release.yml

name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - '*.*.*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  GRADLE_OPTS: '-Dorg.gradle.daemon=false -Dorg.gradle.java.installations.auto-detect=false -Dorg.gradle.warning.mode=fail'

jobs:
  ci:
    uses: ./.github/workflows/ci.yml
    permissions:
      contents: read

  ci-low-cadence:
    uses: ./.github/workflows/ci-low-cadence.yml
    permissions:
      contents: read

  codeql:
    uses: ./.github/workflows/codeql.yml
    permissions:
      actions: read
      contents: read
      security-events: write

  release:
    name: Release java artifacts
    permissions:
      contents: write
      packages: write
    needs: [ ci, ci-low-cadence, codeql ]
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
      - name: Create Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref }}
          release_name: ${{ github.ref }}
          draft: true
      - name: Cache Gradle dependencies
        uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: |
            ${{ runner.os }}-gradle-
      - name: Cache Gradle wrappers
        uses: actions/cache@v4
        with:
          path: ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
      - name: Setup java
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17
      - name: Publish a release
        run: ./gradlew publish
        env:
          SIGNING_GPG_SECRET_KEY: ${{ secrets.GPG_RSA_SIGN_KEY }}
          SIGNING_GPG_PASSWORD: ${{ secrets.GPG_RSA_SIGN_KEYPASS }}
          OSSRH_USERNAME: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.SONATYPE_CENTRAL_PASSWORD }}