publish.yml

#
#   Copyright 2026 Aiven Oy and project contributors
#
#    Licensed under the Apache License, Version 2.0 (the "License");
#    you may not use this file except in compliance with the License.
#    You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing,
#    software distributed under the License is distributed on an
#    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
#    KIND, either express or implied.  See the License for the
#    specific language governing permissions and limitations
#    under the License.
#
#  SPDX-License-Identifier: Apache-2


# Workflow to check pull requests and new commits to main branches
# This checks the source in the state as if after the merge.
name: Publish
on:
  workflow_dispatch:

permissions:
  contents: read

# Disallow concurrent runs for the same PR by cancelling in-progress runs
# when new commits are pushed
concurrency:
  group: publish-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:

      - name: Checkout code
        uses: actions/checkout@v6

      - name: Extract version info
        run: |
          echo "version=$(mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec)" >> $GITHUB_OUTPUT;
          echo "java_version=$(mvn -q -Dexec.executable=echo -Dexec.args='${jdk.version}' --non-recursive exec:exec)" >> $GITHUB_OUTPUT;
        id: project


      - name: Set up JDK ${{ steps.project.outputs.java_version }}
        uses: actions/setup-java@v5
        with:
          distribution: 'adopt'
          java-version: ${{ steps.project.outputs.java_version }}
          cache: maven


      - name: Build  ${{ steps.project.outputs.version }})
        run: mvn -e -B -V -ntp clean verify
        env:
          MAVEN_GPG_KEY: ${{ secrets.GPG_KEY }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSWORD }}

      - name: setup Maven settings.xml
        uses: s4u/maven-settings-action@v4.0.0
        with:
          sonatypeSnapshots: true
          servers: |
            [{
              "id": "central",
              "username": "${{ secrets.SONATYPE_ID }}",
              "password": "${{ secrets.SONATYPE_PASSWORD }}"
            }, {
              "id": "central-snapshot",
              "username": "${{ secrets.SONATYPE_ID }}",
              "password": "${{ secrets.SONATYPE_PASSWORD }}"
            }]

      - name: Sign and Publish (Maven deploy)
        run: mvn -P sign --batch-mode -Dgpg.signer=bc deploy
        env:
          MAVEN_GPG_KEY: ${{ secrets.GPG_KEY }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSWORD }}

      - name: "Upload build failure reports"
        uses: actions/upload-artifact@v7
        if: failure()
        with:
          name: test-results
          path: |
            **/target/*-reports/**
          retention-days: 1