711 build :
812 name : Build and Test
913 runs-on : ubuntu-latest
14+ permissions :
15+ contents : read
16+ id-token : write # OIDC token for the attestations step
17+ attestations : write # Required for the attestations step
18+ artifact-metadata : write # Required for the attestations step
19+ outputs :
20+ sha256 : ${{ steps.checksums.outputs.sha256 }}
1021 steps :
11- - uses : actions/checkout@v4
22+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1223 with :
13- fetch-depth : 0
14- show-progress : false
15- - uses : actions/setup-java@v4
24+ fetch-depth : 0 # deep fetch for better sonarcloud analysis
25+ show-progress : false
26+ - uses : actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
1627 with :
17- java-version : 21
1828 distribution : ' temurin'
29+ java-version : ${{ env.JAVA_VERSION }}
1930 cache : ' maven'
2031 - name : Cache SonarCloud packages
21- uses : actions/cache@v4
32+ uses : actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
2233 with :
2334 path : ~/.sonar/cache
2435 key : ${{ runner.os }}-sonar
2536 restore-keys : ${{ runner.os }}-sonar
2637 - name : Ensure to use tagged version
2738 if : startsWith(github.ref, 'refs/tags/')
28- run : mvn -B versions:set --file ./pom.xml -DnewVersion=${GITHUB_REF##*/}
39+ run : ./mvnw versions:set --file ./pom.xml -DnewVersion=${GITHUB_REF##*/}
2940 - name : Build and Test
3041 run : >
31- mvn -B verify
42+ ./mvnw -B verify --no-transfer-progress
3243 jacoco:report
3344 org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
3445 -Pcoverage
@@ -38,14 +49,123 @@ jobs:
3849env :
3950 GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
4051 SONAR_TOKEN : ${{ secrets.SONAR_TOKEN }}
41- - uses : actions/upload-artifact@v4
52+ - name : Calculate Checksums
53+ id : checksums
54+ run : |
55+ {
56+ echo 'sha256<<EOF'
57+ shasum -a256 target/*.jar
58+ echo EOF
59+ } >> $GITHUB_OUTPUT
60+ name : Attest
61+ if : startsWith(github.ref, 'refs/tags/')
62+ uses : actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
63+ with :
64+ subject-path : |
65+ target/*.jar
66+ target/*.pom
67+ uses : actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
4268 with :
4369 name : artifacts
44- path : target/*.jar
45- - name : Create release
70+ path : |
71+ target/*.jar
72+
73+
74+ deploy-central :
75+ name : Deploy to Maven Central
76+ runs-on : ubuntu-latest
77+ permissions :
78+ id-token : write # OIDC token for sigstore signing
79+ contents : read # Required for sigstore signing
80+ needs : [build]
81+ if : github.repository_owner == 'cryptomator' && (startsWith(github.ref, 'refs/tags/') || contains(github.event.head_commit.message, '[deploy]'))
82+ steps :
83+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
84+ - uses : actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
85+ with :
86+ distribution : ' temurin'
87+ java-version : ${{ env.JAVA_VERSION }}
88+ cache : ' maven'
89+ server-id : central
90+ server-username : MAVEN_CENTRAL_USERNAME
91+ server-password : MAVEN_CENTRAL_PASSWORD
92+ - name : Enforce to use tagged version
4693 if : startsWith(github.ref, 'refs/tags/')
47- uses : softprops/action-gh-release@v2
94+ run : ./mvnw versions:set -B -DnewVersion="${GITHUB_REF##*/}"
95+ - name : Verify project version is -SNAPSHOT
96+ if : startsWith(github.ref, 'refs/tags/') == false
97+ run : |
98+ PROJECT_VERSION=$(./mvnw help:evaluate "-Dexpression=project.version" -q -DforceStdout)
99+ test "${PROJECT_VERSION: -9}" = "-SNAPSHOT"
100+ name : Deploy to Maven Central
101+ run : ./mvnw deploy -B -DskipTests -Psign,deploy-central --no-transfer-progress
102+ env :
103+ MAVEN_CENTRAL_USERNAME : ${{ secrets.MAVEN_CENTRAL_USERNAME }}
104+ MAVEN_CENTRAL_PASSWORD : ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
105+ MAVEN_GPG_PASSPHRASE : ${{ secrets.RELEASES_GPG_PASSPHRASE }}
106+ MAVEN_GPG_KEY : ${{ secrets.RELEASES_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
107+ MAVEN_GPG_KEY_FINGERPRINT : ${{ vars.RELEASES_GPG_KEY_FINGERPRINT }}
108+
109+ deploy-github :
110+ name : Deploy to GitHub Packages
111+ runs-on : ubuntu-latest
112+ permissions :
113+ packages : write # Required for the deploy to GitHub Packages step
114+ id-token : write # OIDC token for sigstore signing
115+ contents : read # Required for sigstore signing
116+ needs : [build]
117+ if : github.repository_owner == 'cryptomator' && (startsWith(github.ref, 'refs/tags/') || contains(github.event.head_commit.message, '[deploy]'))
118+ steps :
119+ - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120+ - uses : actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
48121 with :
122+ java-version : ${{ env.JAVA_VERSION }}
123+ distribution : ' temurin'
124+ cache : ' maven'
125+ - name : Enforce to use tagged version
126+ if : startsWith(github.ref, 'refs/tags/')
127+ run : ./mvnw versions:set -B -DnewVersion="${GITHUB_REF##*/}"
128+ - name : Verify project version is -SNAPSHOT
129+ if : startsWith(github.ref, 'refs/tags/') == false
130+ run : |
131+ PROJECT_VERSION=$(./mvnw help:evaluate "-Dexpression=project.version" -q -DforceStdout)
132+ test "${PROJECT_VERSION: -9}" = "-SNAPSHOT"
133+ name : Deploy to GitHub Packages
134+ run : ./mvnw deploy -B -DskipTests -Psign,deploy-github --no-transfer-progress
135+ env :
136+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
137+ MAVEN_GPG_PASSPHRASE : ${{ secrets.RELEASES_GPG_PASSPHRASE }}
138+ MAVEN_GPG_KEY : ${{ secrets.RELEASES_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
139+ MAVEN_GPG_KEY_FINGERPRINT : ${{ vars.RELEASES_GPG_KEY_FINGERPRINT }}
140+
141+ release :
142+ name : Release
143+ runs-on : ubuntu-latest
144+ permissions :
145+ contents : write # Required for the release step
146+ needs : [build, deploy-central, deploy-github]
147+ if : startsWith(github.ref, 'refs/tags/')
148+ steps :
149+ - name : Create Release
150+ uses : softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
151+ with :
152+ prerelease : true
49153 token : ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
50154 generate_release_notes : true
51- prerelease : true
155+ body : |-
156+ ### Changelog
157+ For a list of all notable changes, read the [changelog](/CHANGELOG.md).
158+
159+ ### Maven Coordinates
160+ ```xml
161+ <dependency>
162+ <groupId>org.cryptomator</groupId>
163+ <artifactId>cryptofs</artifactId>
164+ <version>${{ github.ref_name }}</version>
165+ </dependency>
166+ ```
167+
168+ ### Artifact Checksums
169+ ```txt
170+ ${{ needs.build.outputs.sha256 }}
171+ ```
0 commit comments