publish.ci.yml

name: Publish

concurrency:
  group: "publish"
  cancel-in-progress: false

on:
  ## Publish flows can be invoked from other workflows.
  workflow_call:
    inputs:
      ## Repository to publish to.
      repo:
        description: "Repository"
        required: false
        default: "gcs://elide-snapshots/repository/v3"
        type: string

      ## Environment to update with this deployment.
      environment:
        description: "Target"
        type: string
        required: true

      ## URL target for this repository.
      url:
        description: "URL"
        type: string
        required: false

      ## Switch to use GCP credentials for publishing.
      gcp:
        description: "Use GCP credentials"
        type: boolean
        default: false

      ## Whether this is a snapshot publish.
      snapshot:
        description: "Shapshot?"
        type: boolean
        default: true

      ## Whether to publish library packages.
      packages:
        description: "Publish packages"
        type: boolean
        default: true

      ## Whether to publish the KSP processor.
      processor:
        description: "Publish processor"
        type: boolean
        default: true

      ## Whether to publish substrate packages.
      substrate:
        description: "Publish substrate"
        type: boolean
        default: true

      ## Whether to publish convention plugins.
      conventions:
        description: "Publish conventions"
        type: boolean
        default: true

      ## Whether to authorize the publish operation.
      auth:
        description: "Authorize publish"
        type: boolean
        default: false

    secrets:
      PUBLISH_USER:
        required: false
      PUBLISH_TOKEN:
        required: false
      BUILDBOT_SERVICE_ACCOUNT:
        required: false
      BUILDBOT_SERVICE_ACCOUNT_B64:
        required: false
      SIGNING_KEY:
        required: true
      SIGNING_KEY_ID:
        required: true
      SIGNING_KEY_PASSPHRASE:
        required: false

  ## Publish flow can be triggered manually.
  workflow_dispatch:
    inputs:
      repo:
        description: "Repository"
        required: true
        default: "gcs://elide-snapshots/repository/v3"
        type: string
      environment:
        description: "Target"
        type: environment
        required: true
      url:
        description: "URL"
        type: string
        required: false
      gcp:
        description: "Use GCP credentials"
        type: boolean
        default: false
      snapshot:
        description: "Shapshot?"
        type: boolean
        default: true
      packages:
        description: "Publish packages"
        type: boolean
        default: true
      processor:
        description: "Publish processor"
        type: boolean
        default: true
      substrate:
        description: "Publish substrate"
        type: boolean
        default: true
      conventions:
        description: "Publish conventions"
        type: boolean
        default: true
      auth:
        description: "Authorize publish"
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  publish:
    name: "Publish (${{ inputs.environment }})"
    runs-on: "ubuntu-latest"
    environment: ${{ inputs.environment }}
    concurrency: "publish-${{ inputs.environment }}"
    permissions:
      contents: "read"
      id-token: "write"
      checks: "write"
      pull-requests: "write"
      statuses: "write"
      deployments: "write"
    env:
      PUBLISH_USER: ${{ secrets.PUBLISH_USER }}
      PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
      BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          egress-policy: audit

      - name: "Setup: Checkout"
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - id: "auth"
        name: "Setup: Authorize Service Account"
        if: ${{ inputs.gcp }}
        uses: google-github-actions/auth@35b0e87d162680511bf346c299f71c9c5c379033 # v1.1.1
        with:
          credentials_json: "${{ secrets.BUILDBOT_SERVICE_ACCOUNT }}"
          create_credentials_file: true
          export_environment_variables: true
          cleanup_credentials: true
      - name: "Setup: Setup Cloud SDK"
        if: ${{ inputs.gcp }}
        uses: google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b # v1.1.1
        with:
          version: 389.0.0
          project_id: elide-fw
      - name: "Setup: GraalVM"
        uses: graalvm/setup-graalvm@0a27862568a8481fbfd3e2ce38c6445e34c0bed4 # v1.1.4
        with:
          components: "native-image,js,wasm"
          distribution: 'graalvm'
          java-version: 20
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: "Setup: Signing Keys"
        run: |
          cat <(echo -e "${{ secrets.SIGNING_KEY }}") | base64 -d | gpg --batch --import
          gpg --list-secret-keys --keyid-format LONG
          gpg --export-secret-keys > /home/runner/.gnupg/secring.gpg
      - name: "Setup: Version"
        run: |
          echo "APP_VERSION=$(cat .version)" >> $GITHUB_ENV;
          echo "Releasing version $APP_VERSION"
      - name: "Publish: Conventions"
        uses: gradle/gradle-build-action@b5126f31dbc19dd434c3269bf8c28c315e121da2 # v2.8.1
        if: ${{ inputs.conventions }}
        with:
          arguments: |
            --warning-mode=none
            -Pelide.ci=true
            -PenableSigning=true
            -Psigning.keyId=${{ secrets.SIGNING_KEY_ID }}
            -Psigning.password=${{ secrets.SIGNING_KEY_PASSPHRASE }}
            -Psigning.secretKeyRingFile=/home/runner/.gnupg/secring.gpg
            -Pelide.publish.repo.maven=${{ inputs.repo }}
            -Pversion=${{ env.APP_VERSION }}
            -Pelide.release=true
            -Pelide.buildMode=release
            -x test
            :conventions:publish
      - name: "Publish: Substrate"
        uses: gradle/gradle-build-action@b5126f31dbc19dd434c3269bf8c28c315e121da2 # v2.8.1
        if: ${{ inputs.substrate }}
        with:
          arguments: |
            --warning-mode=none
            -Pelide.ci=true
            -PenableSigning=true
            -Psigning.keyId=${{ secrets.SIGNING_KEY_ID }}
            -Psigning.password=${{ secrets.SIGNING_KEY_PASSPHRASE }}
            -Psigning.secretKeyRingFile=/home/runner/.gnupg/secring.gpg
            -Pelide.publish.repo.maven=${{ inputs.repo }}
            -Pversion=${{ env.APP_VERSION }}
            -Pelide.release=true
            -Pelide.buildMode=release
            -x test
            :substrate:publish
      - name: "Publish: Processor"
        uses: gradle/gradle-build-action@b5126f31dbc19dd434c3269bf8c28c315e121da2 # v2.8.1
        if: ${{ inputs.processor }}
        with:
          arguments: |
            --warning-mode=none
            -Pelide.ci=true
            -PenableSigning=true
            -Psigning.keyId=${{ secrets.SIGNING_KEY_ID }}
            -Psigning.password=${{ secrets.SIGNING_KEY_PASSPHRASE }}
            -Psigning.secretKeyRingFile=/home/runner/.gnupg/secring.gpg
            -Pelide.publish.repo.maven=${{ inputs.repo }}
            -Pversion=${{ env.APP_VERSION }}
            -Pelide.release=true
            -Pelide.buildMode=release
            -x test
            :tools:processor:publish
      - name: "Publish: Packages"
        uses: gradle/gradle-build-action@b5126f31dbc19dd434c3269bf8c28c315e121da2 # v2.8.1
        if: ${{ inputs.packages }}
        with:
          arguments: |
            --warning-mode=none
            -Pelide.ci=true
            -PenableSigning=true
            -Psigning.keyId=${{ secrets.SIGNING_KEY_ID }}
            -Psigning.password=${{ secrets.SIGNING_KEY_PASSPHRASE }}
            -Psigning.secretKeyRingFile=/home/runner/.gnupg/secring.gpg
            -Pelide.publish.repo.maven=${{ inputs.repo }}
            -Pelide.publish.repo.auth=${{ inputs.auth }}
            -Pversion=${{ env.APP_VERSION }}
            -Pelide.release=true
            -Pelide.buildMode=release
            -x test
            :packages:base:publish
            :packages:bom:publish
            :packages:core:publish
            :packages:frontend:publish
            :packages:graalvm:publish
            :packages:graalvm-js:publish
            :packages:graalvm-react:publish
            :packages:model:publish
            :packages:platform:publish
            :packages:proto:proto-core:publish
            :packages:proto:proto-capnp:publish
            :packages:proto:proto-flatbuffers:publish
            :packages:proto:proto-protobuf:publish
            :packages:proto:proto-kotlinx:publish
            :packages:rpc:publish
            :packages:server:publish
            :packages:ssg:publish
            :packages:ssr:publish
            :packages:test:publish

# Disabled until build is fixed:
#            :packages:wasm:publish