From 99e93595e22c38d5308352c75e6de6a42361ab76 Mon Sep 17 00:00:00 2001
From: Ryan Barlow <7389646+ryanbarlow97@users.noreply.github.com>
Date: Tue, 22 Sep 2026 14:57:15 +0000
Subject: [PATCH] ci: add verified UTC development and release builds
---
.github/dependencies.sha256 | 6 ++
.github/scripts/prepare-release.sh | 12 +++
.github/workflows/build.yml | 55 ++++++++++++
.github/workflows/maven-release.yml | 135 ++++++++++++++++++++++++++++
.github/workflows/release.yml | 20 +++++
.gitignore | 3 +
pom.xml | 42 ++++-----
src/main/resources/plugin.yml | 2 +-
8 files changed, 251 insertions(+), 24 deletions(-)
create mode 100644 .github/dependencies.sha256
create mode 100644 .github/scripts/prepare-release.sh
create mode 100644 .github/workflows/build.yml
create mode 100644 .github/workflows/maven-release.yml
create mode 100644 .github/workflows/release.yml
diff --git a/.github/dependencies.sha256 b/.github/dependencies.sha256
new file mode 100644
index 0000000..6845ae9
--- /dev/null
+++ b/.github/dependencies.sha256
@@ -0,0 +1,6 @@
+4241c14a7727c34feea6507ec801318a3d4a90f070e4525681079fb94ee4c593 libs/gson-2.10.1.jar
+c84700df5942fd969d3e8c2f1ad2c3ebeb17987ef88b426408d1306e49c4aada libs/MMOItems-6.10.jar
+660ff2a6ec86bc8d7779948cf65c1637e271a16e1ef812d6a273f4a5c5eec73c libs/MythicLib-1.7.jar
+97e0c708c1e319189ce1cda049244551a105860d51e908d2bcbc183fd1f89816 libs/spigot-api-1.20.2-R0.1-SNAPSHOT.jar
+bbac27e3055d135a4a7f6164ace5e32b7e6275cc8387575a8c8e1809fdc555fd libs/TLibs.jar
+0116d714822b6f0cfebfe833a5df2e4754797b637d0fe709afb762c56da463a3 libs/ItemsAdder_3.5.0-r2.jar
diff --git a/.github/scripts/prepare-release.sh b/.github/scripts/prepare-release.sh
new file mode 100644
index 0000000..bee8bc0
--- /dev/null
+++ b/.github/scripts/prepare-release.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+: "${GH_TOKEN:?Set DEPS_TOKEN with Contents read access to TF-Minecraft/ServerAssets}"
+ref=2fe025eb9879bab7dfe48e32395d8a8c1dff75f7
+mkdir -p libs
+curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/4241c14a7727/gson-2.10.1.jar?ref=$ref" > "libs/gson-2.10.1.jar"
+curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/c84700df5942/MMOItems-6.10.jar?ref=$ref" > "libs/MMOItems-6.10.jar"
+curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/660ff2a6ec86/MythicLib-1.7.jar?ref=$ref" > "libs/MythicLib-1.7.jar"
+curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/97e0c708c1e3/spigot-api-1.20.2-R0.1-SNAPSHOT.jar?ref=$ref" > "libs/spigot-api-1.20.2-R0.1-SNAPSHOT.jar"
+curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/runtime/plugins/TLibs.jar?ref=$ref" > "libs/TLibs.jar"
+curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/0116d714822b/ItemsAdder_3.5.0-r2.jar?ref=$ref" > "libs/ItemsAdder_3.5.0-r2.jar"
+sha256sum --check .github/dependencies.sha256
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..66b7bea
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,55 @@
+name: Build
+
+on:
+ push:
+ branches: [main]
+ pull_request:
+ branches: [main]
+
+permissions:
+ contents: read
+
+jobs:
+ build:
+ runs-on: ubuntu-24.04
+ timeout-minutes: 20
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - uses: actions/setup-java@v6
+ with:
+ distribution: temurin
+ java-version: '25'
+ - name: Prepare pinned dependencies
+ env:
+ GH_TOKEN: ${{ secrets.DEPS_TOKEN }}
+ run: bash .github/scripts/prepare-release.sh
+ - name: Set dated development version
+ id: dev
+ shell: bash
+ run: |
+ dev_version="DEV-$(date -u +%Y%m%d-%H%M)"
+ mvn -B --no-transfer-progress org.codehaus.mojo:versions-maven-plugin:2.22.0:set \
+ -DnewVersion="$dev_version" -DgenerateBackupPoms=false
+ mvn -B --no-transfer-progress help:evaluate \
+ -Dexpression=project.build.finalName -Doutput="$RUNNER_TEMP/final-name"
+ final_name=$(cat "$RUNNER_TEMP/final-name")
+ echo "name=$final_name" >> "$GITHUB_OUTPUT"
+ echo "jar=target/$final_name.jar" >> "$GITHUB_OUTPUT"
+
+ - name: Run unit tests and build
+ run: mvn -B --no-transfer-progress clean verify -DskipTests=false -Dmaven.test.skip=false
+ - uses: actions/upload-artifact@v7
+ with:
+ name: ${{ steps.dev.outputs.name }}-${{ github.run_id }}-${{ github.run_attempt }}
+ path: ${{ steps.dev.outputs.jar }}
+ if-no-files-found: error
+
+ - name: Upload unit test reports
+ if: ${{ !cancelled() && hashFiles('target/surefire-reports/*.xml') != '' }}
+ uses: actions/upload-artifact@v7
+ with:
+ name: unit-test-reports-${{ github.run_id }}-${{ github.run_attempt }}
+ path: target/surefire-reports/
+ if-no-files-found: error
diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml
new file mode 100644
index 0000000..3103b70
--- /dev/null
+++ b/.github/workflows/maven-release.yml
@@ -0,0 +1,135 @@
+name: Maven plugin release
+
+on:
+ workflow_call:
+ inputs:
+ java-version:
+ required: true
+ type: string
+ artifact-path:
+ description: Exact deployable JAR path, with optional {version} placeholder
+ required: true
+ type: string
+ secrets:
+ DEPS_TOKEN:
+ required: false
+
+permissions:
+ contents: read
+
+concurrency:
+ group: plugin-release-${{ github.repository }}-${{ github.ref }}
+ cancel-in-progress: false
+
+defaults:
+ run:
+ shell: bash
+
+jobs:
+ build:
+ if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+ runs-on: ubuntu-24.04
+ timeout-minutes: 20
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+
+ - uses: actions/setup-java@v6
+ with:
+ distribution: temurin
+ java-version: ${{ inputs.java-version }}
+
+ - name: Validate release version
+ env:
+ TAG: ${{ github.ref_name }}
+ run: |
+ [[ "$TAG" =~ ^v[0-9]+\.[0-9]+(\.[0-9]+)?(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]] || {
+ echo '::error::Expected vMAJOR.MINOR or vMAJOR.MINOR.PATCH, with an optional prerelease suffix.'
+ exit 1
+ }
+ [[ "${TAG^^}" != *SNAPSHOT* ]] || exit 1
+
+ - name: Prepare pinned dependencies
+ env:
+ GH_TOKEN: ${{ secrets.DEPS_TOKEN }}
+ run: |
+ if [[ -f .github/scripts/prepare-release.sh ]]; then
+ bash .github/scripts/prepare-release.sh
+ fi
+
+ - name: Check Maven version and build
+ env:
+ TAG: ${{ github.ref_name }}
+ run: |
+ version_file="$RUNNER_TEMP/maven-release-version"
+ mvn -B --no-transfer-progress -P'!deploy-live' help:evaluate \
+ -Dexpression=project.version -Doutput="$version_file"
+ [[ "$(cat "$version_file")" == "${TAG#v}" ]] || {
+ echo '::error::The tag must match project.version exactly.'
+ exit 1
+ }
+ mvn -B --no-transfer-progress -P'!deploy-live' clean verify
+
+ - name: Stage only the release JAR
+ env:
+ ARTIFACT_PATH: ${{ inputs.artifact-path }}
+ TAG: ${{ github.ref_name }}
+ run: |
+ python3 - <<'PY'
+ import hashlib, json, os, pathlib, shutil, zipfile
+ root = pathlib.Path.cwd().resolve()
+ source = (root / os.environ['ARTIFACT_PATH'].replace('{version}', os.environ['TAG'][1:])).resolve()
+ if not source.is_relative_to(root / 'target') or not source.is_file() or source.suffix != '.jar':
+ raise SystemExit('Expected one existing JAR inside target/')
+ with zipfile.ZipFile(source) as jar:
+ if not {'plugin.yml', 'paper-plugin.yml'}.intersection(jar.namelist()):
+ raise SystemExit('Release JAR has no plugin descriptor')
+ if jar.testzip() is not None:
+ raise SystemExit('Release JAR is corrupt')
+ dest = pathlib.Path(os.environ['RUNNER_TEMP']) / 'plugin-release'
+ dest.mkdir()
+ shutil.copyfile(source, dest / source.name)
+ digest = hashlib.sha256((dest / source.name).read_bytes()).hexdigest()
+ (dest / 'SHA256SUMS').write_text(f'{digest} {source.name}\n')
+ (dest / 'build.json').write_text(json.dumps({
+ 'repository': os.environ['GITHUB_REPOSITORY'],
+ 'commit': os.environ['GITHUB_SHA'],
+ 'tag': os.environ['TAG'],
+ 'run': f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ['GITHUB_RUN_ID']}",
+ 'artifact': source.name,
+ 'sha256': digest,
+ }, indent=2) + '\n')
+ PY
+
+ - uses: actions/upload-artifact@v7
+ with:
+ name: plugin-release-${{ github.sha }}
+ path: ${{ runner.temp }}/plugin-release/
+ if-no-files-found: error
+ retention-days: 30
+
+ publish:
+ needs: build
+ runs-on: ubuntu-24.04
+ timeout-minutes: 5
+ permissions:
+ contents: write
+ steps:
+ - uses: actions/download-artifact@v8
+ with:
+ name: plugin-release-${{ github.sha }}
+ path: release
+
+ - name: Create draft release
+ working-directory: release
+ env:
+ GH_TOKEN: ${{ github.token }}
+ GH_REPO: ${{ github.repository }}
+ TAG: ${{ github.ref_name }}
+ run: |
+ sha256sum --check SHA256SUMS
+ flags=()
+ if [[ "$TAG" == *-* ]]; then flags+=(--prerelease); fi
+ gh release create "$TAG" ./*.jar SHA256SUMS build.json \
+ --verify-tag --draft --title "$TAG" --generate-notes "${flags[@]}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..7d909f3
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,20 @@
+name: Release
+
+on:
+ push:
+ tags: ['v*']
+
+permissions:
+ contents: read
+
+jobs:
+ release:
+ permissions:
+ contents: write
+ uses: ./.github/workflows/maven-release.yml
+ with:
+ java-version: '25'
+ # Exact path, not a glob. {version} is replaced with the tag without v.
+ artifact-path: target/woodworking-{version}.jar
+ secrets:
+ DEPS_TOKEN: ${{ secrets.DEPS_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 7a9655e..96afe12 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,3 +31,6 @@ Thumbs.db
# Logs
*.log
+
+# Downloaded build dependencies
+/libs/*.jar
diff --git a/pom.xml b/pom.xml
index f0606f4..976385a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,42 +20,42 @@
gson
2.10.1
system
- D:/Dokumenter/My Plugins/Reference Libs/gson-2.10.1.jar
+ ${project.basedir}/libs/gson-2.10.1.jar
local
MMOItems
6.10
system
- D:/Dokumenter/My Plugins/Reference Libs/MMOItems-6.10.jar
+ ${project.basedir}/libs/MMOItems-6.10.jar
local
MythicLib
1.7
system
- D:/Dokumenter/My Plugins/Reference Libs/MythicLib-1.7.jar
+ ${project.basedir}/libs/MythicLib-1.7.jar
local
spigot-api
1.20.2-R0.1-SNAPSHOT
system
- D:/Dokumenter/My Plugins/Reference Libs/spigot-api-1.20.2-R0.1-SNAPSHOT.jar
+ ${project.basedir}/libs/spigot-api-1.20.2-R0.1-SNAPSHOT.jar
local
TLibs
1.0
system
- D:/Dokumenter/My Plugins/TFMC/TLibs/TLibs.jar
+ ${project.basedir}/libs/TLibs.jar
local
LoneLibs
3.5.0
system
- D:/Dokumenter/My Plugins/Reference Libs/ItemsAdder_3.5.0-r2.jar
+ ${project.basedir}/libs/ItemsAdder_3.5.0-r2.jar
commons-lang
@@ -65,24 +65,20 @@
+
+
+ src/main/resources
+ true
+ plugin.yml
+
+
+ src/main/resources
+ false
+ plugin.yml
+
+
-
- org.apache.maven.plugins
- maven-antrun-plugin
-
-
- package
- run
-
-
-
-
-
-
-
-
-
+
diff --git a/src/main/resources/plugin.yml b/src/main/resources/plugin.yml
index 9d93832..6e96556 100644
--- a/src/main/resources/plugin.yml
+++ b/src/main/resources/plugin.yml
@@ -1,7 +1,7 @@
main: net.tfminecraft.woodworking.Woodworking
api-version: 1.20
name: Woodworking
-version: 0.1.0
+version: ${project.version}
author: Drefvelin
depend: [TLibs, MMOItems, MythicLib]