release.yml

name: Maven Release

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Perform a dry run of the Maven release'
        required: true
        default: false
        type: boolean

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: write  # for git-push after version modifications

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1

      - name: Set up JDK
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # tag=v5.7.0
        with:
          java-version: '25'
          distribution: 'temurin'
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_PASSWORD
          # Export the gpg private key using the following command and add the contents of that file to the GitHub secret
          # gpg --armor --export-secret-keys <key_id> > gpg_key.asc
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Set up git
        run: |
          git config --global user.email "info@cyclonedx.org"
          git config --global user.name "CycloneDX Automation"

      - name: Run Maven command
        env:
          DRY_RUN: ${{ github.event.inputs.dry_run }}
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |-
          if [ "$DRY_RUN" = "true" ]; then
            mvn -B release:prepare -DdryRun=true
          else
            mvn -B release:clean release:prepare release:perform
          fi
        continue-on-error: ${{ github.event.inputs.dry_run == false }}

      - name: Rollback if release fails
        if: failure() && github.event.inputs.dry_run == false
        run: |
          echo "Release failed. Rolling back..."
          mvn -B release:rollback -Prelease
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}