github-workflow-samples/.github/workflows/java-central-release-template.yml at main · FsharpGHActions/github-workflow-samples · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
# SPDX-FileCopyrightText: Copyright (C) 2025 Fabrício Barros Cabral
# SPDX-License-Identifier: MIT
---
# yamllint disable rule:line-length
name: java-central-release-template
'on':
  workflow_call:
    inputs:
      working-directory:
        description: "Set the working directory"
        required: false
        default: "."
        type: string
    secrets:
      RELEASE_KEYNAME:
        description: 'GPG key name'
        required: true
      RELEASE_PASSPHRASE:
        description: 'GPG passphrase'
        required: true
      RELEASE_PRIVATE_KEY:
        description: 'GPG private key'
        required: true
      RELEASE_USERNAME:
        description: 'Central token username'
        required: true
      RELEASE_PASSWORD:
        description: 'Central token password'
        required: true
defaults:
  run:
    shell: bash -xeuo pipefail {0}
permissions:
  actions: read
  security-events: write
  contents: read
jobs:
  java-central-release-template:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Setup Java SDK
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: 17
      - name: Configure Maven cache
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-jdk-maven-${{ github.job }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-jdk-maven-${{ github.job }}-
      - name: Configure GPG
        working-directory: ${{ inputs.working-directory }}
        run: |
          echo "${{ secrets.RELEASE_PRIVATE_KEY }}" | gpg --batch --import
          echo "pinentry-mode loopback" >> "${HOME}/.gnupg/gpg.conf"
          gpgconf --launch gpg-agent
          echo "allow-loopback-pinentry" >> "${HOME}/.gnupg/gpg-agent.conf"
          gpgconf --reload gpg-agent
          # Bootstrapping: forces the key to be initialized and unlocked
          echo "test" | gpg --batch --yes --pinentry-mode loopback \
            --passphrase "${{ secrets.RELEASE_PASSPHRASE }}" \
            -u "${{ secrets.RELEASE_KEYNAME }}" -o /dev/null -a --sign
        env:
          GPG_TTY: $(tty)
      - name: Setup Maven settings.xml
        working-directory: ${{ inputs.working-directory }}
        env:
          MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASE_PASSPHRASE }}
        run: |
          # Download and install xmlstarlet
          sudo apt-get install -y -qq xmlstarlet

          # Set settings.xml path
          settings="${HOME}/.m2/settings.xml"

          # Add 'central' server
          xmlstarlet ed -L \
            -s "/*[local-name()='settings']/*[local-name()='servers']" \
              -t elem -n "server" -v "" \
            -s "/*[local-name()='settings']/*[local-name()='servers']/server[last()]" \
              -t elem -n "id" -v "central" \
            -s "/*[local-name()='settings']/*[local-name()='servers']/server[last()]" \
              -t elem -n "username" -v "${{ secrets.RELEASE_USERNAME }}" \
            -s "/*[local-name()='settings']/*[local-name()='servers']/server[last()]" \
              -t elem -n "password" -v "${{ secrets.RELEASE_PASSWORD }}" \
            "${settings}"

          # Add 'gpg' profile
          xmlstarlet ed -L \
            -s "/*[local-name()='settings']" -t elem -n "profiles" -v "" \
            -s "/*[local-name()='settings']/*[local-name()='profiles']" \
              -t elem -n "profile" -v "" \
            -s "/*[local-name()='settings']/*[local-name()='profiles']/profile[last()]" \
              -t elem -n "id" -v "gpg" \
            -s "/*[local-name()='settings']/*[local-name()='profiles']/profile[last()]" \
              -t elem -n "properties" -v "" \
            -s "/*[local-name()='settings']/*[local-name()='profiles']/profile[last()]/properties" \
              -t elem -n "gpg.keyname" -v "${{ secrets.RELEASE_KEYNAME }}" \
            "${settings}"
      - name: Release to Maven Central
        working-directory: ${{ inputs.working-directory }}
        run: |
          [[ -x "mvnw" ]] && mvn="./mvnw" || mvn="mvn"
          ${mvn} --errors --batch-mode deploy -Pcentral -Pgpg -DskipTests=true