release.yml

name: Release

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"
  workflow_dispatch:
    inputs:
      tag:
        description: "Git tag to release from"
        required: true
        type: string

env:
  GRADLE_OPTS: -Dorg.gradle.daemon=false

jobs:
  publish:
    env:
      ORT_VERSION: ${{ inputs.tag || github.ref_name }}
    permissions:
      attestations: write
      contents: write
      id-token: write
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          ref: ${{ env.ORT_VERSION }}
          fetch-depth: 0
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@473878a77f1b98e2b5ac4af93489d1656a80a5ed # v4
        with:
          dependency-graph: generate-and-submit
      - name: Publish to OSSRH
        env:
          GITHUB_DEPENDENCY_GRAPH_REF: refs/heads/main
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.OSSRH_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.OSSRH_PASSWORD }}
          ORG_GRADLE_PROJECT_RELEASE_SIGNING_ENABLED: true
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
          SONATYPE_CONNECT_TIMEOUT_SECONDS: 300
        run: ./gradlew --no-configuration-cache publishAndReleaseToMavenCentral
      - name: Build ORT Distributions
        env:
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
        run: ./gradlew :cli:signDistTar :cli:signDistZip :helper-cli:signDistTar :helper-cli:signDistZip
      - name: Generate Release Notes
        run: ./gradlew -q printChangeLog > RELEASE_NOTES.md
      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create $ORT_VERSION --notes-file RELEASE_NOTES.md \
              ./cli/build/distributions/ort-$ORT_VERSION.{tgz,zip}* \
              ./helper-cli/build/distributions/orth-$ORT_VERSION.{tgz,zip}*
      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1
        with:
          subject-path: |
            ./cli/build/distributions/ort-${{ env.ORT_VERSION }}.tgz
            ./cli/build/distributions/ort-${{ env.ORT_VERSION }}.zip
            ./helper-cli/build/distributions/orth-${{ env.ORT_VERSION }}.tgz
            ./helper-cli/build/distributions/orth-${{ env.ORT_VERSION }}.zip