Add release CI pipeline (#934)

* Add release CI pipeline

* Rename DRA build pipeline to its original name

---------

Co-authored-by: Laura Trotta <153528055+l-trotta@users.noreply.github.com>
Fix action parameter name

Update file extension

Mount temp dir in build container

(ci) Require Sonatype credentials

fix

fix

Author: swallez

.buildkite/configure_signing.sh

@@ -1,5 +1,5 @@
 steps:
-  - label: ":java: :elasticsearch: Elasticsearch Java API client - {{matrix.workflow}}"
+  - label: ":java: :elasticsearch: Elasticsearch Java API client DRA - {{matrix.workflow}}"
     agents:
       provider: "gcp"
     branches: [ "main", "7.17", "8.x", "8.17", "8.18", "9.0" ]
@@ -8,4 +8,4 @@ steps:
         workflow:
           - "snapshot"
           - "staging"
-    command: ".ci/release.sh {{matrix.workflow}}"
+    command: ".ci/release_dra.sh {{matrix.workflow}}"

.buildkite/pipeline.yml

@@ -0,0 +1,14 @@
+agents:
+  provider: "gcp"
+
+steps:
+  - label: ":java: :elasticsearch: Elasticsearch Java API client - Release"
+    key: "release"
+    command: ".ci/release_central.sh"
+    artifact_paths:
+      - ".ci/output/repository/**/*"
+
+#notify:
+#  - slack: "#devtools-notify"
+#    # skip slack messages if no failures and dry-run mode
+#    if: 'build.state != "passed" && build.env("dry_run") == "false"'

.buildkite/release_central.yml

@@ -50,6 +50,9 @@ COPY --chown=$BUILDER_UID:$BUILDER_GID config ./config/
 COPY --chown=$BUILDER_UID:$BUILDER_GID java-client/build.gradle.kts ./java-client/
 RUN ./gradlew resolveDependencies
 
+# Note: trailing '*' avoids failing if the file doesn't exist
+COPY --chown=$BUILDER_UID:$BUILDER_GID gradle.properties* ./
+
 # Build artifacts. Expects these mounted directories:
 # /elasticsearch-java/.git - git index (read-only)
 # /elasticsearch-java/java-client/src - source files (read-only)

.ci/Dockerfile

@@ -42,7 +42,9 @@
 # Bootstrap
 # ------------------------------------------------------- #
 
-script_path=$(dirname "$(realpath -s "$0")")
+set -euo pipefail
+
+script_path=$(dirname "$(realpath "$0")")
 repo=$(realpath "$script_path/../")
 
 # shellcheck disable=SC1090
@@ -51,7 +53,6 @@ TASK=$1
 TASK_ARGS=()
 VERSION=$2
 STACK_VERSION=$VERSION
-set -euo pipefail
 
 product="elastic/elasticsearch-java"
 output_folder=".ci/output"
@@ -81,6 +82,15 @@ case $CMD in
             exit 1
         fi
         echo -e "\033[36;1mTARGET: assemble artefact $VERSION\033[0m"
+        TASK=assemble
+        TASK_ARGS=("$VERSION" "$output_folder")
+        ;;
+    release)
+        if [ -z "$VERSION" ]; then
+            echo -e "\033[31;1mTARGET: release -> missing version parameter\033[0m"
+            exit 1
+        fi
+        echo -e "\033[36;1mTARGET: release artefact $VERSION\033[0m"
         TASK=release
         TASK_ARGS=("$VERSION" "$output_folder")
         ;;
@@ -159,7 +169,7 @@ if [[ "$CMD" == "assemble" ]]; then
   fi
 
   build_image
-    echo -e "\033[34;1mINFO:\033[0m Building version ${assemble_version}\033[0m"
+  echo -e "\033[34;1mINFO:\033[0m Building version ${assemble_version}\033[0m"
   docker run --rm --env VERSION=$assemble_version -u "$(id -u)" \
     $git_mount $src_mount $output_mount \
     $docker_image \

.ci/make.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+#
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+#see https://central.sonatype.org/publish/publish-gradle/#distributing-your-public-key
+
+set -euo pipefail
+
+.ci/configure_signing.sh
+
+.ci/make.sh release $VERSION

.ci/release_central.sh

@@ -0,0 +1,56 @@
+name: "Release to Maven Central"
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "Branch or tag ref to run the workflow on"
+        required: true
+      version:
+        description: "The version to release. Must start with the one in config/version.txt"
+        required: true
+      dry_run:
+        description: Used to test other workflow steps, does not publish to Maven Central.
+        type: boolean
+        required: true
+        default: false
+
+env:
+  BRANCH: ${{ inputs.branch }}
+  VERSION: ${{ inputs.version }}
+  DRY_RUN: ${{ inputs.dry_run }}
+
+jobs:
+  validate-version:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+          fetch-depth: '1'
+      - name: Validate version
+        shell: bash
+        run: |
+          repo_version="$(cat config/version.txt)"
+          if [[ ! "$VERSION" = $repo_version* ]]; then
+            echo "Workflow version ($VERSION) and config/version.txt ($repo_version) do not match."
+            exit 1
+          fi
+
+  maven-central-deploy:
+    name: "Deploy to Maven Central (Buildkite)"
+    runs-on: ubuntu-latest
+    needs:
+      - validate-version
+    steps:
+      - id: buildkite-run
+        uses: elastic/oblt-actions/buildkite/run@v1
+        with:
+          pipeline: "elasticsearch-java-release"
+          wait-for: true
+          token: ${{ secrets.BUILDKITE_TOKEN }}
+          branch: ${{ inputs.branch }}
+          env-vars: |
+            DRY_RUN=${{ inputs.dry_run }}
+            VERSION=${{ inputs.version }}

.ci/release.sh renamed to .ci/release_dra.sh

@@ -26,3 +26,39 @@ spec:
         devtools-team: {}
         everyone:
           access_level: READ_ONLY
+
+
+---
+# yaml-language-server: $schema=https://gist.githubusercontent.com/elasticmachine/988b80dae436cafea07d9a4a460a011d/raw/rre.schema.json
+apiVersion: backstage.io/v1alpha1
+kind: Resource
+metadata:
+  name: buildkite-pipeline-elasticsearch-java-release
+  description: Buildkite Release pipeline for elasticsearch-java
+  links:
+    - title: Pipeline
+      url: https://buildkite.com/elastic/elasticsearch-java-release
+  tags:
+    - buildkite
+    - gpg-sign
+    - maven-central
+spec:
+  type: buildkite-pipeline
+  owner: group:devtools-team
+  system: buildkite
+  implementation:
+    apiVersion: buildkite.elastic.dev/v1
+    kind: Pipeline
+    metadata:
+      description: Elasticsearch Java Client Release
+      name: elasticsearch-java-release
+    spec:
+      repository: elastic/elasticsearch-java
+      pipeline_file: ".buildkite/release_central.yml"
+      provider_settings:
+        trigger_mode: none
+      teams:
+        devtools-team:
+          access_level: MANAGE_BUILD_AND_READ
+        everyone:
+          access_level: READ_ONLY

.github/workflows/release_central.yml

@@ -65,8 +65,8 @@ tasks.getByName<ProcessResources>("processResources") {
         if (name != "apis.json") {
             // Only process main source-set resources (test files are large)
             expand(
-                    "version" to version,
-                    "git_revision" to (if (rootProject.extra.has("gitHashFull")) rootProject.extra["gitHashFull"] else "unknown")
+                "version" to version,
+                "git_revision" to (if (rootProject.extra.has("gitHashFull")) rootProject.extra["gitHashFull"] else "unknown")
             )
         }
     }
@@ -166,7 +166,7 @@ publishing {
                     // are the same as the one used in the dependency section below.
                     val xPathFactory = javax.xml.xpath.XPathFactory.newInstance()
                     val depSelector = xPathFactory.newXPath()
-                            .compile("/project/dependencies/dependency[groupId/text() = 'org.elasticsearch.client']")
+                        .compile("/project/dependencies/dependency[groupId/text() = 'org.elasticsearch.client']")
                     val versionSelector = xPathFactory.newXPath().compile("version")
 
                     var foundVersion = false;
@@ -282,15 +282,15 @@ licenseReport {
 class SpdxReporter(val dest: File) : ReportRenderer {
     // License names to their SPDX identifier
     val spdxIds = mapOf(
-            "The Apache License, Version 2.0" to "Apache-2.0",
-            "Apache License, Version 2.0" to "Apache-2.0",
-            "The Apache Software License, Version 2.0" to "Apache-2.0",
-            "BSD Zero Clause License" to "0BSD",
-            "Eclipse Public License 2.0" to "EPL-2.0",
-            "Eclipse Public License v. 2.0" to "EPL-2.0",
-            "Eclipse Public License - v 2.0" to "EPL-2.0",
-            "GNU General Public License, version 2 with the GNU Classpath Exception" to "GPL-2.0 WITH Classpath-exception-2.0",
-            "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0" to "CDDL-1.0"
+        "The Apache License, Version 2.0" to "Apache-2.0",
+        "Apache License, Version 2.0" to "Apache-2.0",
+        "The Apache Software License, Version 2.0" to "Apache-2.0",
+        "BSD Zero Clause License" to "0BSD",
+        "Eclipse Public License 2.0" to "EPL-2.0",
+        "Eclipse Public License v. 2.0" to "EPL-2.0",
+        "Eclipse Public License - v 2.0" to "EPL-2.0",
+        "GNU General Public License, version 2 with the GNU Classpath Exception" to "GPL-2.0 WITH Classpath-exception-2.0",
+        "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0" to "CDDL-1.0"
     )
 
     private fun quote(str: String): String {