CI: only publish anything when tests are successful (#1438)

We avoid publishing builds, that don't succeed testing. Also, we have
all jobs related to a commit or tag action on one page, which is much
easier to review.

Pull request: #1438

.github/workflows/actions.yml

@@ -1,4 +1,4 @@
-name: Tests
+name: CI
 on:
   push:
     branches:
@@ -28,11 +28,12 @@ jobs:
         with:
           java-version: ${{ matrix.java-version }}
       - run: ./mill -i unitTest "${{ matrix.scala-binary-version }}"
+
   itest:
     strategy:
       fail-fast: false
       matrix:
-        java-version: [8, 11]
+        java-version: [8, 11, 17]
         scala-version: [2.12.18, 2.13.12, 3.2.2, 3.3.3]
     runs-on: ubuntu-latest
     steps:
@@ -43,6 +44,7 @@ jobs:
         with:
           java-version: ${{ matrix.java-version }}
       - run: ./mill -i integrationTest ${{ matrix.scala-version }}
+
   publishLocal:
     strategy:
       fail-fast: false
@@ -57,3 +59,23 @@ jobs:
         with:
           java-version: 8
       - run: ./mill -i __[${{ matrix.scala-version }}].__.publishLocal
+
+  release:
+    if: github.repository == 'com-lihaoyi/Ammonite' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/2.x')
+    needs: [ test, itest, publishLocal ]
+    uses: ./.github/workflows/release.yml
+    secrets: inherit
+
+  publishDosc:
+    if: github.repository == 'com-lihaoyi/Ammonite' && github.ref == 'refs/heads/main'
+    needs: [ test, itest ]
+    uses: ./.github/workflows/publishDocs.yml
+    secrets:
+      DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+
+  publishExecutable:
+    if: github.repository == 'com-lihaoyi/Ammonite' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/2.x')
+    needs: [ test, itest ]
+    uses: ./.github/workflows/publishExecutable.yml
+    secrets:
+      AMMONITE_BOT_AUTH_TOKEN: ${{ secrets.AMMONITE_BOT_AUTH_TOKEN }}

.github/workflows/publishDocs.yml

@@ -1,8 +1,13 @@
 name: Publish Docs
 on:
-  push:
-    branches:
-      - main
+#  push:
+#    branches:
+#      - main
+  workflow_call:
+    secrets:
+      DEPLOY_KEY:
+        required: true
+
 jobs:
   publishDocs:
     runs-on: ubuntu-latest

.github/workflows/publishExecutable.yml

@@ -1,9 +1,14 @@
 name: Publish Executable
 on:
-  push:
-    branches:
-      - main
-      - 2.x
+#  push:
+#    branches:
+#      - main
+#      - 2.x
+  workflow_call:
+    secrets:
+      AMMONITE_BOT_AUTH_TOKEN:
+        required: true
+
 jobs:
   publishExecutable:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -1,14 +1,25 @@
 name: Release
 on:
-  push:
-    branches:
-      - main
-      - 2.x
+  #  push:
+  #    branches:
+  #      - main
+  #      - 2.x
+  workflow_call:
+    secrets:
+      SONATYPE_PGP_SECRET:
+        required: true
+      SONATYPE_DEPLOY_USER:
+        required: true
+      SONATYPE_DEPLOY_PASSWORD:
+        required: true
+      SONATYPE_PGP_PASSWORD:
+        required: true
+
 jobs:
   release:
     strategy:
       matrix:
-        shard: [1, 2, 3, 4, 5]
+        shard: [ 1, 2, 3, 4, 5 ]
       fail-fast: false
     runs-on: ubuntu-latest
     env: