Fabisev/automating mvn deployment

.github/actions/configure-maven-mirror/action.yml

@@ -0,0 +1,42 @@
+name: Configure Maven CodeArtifact mirror
+description: Configure Maven to resolve dependencies through the release CodeArtifact repository.
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        CA_DOMAIN=aws-lambda
+        CA_REPO=maven-central-store
+
+        # Uses the ambient region and caller account.
+        TOKEN=$(aws codeartifact get-authorization-token \
+          --domain "$CA_DOMAIN" --query authorizationToken --output text)
+        echo "::add-mask::$TOKEN"
+
+        CA_URL=$(aws codeartifact get-repository-endpoint \
+          --domain "$CA_DOMAIN" --repository "$CA_REPO" --format maven \
+          --query repositoryEndpoint --output text)
+
+        # <mirrorOf>*</mirrorOf> routes all resolution through the mirror;
+        # deployment uses distributionManagement and is unaffected.
+        mkdir -p "$HOME/.m2"
+        cat > "$HOME/.m2/settings.xml" <<EOF
+        <settings>
+          <servers>
+            <server>
+              <id>codeartifact-mirror</id>
+              <username>aws</username>
+              <password>${TOKEN}</password>
+            </server>
+          </servers>
+          <mirrors>
+            <mirror>
+              <id>codeartifact-mirror</id>
+              <name>release CodeArtifact Maven Central proxy</name>
+              <url>${CA_URL}</url>
+              <mirrorOf>*</mirrorOf>
+            </mirror>
+          </mirrors>
+        </settings>
+        EOF

.github/actions/configure-release-aws-credentials/action.yml

@@ -0,0 +1,27 @@
+name: "Configure AWS credentials for release (OIDC)"
+description: >
+  Assumes the release OIDC role via aws-actions/configure-aws-credentials so the
+  job can read the signing key and Sonatype token from Secrets Manager. Pinning
+  of the underlying action lives here so it is updated in one place.
+
+inputs:
+  aws-region:
+    description: "AWS region to operate in."
+    required: true
+  role-to-assume:
+    description: "ARN of the OIDC role to assume."
+    required: true
+  role-session-name:
+    description: "Session name for the assumed role (helps distinguish callers in CloudTrail)."
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+      with:
+        aws-region: ${{ inputs.aws-region }}
+        role-to-assume: ${{ inputs.role-to-assume }}
+        role-session-name: ${{ inputs.role-session-name }}
+        # Short-lived: the job only needs the role briefly to read two secrets.
+        role-duration-seconds: 300

.github/actions/resolve-release-version/action.yml

@@ -0,0 +1,54 @@
+name: "Resolve and validate release version"
+description: >
+  Reads the module POM version (the source of truth), verifies it is a
+  -SNAPSHOT, and derives the effective release version (the optional override,
+  or the POM version with -SNAPSHOT stripped). Exports CURRENT_VERSION and
+  EFFECTIVE_RELEASE_VERSION to the job environment for subsequent steps.
+
+inputs:
+  module:
+    description: "Module directory containing the pom.xml to release."
+    required: true
+  release-version-override:
+    description: "Optional release version; defaults to the POM version without -SNAPSHOT."
+    required: false
+    default: ""
+  validate-module-dir:
+    description: "Fail if the module directory or its pom.xml is missing (use for the choice-driven workflow)."
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve and validate release version
+      shell: bash
+      env:
+        MODULE: ${{ inputs.module }}
+        RELEASE_VERSION_OVERRIDE: ${{ inputs.release-version-override }}
+        VALIDATE_MODULE_DIR: ${{ inputs.validate-module-dir }}
+      run: |
+        if [[ "$VALIDATE_MODULE_DIR" == "true" ]]; then
+          if [[ ! -d "$MODULE" ]]; then
+            echo "::error::Module directory '$MODULE' does not exist"
+            exit 1
+          fi
+          if [[ ! -f "$MODULE/pom.xml" ]]; then
+            echo "::error::No pom.xml found in '$MODULE'"
+            exit 1
+          fi
+        fi
+
+        # The POM version is the source of truth and must be a SNAPSHOT.
+        CURRENT_VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version --file "$MODULE/pom.xml")
+        CURRENT_VERSION="${CURRENT_VERSION//[$'\r\n']/}"
+        if [[ "$CURRENT_VERSION" != *-SNAPSHOT ]]; then
+          echo "::error::POM version '$CURRENT_VERSION' is not a SNAPSHOT"
+          exit 1
+        fi
+
+        # Optional override; default strips -SNAPSHOT.
+        EFFECTIVE_RELEASE_VERSION="${RELEASE_VERSION_OVERRIDE:-${CURRENT_VERSION%-SNAPSHOT}}"
+
+        echo "CURRENT_VERSION=$CURRENT_VERSION" >> "$GITHUB_ENV"
+        echo "EFFECTIVE_RELEASE_VERSION=$EFFECTIVE_RELEASE_VERSION" >> "$GITHUB_ENV"