release.yml

name: Maven Release

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Perform a dry run of the Maven release'
        required: true
        default: false
        type: boolean

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: write  # for git-push after version modifications

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2

      - name: Set up JDK
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # tag=v5.2.0
        with:
          java-version: '25'
          distribution: 'temurin'
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_PASSWORD
          # Export the gpg private key using the following command and add the contents of that file to the GitHub secret
          # gpg --armor --export-secret-keys <key_id> > gpg_key.asc
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Set up git
        run: |
          git config --global user.email "info@cyclonedx.org"
          git config --global user.name "CycloneDX Automation"

      - name: Set Maven options
        id: maven_options
        run: |
          # Set the Maven options based on the 'dry_run' input
          if ${{ github.event.inputs.dry_run }}; then
            echo "options=release:prepare -DdryRun=true" >> $GITHUB_ENV
          else
            echo "options=release:clean release:prepare release:perform" >> $GITHUB_ENV
          fi

      - name: Run Maven command
        run: |
          mvn -B ${{ env.options }}
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        continue-on-error: ${{ github.event.inputs.dry_run == false }}

      - name: Rollback if release fails
        if: failure() && github.event.inputs.dry_run == false
        run: |
          echo "Release failed. Rolling back..."
          mvn -B release:rollback -Prelease
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}