release.yml

name: Publish tag release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+' # Push events to matching semver 20.15.10

jobs:
  publish:

    runs-on: ubuntu-22.04
    env:
      PKGCLD_REPO_URL: ${{ vars.PKGCLD_REPO_URL }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          submodules: true
      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          java-version: '17'
          distribution: 'zulu'
      - name: Build with Gradle
        run: ./gradlew build
      - name: Install expect
        run: |
            sudo apt-get update -y
            sudo apt-get -y install expect dpkg-sig
      - name: Sign RPM and Deb
        run: |
          test -d $HOME/.gnupg || ( mkdir $HOME/.gnupg && chmod go-rwx $HOME/.gnupg )
          GPG_PATH=$HOME/.gnupg scripts/sign-packages.sh $PWD/rd-cli-tool/build/distributions
        env:
          SIGNING_KEY_B64: ${{ secrets.SIGNING_KEY_B64 }}
          RUNDECK_SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          RUNDECK_SIGNING_KEYID: rundeck-core+signing@pagerduty.com
      - name: Release
        run: |
          gh release create \
            --generate-notes \
            --title '${{ github.ref_name }}' \
            ${{ github.ref_name }} \
            ./rd-cli-tool/build/distributions/rd-*.zip \
            ./rd-cli-tool/build/distributions/rundeck-cli-*-1.noarch.rpm \
            ./rd-cli-tool/build/distributions/rundeck-cli_*-1_all.deb \
            ./rd-cli-tool/build/libs/rundeck-cli-*-all.jar \
            ./rd-api-client/build/libs/rd-api-client-*.jar \
            ./rd-cli-lib/build/libs/rd-cli-lib-*.jar
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish Maven artifacts to PackageCloud
        run: |
          if [ -z "$PKGCLD_WRITE_TOKEN" ]; then
            echo "::error::PKGCLD_WRITE_TOKEN must be set to publish to PackageCloud"
            exit 1
          fi
          ./gradlew publishAllPublicationsToPackageCloudRepository
        env:
          PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }}
      - name: Sign and upload GPG signatures to PackageCloud
        run: |
          set -e
          VERSION="${GITHUB_REF_NAME#v}"
          BASE_URL="${PKGCLD_REPO_URL:-https://packagecloud.io/pagerduty/rundeck/maven2}"

          echo "$SIGNING_KEY_B64" | base64 -d | gpg --batch --yes --import
          KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}')

          sign_and_upload() {
            local FILE="$1"
            local REMOTE_URL="$2"
            gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSWORD" --default-key "$KEY_ID" --detach-sign --armor "$FILE"
            curl -sf -H "Authorization: Bearer ${PKGCLD_WRITE_TOKEN}" \
              -X PUT --data-binary "@${FILE}.asc" \
              "${REMOTE_URL}"
          }

          # rd-api-client: local build/libs filenames already match the published artifactId
          RD_API_CLIENT_URL="${BASE_URL}/org/rundeck/api/rd-api-client/${VERSION}"
          sign_and_upload "rd-api-client/build/libs/rd-api-client-${VERSION}.jar" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}.jar.asc"
          sign_and_upload "rd-api-client/build/libs/rd-api-client-${VERSION}-sources.jar" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}-sources.jar.asc"
          sign_and_upload "rd-api-client/build/libs/rd-api-client-${VERSION}-javadoc.jar" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}-javadoc.jar.asc"
          sign_and_upload "rd-api-client/build/publications/rd-api-client/pom-default.xml" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}.pom.asc"

          # rd-cli-lib: local build/libs filenames already match the published artifactId
          RD_CLI_LIB_URL="${BASE_URL}/org/rundeck/cli/rd-cli-lib/${VERSION}"
          sign_and_upload "rd-cli-lib/build/libs/rd-cli-lib-${VERSION}.jar" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}.jar.asc"
          sign_and_upload "rd-cli-lib/build/libs/rd-cli-lib-${VERSION}-sources.jar" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}-sources.jar.asc"
          sign_and_upload "rd-cli-lib/build/libs/rd-cli-lib-${VERSION}-javadoc.jar" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}-javadoc.jar.asc"
          sign_and_upload "rd-cli-lib/build/publications/rd-cli-lib/pom-default.xml" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}.pom.asc"

          # rd-cli-tool: archivesBaseName is 'rundeck-cli', so LOCAL filenames differ from the
          # published Maven artifactId 'rd-cli-tool' -- sign the local files, upload under the
          # published coordinate name.
          RD_CLI_TOOL_URL="${BASE_URL}/org/rundeck/rd/rd-cli-tool/${VERSION}"
          sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}.jar.asc"
          sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}-sources.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}-sources.jar.asc"
          sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}-javadoc.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}-javadoc.jar.asc"
          sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}-all.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}-all.jar.asc"
          sign_and_upload "rd-cli-tool/build/publications/rd-cli-tool/pom-default.xml" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}.pom.asc"
        env:
          SIGNING_KEY_B64: ${{ secrets.SIGNING_KEY_B64 }}
          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }}
      - name: Install Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 2.7.8
      - name: Install packagecloud.io CLI
        run: |
          gem install package_cloud
      - name: Publish OS packages (deb/rpm) to PackageCloud
        run: |
            package_cloud push pagerduty/rundeck/any/any rd-cli-tool/build/distributions/rundeck-cli_*-1_all.deb
            package_cloud push pagerduty/rundeckpro/any/any rd-cli-tool/build/distributions/rundeck-cli_*-1_all.deb
            package_cloud push pagerduty/rundeck/rpm_any/rpm_any rd-cli-tool/build/distributions/rundeck-cli-*-1.noarch.rpm
            package_cloud push pagerduty/rundeckpro/rpm_any/rpm_any rd-cli-tool/build/distributions/rundeck-cli-*-1.noarch.rpm
        env:
          PACKAGECLOUD_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }}
  update_homebrew:
    runs-on: ubuntu-latest
    needs: [publish]
    steps:
      - name: Update Homebrew Tap
        run: |
          curl -L \
            -X POST \
            --fail-with-body \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ secrets.HOMEBREW_PAT }}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/rundeck/homebrew-rundeck-cli/actions/workflows/update.yml/dispatches \
            -d '{"ref":"main","inputs":{}}'