Skip to content

Commit 7d71287

Browse files
hsluoyzhsluoyz
committed
feat: replace semantic-release with tag-triggered manual release
1 parent d43f609 commit 7d71287

3 files changed

Lines changed: 155 additions & 43 deletions

File tree

‎.github/workflows/maven-ci.yml‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,6 @@ jobs:
5454
uses: actions/setup-java@v1
5555
with:
5656
java-version: 1.8
57-
server-id: ossrh
58-
server-username: OSSRH_JIRA_USERNAME
59-
server-password: OSSRH_JIRA_PASSWORD
60-
gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
61-
gpg-passphrase: GPG_PASSPHRASE
6257

6358
- name: Build with Maven
6459
run: mvn clean test cobertura:cobertura
@@ -67,19 +62,3 @@ jobs:
6762
uses: codecov/codecov-action@v1
6863
with:
6964
token: ${{ secrets.CODECOV_TOKEN }}
70-
71-
- name: Set up Node.js
72-
uses: actions/setup-node@v2
73-
with:
74-
node-version: 20
75-
76-
- name: Semantic Release
77-
run: |
78-
npm install -g @conveyal/maven-semantic-release semantic-release
79-
semantic-release --prepare @conveyal/maven-semantic-release --publish @semantic-release/github,@conveyal/maven-semantic-release --verify-conditions @semantic-release/github,@conveyal/maven-semantic-release --verify-release @conveyal/maven-semantic-release
80-
env:
81-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
82-
GPG_KEY_NAME: ${{ secrets.GPG_KEY_NAME }}
83-
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
84-
OSSRH_JIRA_USERNAME: ${{ secrets.OSSRH_JIRA_USERNAME }}
85-
OSSRH_JIRA_PASSWORD: ${{ secrets.OSSRH_JIRA_PASSWORD }}

‎.github/workflows/release.yml‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
name: release
2+
3+
# Releases are triggered manually, by pushing a git tag. There is no automatic
4+
# release on merge/commit: as an Apache (incubating) project, every release must
5+
# pass a formal vote before it can be published.
6+
#
7+
# v1.4.0-rc1 -> GitHub *pre-release* only (the candidate used for voting)
8+
# v1.4.0 -> GitHub release + publish to Maven Central
9+
#
10+
# In both cases the release carries the source package that the release manager
11+
# downloads, signs locally (.asc / .sha512) and uploads to dist.apache.org for
12+
# the vote. This workflow deliberately does not touch anything on the Apache
13+
# side - no signing, no svn, no re-upload of signed artifacts.
14+
15+
on:
16+
push:
17+
tags:
18+
- 'v*'
19+
20+
permissions:
21+
contents: write
22+
23+
jobs:
24+
release:
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v4
29+
30+
- name: Resolve version from tag
31+
id: version
32+
run: |
33+
set -euo pipefail
34+
TAG="${GITHUB_REF_NAME}"
35+
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$ ]]; then
36+
echo "::error::Tag '$TAG' has an unexpected format. Use v<x.y.z> (e.g. v1.4.0) or v<x.y.z>-rc<n> (e.g. v1.4.0-rc1)."
37+
exit 1
38+
fi
39+
40+
BASE="${TAG#v}" # 1.4.0 | 1.4.0-rc1
41+
VERSION="${BASE%%-rc*}" # 1.4.0
42+
if [[ "$BASE" == *-rc* ]]; then
43+
IS_RC=true
44+
RC="${BASE##*-}" # rc1
45+
else
46+
IS_RC=false
47+
RC=""
48+
fi
49+
50+
# The Maven coordinates keep the plain version - the "-incubating"
51+
# suffix is only carried by the Apache source package, which is the
52+
# artifact the incubator actually votes on.
53+
#
54+
# Apache source package naming: apache-<project>-<version>-src.tar.gz
55+
# The RC number is not part of the file name, it only appears in the
56+
# vote thread and in the dist.apache.org staging path.
57+
SRC_NAME="apache-casbin-jdbc-adapter-${VERSION}-incubating-src"
58+
59+
{
60+
echo "tag=$TAG"
61+
echo "is_rc=$IS_RC"
62+
echo "rc=$RC"
63+
echo "version=$VERSION"
64+
echo "src_name=$SRC_NAME"
65+
} >> "$GITHUB_OUTPUT"
66+
67+
echo "Tag=$TAG version=$VERSION is_rc=$IS_RC ${RC:+rc=$RC}"
68+
69+
- name: Set up JDK 1.8
70+
uses: actions/setup-java@v4
71+
with:
72+
distribution: temurin
73+
java-version: '8'
74+
server-id: ossrh
75+
server-username: MAVEN_USERNAME
76+
server-password: MAVEN_PASSWORD
77+
gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
78+
gpg-passphrase: MAVEN_GPG_PASSPHRASE
79+
80+
- name: Stamp the release version into the POM
81+
run: mvn -B versions:set -DnewVersion=${{ steps.version.outputs.version }} -DgenerateBackupPoms=false
82+
83+
- name: Build the source package
84+
env:
85+
SRC_NAME: ${{ steps.version.outputs.src_name }}
86+
run: |
87+
set -euo pipefail
88+
# The file list comes from git, so the package holds exactly the
89+
# tracked sources of the tag - no build output, no VCS metadata.
90+
# The contents are read from the working tree, so the POM already
91+
# carries the release version and the package builds as-is.
92+
git ls-files -z | tar --null -T - \
93+
--transform "s,^,$SRC_NAME/," \
94+
-czf "$SRC_NAME.tar.gz"
95+
ls -l "$SRC_NAME.tar.gz"
96+
tar -tzf "$SRC_NAME.tar.gz"
97+
98+
# Only a passed vote may be published, so release candidates never reach
99+
# the package registry.
100+
- name: Publish to Maven Central
101+
if: steps.version.outputs.is_rc == 'false'
102+
env:
103+
MAVEN_USERNAME: ${{ secrets.OSSRH_JIRA_USERNAME }}
104+
MAVEN_PASSWORD: ${{ secrets.OSSRH_JIRA_PASSWORD }}
105+
MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
106+
run: mvn -B clean deploy -DskipTests
107+
108+
- name: Write release notes
109+
env:
110+
TAG: ${{ steps.version.outputs.tag }}
111+
IS_RC: ${{ steps.version.outputs.is_rc }}
112+
RC: ${{ steps.version.outputs.rc }}
113+
VERSION: ${{ steps.version.outputs.version }}
114+
SRC_NAME: ${{ steps.version.outputs.src_name }}
115+
run: |
116+
set -euo pipefail
117+
if [[ "$IS_RC" == "true" ]]; then
118+
cat > release-notes.md <<EOF
119+
Release candidate \`$RC\` for **$VERSION**.
120+
121+
This is *not* an official Apache release. It is the candidate put up for
122+
the Apache Casbin (incubating) release vote, published here so the release
123+
manager can download \`$SRC_NAME.tar.gz\`, sign it locally and stage it on
124+
dist.apache.org. It is not published to Maven Central.
125+
EOF
126+
else
127+
cat > release-notes.md <<EOF
128+
Apache Casbin (incubating) JDBC Adapter **$VERSION**.
129+
130+
The source package \`$SRC_NAME.tar.gz\` is attached, and the convenience
131+
binaries are published to Maven Central as \`org.casbin:jdbc-adapter:$VERSION\`.
132+
EOF
133+
fi
134+
cat release-notes.md
135+
136+
- name: Publish GitHub pre-release (RC)
137+
if: steps.version.outputs.is_rc == 'true'
138+
env:
139+
GH_TOKEN: ${{ github.token }}
140+
run: |
141+
gh release create "${{ steps.version.outputs.tag }}" \
142+
"${{ steps.version.outputs.src_name }}.tar.gz" \
143+
--title "${{ steps.version.outputs.tag }}" \
144+
--notes-file release-notes.md \
145+
--prerelease
146+
147+
- name: Publish GitHub release
148+
if: steps.version.outputs.is_rc == 'false'
149+
env:
150+
GH_TOKEN: ${{ github.token }}
151+
run: |
152+
gh release create "${{ steps.version.outputs.tag }}" \
153+
"${{ steps.version.outputs.src_name }}.tar.gz" \
154+
--title "${{ steps.version.outputs.tag }}" \
155+
--notes-file release-notes.md

‎maven-settings.xml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

0 commit comments

Comments
 (0)