reusable-release.yml

name: Reusable Automated Maven Release workflow

on:
  workflow_call:
    secrets:
      AUTOMATED_MAVEN_RELEASE_PGP_SECRET:
        required: true
      AUTOMATED_MAVEN_RELEASE_SONATYPE_PASSWORD:
        required: true

# Determine Release Version (project code)
# Create Release Commit (release-workflow-code as GitHub App) - includes GitHub Actor in commit message
#   * https://github.com/orgs/community/discussions/50055
# ... wait on standard tests to run?!
# Create artifacts (project code)
# Sign artifacts (release-workflow-code as GitHub App)
#  * Create Release Tag, with artifact hashes in tag message
#  * Create post-Release Commit with post-release version
# Release artifacts to Maven (release-workflow-code as GitHub App)
# Create GitHub Release (release-workflow-code as GitHub App)

env:
  LOCAL_ARTIFACTS_STAGING_PATH: /tmp/artifact_staging

jobs:
  identifiers-for-signing-key:
    name: 🔒 Read Signing Key Id
    runs-on: ubuntu-latest
    outputs:
      key_fingerprint: ${{ steps.read-identifiers.outputs.key_fingerprint }}
      key_email: ${{ steps.read-identifiers.outputs.key_email }}
    steps:
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: 17
          gpg-private-key: ${{ secrets.AUTOMATED_MAVEN_RELEASE_PGP_SECRET }}
      - name: Read Identifiers from Signing Key
        id: read-identifiers
        run: |
          key_fingerprint_and_email=$(gpg2 --list-secret-keys --list-options show-only-fpr-mbox)
          key_fingerprint=$(echo $key_fingerprint_and_email | awk '{print $1}')
          key_email=$(echo $key_fingerprint_and_email | awk '{print $2}')
          echo "key_fingerprint=$key_fingerprint"
          
          cat << EndOfFile >> $GITHUB_OUTPUT
          key_fingerprint=$key_fingerprint
          key_email=$key_email
          EndOfFile


  generate-version-update-commits:
    name: 🎊 Test & Version
    needs: identifiers-for-signing-key
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is merged
        with:
          distribution: corretto
          java-version: 17
      - name: Use sbt-release to construct version.sbt updates
        env:
          KEY_EMAIL: ${{ needs.identifiers-for-signing-key.outputs.key_email }}
        run: |
          git config user.email "$KEY_EMAIL"
          git config user.name "@$GITHUB_ACTOR using Guardian Automated Maven Release"
          sbt "release with-defaults"
          echo $GITHUB_WORKSPACE
          cd `mktemp -d`
          git clone --bare $GITHUB_WORKSPACE repo-with-unsigned-version-update-commits.git
          rm -Rf $GITHUB_WORKSPACE/*
          mv repo-with-unsigned-version-update-commits.git $GITHUB_WORKSPACE/
          ls -lR $GITHUB_WORKSPACE
      - name: Job summary
        run: |
          echo "# Release $(git describe --tags --abbrev=0)" >> $GITHUB_STEP_SUMMARY
      - uses: actions/cache/save@v3
        with:
          path: repo-with-unsigned-version-update-commits.git
          key: repo-with-unsigned-version-update-commits-${{ github.run_id }}-${{ github.run_attempt }}

  push-release-commit:
    name: 🔒 Push Release Commit
    needs: [generate-version-update-commits, identifiers-for-signing-key]
    permissions:
      contents: write
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.create-commit.outputs.release_tag }}
      release_commit_id: ${{ steps.create-commit.outputs.release_commit_id }}
    steps:
      - uses: actions/checkout@v4
        with:
          path: repo
      - uses: actions/cache/restore@v3
        with:
          path: repo-with-unsigned-version-update-commits.git
          key: repo-with-unsigned-version-update-commits-${{ github.run_id }}-${{ github.run_attempt }}
          fail-on-cache-miss: true
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: 17
          gpg-private-key: ${{ secrets.AUTOMATED_MAVEN_RELEASE_PGP_SECRET }}
      - name: Create commit
        id: create-commit
        env:
          KEY_FINGERPRINT: ${{ needs.identifiers-for-signing-key.outputs.key_fingerprint }}
          KEY_EMAIL: ${{ needs.identifiers-for-signing-key.outputs.key_email }}
        run: |
          echo "GITHUB_REF_NAME=$GITHUB_REF_NAME"
          echo "GITHUB_REF=$GITHUB_REF"
          
          cd repo-with-unsigned-version-update-commits.git
          release_tag=$(git describe --tags --abbrev=0)
          
          cd ../repo
          git status
          git config user.email "$KEY_EMAIL"
          git config user.name "@$GITHUB_ACTOR using Guardian Automated Maven Release"
          git config commit.gpgsign true
          git config user.signingkey "$KEY_FINGERPRINT"
          
          git remote add unsigned ../repo-with-unsigned-version-update-commits.git
          git fetch unsigned
          git cherry-pick -S$KEY_FINGERPRINT $GITHUB_REF_NAME..unsigned/$GITHUB_REF_NAME
          git status
          
          release_commit_id=$(git rev-parse HEAD^)
          
          cat << EndOfFile >> $GITHUB_OUTPUT
          release_tag=$release_tag
          release_commit_id=$release_commit_id
          EndOfFile
          
          git log --format="%h %p %ce %s" --decorate=short -n3
          git status
          git push

  create-artifacts:
    name: 🎊 Create artifacts
    needs: [identifiers-for-signing-key, push-release-commit]
    runs-on: ubuntu-latest
    outputs:
      ARTIFACT_SHA256SUMS: ${{ steps.record-hashes.outputs.ARTIFACT_SHA256SUMS }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
      - uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is resolved
        with:
          distribution: corretto
          java-version: 17
      - name: Generate artifacts
        run: |
          cat << EndOfFile > sbt-commands.txt
          set every sonatypeProjectHosting := Some(xerial.sbt.Sonatype.GitHubHosting("$GITHUB_REPOSITORY_OWNER", "${GITHUB_REPOSITORY#*/}", "${{ needs.identifiers-for-signing-key.outputs.key_email }}"))
          set ThisBuild / publishTo := Some(Resolver.file("foobar", file("$LOCAL_ARTIFACTS_STAGING_PATH")))
          EndOfFile
          cat sbt-commands.txt
          
          sbt ";< sbt-commands.txt; +publish"
      - name: Record SHA-256 hashes of artifacts
        id: record-hashes
        run: |
          sudo apt-get install hashdeep -q > /dev/null
          
          cd $LOCAL_ARTIFACTS_STAGING_PATH
          {
            echo 'ARTIFACT_SHA256SUMS<<EOF'
            sha256deep -r -l .
            echo EOF
          } >> "$GITHUB_OUTPUT"

      - uses: actions/cache/save@v3
        id: cache
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: unsigned-${{ github.run_id }}-${{ github.run_attempt }}

  sign:
    name: 🔒 Sign
    needs: [identifiers-for-signing-key, push-release-commit, create-artifacts]
    runs-on: ubuntu-latest
    env:
      KEY_FINGERPRINT: ${{ needs.identifiers-for-signing-key.outputs.key_fingerprint }}
    steps:
      - uses: actions/checkout@v4
        with:
          path: repo
          ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
      - uses: actions/cache/restore@v3
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: unsigned-${{ github.run_id }}-${{ github.run_attempt }}
          fail-on-cache-miss: true
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: 17
          gpg-private-key: ${{ secrets.AUTOMATED_MAVEN_RELEASE_PGP_SECRET }}
      - name: Sign artifacts
        run: |
          echo "KEY_FINGERPRINT=$KEY_FINGERPRINT"
          find $LOCAL_ARTIFACTS_STAGING_PATH -type f -exec gpg -a --local-user "$KEY_FINGERPRINT" --detach-sign {} \;
      - name: Push signed tag
        env:
          RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
          RELEASE_COMMIT_ID: ${{ needs.push-release-commit.outputs.release_commit_id }}
          ARTIFACT_SHA256SUMS: ${{ needs.create-artifacts.outputs.ARTIFACT_SHA256SUMS }}
          KEY_EMAIL: ${{ needs.identifiers-for-signing-key.outputs.key_email }}
        run: |
          echo "RELEASE_TAG=$RELEASE_TAG"
          echo "RELEASE_COMMIT_ID=$RELEASE_COMMIT_ID"
          cd repo
          git config user.email "$KEY_EMAIL"
          git config user.name "@$GITHUB_ACTOR using Automated Maven Release"
          git config tag.gpgSign true
          git config user.signingkey "$KEY_FINGERPRINT"
          
          cat << EndOfFile > tag-message.txt
          Release $RELEASE_TAG initiated by @$GITHUB_ACTOR using Automated Maven Release
          
          $ARTIFACT_SHA256SUMS
          EndOfFile
          
          echo "Message is..."
          cat tag-message.txt
          
          echo "Creating tag"
          git tag -a -F tag-message.txt $RELEASE_TAG $RELEASE_COMMIT_ID
          
          echo "RELEASE_TAG=$RELEASE_TAG"
          git show $RELEASE_TAG
          
          echo "Pushing tag $RELEASE_TAG"
          git push origin $RELEASE_TAG
      - uses: actions/cache/save@v3
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: signed-${{ github.run_id }}-${{ github.run_attempt }}

  sonatype-release:
    name: 🔒 Sonatype Release
    needs: sign
    runs-on: ubuntu-latest
    steps:
      - uses: actions/cache/restore@v3
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: signed-${{ github.run_id }}-${{ github.run_attempt }}
          fail-on-cache-miss: true
      - name: Create tiny sbt project to perform Sonatype upload
        run: |
          cat << EndOfFile > build.sbt
          sonatypeBundleDirectory := new File("$LOCAL_ARTIFACTS_STAGING_PATH")
          sonatypeProfileName := "com.gu"
          EndOfFile
          
          mkdir project
          echo 'addSbtPlugin("org.xerial.sbt" % "sbt-sonatype" % "3.9.21")' > project/plugins.sbt
          echo 'sbt.version = 1.9.7' > project/build.properties
          
          ls -lR .
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: 17
          cache: sbt # the issue described in https://github.com/actions/setup-java/pull/564 doesn't affect this step (no version.sbt)
      - name: Release
        env:
          SONATYPE_USERNAME: guardian.automated.maven.release
          SONATYPE_PASSWORD: ${{ secrets.AUTOMATED_MAVEN_RELEASE_SONATYPE_PASSWORD }}
        run: |
          sbt "sonatypeBundleRelease"

  github-release:
    name: 🔒 GitHub Release
    needs:  [push-release-commit, sign]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
    steps:
      - name: Create Github Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        run: |
          gh release create $RELEASE_TAG --verify-tag --generate-notes --notes "Release run: [#${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
      - name: Job summary
        run: |
          echo "GitHub Release notes: [$RELEASE_TAG](${{ github.server_url }}/${{ github.repository }}/releases/tag/$RELEASE_TAG)" >> $GITHUB_STEP_SUMMARY