Repository navigation
v32.0.0 #64
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Maven | |
| on: | |
| release: | |
| types: [published] | |
| jobs: | |
| bump-version: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Generate GitHub App token | |
| id: generate-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ vars.SDK_GENERATION_APP_ID }} | |
| private-key: ${{ secrets.SDK_GENERATION_APP_PRIVATE_KEY }} | |
| - name: Check out repository code | |
| uses: actions/checkout@v4 | |
| with: | |
| token: ${{ steps.generate-token.outputs.token }} | |
| - name: Set up Python | |
| uses: actions/setup-python@v2 | |
| with: | |
| python-version: '3.x' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install bump-my-version | |
| npm i -g auto-changelog | |
| - name: Bump version | |
| env: | |
| # Passed via env, never interpolated into the script: a git tag name may legally contain | |
| # ; $ ` & | ( ), so inlining it in the script would let a crafted release tag run commands. | |
| INITIAL_TAG: ${{ github.event.release.tag_name }} | |
| run: | | |
| tag="${INITIAL_TAG//[v]/}" | |
| echo "$tag" | |
| git remote update | |
| git fetch | |
| echo "finished fetching" | |
| git checkout --track origin/master | |
| echo "finished checkout" | |
| git config --global user.email "github-actions@github.com" | |
| git config --global user.name "Github Actions" | |
| echo "finished configuration" | |
| bump-my-version bump --config-file .bump_version.toml --current-version 0.0.0 --new-version $tag | |
| echo "bumpversion finished" | |
| auto-changelog | |
| git add . | |
| git commit -m "release $tag" | |
| git push | |
| - name: Move tag | |
| env: | |
| TAG_NAME: ${{ github.event.release.tag_name }} | |
| run: | | |
| echo "$TAG_NAME" | |
| git tag --force "$TAG_NAME" | |
| git push --force origin "$TAG_NAME" | |
| publish: | |
| needs: bump-version | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Check out repository code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.release.tag_name }} | |
| fetch-depth: 0 | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '11' | |
| distribution: 'temurin' | |
| server-id: ossrh | |
| server-username: MAVEN_USERNAME | |
| server-password: MAVEN_PASSWORD | |
| - name: Configure GPG Key | |
| env: | |
| GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }} | |
| run: | | |
| printf '%s' "$GPG_SIGNING_KEY" | base64 --decode | gpg --import --batch | |
| - name: Publish package | |
| # The passphrase goes through env rather than the command line: inlining a secret there | |
| # exposes it in the process list and breaks on quote characters. | |
| run: mvn --batch-mode deploy -Dgpg.passphrase="$GPG_PASSPHRASE" | |
| env: | |
| MAVEN_USERNAME: ${{ secrets.MAVEN_OSSRH_USERNAME }} | |
| MAVEN_PASSWORD: ${{ secrets.MAVEN_OSSRH_TOKEN }} | |
| GPG_PASSPHRASE: ${{ secrets.GPG_PASSWORD }} |