chore: release 0.11.0 (#87) #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| push: | |
| branches: [ release-branch ] | |
| permissions: | |
| contents: write | |
| jobs: | |
| publish: | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '17' | |
| - name: Validate required secrets are set | |
| env: | |
| GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} | |
| GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }} | |
| GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} | |
| MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| run: | | |
| set -euo pipefail | |
| missing=() | |
| [ -z "$GPG_PRIVATE_KEY" ] && missing+=("GPG_PRIVATE_KEY") | |
| [ -z "$GPG_KEY_ID" ] && missing+=("GPG_KEY_ID") | |
| [ -z "$GPG_PASSPHRASE" ] && missing+=("GPG_PASSPHRASE") | |
| [ -z "$MAVEN_CENTRAL_USERNAME" ] && missing+=("MAVEN_CENTRAL_USERNAME") | |
| [ -z "$MAVEN_CENTRAL_PASSWORD" ] && missing+=("MAVEN_CENTRAL_PASSWORD") | |
| if [ ${#missing[@]} -gt 0 ]; then | |
| echo "::error::Missing required secrets: ${missing[*]}" | |
| echo "Go to Settings > Secrets and variables > Actions to configure them." | |
| exit 1 | |
| fi | |
| echo "All required secrets are set." | |
| - name: Inject publish credentials | |
| uses: ./.github/actions/inject-credentials | |
| with: | |
| gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| gpg-key-id: ${{ secrets.GPG_KEY_ID }} | |
| gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }} | |
| maven-central-username: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| maven-central-password: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| - name: Verify gradle.properties has credentials | |
| run: | | |
| set -euo pipefail | |
| for prop in signing.gnupg.keyName signing.gnupg.passphrase maven.central.username maven.central.password; do | |
| if ! grep -q "^${prop}=" gradle.properties; then | |
| echo "::error::Property '${prop}' missing from gradle.properties after credential injection." | |
| exit 1 | |
| fi | |
| done | |
| echo "All credential properties verified in gradle.properties." | |
| - name: Publish all modules to Central Portal | |
| run: | | |
| ./gradlew publishAggregationToCentralPortal --no-configuration-cache | |
| create-release: | |
| needs: [ publish ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Read version from gradle.properties | |
| id: version | |
| run: | | |
| if [ ! -f gradle.properties ]; then | |
| echo "::error::gradle.properties not found" >&2 | |
| exit 1 | |
| fi | |
| VERSION=$(grep "^kraft.version=" gradle.properties | cut -d= -f2) | |
| if [ -z "${VERSION// /}" ]; then | |
| echo "::error::kraft.version is empty or missing in gradle.properties" >&2 | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Resolve previous release tag | |
| id: prev | |
| run: | | |
| # release-branch is force-reset to `main + chore: release <v>` each | |
| # cycle, so prior release tags are not ancestors of the new release | |
| # SHA. Without an explicit --notes-start-tag, gh's --generate-notes | |
| # falls back to "no previous release" and dumps every PR since #1 | |
| # into the changelog (and renders Full Changelog as commits/<tag> | |
| # instead of compare/<prev>...<tag>). Pick the most recent stable | |
| # release tag globally by version sort, restricted to bare | |
| # MAJOR.MINOR.PATCH so old experimental tags (v*, -RC*, -Alpha*, | |
| # -test*) don't sort on top. | |
| git fetch --tags --force --quiet | |
| LAST_TAG=$(git for-each-ref --sort=-v:refname \ | |
| --format='%(refname:short)' 'refs/tags/[0-9]*' \ | |
| | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \ | |
| | grep -v "^${{ steps.version.outputs.version }}$" \ | |
| | head -n1) | |
| echo "tag=$LAST_TAG" >> "$GITHUB_OUTPUT" | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PREV_TAG: ${{ steps.prev.outputs.tag }} | |
| run: | | |
| args=( | |
| "${{ steps.version.outputs.version }}" | |
| --generate-notes | |
| --title "${{ steps.version.outputs.version }}" | |
| --target "${{ github.sha }}" | |
| ) | |
| if [ -n "$PREV_TAG" ]; then | |
| args+=( --notes-start-tag "$PREV_TAG" ) | |
| fi | |
| gh release create "${args[@]}" | |
| sync-version-to-main: | |
| needs: [ create-release ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: release-branch | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Push version files to main | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| VERSION=$(grep "^kraft.version=" gradle.properties | cut -d= -f2) | |
| git checkout main | |
| git checkout release-branch -- gradle.properties .release-please-manifest.json | |
| git add gradle.properties .release-please-manifest.json | |
| git diff --cached --quiet || git commit -m "chore: sync version $VERSION to main" | |
| git push origin main |