protovalidate-java/.github/workflows/release.yaml at main · bufbuild/protovalidate-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: Gradle Publish

on:
  push:
    tags:
      - v*
  workflow_dispatch: {} # support manual runs
permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Cache Go Modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-gomod-ci-${{ hashFiles('gradle.properties', 'gradle/libs.versions.toml') }}
          restore-keys:
            ${{ runner.os }}-gomod-ci-
      - name: Set up JDK
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1.5.0
        with:
          setup_only: true
          token: ${{ secrets.BUF_TOKEN }}
      - name: Validate Gradle Wrapper
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
      - name: Configure GPG signing & publish
        env:
          GPG_KEY: ${{ secrets.GPG_KEY }}
          GPG_KEY_NAME: ${{ secrets.GPG_KEY_NAME }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
        run: |
          export ORG_GRADLE_PROJECT_mavenCentralUsername=$SONATYPE_USER
          export ORG_GRADLE_PROJECT_mavenCentralPassword=$SONATYPE_PASSWORD
          export ORG_GRADLE_PROJECT_signingInMemoryKeyPassword=$GPG_PASSPHRASE
          release_version=$(git describe --tags --abbrev=0 --exact-match)
          export ORG_GRADLE_PROJECT_releaseVersion="${release_version:1}"
          # https://github.com/keybase/keybase-issues/issues/2798
          export GPG_TTY=$(tty)
          # Import gpg keys and warm the passphrase to avoid the gpg
          # passphrase prompt when initiating a deploy
          # `--pinentry-mode=loopback` could be needed to ensure we
          # suppress the gpg prompt
          echo $GPG_KEY | base64 --decode > signing-key
          gpg --passphrase $GPG_PASSPHRASE --batch --import signing-key
          export ORG_GRADLE_PROJECT_signingInMemoryKey=$(gpg --armor --passphrase $GPG_PASSPHRASE --pinentry-mode=loopback --export-secret-keys $GPG_KEY_NAME signing-key | grep -v '\-\-' | grep -v '^=.' | tr -d '\n')
          shred signing-key
          make release