adcp-sdk-java/.github/workflows/release.yml at main · adcontextprotocol/adcp-sdk-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# Maven Central release workflow (per D6 / D18 / D20).
#
# Triggered by a GitHub Release (created by Changesets or manually). Builds
# all modules and publishes to Maven Central via the vanniktech plugin and
# the Central Portal API (central.sonatype.com) — confirmed by bokelley
# review on PR #3; legacy OSSRH s01 endpoint is being sunset.
#
# Prerequisites (foundation admin actions per D6/D20):
#   1. Sonatype Central Portal namespace `org.adcontextprotocol` claimed via DNS TXT
#   2. GPG key generated and published to key servers
#   3. GitHub repo secrets configured:
#      - SONATYPE_USERNAME  (Central Portal token user)
#      - SONATYPE_PASSWORD  (Central Portal token password)
#      - GPG_KEY_ID         (last 8 hex chars of GPG key)
#      - GPG_PASSPHRASE     (GPG key passphrase)
#      - GPG_SECRET_KEY     (ASCII-armored GPG private key)
#
# First actual publish: v0.3 alpha (per D6). Until then this workflow
# exists but secrets won't be configured, so it will fail gracefully.

name: Release to Maven Central

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  publish:
    name: Publish to Maven Central
    runs-on: ubuntu-latest
    if: startsWith(github.event.release.tag_name, 'v')

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Install cosign
        uses: sigstore/cosign-installer@v3
        # cosign is required by adcp.schema-bundle-conventions — the :adcp
        # build runs cosign verify-blob against the protocol tarball (D4 /
        # Sigstore verification). publishAndReleaseToMavenCentral triggers
        # the full build, so cosign must be on PATH.

      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@v4

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Publish to Maven Central
        env:
          # vanniktech maven-publish plugin reads credentials via
          # ORG_GRADLE_PROJECT_* — no -P flags or on-disk keyring needed.
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_SECRET_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.GPG_KEY_ID }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_PASSPHRASE }}
        # publishToMavenCentral stages to Central Portal without auto-releasing
        # (automaticRelease = false in adcp.publishing-conventions). A human
        # must go to central.sonatype.com/publishing/deployments and click
        # "Publish" after reviewing the staged bundle.  Once we have done one
        # or two clean publishes, flip automaticRelease = true and switch this
        # to publishAndReleaseToMavenCentral.
        run: ./gradlew publishToMavenCentral --no-configuration-cache