Automate release process to Maven Central and Gradle Plugin Portal

.github/workflows/include-deploy-release.yml

@@ -0,0 +1,112 @@
+name: Deploy release
+
+on:
+  workflow_call:
+    inputs:
+      version-label:
+        required: true
+        type: string
+
+      packages-sha-label:
+        required: true
+        type: string
+
+jobs:
+  deploy:
+    runs-on: macos-latest
+    name: Deploy release 
+
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v3
+        with:
+          submodules: "recursive"
+
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
+        with:
+          distribution: ${{ vars.VERSION_JAVA_DISTRIBUTION  }}
+          java-version: ${{ vars.VERSION_JAVA }}
+
+      - name: Setup Gradle and task/dependency caching
+        uses: gradle/gradle-build-action@v2
+        with:
+          cache-read-only: false
+
+      - name: Setup cmake
+        uses: jwlawson/[email protected]
+        with:
+          cmake-version: ${{ vars.VERSION_CMAKE }}
+
+      - name: Setup ninja
+        uses: cmelchior/setup-ninja@master
+        with:
+          version: ${{ vars.VERSION_NINJA  }}
+
+      - name: Install ccache
+        uses: hendrikmuhs/[email protected]
+        with:
+          key: 'jvm-package'
+          max-size: '2.0G'
+
+      - name: Install coreutils and s3cmd
+        run: brew install coreutils s3cmd
+
+      - name: Prepend ccache executables to the PATH
+        run: echo "/usr/lib/ccache:/usr/local/opt/ccache/libexec" >> $GITHUB_PATH
+
+      # See https://github.com/hendrikmuhs/ccache-action/issues/94
+      - name: Configure ccache
+        run: |
+          ccache --set-config="compiler_check=content"
+          ccache --show-config
+          echo '#!/bin/bash\nccache clang "$@"%"' > /usr/local/bin/ccache-clang 
+          echo '#!/bin/bash\nccache clang++ "$@"%"' > /usr/local/bin/ccache-clang++          
+
+      # TODO This matches 23.2.8568313, but what happens if we define specific ndk version in our build? 
+      - name: Setup NDK
+        uses: nttld/setup-ndk@v1
+        with:
+          ndk-version: r23c
+
+      # We cannot use artifacts as they cannot be shared between workflows, so use cache instead.
+      - name: Setup build cache
+        uses: actions/cache@v3
+        with:
+          path: ./packages/build/m2-buildrepo
+          key: packages-m2-jvm-sync-${{ inputs.packages-sha-label }}
+
+      - name: Restore Linux JNI lib
+        uses: actions/download-artifact@v3
+        with:
+          name: jni-linux-lib-${{ inputs.version-label }}
+          path: ./packages/cinterop/build/realmLinuxBuild
+
+      - name: Restore Windows JNI lib
+        uses: actions/download-artifact@v3
+        with:
+          name: jni-windows-lib-${{ inputs.version-label }}
+          path: ./packages/cinterop/build/realmWindowsBuild/Release
+
+      - name: Restore MacOS JNI lib
+        uses: actions/download-artifact@v3
+        with:
+          name: jni-macos-lib-${{ inputs.version-label }}
+          path: ./packages/cinterop/build/realmMacOsBuild
+
+      - name: Restore m2-buildrepo
+        uses: actions/download-artifact@v3
+        with:
+          name: all-packages-${{ inputs.version-label }}
+          path: ./packages/build/m2-buildrepo
+
+      - name: Publish release to Maven Central
+        run: |
+         set +x
+         sh ./tools/publish_release.sh "${{ secrets.MAVEN_CENTRAL_USER_DBG }}" "${{ secrets.MAVEN_CENTRAL_KEY_DBG }}" \
+         "${{ secrets.AWS_S3_ACCESS_KEY_ID }}" "${{ secrets.AWS_S3_SECRET_ACCESS_KEY }}" \
+         "${{ secrets.DOCS_S3_ACCESS_KEY }}" "${{ secrets.DOCS_S3_SECRET_KEY }}" \
+         "${{ secrets.SLACK_URL_RELEASE }}" "${{ secrets.SLACK_URL_CI }}" \
+         "${{ secrets.GRADLE_PORTAL_KEY }}" "${{ secrets.GRADLE_PORTAL_SECRET }}" \
+         '-PsignBuild=true -PsignSecretRingFileKotlin="${{ secrets.GPG_SIGNING_KEY_BASE_64_DBG }}" -PsignPasswordKotlin=${{ secrets.GPG_PASS_PHRASE_DBG }}'
+        

.github/workflows/pr.yml

@@ -227,9 +227,9 @@ jobs:
     runs-on: macos-latest
     needs: [check-cache, build-jni-swig-stub]
     if: |
-      always() && 
-      !cancelled() && 
-      !contains(needs.*.result, 'failure') && 
+      always() &&
+      !cancelled() &&
+      !contains(needs.*.result, 'failure') &&
       !contains(needs.*.result, 'cancelled') &&
       needs.check-cache.outputs.jni-windows-lib-cache-hit != 'true'
 
@@ -1642,4 +1642,70 @@ jobs:
 
     secrets: inherit
     with:
-      version-label: ${{ needs.check-cache.outputs.version-label }}
+      version-label: ${{ needs.check-cache.outputs.version-label }}
+
+  # This job sets an output `is_publish_build` to `true` if this is a release build
+  check-release-build:
+    runs-on: ubuntu-latest
+    needs: [check-cache]
+    outputs:  
+      is_publish_build: ${{ steps.check_release.outputs.is_publish_build }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Get Git tag
+        run: |
+          gitTag=$(git describe --tags --exact-match HEAD) || echo "NONE"
+          echo "Git branch/tag: ${GITHUB_REF}/${gitTag:-'none'}"
+
+      - name: Check if release build
+        id: check_release
+        run: |
+          if [[ -z "$gitTag" ]]; then
+            gitSha=$(git rev-parse HEAD | cut -c1-8)
+            echo "Building commit: ${{ needs.check-cache.outputs.version-label }} - ${gitSha}"
+            echo "is_publish_build=false" >> $GITHUB_OUTPUT
+          else
+            if [[ "$gitTag" != "v${{ needs.check-cache.outputs.version-label }}" ]]; then
+              echo "Git tag '${gitTag}' does not match v${{ needs.check-cache.outputs.version-label }}"
+              echo "is_publish_build=false" >> $GITHUB_OUTPUT
+            else
+              echo "Building release: '${gitTag}'"
+              echo "is_publish_build=true" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+
+      - name: Print is release build
+        run: |
+          echo "Is release build: ${{ steps.check_release.outputs.is_publish_build }}"
+
+  deploy-release:
+    uses: ./.github/workflows/include-deploy-release.yml
+    needs: [ 
+              check-cache,
+              check-release-build, 
+              static-analysis, 
+              integration-tests, 
+              test-jvm-packages, 
+              test-macos-packages, 
+              test-ios-packages, 
+              test-android-packages-emulator, 
+              # test-android-packages-device-farm,
+              test-android-packages-device-farm-sync,
+              package-all-artifacts
+            ]
+    if: |
+      always() && 
+      !cancelled() && 
+      !endsWith(needs.check-cache.outputs.version-label, '-SNAPSHOT') &&
+      !contains(needs.*.result, 'failure') && 
+      !contains(needs.*.result, 'cancelled') &&
+      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/releases') && 
+      (needs.check-release-build.outputs.is_publish_build == 'true')
+
+    secrets: inherit
+    with:
+      version-label: ${{ needs.check-cache.outputs.version-label }}
+      packages-sha-label: ${{ needs.check-cache.outputs.packages-sha }}