release.yml

# Publishes a release to Maven Central and creates the GitHub release. Triggered by pushing a tag
# "v<version>" whose version matches the POM, see "Releasing" in CONTRIBUTING.md.
name: Release
# a tag push carries no commit for GitHub to title the run with, so name it by the tag
run-name: Release ${{ github.ref_name }}

on:
  push:
    tags: ['v*']

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 21
          cache: maven
          # settings.xml with the Central portal token, read from the environment of the deploy step
          server-id: central
          server-username: CENTRAL_USERNAME
          server-password: CENTRAL_PASSWORD
          # imports the signing key; the passphrase is read from the named environment variable
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Scope the Central credentials to central.sonatype.com
        # Maven 3.10 offers the credentials of a settings server only to repositories declared with
        # that id, and 'central' is also the id of Maven Central: without this origin the Central
        # snapshot repository and publisher API get no credentials (401), see CONTRIBUTING.md.
        run: |
          sed -i 's|<id>central</id>|<id>central</id><repositoryOrigins><repositoryOrigin>https://central.sonatype.com</repositoryOrigin></repositoryOrigins>|' ~/.m2/settings.xml
          grep -c '<repositoryOrigin>https://central.sonatype.com</repositoryOrigin>' ~/.m2/settings.xml

      - name: Check that the tag matches the project version
        run: |
          version=$(./mvnw -q -N --no-transfer-progress org.apache.maven.plugins:maven-help-plugin:3.5.1:evaluate -Dexpression=project.version -DforceStdout)
          echo "project version: $version, tag: $GITHUB_REF_NAME"
          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
            echo "::error::tag $GITHUB_REF_NAME does not match version $version in pom.xml"
            exit 1
          fi
          case "$version" in *-SNAPSHOT) echo "::error::refusing to release a snapshot"; exit 1;; esac

      - name: Build, test, sign and publish
        run: ./mvnw -B --no-transfer-progress -Prelease deploy
        env:
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Collect SBOMs
        run: |
          mkdir -p sbom
          for bom in */target/bom.json; do
            module=${bom%%/*}
            cp "$bom" "sbom/${module}-${GITHUB_REF_NAME#v}-cyclonedx.json"
          done
          ls sbom

      - name: Take the release notes from the changelog
        run: |
          version="${GITHUB_REF_NAME#v}"
          # the section of this version, without its heading, up to the next version heading
          awk -v v="$version" '
            /^## \[/ { in_section = ($0 ~ "^## \\[" v "\\]") ; next }
            in_section && !/^\[/ { print }
          ' CHANGELOG.md | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}' > notes.md
          if [ ! -s notes.md ]; then
            echo "::error::CHANGELOG.md has no section for $version"
            exit 1
          fi
          cat notes.md

      - name: Create the GitHub release
        run: gh release create "$GITHUB_REF_NAME" --verify-tag --notes-file notes.md --title "${GITHUB_REF_NAME#v}" sbom/*
        env:
          GH_TOKEN: ${{ github.token }}