reusable-release.yml

name: Scala Library Release Workflow

on:
  workflow_call:
    inputs:
      GITHUB_APP_ID:
        description:
          "App ID for a GitHub App that is allowed to push directly to the default branch. Eg, App ID on:
          https://github.com/organizations/guardian/settings/apps/gu-scala-library-release"
        default: '807361' # Only for use by the Guardian!
        required: false # ...but if you're not the Guardian, you'll want to set this explicitly
        type: string
      LIBRARY_BUILD_JAVA_VERSION_FILE:
        description: "Path within the repo to the java-version-file - see https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#java-version-file"
        default: '.tool-versions' # as used by https://asdf-vm.com/
        required: false
        type: string
      SONATYPE_PROFILE_NAME:
        description: 'Sonatype account profile name, eg "com.gu", "org.xerial", etc (not your Sonatype username)'
        default: 'com.gu' # Only for use by the Guardian!
        required: false # Must be supplied if used by a non-Guardian project
        type: string
      SONATYPE_CREDENTIAL_HOST:
        description: 'The host of your SONATYPE_PROFILE_NAME, either "oss.sonatype.org" or "s01.oss.sonatype.org"'
        default: 'oss.sonatype.org' # The default host is going to be whatever "com.gu" is using
        required: false # ...but if you're not the Guardian, you'll want to set this explicitly
        type: string
      SONATYPE_USERNAME:
        description: 'Sonatype username'
        default: 'guardian.automated.maven.release' # Only for use by the Guardian!
        required: false # Must be supplied if used by a non-Guardian project
        type: string
    secrets:
      SONATYPE_PASSWORD:
        description: 'Password for the SONATYPE_USERNAME account - used to authenticate when uploading artifacts'
        required: true
      PGP_PRIVATE_KEY:
        description:
          "A passphrase-less PGP private key used to sign artifacts, commits, & tags.
          Should be in normal plaintext (ASCII-armored) format, starting 'BEGIN PGP PUBLIC KEY BLOCK', with no additional BASE64-encoding.
          The passphrase can be removed from an existing key using 'gpg --edit-key <key-id> passwd' : https://unix.stackexchange.com/a/550538/46453"
        required: true
      GITHUB_APP_PRIVATE_KEY:
        description:
          "See https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps#generating-private-keys
          Should be in normal plaintext format, starting '-----BEGIN RSA PRIVATE KEY-----'"
        required: true
    outputs:
      RELEASE_VERSION:
        description: "The un-prefixed version number of the release, eg '3.0.1'"
        value: ${{ jobs.push-release-commit.outputs.release_version }}
      RELEASE_TYPE:
        description: "Either 'FULL_MAIN_BRANCH' or 'PREVIEW_FEATURE_BRANCH' - whether this is a full release or a pre-release"
        value: ${{ jobs.init.outputs.release_type }}

env:
  LOCAL_ARTIFACTS_STAGING_PATH: /tmp/artifact_staging
  COMMITTER_NAME: "@${{github.actor}} using gha-scala-library-release-workflow"
  RUN_ATTEMPT_UID: ${{ github.run_id }}-${{ github.run_attempt }}
  TEMPORARY_BRANCH: release-workflow/temporary/${{ github.run_id }}
  GITHUB_REPO_URL: ${{ github.server_url }}/${{ github.repository }}
  LATEST_LTS_JAVA_VERSION: '21' # Used by all parts of the workflow that are not invoking the library's build process

jobs:
  init:
    name: 🔒 Init
    runs-on: ubuntu-latest
    outputs:
      key_fingerprint: ${{ steps.read-identifiers.outputs.key_fingerprint }}
      key_email: ${{ steps.read-identifiers.outputs.key_email }}
      release_type: ${{ steps.generate-version-suffix.outputs.release_type }}
      version_suffix: ${{ steps.generate-version-suffix.outputs.version_suffix }}
    steps:
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: ${{ env.LATEST_LTS_JAVA_VERSION }}
          gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
      - name: Read Identifiers from Signing Key
        id: read-identifiers
        run: |
          key_fingerprint_and_email=$(gpg2 --list-secret-keys --list-options show-only-fpr-mbox)
          key_fingerprint=$(echo $key_fingerprint_and_email | awk '{print $1}')
          key_email=$(echo $key_fingerprint_and_email | awk '{print $2}')
          echo "key_fingerprint=$key_fingerprint"
          
          cat << EndOfFile >> $GITHUB_OUTPUT
          key_fingerprint=$key_fingerprint
          key_email=$key_email
          EndOfFile
          if ! [[ "$key_fingerprint" =~ ^[[:xdigit:]]{8,}$ ]]; then
            echo "::error title=Missing PGP key::Has PGP_PRIVATE_KEY been set correctly? https://github.com/guardian/gha-scala-library-release-workflow/blob/main/docs/credentials/supplying-credentials.md"
            exit 1
          fi
      - name: Check for default branch
        id: generate-version-suffix
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          default_branch=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name ${{ github.repository }})
   
          if [[ "$default_branch" = $GITHUB_REF_NAME ]]; then
            release_type="FULL_MAIN_BRANCH"
            version_suffix=""
          else
            release_type="PREVIEW_FEATURE_BRANCH"
            version_suffix="-PREVIEW.${GITHUB_REF_NAME//[^[:alnum:]-]/}.$(date +%Y-%m-%dT%H%M).${GITHUB_SHA:0:8}"
          fi
          echo "current branch: $GITHUB_REF_NAME, release_type: $release_type, version_suffix: $version_suffix"
          cat << EndOfFile >> $GITHUB_OUTPUT
          release_type=$release_type
          version_suffix=$version_suffix
          EndOfFile

  generate-version-update-commits:
    name: 🎊 Test & Version
    needs: init
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is merged
        with:
          distribution: corretto
          java-version-file: ${{ inputs.LIBRARY_BUILD_JAVA_VERSION_FILE }}
#      - name: Debug MIMA assessment
#        run: |
#          sbt "show versionPolicyFindIssues"
      - name: Use sbt-release to construct version.sbt updates
        run: |
          git config user.email "${{ needs.init.outputs.key_email }}"
          git config user.name "$COMMITTER_NAME"
          
          sbt_commands_file=$(mktemp)
          cat << EndOfFile > $sbt_commands_file
          set releaseVersion := releaseVersion.value.andThen(_ + "${{ needs.init.outputs.version_suffix }}")
          release with-defaults
          EndOfFile
          cat $sbt_commands_file
          sbt ";< $sbt_commands_file"
          
          echo $GITHUB_WORKSPACE
          cd `mktemp -d`
          git clone --bare $GITHUB_WORKSPACE repo-with-unsigned-version-update-commits.git
          rm -Rf $GITHUB_WORKSPACE/*
          mv repo-with-unsigned-version-update-commits.git $GITHUB_WORKSPACE/
          ls -lR $GITHUB_WORKSPACE
      - name: Job summary
        run: |
          echo "# Release $(git describe --tags --abbrev=0)" >> $GITHUB_STEP_SUMMARY
      - uses: actions/cache/save@v4
        with:
          path: repo-with-unsigned-version-update-commits.git
          key: repo-with-unsigned-version-update-commits-${{ env.RUN_ATTEMPT_UID }}

  push-release-commit:
    name: 🔒 Push Release Commit
    needs: [generate-version-update-commits, init]
    permissions:
      contents: write
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.create-commit.outputs.release_tag }}
      release_version: ${{ steps.create-commit.outputs.release_version }}
      release_commit_id: ${{ steps.create-commit.outputs.release_commit_id }}
      version_file_path: ${{ steps.create-commit.outputs.version_file_path }}
      version_file_release_sha: ${{ steps.create-commit.outputs.version_file_release_sha }}
      version_file_post_release_content: ${{ steps.create-commit.outputs.version_file_post_release_content }}
    steps:
      - id: generate-github-app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ inputs.GITHUB_APP_ID }}
          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} }
      - uses: actions/checkout@v4
        with:
          path: repo
      - uses: actions/cache/restore@v4
        with:
          path: repo-with-unsigned-version-update-commits.git
          key: repo-with-unsigned-version-update-commits-${{ env.RUN_ATTEMPT_UID }}
          fail-on-cache-miss: true
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: ${{ env.LATEST_LTS_JAVA_VERSION }}
          gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
      - name: Create commit
        id: create-commit
        env:
          KEY_FINGERPRINT: ${{ needs.init.outputs.key_fingerprint }}
          KEY_EMAIL: ${{ needs.init.outputs.key_email }}
          GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          echo "GITHUB_REF_NAME=$GITHUB_REF_NAME"
          echo "GITHUB_REF=$GITHUB_REF"
          
          cd repo-with-unsigned-version-update-commits.git
          RELEASE_TAG=$(git describe --tags --abbrev=0)
          
          cd ../repo
          
          git remote add unsigned ../repo-with-unsigned-version-update-commits.git
          git fetch unsigned
          
          RELEASE_VERSION=${RELEASE_TAG#"v"}
          VERSION_FILE_PATH=$(git diff-tree --no-commit-id --name-only -r $RELEASE_TAG | grep version.sbt)
          VERSION_FILE_INITIAL_SHA=$( git rev-parse $GITHUB_REF:$VERSION_FILE_PATH )
          VERSION_FILE_RELEASE_SHA=$( git rev-parse $RELEASE_TAG:$VERSION_FILE_PATH )
          VERSION_FILE_RELEASE_CONTENT=$( git cat-file blob $RELEASE_TAG:$VERSION_FILE_PATH | base64 -w0)
          VERSION_FILE_POST_RELEASE_CONTENT=$( git cat-file blob unsigned/$GITHUB_REF_NAME:$VERSION_FILE_PATH | base64 -w0)

          cd ..
          
          cat << EndOfFile > commit-message.txt
          $RELEASE_TAG published by ${{github.actor}}
          
          ${{github.actor}} published release version $RELEASE_VERSION
          using gha-scala-library-release-workflow: https://github.com/guardian/gha-scala-library-release-workflow

          Release-Version: $RELEASE_VERSION
          Release-Initiated-By: ${{ github.server_url }}/${{github.actor}}
          Release-Workflow-Run: $GITHUB_REPO_URL/actions/runs/${{ github.run_id }}
          GitHub-Release-Notes: $GITHUB_REPO_URL/releases/tag/$RELEASE_TAG
          EndOfFile

          # Create temporary branch to push the release commit- required for PREVIEW releases
          gh api --method POST /repos/:owner/:repo/git/refs -f ref="refs/heads/$TEMPORARY_BRANCH" -f sha="$GITHUB_SHA"

          release_commit_id=$(gh api --method PUT /repos/:owner/:repo/contents/$VERSION_FILE_PATH \
            --field branch="$TEMPORARY_BRANCH" \
            --field message="@commit-message.txt" \
            --field sha="$VERSION_FILE_INITIAL_SHA" \
            --field content="$VERSION_FILE_RELEASE_CONTENT" --jq '.commit.sha')
                    
          cat << EndOfFile >> $GITHUB_OUTPUT
          release_tag=$RELEASE_TAG
          release_version=$RELEASE_VERSION
          release_commit_id=$release_commit_id
          version_file_path=$VERSION_FILE_PATH
          version_file_release_sha=$VERSION_FILE_RELEASE_SHA
          version_file_post_release_content=$VERSION_FILE_POST_RELEASE_CONTENT
          EndOfFile
          

  create-artifacts:
    name: 🎊 Create artifacts
    needs: [init, push-release-commit]
    runs-on: ubuntu-latest
    outputs:
      ARTIFACT_SHA256SUMS: ${{ steps.record-hashes.outputs.ARTIFACT_SHA256SUMS }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
      - uses: actions/setup-java@v4 # don't 'cache: sbt', at least until https://github.com/actions/setup-java/pull/564 is resolved
        with:
          distribution: corretto
          java-version-file: ${{ inputs.LIBRARY_BUILD_JAVA_VERSION_FILE }}
      - name: Generate artifacts
        run: |
          cat << EndOfFile > sbt-commands.txt
          set every sonatypeProjectHosting := Some(xerial.sbt.Sonatype.GitHubHosting("$GITHUB_REPOSITORY_OWNER", "${GITHUB_REPOSITORY#*/}", "${{ needs.init.outputs.key_email }}"))
          set ThisBuild / publishTo := Some(Resolver.file("foobar", file("$LOCAL_ARTIFACTS_STAGING_PATH")))
          EndOfFile
          cat sbt-commands.txt
          
          sbt ";< sbt-commands.txt; +publish"
      - name: Record SHA-256 hashes of artifacts
        id: record-hashes
        run: |
          sudo apt-get install hashdeep -q > /dev/null
          
          cd $LOCAL_ARTIFACTS_STAGING_PATH
          {
            echo 'ARTIFACT_SHA256SUMS<<EOF'
            sha256deep -r -l .
            echo EOF
          } >> "$GITHUB_OUTPUT"

      - uses: actions/cache/save@v4
        id: cache
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: unsigned-${{ env.RUN_ATTEMPT_UID }}

  sign:
    name: 🔒 Sign
    needs: [init, push-release-commit, create-artifacts]
    runs-on: ubuntu-latest
    env:
      KEY_FINGERPRINT: ${{ needs.init.outputs.key_fingerprint }}
    steps:
      - id: generate-github-app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ inputs.GITHUB_APP_ID }}
          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} }
      - uses: actions/checkout@v4
        with:
          path: repo
          ref: ${{ needs.push-release-commit.outputs.release_commit_id }}
          fetch-depth: 2 # To fast-forward the main branch, we need the commit on main, as well as the release commit
          token: ${{ steps.generate-github-app-token.outputs.token }}
          persist-credentials: true # Allow us to push as the GitHub App, and bypass branch ruleset
      - uses: actions/cache/restore@v4
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: unsigned-${{ env.RUN_ATTEMPT_UID }}
          fail-on-cache-miss: true
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: ${{ env.LATEST_LTS_JAVA_VERSION }}
          gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }}
      - name: Sign artifacts
        run: |
          echo "KEY_FINGERPRINT=$KEY_FINGERPRINT"
          find $LOCAL_ARTIFACTS_STAGING_PATH -type f -exec gpg -a --local-user "$KEY_FINGERPRINT" --detach-sign {} \;
      - name: Push signed tag
        env:
          RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
          RELEASE_COMMIT_ID: ${{ needs.push-release-commit.outputs.release_commit_id }}
          ARTIFACT_SHA256SUMS: ${{ needs.create-artifacts.outputs.ARTIFACT_SHA256SUMS }}
          KEY_EMAIL: ${{ needs.init.outputs.key_email }}
        run: |
          cd repo
          git config user.email "$KEY_EMAIL"
          git config user.name "$COMMITTER_NAME"
          git config tag.gpgSign true
          git config user.signingkey "$KEY_FINGERPRINT"
          
          if [ "${{ needs.init.outputs.release_type }}" == "FULL_MAIN_BRANCH" ]
          then
            echo "Full Main-Branch release, fast-forwarding the default branch to the release commit"
            git log --oneline -n 3
            git push origin $RELEASE_COMMIT_ID:refs/heads/$GITHUB_REF_NAME
          fi
          
          cat << EndOfFile > tag-message.txt
          Release $RELEASE_TAG initiated by $COMMITTER_NAME
          
          $ARTIFACT_SHA256SUMS
          EndOfFile
          
          echo "Message is..."
          cat tag-message.txt
          
          echo "Creating release tag (including artifact hashes)"
          git tag -a -F tag-message.txt $RELEASE_TAG $RELEASE_COMMIT_ID
          
          echo "Pushing tag $RELEASE_TAG"
          git push origin $RELEASE_TAG
      - uses: actions/cache/save@v4
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: signed-${{ env.RUN_ATTEMPT_UID }}

  sonatype-release:
    name: 🔒 Sonatype Release
    needs: [push-release-commit, sign]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/cache/restore@v4
        with:
          path: ${{ env.LOCAL_ARTIFACTS_STAGING_PATH }}
          key: signed-${{ env.RUN_ATTEMPT_UID }}
          fail-on-cache-miss: true
      - name: Create tiny sbt project to perform Sonatype upload
        run: |
          cat << EndOfFile > build.sbt
          sonatypeBundleDirectory := new File("$LOCAL_ARTIFACTS_STAGING_PATH")
          sonatypeProfileName := "${{ inputs.SONATYPE_PROFILE_NAME }}"
          sonatypeCredentialHost := "${{ inputs.SONATYPE_CREDENTIAL_HOST }}"
          version := "${{ needs.push-release-commit.outputs.release_version }}"
          EndOfFile
          
          mkdir project
          echo 'addSbtPlugin("org.xerial.sbt" % "sbt-sonatype" % "3.10.0")' > project/plugins.sbt
          echo 'sbt.version = 1.9.9' > project/build.properties
          
          ls -lR .
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: ${{ env.LATEST_LTS_JAVA_VERSION }}
          cache: sbt # the issue described in https://github.com/actions/setup-java/pull/564 doesn't affect this step (no version.sbt)
      - name: Release
        env:
          SONATYPE_USERNAME: ${{ inputs.SONATYPE_USERNAME }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
        run: |
          sbt "sonatypeBundleRelease"

  github-release:
    name: 🔒 Update GitHub
    needs:  [init, push-release-commit, sign]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    env:
      RELEASE_TAG: ${{ needs.push-release-commit.outputs.release_tag }}
      RELEASE_VERSION: ${{ needs.push-release-commit.outputs.release_version }}
      GH_REPO: ${{ github.repository }}
    steps:
      - id: generate-github-app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ inputs.GITHUB_APP_ID }}
          private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} }
      - name: Clean-up temporary branch that was retaining the now-tagged release commit
        env:
          GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
        run: |
          gh api --method DELETE /repos/:owner/:repo/git/refs/heads/$TEMPORARY_BRANCH
      - name: Common values
        run: |
          GITHUB_ACTIONS_PATH="$GITHUB_REPO_URL/actions"
          GITHUB_WORKFLOW_FILE="release.yml" # Could be derived from $GITHUB_WORKFLOW_REF
          GITHUB_WORKFLOW_URL="$GITHUB_ACTIONS_PATH/workflows/$GITHUB_WORKFLOW_FILE"
          
          cat << EndOfFile >> $GITHUB_ENV
          GITHUB_WORKFLOW_FILE=$GITHUB_WORKFLOW_FILE
          GITHUB_WORKFLOW_LINK=[GitHub UI]($GITHUB_WORKFLOW_URL)
          GITHUB_WORKFLOW_RUN_LINK=[#${{ github.run_number }}]($GITHUB_ACTIONS_PATH/runs/${{ github.run_id }})
          EndOfFile
      - name: Create Github Release and update version.sbt post-release
        if: needs.init.outputs.release_type == 'FULL_MAIN_BRANCH'
        env:
          GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
        run: |
          gh release create $RELEASE_TAG --verify-tag --generate-notes --notes "Release run: $GITHUB_WORKFLOW_RUN_LINK"
          echo "GitHub Release notes: [$RELEASE_TAG]($GITHUB_REPO_URL/releases/tag/$RELEASE_TAG)" >> $GITHUB_STEP_SUMMARY
          
          cat << EndOfFile > commit-message.txt
          Post-release of $RELEASE_TAG by @${{github.actor}}: set snapshot version
          
          Setting snapshot version after @${{github.actor}} published $GITHUB_REPO_URL/releases/tag/$RELEASE_TAG
          EndOfFile
          
          gh api --method PUT /repos/:owner/:repo/contents/${{ needs.push-release-commit.outputs.version_file_path }} \
            --field message="@commit-message.txt" \
            --field sha="${{ needs.push-release-commit.outputs.version_file_release_sha }}" \
            --field content="${{ needs.push-release-commit.outputs.version_file_post_release_content }}"
      - name: Update PR with comment
        if: needs.init.outputs.release_type == 'PREVIEW_FEATURE_BRANCH'
        env:
          GH_TOKEN: ${{ steps.generate-github-app-token.outputs.token }}
        run: |
          cat << EndOfFile > comment_body.txt
          @${{github.actor}} has published a preview version of this PR with release workflow run $GITHUB_WORKFLOW_RUN_LINK, based on commit ${{ github.sha }}:
          
          $RELEASE_VERSION
          
          <details>
          <summary>Want to make another preview release?</summary>
          
          Click 'Run workflow' in the $GITHUB_WORKFLOW_LINK, specifying the $GITHUB_REF_NAME branch, or use the [GitHub CLI](https://cli.github.com/) command:
          
          gh workflow run $GITHUB_WORKFLOW_FILE --ref $GITHUB_REF_NAME
          
          </details>
          
          <details>
          <summary>Want to make a full release after this PR is merged?</summary>
          
          Click 'Run workflow' in the $GITHUB_WORKFLOW_LINK, leaving the branch as the default, or use the [GitHub CLI](https://cli.github.com/) command:
          
          gh workflow run $GITHUB_WORKFLOW_FILE
          
          </details>
          EndOfFile
          
          cat comment_body.txt
          
          gh pr comment ${{ github.ref_name }} --body-file comment_body.txt >> $GITHUB_STEP_SUMMARY