version-and-release.yml

name: Release
# Needs CENTRAL_USERNAME / CENTRAL_PASSWORD (Sonatype Central Portal user token) plus GPG_SECRET / GPG_PASSWORD.
on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: Version to publish (e.g. 3.0.0); the poms are set to it before deploying
        required: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Set up Java with Maven cache
        uses: actions/setup-java@v4
        with:
          java-version: '8'
          distribution: 'temurin'
          cache: 'maven'
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD

      - name: Update version in Maven configuration
        run: |
          mvn --no-transfer-progress \
            --batch-mode \
            versions:set -DnewVersion=${{ github.event.inputs.version || github.event.release.tag_name }} -DprocessAllModules

      - name: Install GPG key
        # accepts the armored key with real newlines, with escaped "\n", or base64 encoded
        run: |
          printf '%s' "$GPG_SECRET" > "$RUNNER_TEMP/gpg.key"
          gpg --batch --import "$RUNNER_TEMP/gpg.key" 2>/dev/null \
            || printf '%b' "$GPG_SECRET" | gpg --batch --import 2>/dev/null \
            || base64 -d "$RUNNER_TEMP/gpg.key" | gpg --batch --import
          rm -f "$RUNNER_TEMP/gpg.key"
          gpg --list-secret-keys --keyid-format LONG
        env:
          GPG_SECRET: ${{ secrets.GPG_SECRET }}

      - name: Publish to Maven
        run: |
          mvn --no-transfer-progress \
            --batch-mode \
            -Dgpg.passphrase='${{ secrets.GPG_PASSWORD }}' \
            -DskipTests deploy -P release

        env:
          MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}