release.yml

name: Release

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:
    inputs:
      tag:
        description: "Git tag to release from"
        required: true
        type: string

env:
  GRADLE_OPTS: -Dorg.gradle.daemon=false

jobs:
  publish:
    env:
      ORT_VERSION: ${{ inputs.tag || github.ref_name }}
    permissions:
      attestations: write
      contents: write
      id-token: write
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          ref: ${{ env.ORT_VERSION }}
          fetch-depth: 0
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4
        with:
          gradle-home-cache-cleanup: true
      - name: Publish to OSSRH
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.OSSRH_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.OSSRH_PASSWORD }}
          ORG_GRADLE_PROJECT_RELEASE_SIGNING_ENABLED: true
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
        run: ./gradlew --no-configuration-cache publishAndReleaseToMavenCentral
      - name: Build ORT Distributions
        env:
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
        run: ./gradlew :cli:signDistTar :cli:signDistZip :helper-cli:signDistTar :helper-cli:signDistZip
      - name: Generate Release Notes
        run: ./gradlew -q printChangeLog > RELEASE_NOTES.md
      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create $ORT_VERSION --notes-file RELEASE_NOTES.md \
              ./cli/build/distributions/ort-$ORT_VERSION.{tgz,zip}* \
              ./helper-cli/build/distributions/orth-$ORT_VERSION.{tgz,zip}*
      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@310b0a4a3b0b78ef57ecda988ee04b132db73ef8 # v1
        with:
          subject-path: |
            ./cli/build/distributions/ort-${{ env.ORT_VERSION }}.tgz
            ./cli/build/distributions/ort-${{ env.ORT_VERSION }}.zip
            ./helper-cli/build/distributions/orth-${{ env.ORT_VERSION }}.tgz
            ./helper-cli/build/distributions/orth-${{ env.ORT_VERSION }}.zip