ci.yaml

name: ci

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  push:
    branches:
      - main
      - v*
    # Publish `v1.2.3` tags as releases.
    tags:
      - v*
  # Run tests for PRs
  pull_request:

env:
  VAULT_ADDR: https://vault.eng.aserto.com/

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up Java for publishing to Maven Central Repository
        uses: actions/setup-java@v3
        with:
          java-version: 8
          distribution: temurin

      - name: Run tests
        run: mvn clean test
  release:
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    name: Release to maven central
    steps:
      - name: Read Configuration
        uses: hashicorp/vault-action@v2.5.0
        id: vault
        with:
          url: ${{ env.VAULT_ADDR }}
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            kv/data/MavenCentral  "USERNAME" | MAVEN_USERNAME;
            kv/data/MavenCentral  "PASSWORD" | MAVEN_PASSWORD;
            kv/data/MavenCentral  "GPG_PASSPHRASE" | MAVEN_GPG_PASSPHRASE;
            kv/data/MavenCentral  "PRIVATE_GPG_KEY" | GPG_PRIVATE_KEY;

      - name: Set up Java for publishing to Maven Central Repository
        uses: actions/setup-java@v3
        with:
          java-version: 8
          distribution: temurin
          server-id: ossrh
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ env.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: build artifact
        run: mvn clean package

      - name: Create release
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          artifacts: "${{ github.workspace }}/target/*.jar"
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish to the Maven Central Repository
        run: |
          mvn \
            --no-transfer-progress \
            --batch-mode \
            -Pci-cd \
            deploy