Automate release process to Maven Central and Gradle Plugin Portal

.github/workflows/include-deploy-release.yml

@@ -0,0 +1,112 @@
+name: Deploy release
+
+on:
+  workflow_call:
+    inputs:
+      version-label:
+        required: true
+        type: string
+
+      packages-sha-label:
+        required: true
+        type: string
+
+jobs:
+  deploy:
+    runs-on: macos-latest
+    name: Deploy release 
+
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v3
+        with:
+          submodules: "recursive"
+
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
+        with:
+          distribution: ${{ vars.VERSION_JAVA_DISTRIBUTION  }}
+          java-version: ${{ vars.VERSION_JAVA }}
+
+      - name: Setup Gradle and task/dependency caching
+        uses: gradle/gradle-build-action@v2
+        with:
+          cache-read-only: false
+
+      - name: Setup cmake
+        uses: jwlawson/[email protected]
+        with:
+          cmake-version: ${{ vars.VERSION_CMAKE }}
+
+      - name: Setup ninja
+        uses: cmelchior/setup-ninja@master
+        with:
+          version: ${{ vars.VERSION_NINJA  }}
+
+      - name: Install ccache
+        uses: hendrikmuhs/[email protected]
+        with:
+          key: 'jvm-package'
+          max-size: '2.0G'
+
+      - name: Install coreutils and s3cmd
+        run: brew install coreutils s3cmd
+
+      - name: Prepend ccache executables to the PATH
+        run: echo "/usr/lib/ccache:/usr/local/opt/ccache/libexec" >> $GITHUB_PATH
+
+      # See https://github.com/hendrikmuhs/ccache-action/issues/94
+      - name: Configure ccache
+        run: |
+          ccache --set-config="compiler_check=content"
+          ccache --show-config
+          echo '#!/bin/bash\nccache clang "$@"%"' > /usr/local/bin/ccache-clang 
+          echo '#!/bin/bash\nccache clang++ "$@"%"' > /usr/local/bin/ccache-clang++          
+
+      # TODO This matches 23.2.8568313, but what happens if we define specific ndk version in our build? 
+      - name: Setup NDK
+        uses: nttld/setup-ndk@v1
+        with:
+          ndk-version: r23c
+
+      # We cannot use artifacts as they cannot be shared between workflows, so use cache instead.
+      - name: Setup build cache
+        uses: actions/cache@v3
+        with:
+          path: ./packages/build/m2-buildrepo
+          key: packages-m2-jvm-sync-${{ inputs.packages-sha-label }}
+
+      - name: Restore Linux JNI lib
+        uses: actions/download-artifact@v3
+        with:
+          name: jni-linux-lib-${{ inputs.version-label }}
+          path: ./packages/cinterop/build/realmLinuxBuild
+
+      - name: Restore Windows JNI lib
+        uses: actions/download-artifact@v3
+        with:
+          name: jni-windows-lib-${{ inputs.version-label }}
+          path: ./packages/cinterop/build/realmWindowsBuild/Release
+
+      - name: Restore MacOS JNI lib
+        uses: actions/download-artifact@v3
+        with:
+          name: jni-macos-lib-${{ inputs.version-label }}
+          path: ./packages/cinterop/build/realmMacOsBuild
+
+      - name: Restore m2-buildrepo
+        uses: actions/download-artifact@v3
+        with:
+          name: all-packages-${{ inputs.version-label }}
+          path: ./packages/build/m2-buildrepo
+
+      - name: Publish release to Maven Central
+        run: |
+         set +x
+         sh ./tools/publish_release.sh "${{ secrets.MAVEN_CENTRAL_USER_DBG }}" "${{ secrets.MAVEN_CENTRAL_KEY_DBG }}" \
+         "${{ secrets.AWS_S3_ACCESS_KEY_ID }}" "${{ secrets.AWS_S3_SECRET_ACCESS_KEY }}" \
+         "${{ secrets.DOCS_S3_ACCESS_KEY }}" "${{ secrets.DOCS_S3_SECRET_KEY }}" \
+         "${{ secrets.SLACK_URL_RELEASE }}" "${{ secrets.SLACK_URL_CI }}" \
+         "${{ secrets.GRADLE_PORTAL_KEY }}" "${{ secrets.GRADLE_PORTAL_SECRET }}" \
+         '-PsignBuild=true -PsignSecretRingFileKotlin="${{ secrets.GPG_SIGNING_KEY_BASE_64_DBG }}" -PsignPasswordKotlin=${{ secrets.GPG_PASS_PHRASE_DBG }}'
+

.github/workflows/include-deploy-snapshot.yml

@@ -41,12 +41,12 @@ jobs:
           path: ./packages/build/m2-buildrepo 
 
       - name: Publish SNAPSHOT to Maven Central
-        env:    
-          GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY_BASE_64 }}
-          GPG_PASS_PHRASE: ${{ secrets.GPG_PASS_PHRASE }}
-          MAVEN_CENTRAL_USER: ${{ secrets.MAVEN_CENTRAL_USER }}
-          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+        # env:    
+        #   GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY_BASE_64 }}
+        #   GPG_PASS_PHRASE: ${{ secrets.GPG_PASS_PHRASE }}
+        #   MAVEN_CENTRAL_USER: ${{ secrets.MAVEN_CENTRAL_USER }}
+        #   MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
         working-directory: tools
         run: |
           export GPG_TTY=$(tty)
-          kotlin ./publish_snapshots.main.kts "../" "${{ inputs.version-label }}" "$GPG_SIGNING_KEY" "$GPG_PASS_PHRASE" "$MAVEN_CENTRAL_USER" "$MAVEN_CENTRAL_PASSWORD"
+          kotlin ./publish_snapshots.main.kts "../" "${{ inputs.version-label }}" "${{ secrets.GPG_SIGNING_KEY_BASE_64 }}" "${{ secrets.GPG_PASS_PHRASE }}" "${{ secrets.MAVEN_CENTRAL_USER }}" "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"

.github/workflows/pr.yml

@@ -1643,4 +1643,70 @@ jobs:
 
     secrets: inherit
     with:
-      version-label: ${{ needs.check-cache.outputs.version-label }}
+      version-label: ${{ needs.check-cache.outputs.version-label }}
+
+  # This job sets an output `is_publish_build` to `true` if this is a release build
+  check-release-build:
+    runs-on: ubuntu-latest
+    needs: [check-cache]
+    outputs:  
+      is_publish_build: ${{ steps.check_release.outputs.is_publish_build }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Get Git tag
+        run: |
+          gitTag=$(git describe --tags --exact-match HEAD) || echo "NONE"
+          echo "Git branch/tag: ${GITHUB_REF}/${gitTag:-'none'}"
+
+      - name: Check if release build
+        id: check_release
+        run: |
+          if [[ -z "$gitTag" ]]; then
+            gitSha=$(git rev-parse HEAD | cut -c1-8)
+            echo "Building commit: ${{ needs.check-cache.outputs.version-label }} - ${gitSha}"
+            echo "is_publish_build=false" >> $GITHUB_OUTPUT
+          else
+            if [[ "$gitTag" != "v${{ needs.check-cache.outputs.version-label }}" ]]; then
+              echo "Git tag '${gitTag}' does not match v${{ needs.check-cache.outputs.version-label }}"
+              echo "is_publish_build=false" >> $GITHUB_OUTPUT
+            else
+              echo "Building release: '${gitTag}'"
+              echo "is_publish_build=true" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+
+      - name: Print is release build
+        run: |
+          echo "Is release build: ${{ steps.check_release.outputs.is_publish_build }}"
+
+  deploy-release:
+    uses: ./.github/workflows/include-deploy-release.yml
+    needs: [ 
+              check-cache,
+              check-release-build, 
+              static-analysis, 
+              integration-tests, 
+              test-jvm-packages, 
+              test-macos-packages, 
+              test-ios-packages, 
+              test-android-packages-emulator, 
+              # test-android-packages-device-farm,
+              test-android-packages-device-farm-sync,
+              package-all-artifacts
+            ]
+    if: |
+      always() && 
+      !cancelled() && 
+      !endsWith(needs.check-cache.outputs.version-label, '-SNAPSHOT') &&
+      !contains(needs.*.result, 'failure') && 
+      !contains(needs.*.result, 'cancelled') &&
+      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/releases') && 
+      (needs.check-release-build.outputs.is_publish_build == 'true')
+
+    secrets: inherit
+    with:
+      version-label: ${{ needs.check-cache.outputs.version-label }}
+      packages-sha-label: ${{ needs.check-cache.outputs.packages-sha }}

CHANGELOG.md

@@ -11,9 +11,10 @@
 ### Fixed
 * Cache notification callback JNI references at startup to ensure that symbols can be resolved in core callbacks. (Issue [#1577](https://github.com/realm/realm-kotlin/issues/1577))
 * Using `Realm.asFlow()` could miss an update if a write was started right after opening the Realm. (Issue [#1582](https://github.com/realm/realm-kotlin/issues/1582)) 
-* Snapshot publishing with Github Action. (Issue [#1654](https://github.com/realm/realm-kotlin/issues/1654) [JIRA](https://jira.mongodb.org/browse/RKOTLIN-1018))
 * Guarded analytic errors so that they do not fail user builds.
 * [Sync] `NullPointerException` while waiting for the synchronization of a subscription set if the client was set in `AwaitingMark` state. (Issue [#1671](https://github.com/realm/realm-kotlin/issues/1671) [JIRA](https://jira.mongodb.org/browse/RKOTLIN-1027))
+* Github Action: Snapshot publishing with Github Action. (Issue [#1654](https://github.com/realm/realm-kotlin/issues/1654) [JIRA](https://jira.mongodb.org/browse/RKOTLIN-1018))
+* Github Action: automate release process to Maven Central. (Issue [JIRA](https://jira.mongodb.org/browse/RKOTLIN-709))
 
 ### Compatibility
 * File format: Generates Realms with file format v23.