Skip to content

Commit 7d71c9f

Browse files
fabisevfabisev
committed
fix(release): resolve artifact dir dynamically, extract tag/PR action, bump gpg plugin
- Discover release:perform signed-artifact dir at runtime and fail if none found - Extract shared push-tag-and-open-pr composite action used by both workflows - Bump maven-gpg-plugin 1.5 -> 3.2.8 (1.5 lacks MAVEN_GPG_PASSPHRASE support)
1 parent baa4cd5 commit 7d71c9f

11 files changed

Lines changed: 96 additions & 41 deletions

File tree

‎.github/actions/create-github-release/action.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,10 @@ inputs:
3030
artifact-dir:
3131
description: >
3232
Directory (searched non-recursively) holding the signed jars and their
33-
.asc siblings. For release:perform this is <module>/target/checkout/target;
34-
for an in-place deploy it is <module>/target.
33+
.asc siblings. For release:perform the caller should discover this at
34+
runtime (the SCM checkout re-nests the module under
35+
<module>/target/checkout/<module>/target); for an in-place deploy it is
36+
<module>/target.
3537
required: true
3638
extra-notes:
3739
description: "Optional Markdown inserted between the changelog and the Central link (e.g. an artifact inventory)."

‎.github/actions/push-tag-and-open-pr/action.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: "Push release tag and open version-bump PR"
2+
description: >
3+
Pushes an already-created local release tag, then routes the local
4+
version-bump commit(s) to a release/<tag> branch and opens a PR into the base
5+
branch. main is protected (no direct push): tag pushes aren't gated by branch
6+
protection, but the commits must land via PR. Shared by release.yml and
7+
release-runtime-interface-client.yml so the tag/PR handoff stays identical.
8+
9+
inputs:
10+
tag:
11+
description: "Local git tag to push (e.g. aws-lambda-java-core-1.3.0)."
12+
required: true
13+
module:
14+
description: "Module being released, used in the PR title and body."
15+
required: true
16+
version:
17+
description: "Released version, used in the PR title and body."
18+
required: true
19+
base-branch:
20+
description: "Branch the version-bump PR targets (typically the release branch, i.e. main)."
21+
required: true
22+
github-token:
23+
description: "Token for the gh CLI (typically github.token)."
24+
required: true
25+
26+
runs:
27+
using: composite
28+
steps:
29+
- name: Push tag and open version-bump PR
30+
shell: bash
31+
env:
32+
GH_TOKEN: ${{ inputs.github-token }}
33+
TAG: ${{ inputs.tag }}
34+
REL_MODULE: ${{ inputs.module }}
35+
REL_VERSION: ${{ inputs.version }}
36+
BASE_BRANCH: ${{ inputs.base-branch }}
37+
run: |
38+
RELEASE_BRANCH="release/${TAG}"
39+
40+
# Tag push isn't gated by branch protection; the version-bump commits
41+
# go to a release branch and land on the base branch via PR.
42+
git push origin "refs/tags/${TAG}"
43+
git push origin "HEAD:refs/heads/${RELEASE_BRANCH}"
44+
45+
gh pr create \
46+
--base "${BASE_BRANCH}" \
47+
--head "${RELEASE_BRANCH}" \
48+
--title "chore(release): ${REL_MODULE} ${REL_VERSION}" \
49+
--body "Post-release version bump for ${REL_MODULE} ${REL_VERSION} (already on Maven Central, tag ${TAG} pushed)."

‎.github/workflows/release-runtime-interface-client.yml‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -312,13 +312,9 @@ jobs:
312312
# gated by branch protection) and route the release + next-development
313313
# version-bump commits through a PR, mirroring release.yml. A direct
314314
# `git push ... HEAD:main` here is rejected with GH006 (protected branch).
315-
- name: Tag and push (only after publish succeeds)
315+
- name: Create release commit, tag, and version-bump commit
316316
if: ${{ github.event.inputs.skip_publish != 'true' }}
317-
env:
318-
GH_TOKEN: ${{ github.token }}
319317
run: |
320-
RELEASE_BRANCH="release/${TAG_NAME}"
321-
322318
# Release commit + tag (the tag points at the release version).
323319
git commit -am "chore(ric): release ${EFFECTIVE_RELEASE_VERSION}"
324320
git tag "$TAG_NAME"
@@ -344,16 +340,17 @@ jobs:
344340
git add "$CHANGELOG"
345341
git commit -am "chore(release): prepare next development, record ${MODULE} ${EFFECTIVE_RELEASE_VERSION} lastPublished and changelog"
346342
347-
# Tag push isn't gated by branch protection; the version-bump commits
348-
# go to a release branch and land on main via PR.
349-
git push origin "refs/tags/${TAG_NAME}"
350-
git push origin "HEAD:refs/heads/${RELEASE_BRANCH}"
351-
352-
gh pr create \
353-
--base "${GITHUB_REF_NAME}" \
354-
--head "${RELEASE_BRANCH}" \
355-
--title "chore(release): ${MODULE} ${EFFECTIVE_RELEASE_VERSION}" \
356-
--body "Post-release version bump for ${MODULE} ${EFFECTIVE_RELEASE_VERSION} (already on Maven Central, tag ${TAG_NAME} pushed)."
343+
# Shared with release.yml: push the tag and route the version-bump commits
344+
# to main via PR (main is protected, so no direct push).
345+
- name: Push release tag and open version-bump PR
346+
if: ${{ github.event.inputs.skip_publish != 'true' }}
347+
uses: ./.github/actions/push-tag-and-open-pr
348+
with:
349+
tag: ${{ env.TAG_NAME }}
350+
module: ${{ env.MODULE }}
351+
version: ${{ env.EFFECTIVE_RELEASE_VERSION }}
352+
base-branch: ${{ github.ref_name }}
353+
github-token: ${{ github.token }}
357354

358355
# GitHub Release on the pushed tag: the signed artifacts (byte-for-byte the
359356
# same detached GPG signatures uploaded to Maven Central) + verification

‎.github/workflows/release.yml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,21 @@ jobs:
250250
-Darguments="-gs $MAVEN_SETTINGS -Prelease -Dgpg.keyname=$GPG_KEYNAME" \
251251
--file "$MODULE/pom.xml"
252252
253+
# release:perform builds in a fresh SCM checkout under
254+
# <module>/target/checkout. Because the whole repo is one git repo, the
255+
# checkout re-nests the module, so the signed jars land under
256+
# <module>/target/checkout/<module>/target, not .../checkout/target.
257+
# Locate them by their detached signatures right after the build, pin
258+
# the directory into the env for the GitHub Release step, and fail loudly
259+
# if the publish produced no signed artifact.
260+
SIGNED_JAR=$(find "$MODULE/target/checkout" -type f -name '*.jar.asc' -print -quit)
261+
if [[ -z "$SIGNED_JAR" ]]; then
262+
echo "::error::No signed artifacts (*.jar.asc) found under $MODULE/target/checkout after release:perform"
263+
exit 1
264+
fi
265+
echo "ARTIFACT_DIR=$(dirname "$SIGNED_JAR")" >> "$GITHUB_ENV"
266+
echo "::notice::Signed release artifacts at $(dirname "$SIGNED_JAR")"
267+
253268
# Fold the lastPublished marker and changelog entry into the single
254269
# next-development commit that release:prepare created (local, unpushed),
255270
# so the whole post-release bump is ONE commit in the version-bump PR
@@ -287,25 +302,17 @@ jobs:
287302
# the just-released -SNAPSHOT.
288303
- name: Push release tag and open version-bump PR
289304
if: ${{ github.event.inputs.skip_publish != 'true' }}
290-
env:
291-
GH_TOKEN: ${{ github.token }}
292-
run: |
293-
RELEASE_BRANCH="release/${TAG_NAME}"
294-
295-
# Tag push isn't gated by branch protection; commits go via a PR.
296-
git push origin "refs/tags/${TAG_NAME}"
297-
git push origin "HEAD:refs/heads/${RELEASE_BRANCH}"
298-
299-
gh pr create \
300-
--base "${GITHUB_REF_NAME}" \
301-
--head "${RELEASE_BRANCH}" \
302-
--title "chore(release): ${MODULE} ${EFFECTIVE_RELEASE_VERSION}" \
303-
--body "Post-release version bump for ${MODULE} ${EFFECTIVE_RELEASE_VERSION} (already on Maven Central, tag ${TAG_NAME} pushed)."
305+
uses: ./.github/actions/push-tag-and-open-pr
306+
with:
307+
tag: ${{ env.TAG_NAME }}
308+
module: ${{ env.MODULE }}
309+
version: ${{ env.EFFECTIVE_RELEASE_VERSION }}
310+
base-branch: ${{ github.ref_name }}
311+
github-token: ${{ github.token }}
304312

305313
# GitHub Release on the pushed tag: changelog + Central link + GPG verify
306314
# instructions, with the signed jars and their .asc signatures attached.
307-
# release:perform builds in a fresh checkout, so the signed artifacts live
308-
# under <module>/target/checkout/target.
315+
# ARTIFACT_DIR was pinned to the checkout's build output by the publish step.
309316
- name: Create GitHub Release
310317
if: ${{ github.event.inputs.skip_publish != 'true' }}
311318
uses: ./.github/actions/create-github-release
@@ -316,7 +323,7 @@ jobs:
316323
version: ${{ env.EFFECTIVE_RELEASE_VERSION }}
317324
changelog-entry: ${{ env.CHANGELOG_ENTRY_INPUT }}
318325
fingerprint: ${{ env.GPG_FINGERPRINT }}
319-
artifact-dir: ${{ env.MODULE }}/target/checkout/target
326+
artifact-dir: ${{ env.ARTIFACT_DIR }}
320327
github-token: ${{ github.token }}
321328

322329
- name: Dry-run release (prepare only, no publish)

‎aws-lambda-java-core/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@
137137
<plugin>
138138
<groupId>org.apache.maven.plugins</groupId>
139139
<artifactId>maven-gpg-plugin</artifactId>
140-
<version>1.5</version>
140+
<version>3.2.8</version>
141141
<executions>
142142
<execution>
143143
<id>sign-artifacts</id>

‎aws-lambda-java-events-sdk-transformer/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@
189189
<plugin>
190190
<groupId>org.apache.maven.plugins</groupId>
191191
<artifactId>maven-gpg-plugin</artifactId>
192-
<version>1.5</version>
192+
<version>3.2.8</version>
193193
<executions>
194194
<execution>
195195
<id>sign-artifacts</id>

‎aws-lambda-java-events/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@
184184
<plugin>
185185
<groupId>org.apache.maven.plugins</groupId>
186186
<artifactId>maven-gpg-plugin</artifactId>
187-
<version>1.5</version>
187+
<version>3.2.8</version>
188188
<executions>
189189
<execution>
190190
<id>sign-artifacts</id>

‎aws-lambda-java-log4j2/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@
178178
<plugin>
179179
<groupId>org.apache.maven.plugins</groupId>
180180
<artifactId>maven-gpg-plugin</artifactId>
181-
<version>1.5</version>
181+
<version>3.2.8</version>
182182
<executions>
183183
<execution>
184184
<id>sign-artifacts</id>

‎aws-lambda-java-runtime-interface-client/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -399,7 +399,7 @@
399399
<plugin>
400400
<groupId>org.apache.maven.plugins</groupId>
401401
<artifactId>maven-gpg-plugin</artifactId>
402-
<version>1.5</version>
402+
<version>3.2.8</version>
403403
<executions>
404404
<execution>
405405
<id>sign-artifacts</id>

‎aws-lambda-java-serialization/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@
161161
<plugin>
162162
<groupId>org.apache.maven.plugins</groupId>
163163
<artifactId>maven-gpg-plugin</artifactId>
164-
<version>1.5</version>
164+
<version>3.2.8</version>
165165
<executions>
166166
<execution>
167167
<id>sign-artifacts</id>

0 commit comments

Comments
 (0)