release-publish.yml

# Copyright (C) 2020 Dremio
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Publish Nessie release artifacts

# Triggered when a `nessie-*` tag is being pushed.

# Publishes the Maven, Python, Docker and Gradle-plugin artifacts.

# GitHub environment name:
#   release
# Required secrets:
#   OSSRH_ACCESS_ID
#   OSSRH_TOKEN
#   MAVEN_GPG_PASSPHRASE

name: Publish release

on:
  push:
    tags:
      - nessie-*

  workflow_dispatch:
    inputs:
      releaseTag:
        description: 'Release tag name to re-release'
        required: true

jobs:
  publish-release:
    name: Publish release
    runs-on: ubuntu-22.04
    if: github.repository_owner == 'projectnessie'
    # Runs in the `release` environment, which has the necessary secrets and defines the reviewers.
    # See https://docs.github.com/en/actions/reference/environments
    environment: release

    steps:

    # GH doesn't provide just the tag name, so this step strips `/refs/tags/nessie-` from `GITHUB_REF`
    # and provides the output `VERSION` or, in case of a manual run, uses the input `releaseTag` as
    # the input tag name.
    - name: Get release version
      run: |
        if [[ "${{ github.event_name }}" == "push" ]] ; then
          V="${GITHUB_REF/refs\/tags\/}"
        else
          V="${{ github.event.inputs.releaseTag }}"
        fi
        # check if tag matches patterns like nessie-0.5, nessie-0.10.4.3-alpha1, etc
        if [[ ${V} =~ ^nessie-[0-9]+[.][0-9.]*[0-9](-[a-zA-Z0-9]+)?$ ]]; then
          echo "RELEASE_VERSION=${V/nessie-}" >> ${GITHUB_ENV}
          echo "GIT_TAG=${V}" >> ${GITHUB_ENV}
        else
          echo "Tag must start with nessie- followed by a valid version (got tag ${V}, ref is ${GITHUB_REF} )"
          exit 1
        fi

    ### BEGIN runner setup
    - name: Checkout
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      if: ${{ github.event_name == 'push' }}
      with:
        fetch-depth: '0'
    - name: Checkout
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      if: ${{ github.event_name == 'workflow_dispatch' }}
      with:
        fetch-depth: '0'
        ref: refs/tags/${{ github.event.inputs.releaseTag }}
    - name: Setup Java, Gradle
      uses: ./.github/actions/dev-tool-java
      with:
        gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: 18.x
    ### END runner setup

    - name: NPM Install
      run: npm install
    - name: NPM Generate API
      run: npm run generate-api
    - name: NPM fix API
      run: npm run fix-generated-client
    - name: NPM build
      env:
        GENERATE_SOURCEMAP: false
        DISABLE_ESLINT_PLUGIN: false
        DISABLE_TERSER_PLUGIN: false
        PROFILE_PLUGINS: false
      run: npm run build
    - name: Generate UI jar
      run: ./gradlew jar

    # Deploys Maven artifacts. Build and test steps were already ran in previous steps.
    # Not running tests, because the environment contains secrets.
    - name: Publish Maven artifacts for release
      env:
        # To release with Gradle
        ORG_GRADLE_PROJECT_signingKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
        ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
        ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_ACCESS_ID }}
        ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_TOKEN }}
        # To release commits that used Maven to build
        MAVEN_USERNAME: ${{ secrets.OSSRH_ACCESS_ID }}
        MAVEN_OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
        MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
      run: |
        echo "::group::Publish to Sonatype"
        ./gradlew publishToMavenLocal publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease
        echo "::endgroup::"

        echo "## Successfully released ${RELEASE_VERSION} to Sonatype" >> $GITHUB_STEP_SUMMARY