release.yml

# This file was generated by Project Keeper.
name: Release
on:
  workflow_call:
    inputs:
      started-from-ci: {
        description: 'Marks this release as started from CI, skipping precondition check',
        type: boolean,
        required: true,
        default: false
      }
  workflow_dispatch:
    inputs:
      skip-maven-central: {
        description: Skip deployment to Maven Central,
        required: true,
        type: boolean,
        default: false
      }
      skip-github-release: {
        description: Skip creating the GitHub release,
        required: true,
        type: boolean,
        default: false
      }
jobs:
  release:
    runs-on: ubuntu-latest
    defaults:
      run: {
        shell: bash
      }
    concurrency: {
      group: '${{ github.workflow }}',
      cancel-in-progress: false
    }
    permissions: {
      contents: write,
      actions: read,
      issues: read
    }
    steps:
      - name: Checkout the repository
        id: checkout
        uses: actions/checkout@v4
        with: {
          fetch-depth: 0
        }
      - name: Set up Maven Central Repository
        id: configure-maven-central-credentials
        if: ${{ false }}
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: |
            11
            17
          cache: maven
          server-id: ossrh
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Set up JDKs
        id: setup-jdks
        if: ${{ ! false }}
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: |
            11
            17
          cache: maven
      - id: setup-node
        uses: actions/setup-node@v4
        with: {
          node-version: '22',
          cache: npm,
          cache-dependency-path: javascript-test/package-lock.json
        }
      - name: Fail if not running on main branch
        id: check-main-branch
        if: ${{ github.ref != 'refs/heads/main' }}
        uses: actions/github-script@v7
        with:
          script: |
            core.setFailed('Not running on main branch, github.ref is ${{ github.ref }}. Please start this workflow only on main')
      - name: Check CI build of this commit succeeded
        id: check-ci-build-status
        if: ${{ ! inputs.started-from-ci }}
        run: |
          echo "Commit SHA: $COMMIT_SHA"
          gh run list --workflow ci-build.yml --branch main --event push --commit $COMMIT_SHA
          ci_build_status=$(gh run list --workflow ci-build.yml --branch main --event push --commit $COMMIT_SHA --json conclusion --template '{{range .}}{{.conclusion}}{{"\n"}}{{end}}')
          echo "CI build status at commit $COMMIT_SHA was '$ci_build_status'"
          if [[ "$ci_build_status" != "success" ]]; then
            gh run list --workflow ci-build.yml --commit $COMMIT_SHA >> $GITHUB_STEP_SUMMARY
            echo "Status of CI build for commit $COMMIT_SHA was '$ci_build_status', expected 'success'" >> $GITHUB_STEP_SUMMARY
            cat $GITHUB_STEP_SUMMARY
            exit 1
          fi
        env: {
          COMMIT_SHA: '${{ github.sha }}',
          GH_TOKEN: '${{ github.token }}'
        }
      - name: Verify release preconditions
        id: verify-release
        run: |
          mvn --batch-mode com.exasol:project-keeper-maven-plugin:verify-release --projects .
          echo "$GITHUB_OUTPUT"
        env: {
          GITHUB_TOKEN: '${{ github.token }}'
        }
      - {
        name: Build connectors,
        id: build,
        run: ./tools/package_connector.sh
      }
      - {
        name: Generate dummy error code report,
        id: generate-dummy-error-code-report,
        run: 'echo ''{"$schema":"https://schemas.exasol.com/error_code_report-1.0.0.json","errorCodes":[]}'' > target/error_code_report.json'
      }
      - name: Retrieve code signing certificate
        id: retrieve-code-signing-certificate
        run: echo $CODE_SIGNING_CERTIFICATE_BASE64 | base64 --decode > target/cert.p12
        env: {
          CODE_SIGNING_CERTIFICATE_BASE64: '${{ secrets.CODE_SIGNING_CERTIFICATE_BASE64 }}'
        }
      - name: Retrieve code signing certificate chain
        id: retrieve-code-signing-certificate-chain
        run: echo $CODE_SIGNING_CERTIFICATE_CHAIN_BASE64 | base64 --decode > target/cert_chain.p7b
        env: {
          CODE_SIGNING_CERTIFICATE_CHAIN_BASE64: '${{ secrets.CODE_SIGNING_CERTIFICATE_CHAIN_BASE64 }}'
        }
      - name: Sign connectors
        id: sign-connectors
        run: ./tools/sign_connector.sh target/cert.p12 target/cert_chain.p7b
        env: {
          CODE_SIGNING_CERTIFICATE_PASSWORD: '${{ secrets.CODE_SIGNING_CERTIFICATE_PASSWORD }}'
        }
      - {
        name: List secret GPG keys,
        id: list-secret-gpg-keys,
        if: '${{ false && (! inputs.skip-maven-central) }}',
        run: gpg --list-secret-keys
      }
      - name: Publish to Central Repository
        id: deploy-maven-central
        if: ${{ false && (! inputs.skip-maven-central) }}
        run: |
          echo "#### Maven Central Release" >> "$GITHUB_STEP_SUMMARY"
          mvn --batch-mode -Dgpg.skip=false -DskipTests deploy
          echo "Published to Maven Central ✅" >> "$GITHUB_STEP_SUMMARY"
        env: {
          MAVEN_USERNAME: '${{ secrets.OSSRH_USERNAME }}',
          MAVEN_PASSWORD: '${{ secrets.OSSRH_PASSWORD }}',
          MAVEN_GPG_PASSPHRASE: '${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}'
        }
      - name: Calculate Artifact Checksums
        id: artifact-checksum
        if: ${{ ! inputs.skip-github-release }}
        run: |
          echo "Calculating sha256 checksum for artifact files"
          echo "artifacts<<EOF" >> "$GITHUB_OUTPUT"
          IFS=$'\n' artifacts_array=($ARTIFACTS)
          for file in "${artifacts_array[@]}";
          do
              full_path=$(realpath "$file")
              echo "Calculate sha256sum for file '$full_path'"
              file_dir="$(dirname "$full_path")"
              file_name=$(basename "$full_path")
              pushd "$file_dir"
              checksum_file_name="${file_name}.sha256"
              sha256sum "$file_name" > "$checksum_file_name"
              echo "$full_path" >> "$GITHUB_OUTPUT"
              echo "${file_dir}/$checksum_file_name" >> "$GITHUB_OUTPUT"
              popd
          done
          echo "EOF" >> "$GITHUB_OUTPUT"
          echo "Full artifact file list"
          cat "$GITHUB_OUTPUT"
        env: {
          ARTIFACTS: '${{ steps.verify-release.outputs.release-artifacts }}'
        }
      - name: Create GitHub Release
        id: create-github-release
        if: ${{ ! inputs.skip-github-release }}
        run: |
          echo "### GitHub Release" >> "$GITHUB_STEP_SUMMARY"
          IFS=$'\n' artifacts_array=($ARTIFACTS)
          echo "#### Attaching Release Artifacts" >> "$GITHUB_STEP_SUMMARY"
          for file in "${artifacts_array[@]}";
          do
              echo "Attaching artifact '$file'"
              echo "* \`$file\`" >> "$GITHUB_STEP_SUMMARY"
          done
          echo "" >> "$GITHUB_STEP_SUMMARY"
          release_url=$(gh release create --latest --title "$TITLE" --notes "$NOTES" --target main $TAG "${artifacts_array[@]}")
          echo "Created release $TAG with title '$TITLE' at $release_url ✅" >> "$GITHUB_STEP_SUMMARY"
          echo "release-url=$release_url" >> "$GITHUB_OUTPUT"

          # [impl->dsn~release-workflow.create-golang-tags~1]
          echo "#### Creating Additional Tags" >> "$GITHUB_STEP_SUMMARY"
          IFS=$'\n' tags_array=($ADDITIONAL_TAGS)
          for tag in "${tags_array[@]}";
          do
              echo "Creating tag '$tag'"
              git tag "$tag"
              git push origin "$tag"
              echo "* \`$tag\`" >> "$GITHUB_STEP_SUMMARY"
          done

          git fetch --tags origin
        env: {
          GH_TOKEN: '${{ github.token }}',
          TAG: '${{ steps.verify-release.outputs.release-tag }}',
          ADDITIONAL_TAGS: '${{ steps.verify-release.outputs.additional-release-tags }}',
          NOTES: '${{ steps.verify-release.outputs.release-notes }}',
          TITLE: '${{ steps.verify-release.outputs.release-title }}',
          ARTIFACTS: '${{ steps.artifact-checksum.outputs.artifacts }}'
        }
      - name: Report failure Status to Slack channel
        id: report-failure-status-slack
        if: ${{ always() }}
        uses: ravsamhq/notify-slack-action@v2
        with: {
          status: '${{ job.status }}',
          token: '${{ github.token }}',
          notification_title: 'Release build in {repo} has {status_message}',
          message_format: '{emoji} *{workflow}* {status_message} in <{repo_url}|{repo}>',
          notify_when: 'failure,cancelled,warnings,skipped'
        }
        env: {
          SLACK_WEBHOOK_URL: '${{ secrets.INTEGRATION_TEAM_SLACK_NOTIFICATION_WEBHOOK }}'
        }
      - name: Report new release to Slack channel
        id: report-new-release-slack
        if: ${{ steps.create-github-release.outputs.release-url }}
        uses: ravsamhq/notify-slack-action@v2
        with: {
          status: '${{ job.status }}',
          token: '${{ github.token }}',
          notification_title: 'Release build for {repo} created a new release',
          message_format: '{workflow} created release ${{ steps.create-github-release.outputs.release-url }}'
        }
        env: {
          SLACK_WEBHOOK_URL: '${{ secrets.INTEGRATION_TEAM_SLACK_NOTIFICATION_WEBHOOK }}'
        }