feat(release): add changelog entry, GitHub Releases, lastPublished, a… #640
+340
−71
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| name: "Create GitHub Release with signed assets" | ||
| description: > | ||
| Creates a GitHub Release on an already-pushed tag. Builds the release notes | ||
| from the changelog entry, a Maven Central link, and GPG verification | ||
| instructions, then attaches the signed jars and their detached .asc | ||
| signatures (byte-for-byte the same signatures uploaded to Maven Central). The | ||
| attachment set is derived from the .asc files, so only signed, published | ||
| artifacts are attached (unsigned intermediates like shade's original-*.jar are | ||
| skipped). No re-signing happens here. | ||
|
|
||
| inputs: | ||
| tag: | ||
| description: "Git tag the release is created on (already pushed)." | ||
| required: true | ||
| title: | ||
| description: "Release title." | ||
| required: true | ||
| module: | ||
| description: "Module artifactId (used for the Central link and verify example)." | ||
| required: true | ||
| version: | ||
| description: "Released version." | ||
| required: true | ||
| changelog-entry: | ||
| description: "Markdown changelog entry used as the lead of the release notes." | ||
| required: true | ||
| fingerprint: | ||
| description: "Public GPG key fingerprint, shown in the verification instructions." | ||
| required: true | ||
| artifact-dir: | ||
| description: > | ||
| Directory (searched non-recursively) holding the signed jars and their | ||
| .asc siblings. For release:perform this is <module>/target/checkout/target; | ||
| for an in-place deploy it is <module>/target. | ||
| required: true | ||
| extra-notes: | ||
| description: "Optional Markdown inserted between the changelog and the Central link (e.g. an artifact inventory)." | ||
| required: false | ||
| default: "" | ||
| github-token: | ||
| description: "Token for the gh CLI (typically github.token)." | ||
| required: true | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Create GitHub Release | ||
| shell: bash | ||
| env: | ||
| GH_TOKEN: ${{ inputs.github-token }} | ||
| TAG: ${{ inputs.tag }} | ||
| RELEASE_TITLE: ${{ inputs.title }} | ||
| REL_MODULE: ${{ inputs.module }} | ||
| REL_VERSION: ${{ inputs.version }} | ||
| CHANGELOG_ENTRY: ${{ inputs.changelog-entry }} | ||
| GPG_FINGERPRINT: ${{ inputs.fingerprint }} | ||
| ARTIFACT_DIR: ${{ inputs.artifact-dir }} | ||
| EXTRA_NOTES: ${{ inputs.extra-notes }} | ||
| run: | | ||
| NOTES="$(mktemp)" | ||
| { | ||
| printf '%s\n\n' "$CHANGELOG_ENTRY" | ||
| if [ -n "$EXTRA_NOTES" ]; then | ||
| printf '%s\n\n' "$EXTRA_NOTES" | ||
| fi | ||
| echo "Published to Maven Central: https://central.sonatype.com/artifact/com.amazonaws/${REL_MODULE}/${REL_VERSION}" | ||
| echo | ||
| echo "## Verifying the signatures" | ||
| echo | ||
| echo "The attached \`.jar.asc\` files are the same GPG signatures published to Maven Central, made with the AWS Lambda Java release signing key." | ||
| echo | ||
| echo '```sh' | ||
| echo "# Import the public signing key" | ||
| echo "gpg --keyserver keys.openpgp.org --recv-keys ${GPG_FINGERPRINT}" | ||
| echo "# Verify a downloaded jar against its signature" | ||
| echo "gpg --verify ${REL_MODULE}-${REL_VERSION}.jar.asc ${REL_MODULE}-${REL_VERSION}.jar" | ||
| echo '```' | ||
| } > "$NOTES" | ||
|
|
||
| # Attach the signed jars + their detached GPG signatures. Deriving the | ||
| # list from the .asc set means only signed, published artifacts are | ||
| # attached (skips unsigned intermediates like shade's original-*.jar). | ||
| ASSETS=() | ||
| while IFS= read -r sig; do | ||
| ASSETS+=("${sig%.asc}" "$sig") | ||
| done < <(find "$ARTIFACT_DIR" -maxdepth 1 -type f -name '*.jar.asc' 2>/dev/null | sort) | ||
| if [ ${#ASSETS[@]} -eq 0 ]; then | ||
| echo "::warning::No signed jars found under $ARTIFACT_DIR; creating the release without attachments" | ||
| fi | ||
|
|
||
| gh release create "$TAG" \ | ||
| --title "$RELEASE_TITLE" \ | ||
| --notes-file "$NOTES" \ | ||
| "${ASSETS[@]}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| name: "Use the runner image's preinstalled Corretto 8" | ||
| description: > | ||
| Points JAVA_HOME/PATH at the CodeBuild image's preinstalled Corretto 8 | ||
| ($JAVA_8_HOME) and writes a Maven toolchains.xml for JDK 8. The image defaults | ||
| JAVA_HOME to Java 25, so this is required before any Maven call. Avoids | ||
| actions/setup-java, which fetches from corretto.github.io + corretto.aws, both | ||
| blocked by the runner egress lock. $JAVA_8_HOME resolves per-arch | ||
| (x86_64/aarch64). | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Use the runner image's preinstalled Corretto 8 | ||
| shell: bash | ||
| run: | | ||
| echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV" | ||
| echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH" | ||
| "$JAVA_8_HOME/bin/java" -version | ||
| mkdir -p "$HOME/.m2" | ||
| cat > "$HOME/.m2/toolchains.xml" <<EOF | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <toolchains> | ||
| <toolchain> | ||
| <type>jdk</type> | ||
| <provides><version>8</version></provides> | ||
| <configuration><jdkHome>$JAVA_8_HOME</jdkHome></configuration> | ||
| </toolchain> | ||
| </toolchains> | ||
| EOF |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can see the plugin
maven-gpg-pluginversion are all v1.5, does it support this new feature? Do we need to bump the version ofmaven-gpg-pluginas well?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice catch. The example provided here is with the new version which is 3.2.8
https://maven.apache.org/plugins/maven-gpg-plugin/usage.html
This seems to me something we can add later. Can we descope it in another PR?