flow-deploy-release-artifact.yaml

name: "Deploy Release Artifact"
on:
  workflow_dispatch:
    inputs:
      java-version:
        description: "Java JDK Version:"
        type: string
        required: false
        default: "17.0.9"
      java-distribution:
        description: "Java JDK Distribution:"
        type: string
        required: false
        default: "temurin"
  push:
    branches:
      - main
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+-?*"

defaults:
  run:
    shell: bash

permissions:
  contents: read

env:
  LC_ALL: C.UTF-8
  PBJ_CORE: pbj-core
  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}

jobs:
  prepare-release:
    name: Release / Prepare
    runs-on: [self-hosted, Linux, medium, ephemeral]
    outputs:
      mode: ${{ steps.info.outputs.mode }}
      version: ${{ steps.info.outputs.version }}
      prerelease: ${{ steps.info.outputs.prerelease }}
    steps:
      - name: Install Semantic Version Tools
        run: |
          echo "::group::Download SemVer Binary"
          sudo curl -L -o /usr/local/bin/semver https://raw.githubusercontent.com/fsaintjacques/semver-tool/master/src/semver
          echo "::endgroup::"
          echo "::group::Change SemVer Binary Permissions"
          sudo chmod -v +x /usr/local/bin/semver
          echo "::endgroup::"
          echo "::group::Show SemVer Binary Version Info"
          semver --version
          echo "::endgroup::"

      - name: Extract Version Info
        id: info
        env:
          IS_TAGGED_RELEASE: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
        run: |
          if [[ "${IS_TAGGED_RELEASE}" == true ]]; then
            RELEASE_VERSION="$(semver get release "${{ github.ref_name }}")"
            PRERELEASE_VERSION="$(semver get prerel "${{ github.ref_name }}")"
  
            RELEASE_MODE="specified"
            FINAL_VERSION="${RELEASE_VERSION}"
            PRERELEASE_FLAG="false"
            [[ -n "${PRERELEASE_VERSION}" ]] && FINAL_VERSION="${RELEASE_VERSION}-${PRERELEASE_VERSION}"
            [[ -n "${PRERELEASE_VERSION}" ]] && PRERELEASE_FLAG="true"
          else
            RELEASE_MODE="snapshot"
            PRERELEASE_FLAG="true"
            FINAL_VERSION=""
          fi

          echo "mode=${RELEASE_MODE}" >>"${GITHUB_OUTPUT}"
          echo "version=${FINAL_VERSION}" >>"${GITHUB_OUTPUT}"
          echo "prerelease=${PRERELEASE_FLAG}" >>"${GITHUB_OUTPUT}"

  maven-central-release:
    name: Release / Maven Central
    runs-on: [self-hosted, Linux, medium, ephemeral]
    needs:
      - prepare-release
    if: |
        (needs.prepare-release.outputs.mode == 'specified' && needs.prepare-release.outputs.prerelease != 'true') 
        || needs.prepare-release.outputs.mode == 'snapshot'
    steps:
      - name: Checkout Code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0

      - name: Setup Java
        uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
        with:
          distribution: ${{ github.event.inputs.java-distribution || 'temurin' }}
          java-version: ${{ github.event.inputs.java-version || '17.0.9' }}

      - name: Setup Gradle
        uses: gradle/gradle-build-action@842c587ad8aa4c68eeba24c396e15af4c2e9f30a # v2.9.0
        with:
          gradle-home-cache-strict-match: false

      - name: Install GnuPG Tools
        run: |
          if ! command -v gpg2 >/dev/null 2>&1; then
            echo "::group::Updating APT Repository Indices"
              sudo apt update
            echo "::endgroup::"
            echo "::group::Installing GnuPG Tools"
              sudo apt install -y gnupg2
            echo "::endgroup::"
          fi

      - name: Import GPG key
        id: gpg_key
        uses: crazy-max/ghaction-import-gpg@82a020f1f7f605c65dd2449b392a52c3fcfef7ef # v6.0.0
        with:
          gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
          passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: true

      - name: Gradle Update Version (As Specified)
        if: ${{ needs.prepare-release.outputs.mode == 'specified' && !cancelled() && !failure() }}
        working-directory: ${{ env.PBJ_CORE }}
        run: ./gradlew versionAsSpecified -PnewVersion=${{ needs.prepare-release.outputs.version }} --scan

      - name: Gradle Update Version (Snapshot)
        if: ${{ needs.prepare-release.outputs.mode == 'snapshot' && !cancelled() && !failure() }}
        working-directory: ${{ env.PBJ_CORE }}
        run: ./gradlew versionAsSnapshot --scan

      - name: Gradle Version Summary
        working-directory: ${{ env.PBJ_CORE }}
        run: ./gradlew githubVersionSummary --scan

      - name: Gradle Assemble
        working-directory: ${{ env.PBJ_CORE }}
        run: ./gradlew assemble --scan

      - name: Gradle Maven Central Release
        if: ${{ needs.prepare-release.outputs.mode == 'specified' && !cancelled() && !failure() }}
        working-directory: ${{ env.PBJ_CORE }}
        env:
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
          GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
          GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
        run: |
          ./gradlew release --no-parallel --scan -PpublishSigningEnabled=true \
              -Pgradle.publish.key=${GRADLE_PUBLISH_KEY} -Pgradle.publish.secret=${GRADLE_PUBLISH_SECRET}

      - name: Gradle Maven Central Snapshot
        if: ${{ needs.prepare-release.outputs.mode == 'snapshot' && !cancelled() && !failure() }}
        working-directory: ${{ env.PBJ_CORE }}
        env:
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
        run: ./gradlew releaseSnapshot --no-parallel --scan -PpublishSigningEnabled=true