hiero-sdk-java/.github/workflows/release-artifacts.yml at main · hiero-ledger/hiero-sdk-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
# SPDX-License-Identifier: Apache-2.0
name: Release Artifacts

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        type: string
        description: Test Version String (No release to Maven Central)
        required: true

defaults:
  run:
    shell: bash

permissions:
  contents: read
  packages: write

env:
  LC_ALL: C.UTF-8
  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}

jobs:
  validate-release:
    name: Validate Release
    runs-on: hiero-client-sdk-linux-medium
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Retrieve Tag Version
        if: ${{ github.event_name == 'push' }}
        id: tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "${GITHUB_OUTPUT}"

      - name: Retrieve Tag Version (workflow_dispatch)
        if: ${{ github.event_name == 'workflow_dispatch' }}
        id: workflow_tag
        run: echo "version=${{github.event.inputs.version}}" >> "${GITHUB_OUTPUT}"

      - name: Setup Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: "21.0.6"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-read-only: false

      - name: Determine Project Version
        id: project
        run: echo "version=$(./gradlew -q showVersion | tr -d '[:space:]')" >> "${GITHUB_OUTPUT}"

      - name: Validate Release
        if: ${{ github.event_name == 'push' }}
        run: |
          if [[ "${{ steps.tag.outputs.version }}" != "${{ steps.project.outputs.version }}" ]]; then
            echo "::error file=version.txt,line=0,title=Version Mismatch::Tag version '${{ steps.tag.outputs.version }}' does not match the Gradle project version '${{ steps.project.outputs.version }}'. Please update the 'version.txt' file before tagging."
            exit 1
          fi

  maven-central:
    name: Publish to Maven Central
    runs-on: hiero-client-sdk-linux-medium
    needs:
      # This needs clause exists solely to provide a dependency on the previous step. This publish step will not occur
      # until the validate-release step completes successfully.
      - validate-release

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install GnuPG Tools
        run: |
          if ! command -v gpg2 >/dev/null 2>&1; then
            echo "::group::Updating APT Repository Indices"
              sudo apt update
            echo "::endgroup::"
            echo "::group::Installing GnuPG Tools"
              sudo apt install -y gnupg2
            echo "::endgroup::"
          fi

      - name: Import GPG key
        id: gpg_key
        uses: step-security/ghaction-import-gpg@c0b4a334b9b72bfaaebec86ef022a78a5b17f828 # v7.0.0
        with:
          gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
          passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: true

      - name: Setup Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: "21.0.6"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-read-only: false

      - name: Compile SDK & Javadoc
        run: ./gradlew assemble

      - name: Nexus Release
        if: ${{ github.event_name == 'push' }}
        env:
          NEXUS_USERNAME: ${{ secrets.CENTRAL_PUBLISHING_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.CENTRAL_PUBLISHING_PASSWORD }}
        run: ./gradlew publishAggregationToCentralPortal -PpublishSigningEnabled=true