ci-publish.yaml

# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
name: Publish CI

on:
  release:
    types:
      - released
  workflow_dispatch:

permissions: { }

jobs:
  read-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.parse.outputs.version }}
    steps:
      - name: Assert ref type
        run: |-
          if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
            echo "::error::Publishing is only supported for tags!"
            exit 1
          fi
      - name: Checkout Repository
        uses: actions/checkout@v4.2.2

      - name: Parse Version from POM
        id: parse
        run: |-
          VERSION=`yq -p=xml '.project.version' pom.xml`
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

  call-build:
    needs:
      - read-version
    uses: ./.github/workflows/_meta-build.yaml
    with:
      app-version: ${{ needs.read-version.outputs.version }}
      publish-container: true
      ref-name: ${{ github.ref_name }}
    permissions:
      packages: write # Required to push images to ghcr.io
      security-events: write # Required to upload trivy's SARIF output
    secrets:
      registry-0-usr: ${{ github.repository_owner }}
      registry-0-psw: ${{ secrets.GITHUB_TOKEN }}

  update-github-release:
    runs-on: ubuntu-latest
    needs:
      - read-version
      - call-build
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4.2.2

      - name: Download Artifacts
        uses: actions/download-artifact@v4.1.8
        with:
          name: assembled-wars
          path: target

      - name: Create Checksums and SBOM
        run: |-
          pushd target
          echo "# SHA1" >> checksums.txt
          sha1sum dependency-track-apiserver.jar >> checksums.txt
          echo "# SHA256" >> checksums.txt
          sha256sum dependency-track-apiserver.jar >> checksums.txt
          echo "# SHA512" >> checksums.txt
          sha512sum dependency-track-apiserver.jar >> checksums.txt
          popd

      - name: Update Release
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_TOKEN }}
        run: |-
          gh release upload ${{ needs.read-version.outputs.version }} \
            --clobber \
            target/dependency-track-apiserver.jar \
            target/checksums.txt \
            target/bom.json