ci: harden CI pipeline for external/fork PRs (GTI-846) (#27) #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Early Access' | |
| on: | |
| push: | |
| branches: [ main ] | |
| permissions: | |
| contents: write | |
| actions: write # required for actions/upload-artifact | |
| concurrency: | |
| group: early-access-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| earlyaccess: | |
| name: 'Early Access' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Java | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 | |
| with: | |
| java-version: 21 | |
| distribution: 'zulu' | |
| - name: Cache Gradle | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ~/.gradle/caches | |
| key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}-${{ hashFiles('**/gradle.properties') }} | |
| restore-keys: | | |
| ${{ runner.os }}-gradle- | |
| - name: Cache Gradle wrapper | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ~/.gradle/wrapper | |
| key: ${{ runner.os }}-gradlew-${{ hashFiles('**/gradlew') }} | |
| restore-keys: ${{ runner.os }}-gradlew- | |
| - name: Build | |
| run: | | |
| ./gradlew build test -S | |
| - name: Upload test reports | |
| if: failure() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: test-report | |
| path: | | |
| build/reports/tests/aggregate | |
| - name: Version | |
| id: vars | |
| shell: bash | |
| run: | | |
| BASE_VERSION=$(grep '^version\s*=\s*' gradle.properties | cut -d'=' -f2 | xargs) | |
| echo "BASE_VERSION=$BASE_VERSION" >> "$GITHUB_OUTPUT" | |
| # Check if current version is already a release (RC, SNAPSHOT, or tagged release) | |
| if [[ "$BASE_VERSION" == *-SNAPSHOT ]] || [[ "$BASE_VERSION" == *-RC* ]]; then | |
| echo "SHOULD_RELEASE_SNAPSHOT=false" >> "$GITHUB_OUTPUT" | |
| echo "Skipping snapshot release: version is already a pre-release ($BASE_VERSION)" | |
| else | |
| # Check if this exact version has been released as a tag | |
| if git tag --list | grep -q "^v${BASE_VERSION}$"; then | |
| echo "SHOULD_RELEASE_SNAPSHOT=false" >> "$GITHUB_OUTPUT" | |
| echo "Skipping snapshot release: version $BASE_VERSION has already been released" | |
| else | |
| # Create snapshot version | |
| SNAPSHOT_VERSION="${BASE_VERSION}-SNAPSHOT" | |
| echo "VERSION=$SNAPSHOT_VERSION" >> "$GITHUB_OUTPUT" | |
| echo "SHOULD_RELEASE_SNAPSHOT=true" >> "$GITHUB_OUTPUT" | |
| echo "Will release snapshot version: $SNAPSHOT_VERSION" | |
| fi | |
| fi | |
| - name: Release Snapshot | |
| if: ${{ steps.vars.outputs.SHOULD_RELEASE_SNAPSHOT == 'true' }} | |
| uses: jreleaser/release-action@90ac653bb9c79d11179e65d81499f3f34527dcd5 # 2.5.0 | |
| with: | |
| arguments: release | |
| version: 'latest' | |
| env: | |
| JRELEASER_GITHUB_PASSWORD: ${{ secrets.GIT_ACCESS_TOKEN }} | |
| JRELEASER_GITHUB_TOKEN: ${{ secrets.GIT_ACCESS_TOKEN }} | |
| JRELEASER_GITHUB_USERNAME: ${{ secrets.GIT_USER }} | |
| JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} | |
| JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }} | |
| JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }} | |
| JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.SONATYPE_USERNAME }} | |
| JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} | |
| JRELEASER_PROJECT_VERSION: ${{ steps.vars.outputs.VERSION }} | |
| JRELEASER_SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} | |
| - name: JReleaser output | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: artifact | |
| path: | | |
| out/jreleaser/trace.log | |
| out/jreleaser/output.properties |