ci.yaml

name: ci

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  push:
    branches:
      - main
      - v*
    # Publish `v1.2.3` tags as releases.
    tags:
      - v*
  # Run tests for PRs
  pull_request:

env:
  VAULT_ADDR: https://vault.eng.aserto.com/

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Java for publishing to Maven Central Repository
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: temurin

      - name: Set up Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Install topaz
        run: brew tap aserto-dev/tap && brew install aserto-dev/tap/topaz && topaz install

      - name: Run all tests
        run: mvn --no-transfer-progress clean test -Pintegration
  release:
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    name: Release to maven central
    steps:
      - name: Read Configuration
        uses: hashicorp/vault-action@v3
        id: vault
        with:
          url: ${{ env.VAULT_ADDR }}
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            kv/data/MavenCentral  "USERNAME" | MAVEN_USERNAME;
            kv/data/MavenCentral  "PASSWORD" | MAVEN_CENTRAL_TOKEN;
            kv/data/MavenCentral  "GPG_PASSPHRASE" | MAVEN_GPG_PASSPHRASE;
            kv/data/MavenCentral  "PRIVATE_GPG_KEY" | MAVEN_GPG_PRIVATE_KEY;
            kv/data/MavenCentral  "TOKEN_USERNAME" | TOKEN_USERNAME;
            kv/data/MavenCentral  "TOKEN_PASSWORD" | TOKEN_PASSWORD;

      - name: Set up Java for publishing to Maven Central Repository
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: temurin
          server-id: ossrh
          server-username: TOKEN_USERNAME
          server-password: TOKEN_PASSWORD
          gpg-private-key: ${{ env.MAVEN_GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: build artifact
        run: mvn --no-transfer-progress clean package

      - name: Create release
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          artifacts: "${{ github.workspace }}/target/*.jar"
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish to the Maven Central Repository
        run: mvn --no-transfer-progress --batch-mode -Pci-cd deploy