.github/workflows/ci-release.yml - 4.2 - githubmirror/netty

.github/workflows/ci-release.yml
406 строк16 KB
Norman Maurer
Pin github actions to reduce risk (#17043)
02 июл 2026, 22:30
02 июл 2026, 22:30da22048
# ----------------------------------------------------------------------------
# Copyright 2021 The Netty Project
#
# The Netty Project licenses this file to you under the Apache License,
# version 2.0 (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at:
#
#   https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
# ----------------------------------------------------------------------------
name: Release 4.1.x

on:

  # Releases can only be triggered via the action tab
  workflow_dispatch:

permissions: read-all

env:
  MAVEN_OPTS: -Xmx6g -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryhandler.count=5 -Dmaven.wagon.httpconnectionManager.ttlSeconds=240

# Cancel running jobs when a new push happens to the same branch as otherwise it will
# tie up too many resources without providing much value.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    steps:
      # Pinned to v4.3.1
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          ref: 4.1

      # Pinned to v4.8.0
      - name: Set up JDK 8
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9
        with:
          distribution: 'zulu'
          java-version: '8'

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      # Pinned to v2.8.1
      - name: Install SSH key
        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      # Cache .m2/repository
      # Pinned to v4.3.0
      - name: Cache local Maven repository
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: cache-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            cache-maven-${{ hashFiles('**/pom.xml') }}
            cache-maven-

      - name: Prepare release with Maven
        run: |
          ./mvnw -B -ntp --file pom.xml release:prepare -DpreparationGoals=clean -DskipTests=true
          ./mvnw -B -ntp clean

      - name: Checkout tag
        run: ./.github/scripts/release_checkout_tag.sh release.properties

      # Pinned to v4.6.2
      - name: Upload workspace
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: prepare-release-workspace
          path: |
            ${{ github.workspace }}/**
            !${{ github.workspace }}/.git/config
          include-hidden-files: true

  stage-release-linux:
    runs-on: ubuntu-latest
    needs: prepare-release
    strategy:
      matrix:
        include:
          - setup: linux-x86_64-java8
            docker-compose-build: "-f docker/docker-compose.yaml -f docker/docker-compose.centos-6.18.yaml build"
            docker-compose-run: "-f docker/docker-compose.yaml -f docker/docker-compose.centos-6.18.yaml run stage-release"
          - setup: linux-aarch64
            docker-compose-build: "-f docker/docker-compose.centos-7.yaml build"
            docker-compose-run: "-f docker/docker-compose.centos-7.yaml run cross-compile-aarch64-stage-release"
          - setup: linux-riscv64
            docker-compose-build: "-f docker/docker-compose.ubuntu-20.04.yaml build"
            docker-compose-run: "-f docker/docker-compose.ubuntu-20.04.yaml run cross-compile-riscv64-stage-release"

    name: stage-release-${{ matrix.setup }}

    steps:
      # Pinned to v4.3.0
      - name: Download release-workspace
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: prepare-release-workspace
          path: ./prepare-release-workspace/

      - name: Adjust mvnw permissions
        run: chmod 755 ./prepare-release-workspace/mvnw

      # Pinned to v4.8.0
      - name: Set up JDK 8
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9
        with:
          distribution: 'zulu'
          java-version: '8'

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      # Pinned to v2.8.1
      - name: Install SSH key
        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      # Pinned to v3.0.0
      - uses: s4u/maven-settings-action@7802f6aec16c9098b4798ad1f1d8ac75198194bd
        with:
          servers: |
            [{
              "id": "central",
              "username": "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
              "password": "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
            }]

      # Cache .m2/repository
      # Pinned to v4.3.0
      - name: Cache local Maven repository
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: cache-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            cache-maven-${{ hashFiles('**/pom.xml') }}
            cache-maven-

      - name: Create local staging directory
        run: mkdir -p ~/local-staging

      - name: Build docker image
        working-directory: ./prepare-release-workspace/
        run: docker compose ${{ matrix.docker-compose-build }}

      - name: Stage release to local staging directory
        working-directory: ./prepare-release-workspace/
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_KEYNAME: ${{ secrets.GPG_KEYNAME }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: docker compose ${{ matrix.docker-compose-run }}

      # Pinned to v4.6.2
      - name: Upload workspace
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: ${{ matrix.setup }}-local-staging
          path: ./prepare-release-workspace/target/central-staging
          if-no-files-found: error
          include-hidden-files: true

      - name: Rollback release on failure
        working-directory: ./prepare-release-workspace/
        if: ${{ failure() }}
        # Rollback the release in case of an failure
        run: bash ./.github/scripts/release_rollback.sh release.properties netty/netty 4.1

  stage-release-macos:
    needs: prepare-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - setup: macos-x86_64-java8
            os: macos-15-intel
          - setup: macos-aarch64-java8
            os: macos-15
    runs-on: ${{ matrix.os }}
    name:  stage-release-${{ matrix.setup }}

    steps:
      # Pinned to v4.3.0
      - name: Download release-workspace
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: prepare-release-workspace
          path: ./prepare-release-workspace/

      - name: Adjust mvnw permissions
        run: chmod 755 ./prepare-release-workspace/mvnw

      # Pinned to v4.8.0
      - name: Set up JDK 8
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9
        with:
          distribution: 'zulu'
          java-version: '8'

      # Pinned to v6.3.0
      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      # Pinned to v2.8.1
      - name: Install SSH key
        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      # Pinned to v3.0.0
      - uses: s4u/maven-settings-action@7802f6aec16c9098b4798ad1f1d8ac75198194bd
        with:
          servers: |
            [{
              "id": "central",
              "username": "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
              "password": "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
            }]

      # Cache .m2/repository
      # Pinned to v4.3.0
      - name: Cache local Maven repository
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
        continue-on-error: true
        with:
          path: ~/.m2/repository
          key: cache-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            cache-maven-${{ hashFiles('**/pom.xml') }}
            cache-maven-

      - name: Install tools via brew
        working-directory: ./prepare-release-workspace/
        run: brew bundle

      - name: Create local staging directory
        run: mkdir -p ~/local-staging

      - name: Stage snapshots to local staging directory
        working-directory: ./prepare-release-workspace/
        run: ./mvnw -B -ntp clean javadoc:jar package gpg:sign org.sonatype.central:central-publishing-maven-plugin:publish -DskipPublishing=true -DskipTests=true

      # Pinned to v4.6.2
      - name: Upload local staging directory
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: ${{ matrix.setup }}-local-staging
          path: ./prepare-release-workspace/target/central-staging
          if-no-files-found: error
          include-hidden-files: true

      - name: Rollback release on failure
        working-directory: ./prepare-release-workspace/
        if: ${{ failure() }}
        # Rollback the release in case of an failure
        run: bash ./.github/scripts/release_rollback.sh release.properties netty/netty 4.1

  deploy-staged-release:
    runs-on: ubuntu-latest
    # Wait until we have staged everything
    needs: [ stage-release-linux, stage-release-macos ]
    steps:
      # Pinned to v4.3.0
      - name: Download release-workspace
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: prepare-release-workspace
          path: ./prepare-release-workspace/

      - name: Adjust mvnw permissions
        run: chmod 755 ./prepare-release-workspace/mvnw

      # Pinned to v4.8.0
      - name: Set up JDK 8
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9
        with:
          distribution: 'zulu'
          java-version: '8'

      # Pinned to v6.3.0
      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Setup git configuration
        run: |
          git config --global user.email "netty-project-bot@users.noreply.github.com"
          git config --global user.name "Netty Project Bot"

      # Pinned to v2.8.1
      - name: Install SSH key
        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY_PEM }}
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

      # Pinned to v3.0.0
      - uses: s4u/maven-settings-action@7802f6aec16c9098b4798ad1f1d8ac75198194bd
        with:
          servers: |
            [{
              "id": "central",
              "username": "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
              "password": "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
            }]

      # Hardcode the staging artifacts that need to be downloaded.
      # These must match the matrix setups. There is currently no way to pull this out of the config.
      # Pinned to v4.3.0
      - name: Download macos-aarch64-java8 staging directory
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: macos-aarch64-java8-local-staging
          path: ~/macos-aarch64-java8-local-staging

      # Pinned to v4.3.0
      - name: Download macos-x86_64-java8 staging directory
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: macos-x86_64-java8-local-staging
          path: ~/macos-x86_64-java8-local-staging

      # Pinned to v4.3.0
      - name: Download linux-aarch64 staging directory
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: linux-aarch64-local-staging
          path: ~/linux-aarch64-local-staging

      # Pinned to v4.3.0
      - name: Download linux-riscv64 staging directory
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: linux-riscv64-local-staging
          path: ~/linux-riscv64-local-staging

      # Pinned to v4.3.0
      - name: Download linux-x86_64-java8 staging directory
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: linux-x86_64-java8-local-staging
          path: ~/linux-x86_64-java8-local-staging

      - name: Copy previous build artifacts to local maven repository
        working-directory: ./prepare-release-workspace/
        run: bash ./.github/scripts/local_staging_install_release.sh ~/.m2/repository ~/macos-aarch64-java8-local-staging ~/macos-x86_64-java8-local-staging ~/linux-aarch64-local-staging ~/linux-riscv64-local-staging ~/linux-x86_64-java8-local-staging

      - name: Generate netty-all and deploy to local staging.
        working-directory: ./prepare-release-workspace/
        run: ./mvnw -B --file pom.xml -Psonatype-oss-release,native-dependencies -pl all clean package gpg:sign org.sonatype.central:central-publishing-maven-plugin:publish -DskipPublishing=true -DskipTests=true -Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }} -Dgpg.keyname=${{ secrets.GPG_KEYNAME }}

      # This step takes care of merging all the previous staged repositories in a way that will allow us to deploy
      # all together with one maven command.
      - name: Merge staging repositories
        working-directory: ./prepare-release-workspace/
        run: bash ./.github/scripts/local_staging_merge_release.sh ~/local-staging ~/macos-aarch64-java8-local-staging ~/macos-x86_64-java8-local-staging ~/linux-aarch64-local-staging ~/linux-riscv64-local-staging ~/linux-x86_64-java8-local-staging ./all/target/central-staging

      - name: Create bundle
        working-directory: ./prepare-release-workspace/
        run: bash ./.github/scripts/bundle_create.sh ~/central-bundle.zip ~/local-staging/

      - name: Upload bundle to maven central
        working-directory: ./prepare-release-workspace/
        run: bash ./.github/scripts/bundle_upload.sh ~/central-bundle.zip ${{ secrets.MAVEN_CENTRAL_USERNAME }} ${{ secrets.MAVEN_CENTRAL_PASSWORD }}

      - name: Rollback release on failure
        working-directory: ./prepare-release-workspace/
        if: ${{ failure() }}
        # Rollback the release in case of an failure
        run: bash ./.github/scripts/release_rollback.sh release.properties netty/netty 4.1