code-maven_java-release.yml

---
name: code-maven-release
run-name: "Release labeled ${{ inputs.RELEASE_TYPE || 'in PR' }}"

concurrency: code-release-${{ github.ref }}

on:
  pull_request:
    types: [closed]
    branches: ['main', 'main-*']
    paths: ['code/**', '.github/workflows/code**']
  workflow_dispatch:
    inputs:
      BASELINE:
        description: 'Baseline branch'
        required: true
        default: 'main'
      RELEASE_TYPE:
        description: 'Release type to use'
        required: true
        default: 'release-type/minor'
        type: choice
        options:
          - 'release-type/hotfix'
          - 'release-type/multi-hotfix'
          - 'release-type/major'
          - 'release-type/minor'
          - 'release-type/patch'

env:
  MAVEN_OPTS: "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"

jobs:
  release:
    name: Release
    permissions:
      contents: write
      pull-requests: write
    if: github.event_name == 'workflow_dispatch'
      || (github.event.pull_request.merged == true && !contains(join(github.event.pull_request.labels.*.name, ', '), 'skip-release')
      && (contains(join(github.event.pull_request.labels.*.name, ', '), 'release-type')
      || vars.DEVELOPMENT_FLOW == 'trunk-based-development' ))
    runs-on: ubuntu-24.04
    steps:
      - name: Get input parameters
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            RELEASE_LABELS="${{ github.event.inputs.RELEASE_TYPE }}"
          else
            RELEASE_LABELS="${{ join(github.event.pull_request.labels.*.name, ', ') }}"
            if [[ $RELEASE_LABELS != *release-type/* ]]; then
              RELEASE_LABELS="$RELEASE_LABELS, release-type/minor"
            fi
          fi
          echo "RELEASE_LABELS=$RELEASE_LABELS" >> "$GITHUB_ENV"
          BASELINE_BRANCH=${{ github.event.inputs.BASELINE || github.ref }}
          echo "BASELINE_BRANCH=${BASELINE_BRANCH#refs/heads/}" >> "$GITHUB_ENV"

      - name: Checkout merge commit
        uses: actions/checkout@v4
        with:
          ref: ${{ env.BASELINE_BRANCH }}
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}


      - name: Check if CHANGELOG.md has changes
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          if git diff --quiet HEAD^ HEAD -- code/CHANGELOG.md; then
            echo "::error title={No CHANGELOG.md changes}::{No CHANGELOG.md changes were found. Update the UNRELEASED section with the new changes.}"
            gh pr comment ${{ github.event.number }} --body "
          ### :x: No changes in the \`CHANGELOG.md\` file
          No changes were found in the \`CHANGELOG.md\` file. Please, update the UNRELEASED section, listing the new changes that applies to this release."
            exit 1
          fi

      - name: Setup Maven Cache
        uses: actions/cache@v4
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Setup asdf Cache
        id: asdf-cache
        uses: actions/cache@v4
        continue-on-error: true
        with:
          path: ~/.asdf/data
          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
          restore-keys: |
            ${{ runner.os }}-asdf-

      - name: Validate tool-versions content
        run: |
          if grep -Evq '^[a-zA-Z0-9_-]+ [a-zA-Z0-9._+-]+$' code/.tool-versions; then
            echo "::error::Invalid .tool-versions content detected"
            exit 1
          fi

      - name: Save tool-versions content
        run: |
          {
            echo "TOOL_VERSIONS<<EOF"
            cat code/.tool-versions
            echo "EOF"
          } >> "$GITHUB_ENV"

      - name: Setup asdf environment
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
        # https://github.com/asdf-vm/actions/issues/356
        if: steps.asdf-cache.outputs.cache-hit != 'true'
        with:
          tool_versions: ${{ env.TOOL_VERSIONS }}

      - name: Setup Java environment vars
        run: |
          JAVA_HOME="$(asdf where java)"
          echo "JAVA_HOME=$JAVA_HOME" >> $GITHUB_ENV

      - name: Setup patch release type version
        if: contains(env.RELEASE_LABELS, 'release-type/hotfix')
          || contains(env.RELEASE_LABELS, 'release-type/multi-hotfix')
          || contains(env.RELEASE_LABELS, 'release-type/patch')
        run: echo "RELEASE_VERSION=patch" >> "$GITHUB_ENV"

      - name: Setup minor release type version
        if: contains(env.RELEASE_LABELS, 'release-type/minor')
        run: echo "RELEASE_VERSION=minor" >> "$GITHUB_ENV"

      - name: Setup minor release type version when no label set and TBD
        if: ${{ !contains(env.RELEASE_LABELS, 'release-type') && vars.DEVELOPMENT_FLOW == 'trunk-based-development' }}
        run: echo "RELEASE_VERSION=minor" >> "$GITHUB_ENV"

      - name: Setup major release type version
        if: contains(env.RELEASE_LABELS, 'release-type/major')
        run: echo "RELEASE_VERSION=major" >> "$GITHUB_ENV"

      - name: Prepare committer information
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GPG_PRIVATE_KEY: ${{ secrets.CI_GPG_SECRET_KEY }}
          GPG_PASSPHRASE: ${{ secrets.CI_GPG_SECRET_KEY_PASSWORD }}
        run: |
          git remote set-url origin "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ github.repository }}.git"

          # GPG: non-interactive signing setup
          mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
          printf 'allow-loopback-pinentry\nallow-preset-passphrase\n' > ~/.gnupg/gpg-agent.conf
          printf 'use-agent\npinentry-mode loopback\n' > ~/.gnupg/gpg.conf
          gpgconf --kill gpg-agent || true
          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
          KEY_DATA=$(gpg --list-secret-keys --with-colons)
          echo "$KEY_DATA" | awk -F: '/^grp:/ {print $10}' | while read -r GRIP; do
            /usr/lib/gnupg/gpg-preset-passphrase --preset "$GRIP" <<< "$GPG_PASSPHRASE"
          done

          # Git: identity and signing
          FPR=$(echo "$KEY_DATA" | awk -F: '/^fpr:/ {print $10; exit}')
          git config user.name "srvcosoitxtech"
          git config user.email "oso@inditex.com"
          git config user.signingkey "$FPR"
          git config commit.gpgsign true
          git config tag.gpgsign true

      - name: Update CHANGELOG.md
        id: update-changelog
        uses: release-flow/keep-a-changelog-action@74931dec7ecdbfc8e38ac9ae7e8dd84c08db2f32 # v3.0.0
        with:
          command: bump
          version: ${{ env.RELEASE_VERSION }}
          changelog: code/CHANGELOG.md
          fail-on-empty-release-notes: false
          keep-unreleased-section: true
          tag-prefix: ""

      - name: Deploy released artifact
        id: maven-release-deploy
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.CI_GPG_SECRET_KEY_PASSWORD }}
        working-directory: code
        run: |
          mkdir -p ~/.m2
          cat <<EOF > ~/.m2/settings.xml
          <settings>
            <servers>
              <server>
                <id>central</id>
                <username>${{ secrets.MAVEN_CENTRAL_USERNAME }}</username>
                <password>${{ secrets.MAVEN_CENTRAL_PASSWORD }}</password>
              </server>
              <server>
                <id>gpg.passphrase</id>
                <passphrase>${{ secrets.CI_GPG_SECRET_KEY_PASSWORD }}</passphrase>
              </server>
            </servers>
          </settings>
          EOF
          git add CHANGELOG.md
          git commit -S -m "chore: Update CHANGELOG with ${{ steps.update-changelog.outputs.version }} version Signed-off-by: srvcosoitxtech <oso@inditex.com>"
          git push --no-verify -u origin HEAD     
          mvn -B release:prepare release:perform -DreleaseVersion=${{ steps.update-changelog.outputs.version }} -DdeveloperConnection="scm:git:https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ github.repository }}.git" -Dconnection="scm:git:https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ github.repository }}.git"
          git push --follow-tags origin HEAD

      - name: Next Development Iteration / Create Sync Branch PR into Develop
        id: sync-branch-pr
        continue-on-error: true
        if: ${{ vars.DEVELOPMENT_FLOW != 'trunk-based-development' }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          DEVELOP=${BASELINE_BRANCH/main/develop}
          echo "DEVELOP=$DEVELOP" >> "$GITHUB_OUTPUT"
          # Avoid creating sync PR if the corresponding development branch does not exist
          if [[ -z $(git ls-remote --heads origin "$DEVELOP") ]]; then
            echo "The '$DEVELOP' branch does not exist in remote. Skipping the creation of sync PR"
          else
            git checkout -b "automated/sync-release-${{ steps.update-changelog.outputs.version }}-to-$DEVELOP"
            git push --no-verify -u origin HEAD
            gh pr create --base "$DEVELOP" \
              --title "Sync release ${{ steps.update-changelog.outputs.version }} to $DEVELOP" \
              --body "**Automated Pull Request**"
          fi

      - name: Github Release / Create
        uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
        id: github-release
        continue-on-error: true
        with:
          name: ${{ steps.update-changelog.outputs.version }}
          tag: ${{ steps.update-changelog.outputs.version }}
          token: ${{ steps.app-token.outputs.token }}
          body: |
            Check out the [changelog](code/CHANGELOG.md) for version ${{ steps.update-changelog.outputs.version }}

      - name: Comment in PR / Sync PR creation failed
        if: ${{ vars.DEVELOPMENT_FLOW != 'trunk-based-development' }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          DEVELOP=${BASELINE_BRANCH/main/develop}
          git remote set-url origin "https://x-access-token:$GITHUB_TOKEN@github.com/$GITHUB_REPOSITORY"
          # shellcheck disable=SC2140
          if ! git ls-remote --exit-code --heads origin automated/sync-release-"${{ steps.update-changelog.outputs.version }}"-to-"$DEVELOP"; then
            gh pr comment "${{ github.event.number }}" --body "An error occurred creating the \`sync\` branch that synchronizes the \`$BASELINE_BRANCH\` and \`$DEVELOP\` branches.
            Please create a branch from \`$BASELINE_BRANCH\` (e.g. \`internal/sync-$BASELINE_BRANCH-with-$DEVELOP\`) and then create a pull request against \`$DEVELOP\` to finish the release process."
          fi

      - name: Comment in PR / Release creation failed
        if: ${{ steps.github-release.outcome == 'failure' }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
        run: >
          gh pr comment ${{ github.event.number }} --body "An error occurred creating the Github Release.
          Don't panic! Your artifacts were successfully uploaded to the Distribution Platform and the new release tag was created.
          You can manually complete the release by creating it in the [releases](https://github.com/${{ github.repository }}/releases)
          page."