release.yaml

name: Release
run-name: "Release ${{ inputs.version }} from branch ${{ inputs.target-branch }} ${{ inputs.dry-run && '(DRY RUN)' || ''}}"
on:
  workflow_dispatch:
    inputs:
      target-branch:
        description: "Branch to release"
        required: true
        type: choice
        default: 'main'
        options:
        - "main"
        - "24.4"
        - "2.5"
        - "2.4"
        - "2.3"
        - "2.2"
        - "2.1"
        - "1.3"
      version:
        description: "Version to release (e.g. 1.1.0 or 1.2.0-alpha1)"
        required: true
        type: string
      hilla-version:
        description: |
          Version of Hilla to pin for this release. If not provided, the value of the hilla.version property in will be used.
          If the Hilla version is a SNAPSHOT, the latest available release compatible with quarkus-hilla major.minor will be used.
        required: false
        type: string
      dry-run:
        description: "Dry run (skips remote operations)"
        required: true
        type: boolean
        default: false
jobs:
  release:
    name: Release
    runs-on: ubuntu-latest

    steps:
      - uses: actions-cool/check-user-permission@main
        id: checkUser
        with:
          username: ${{github.triggering_actor}}
          check-contributor: true
          require: 'write'
      - name: Fail on workflow triggered by external contributor
        if: ${{ steps.checkUser.outputs.require-result != 'true' }}
        run: |
          echo "🚫 **${{ github.actor }}** is an external contributor, only **${{ github.repository }}** team members can perform a release" \
            | tee -a $GITHUB_STEP_SUMMARY && exit 1
      - name: Validate Workflow branch
        if: ${{ !github.event.inputs.dry-run }}
        run: |
          BRANCH_NAME=${GITHUB_REF##*/}
          if [[ "main" != "${BRANCH_NAME}" ]]; then
            echo "🚫 Release Workflow must be dispatched on 'main' branch." \
             | tee -a  $GITHUB_STEP_SUMMARY
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: refs/heads/${{ inputs.target-branch }}
          fetch-depth: 0

      - name: Validate version
        run: |
          VERSION_REGEX='^[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta|rc)[0-9]+)?$'
          if [[ ! "${{ inputs.version }}" =~ $VERSION_REGEX ]]; then
            echo "🚫 Invalid version specified: '${{ inputs.version }}'. Please enter a valid SemVer version, like '1.2.3' or '1.0.0-alpha1'." \
             | tee -a  $GITHUB_STEP_SUMMARY
            exit 1
          fi
          if [[ "${{ inputs.target-branch }}" != "main" && ! "${{ inputs.version }}" = "${{ inputs.target-branch }}."* ]]; then
            echo "🚫 Invalid version specified: '${{ inputs.version }}' does not match the release branch '${{ inputs.target-branch }}'." \
             | tee -a  $GITHUB_STEP_SUMMARY
            exit 1
          fi
          if git rev-parse -q --verify "refs/tags/${{ inputs.version }}" > /dev/null; then
            echo "🚫 Version '${{ inputs.version }}' already exists. Please choose a different version." \
             | tee -a  $GITHUB_STEP_SUMMARY
            exit 1
          fi
          echo "Releasing version '${{ inputs.version }}' from branch '${{ inputs.target-branch }}'." | tee -a $GITHUB_STEP_SUMMARY
          if [[ "${{ github.event.inputs.dry-run }}" == "true" ]]; then
            echo "⚠️ dry-run execution, artifacts will not be published on Maven Central." | tee -a $GITHUB_STEP_SUMMARY
          fi
      - name: Pin Hilla version
        run: |
          hilla_version=$(mvn -ntp -N -q help:evaluate -Dexpression=hilla.version -DforceStdout)
          hilla_version_major_minor=$(echo "${hilla_version/-*/}" | cut -d. -f1,2)
          echo "POM file Hilla version: $hilla_version." | tee -a  $GITHUB_STEP_SUMMARY
          if [[ -n "${{ inputs.hilla-version }}" ]]; then
            if [[ "${{ inputs.hilla-version }}" = "${hilla_version_major_minor}."* ]]; then
              mvn -N -ntp versions:set-property -Dproperty=hilla.version -DnewVersion="${{ inputs.hilla-version }}"
              echo "⚠️ Hilla version manually forced to ${{ inputs.hilla-version }}." | tee -a  $GITHUB_STEP_SUMMARY
              hilla_version="${{ inputs.hilla-version }}"
            else
              echo "🚫 Forced Hilla version '${{ inputs.hilla-version }}' does not match Hilla version on release branch '$hilla_version_major_minor'." \
                | tee -a $GITHUB_STEP_SUMMARY
              exit 1
            fi
          fi
          if [[ "$hilla_version" =~ .*-SNAPSHOT ]]; then
            mvn -N -ntp -Dproperty=hilla.version -DallowMinorUpdates=false -DgenerateBackupPoms=false -Dmaven.version.rules=file://$(pwd)/etc/release-version-rules.xml versions:update-property
            hilla_version=$(mvn -ntp -N -q help:evaluate -Dexpression=hilla.version -DforceStdout)
            echo "⚠️ SNAPSHOT detected for Hilla version. Automatically forcing version to $hilla_version." | tee -a $GITHUB_STEP_SUMMARY
          fi
          if [[ "$hilla_version" =~ .*-SNAPSHOT ]]; then
            echo "🚫 Hilla version '${{ inputs.hilla-version }}' is a SNAPSHOT. Please provide a proper release version." \
             | tee -a $GITHUB_STEP_SUMMARY
            exit 1
          fi
      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: 'temurin'

      - name: Staging artifacts
        run: |
          mvn -V -ntp -Pdistribution,default-modules -Drevision=${{ inputs.version }} -DaltDeploymentRepository=local::file:./target/staging-deploy ${{ github.event.inputs.dry-run && '-DskipTests' || '' }} deploy

      - name: Run JReleaser
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JRELEASER_DEPLOY_MAVEN_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_TOKEN }}
          JRELEASER_NEXUS2_MAVEN_CENTRAL_USERNAME: ${{ secrets.JRELEASER_NEXUS2_MAVEN_CENTRAL_USERNAME }}
          JRELEASER_NEXUS2_MAVEN_CENTRAL_PASSWORD: ${{ secrets.JRELEASER_NEXUS2_MAVEN_CENTRAL_PASSWORD }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.JRELEASER_GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
        run: |
          mvn -N -V -ntp -Pdistribution -Drevision=${{ inputs.version }} -Djreleaser.dry.run="${{ github.event.inputs.dry-run }}" ${{ github.event.inputs.dry-run && '-DskipTests' || '' }} jreleaser:full-release

      - name: JReleaser release output
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: jreleaser-release
          path: |
            target/jreleaser/**