|
| 1 | +name: Maven plugin release |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_call: |
| 5 | + inputs: |
| 6 | + java-version: |
| 7 | + required: true |
| 8 | + type: string |
| 9 | + artifact-path: |
| 10 | + description: Exact deployable JAR path, with optional {version} placeholder |
| 11 | + required: true |
| 12 | + type: string |
| 13 | + secrets: |
| 14 | + DEPS_TOKEN: |
| 15 | + required: false |
| 16 | + |
| 17 | +permissions: |
| 18 | + contents: read |
| 19 | + |
| 20 | +concurrency: |
| 21 | + group: plugin-release-${{ github.repository }}-${{ github.ref }} |
| 22 | + cancel-in-progress: false |
| 23 | + |
| 24 | +defaults: |
| 25 | + run: |
| 26 | + shell: bash |
| 27 | + |
| 28 | +jobs: |
| 29 | + build: |
| 30 | + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') |
| 31 | + runs-on: ubuntu-24.04 |
| 32 | + timeout-minutes: 20 |
| 33 | + steps: |
| 34 | + - uses: actions/checkout@v7 |
| 35 | + with: |
| 36 | + persist-credentials: false |
| 37 | + |
| 38 | + - uses: actions/setup-java@v6 |
| 39 | + with: |
| 40 | + distribution: temurin |
| 41 | + java-version: ${{ inputs.java-version }} |
| 42 | + |
| 43 | + - name: Validate release version |
| 44 | + env: |
| 45 | + TAG: ${{ github.ref_name }} |
| 46 | + run: | |
| 47 | + [[ "$TAG" =~ ^v[0-9]+\.[0-9]+(\.[0-9]+)?(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]] || { |
| 48 | + echo '::error::Expected vMAJOR.MINOR or vMAJOR.MINOR.PATCH, with an optional prerelease suffix.' |
| 49 | + exit 1 |
| 50 | + } |
| 51 | + [[ "${TAG^^}" != *SNAPSHOT* ]] || exit 1 |
| 52 | +
|
| 53 | + - name: Prepare pinned dependencies |
| 54 | + env: |
| 55 | + GH_TOKEN: ${{ secrets.DEPS_TOKEN }} |
| 56 | + run: | |
| 57 | + if [[ -f .github/scripts/prepare-release.sh ]]; then |
| 58 | + bash .github/scripts/prepare-release.sh |
| 59 | + fi |
| 60 | +
|
| 61 | + - name: Check Maven version and build |
| 62 | + env: |
| 63 | + TAG: ${{ github.ref_name }} |
| 64 | + run: | |
| 65 | + version_file="$RUNNER_TEMP/maven-release-version" |
| 66 | + mvn -B --no-transfer-progress -P'!deploy-live' help:evaluate \ |
| 67 | + -Dexpression=project.version -Doutput="$version_file" |
| 68 | + [[ "$(cat "$version_file")" == "${TAG#v}" ]] || { |
| 69 | + echo '::error::The tag must match project.version exactly.' |
| 70 | + exit 1 |
| 71 | + } |
| 72 | + mvn -B --no-transfer-progress -P'!deploy-live' clean verify |
| 73 | +
|
| 74 | + - name: Stage only the release JAR |
| 75 | + env: |
| 76 | + ARTIFACT_PATH: ${{ inputs.artifact-path }} |
| 77 | + TAG: ${{ github.ref_name }} |
| 78 | + run: | |
| 79 | + python3 - <<'PY' |
| 80 | + import hashlib, json, os, pathlib, shutil, zipfile |
| 81 | + root = pathlib.Path.cwd().resolve() |
| 82 | + source = (root / os.environ['ARTIFACT_PATH'].replace('{version}', os.environ['TAG'][1:])).resolve() |
| 83 | + if not source.is_relative_to(root / 'target') or not source.is_file() or source.suffix != '.jar': |
| 84 | + raise SystemExit('Expected one existing JAR inside target/') |
| 85 | + with zipfile.ZipFile(source) as jar: |
| 86 | + if not {'plugin.yml', 'paper-plugin.yml'}.intersection(jar.namelist()): |
| 87 | + raise SystemExit('Release JAR has no plugin descriptor') |
| 88 | + if jar.testzip() is not None: |
| 89 | + raise SystemExit('Release JAR is corrupt') |
| 90 | + dest = pathlib.Path(os.environ['RUNNER_TEMP']) / 'plugin-release' |
| 91 | + dest.mkdir() |
| 92 | + shutil.copyfile(source, dest / source.name) |
| 93 | + digest = hashlib.sha256((dest / source.name).read_bytes()).hexdigest() |
| 94 | + (dest / 'SHA256SUMS').write_text(f'{digest} {source.name}\n') |
| 95 | + (dest / 'build.json').write_text(json.dumps({ |
| 96 | + 'repository': os.environ['GITHUB_REPOSITORY'], |
| 97 | + 'commit': os.environ['GITHUB_SHA'], |
| 98 | + 'tag': os.environ['TAG'], |
| 99 | + 'run': f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ['GITHUB_RUN_ID']}", |
| 100 | + 'artifact': source.name, |
| 101 | + 'sha256': digest, |
| 102 | + }, indent=2) + '\n') |
| 103 | + PY |
| 104 | +
|
| 105 | + - uses: actions/upload-artifact@v7 |
| 106 | + with: |
| 107 | + name: plugin-release-${{ github.sha }} |
| 108 | + path: ${{ runner.temp }}/plugin-release/ |
| 109 | + if-no-files-found: error |
| 110 | + retention-days: 30 |
| 111 | + |
| 112 | + publish: |
| 113 | + needs: build |
| 114 | + runs-on: ubuntu-24.04 |
| 115 | + timeout-minutes: 5 |
| 116 | + permissions: |
| 117 | + contents: write |
| 118 | + steps: |
| 119 | + - uses: actions/download-artifact@v8 |
| 120 | + with: |
| 121 | + name: plugin-release-${{ github.sha }} |
| 122 | + path: release |
| 123 | + |
| 124 | + - name: Create draft release |
| 125 | + working-directory: release |
| 126 | + env: |
| 127 | + GH_TOKEN: ${{ github.token }} |
| 128 | + GH_REPO: ${{ github.repository }} |
| 129 | + TAG: ${{ github.ref_name }} |
| 130 | + run: | |
| 131 | + sha256sum --check SHA256SUMS |
| 132 | + flags=() |
| 133 | + if [[ "$TAG" == *-* ]]; then flags+=(--prerelease); fi |
| 134 | + gh release create "$TAG" ./*.jar SHA256SUMS build.json \ |
| 135 | + --verify-tag --draft --title "$TAG" --generate-notes "${flags[@]}" |
0 commit comments