Automate OSSRH releases to maven central

.github/workflows/gradle-build.yml

@@ -18,8 +18,10 @@ jobs:
  java-version: 21
  distribution: 'temurin'
  cache: gradle
- - name: Detect Secrets
- uses: RobertFischer/[email protected]
+ - name: Detect secrets
+ run: |
+ pip install detect-secrets
+ git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
  - name: Grant Execute permission for gradlew
  run: chmod +x gradlew
  - name: Build with Gradle
@@ -46,7 +48,7 @@ jobs:
  settings.gradle
  gradle.properties
  **/gradle/**
- Scripts/**
+ scripts/**
 
  build-java-8:
  runs-on: ubuntu-latest

.github/workflows/preview-and-release.yml

@@ -14,8 +14,10 @@ on:
  workflow_dispatch:
 
 env:
- PREVIEW_TASK: publishSnapshotPublicationToSonatypeSnapshotRepository
- PUBLISH_TASK: publishMavenCentralReleasePublicationToSonatypeRepository
+ PREVIEW_TASK: publishToSonatype
+ PUBLISH_TASK: publishToSonatype closeAndReleaseSonatypeStagingRepository
+ JAVA_VERSION: 21
+ JAVA_DISTRIBUTION: 'temurin'
 
 permissions:
  contents: write
@@ -26,24 +28,27 @@ jobs:
  environment:
  name: maven_central_snapshot
  runs-on: ubuntu-latest
+ needs: validate-package-contents
  steps:
  - uses: actions/checkout@v4
  - name: Set up JDK
  uses: actions/setup-java@v4
  with:
- java-version: 21
- distribution: 'temurin'
+ java-version: ${{ env.JAVA_VERSION }}
+ distribution: ${{ env.JAVA_DISTRIBUTION}}
  cache: gradle
- - name: Easy detect-secrets
- uses: RobertFischer/[email protected]
+ - name: Detect secrets
+ run: |
+ pip install detect-secrets
+ git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
  - name: Download File
- run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+ run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
  shell: pwsh
  env:
  ENCODED_VALUE: ${{ secrets.LOCAL_PROPERTIES }}
  OUTPUT_PATH: '.\local.properties'
  - name: Download File
- run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+ run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
  shell: pwsh
  env:
  ENCODED_VALUE: ${{ secrets.SECRING_GPG }}
@@ -58,32 +63,35 @@ jobs:
  environment:
  name: maven_central_release
  runs-on: ubuntu-latest
+ needs: validate-package-contents
  steps:
  - uses: actions/checkout@v4
  - name: Set up JDK
  uses: actions/setup-java@v4
  with:
- java-version: 21
- distribution: 'temurin'
+ java-version: ${{ env.JAVA_VERSION }}
+ distribution: ${{ env.JAVA_DISTRIBUTION}}
  cache: gradle
- - name: Easy detect-secrets
- uses: RobertFischer/[email protected]
+ - name: Detect secrets
+ run: |
+ pip install detect-secrets
+ git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline
  - name: Download File
- run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+ run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
  shell: pwsh
  env:
  ENCODED_VALUE: ${{ secrets.LOCAL_PROPERTIES }}
  OUTPUT_PATH: '.\local.properties'
  - name: Download File
- run: .\Scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+ run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
  shell: pwsh
  env:
  ENCODED_VALUE: ${{ secrets.SECRING_GPG }}
  OUTPUT_PATH: '.\secring.gpg'
  - name: Grant execute permission for gradlew
  run: chmod +x gradlew
  - name: Publish
- run: ./gradlew $PUBLISH_TASK
+ run: ./gradlew $PUBLISH_TASK -PmavenCentralSnapshotArtifactSuffix=""
  - name: Upload Build Artifact
  uses: actions/upload-artifact@v4
  with:
@@ -98,11 +106,54 @@ jobs:
  settings.gradle
  gradle.properties
  **/gradle/**
- Scripts/**
+ scripts/**
  - name: GitHub Release
  uses: softprops/action-gh-release@v2
  with:
  token: ${{ secrets.GITHUB_TOKEN }}
  fail_on_unmatched_files: true
  files: |
  build/**/*.jar
+
+ validate-package-contents:
+ runs-on: ubuntu-latest
+ environment: ${{ contains(github.ref, 'refs/tags/v') && 'maven_central_release' || 'maven_central_snapshot' }}
+ defaults:
+ run:
+ working-directory: ./
+ steps:
+ - uses: actions/checkout@v4
+ - name: Setup JDK
+ uses: actions/setup-java@v4
+ with:
+ java-version: ${{ env.JAVA_VERSION }}
+ distribution: ${{ env.JAVA_DISTRIBUTION}}
+ cache: gradle
+ - name: Download file
+ run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+ shell: pwsh
+ env:
+ ENCODED_VALUE: ${{ secrets.LOCAL_PROPERTIES }}
+ OUTPUT_PATH: 'local.properties'
+ - name: Download file
+ run: .\scripts\decodeAndWrite.ps1 -encodedValue $env:ENCODED_VALUE -outputPath $env:OUTPUT_PATH
+ shell: pwsh
+ env:
+ ENCODED_VALUE: ${{ secrets.SECRING_GPG }}
+ OUTPUT_PATH: '.\secring.gpg'
+ - name: Publish to local Maven cache for validation
+ run: ./gradlew --no-daemon publishToMavenLocal
+ - name: Get current SNAPSHOT version
+ shell: pwsh
+ run: |
+ $contents = Get-Content gradle.properties -Raw
+ $major = $contents | Select-String -Pattern 'mavenMajorVersion\s+= ([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
+ $minor = $contents | Select-String -Pattern 'mavenMinorVersion\s+= ([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
+ $patch = $contents | Select-String -Pattern 'mavenPatchVersion\s+= ([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
+ $version = "$major.$minor.$patch-SNAPSHOT"
+ echo "Current version is $version"
+ echo "PACKAGE_VERSION=$version" >> $Env:GITHUB_ENV
+ - name: Inspect contents of local Maven cache
+ shell: pwsh
+ run: |
+ .\scripts\validatePackageContents.ps1 -ArtifactId msgraph-sdk-java -Version $env:PACKAGE_VERSION