build.yml

# This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle

name: Build

on:
  push:
    branches: [ main ]
    tags: [ "v*.*.*" ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
    inputs:
      publish_artifacts:
        description: "Publish snapshot artifacts: true or false?"
        default: "true"

permissions:
  contents: read

jobs:
  build:
    permissions:
      packages: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
      - uses: gradle/wrapper-validation-action@8d49e559aae34d3e0eb16cde532684bc9702762b # v1.0.6
      - name: Fetch version history
        # Do NOT want to fetch all tags if building a specific tag.
        # Doing so could result in code published with wrong version, if newer tags have been pushed
        if: (!startsWith(github.ref, 'refs/tags/'))
        run: git fetch --tag --unshallow
      - name: Set up JDK
        uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
        with:
          java-version: '17'
          distribution: 'adopt'
          cache: gradle
      - name: Build
        env:
          COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
        run: ./gradlew build coveralls
      - name: Publish
        if: github.event_name == 'push' || github.event.inputs.publish_artifacts == 'true'
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
          ORG_GRADLE_PROJECT_SONA_USERNAME: ${{ secrets.SONA_USERNAME }}
          ORG_GRADLE_PROJECT_SONA_PASSWORD: ${{ secrets.SONA_PASSWORD }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ./gradlew cV
          ./gradlew publish closeAndReleaseStagingRepository
      - name: Publish to Gradle Plugins Portal
        if: startsWith(github.ref, 'refs/tags/') && !endsWith(github.ref, '-alpha')
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
          GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
          GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
        run: |
          ./gradlew -Dgradle.publish.key="$GRADLE_PUBLISH_KEY" -Dgradle.publish.secret="$GRADLE_PUBLISH_SECRET" publishPlugins

  create-gh-release:
    if: startsWith(github.ref, 'refs/tags/') && !endsWith(github.ref, '-alpha')
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.0.0
      - name: Create GitHut Release
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
        with:
          generate_release_notes: true