release.yml

name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - "*.*.*"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  GRADLE_OPTS: '-Dorg.gradle.daemon=false -Dorg.gradle.java.installations.auto-detect=false -Dorg.gradle.warning.mode=fail'
  JAVA_VERSION: '17'

jobs:
  ci:
    uses: ./.github/workflows/ci.yml
    permissions:
      contents: read

  ci-low-cadence:
    uses: ./.github/workflows/ci-low-cadence.yml
    permissions:
      contents: read

  codeql:
    uses: ./.github/workflows/codeql.yml
    permissions:
      actions: read
      contents: read
      security-events: write

  release-java:
    name: Release java artifacts
    permissions:
      contents: read
      packages: write
    needs: [ ci, ci-low-cadence, codeql ]
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
      - name: Cache Gradle dependencies
        uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-caches-${{ hashFiles('**/*.gradle') }}
          restore-keys: |
            ${{ runner.os }}-gradle-caches-
      - name: Cache Gradle wrappers
        uses: actions/cache@v4
        with:
          path: ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
      - name: Setup java
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ env.JAVA_VERSION }}
      - name: Setup BUILD_JAVA_HOME & BUILD_JAVA_VERSION
        run: |
          java -Xinternalversion
          echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
          echo "BUILD_JAVA_VERSION=17" >> $GITHUB_ENV
      - name: Publish with Gradle
        run: ./gradlew publish
        env:
          ORG_GRADLE_PROJECT_ossrhUsername: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_ossrhPassword: ${{ secrets.SONATYPE_CENTRAL_PASSWORD }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_RSA_SIGN_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_RSA_SIGN_KEYPASS }}