maven-release.yml

---
name: maven-release
on:
  push:
    branches: ['**/**']
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4
      - name: Set up JDK and Maven
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9  # v4
        with:
          distribution: adopt
          java-version: 17
          cache: maven
          gpg-private-key: ${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_GPG_PRIVATE_KEY }}
      - uses: whelk-io/maven-settings-xml-action@9dc09b23833fa9aa7f27b63db287951856f3433d  # v22
        with:
          repositories: >
            [
              {
                "id": "s3",
                "name": "s3.sbb.polarion.maven.repo",
                "url": "s3://sbb-polarion-maven-repo/polarion.mvn",
                "releases": {
                  "enabled": "true",
                  "updatePolicy": "never"
                }
              }
            ]
          servers: >
            [
              {
                "id": "s3",
                "username": "${{ secrets.S3_SBB_POLARION_MAVEN_REPO_RW_ACCESS_KEY }}",
                "password": "${{ secrets.S3_SBB_POLARION_MAVEN_REPO_RW_SECRET_ACCESS_KEY }}"
              },
              {
                "id": "github",
                "username": "${env.GITHUB_ACTOR}",
                "password": "${env.GITHUB_TOKEN}"
              },
              {
                "id": "ossrh",
                "username": "${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_USERNAME }}",
                "password": "${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_TOKEN }}"
              },
              {
                "id": "gpg.passphrase",
                "passphrase": "${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_GPG_PASSPHRASE }}"
              }
            ]
          profiles: >
            [
              {
                "id": "deploy-github-packages",
                "properties":
                {
                  "altDeploymentRepository": "github::default::https://maven.pkg.github.com/${{ github.repository }}"
                }
              }
            ]
      - name: Print settings.xml
        run: cat /home/runner/.m2/settings.xml
      - name: Build with Maven
        run: mvn --batch-mode clean package
        env:
          FAIL_ON_CHECK_COMMANDS: 'true'
      - name: Extract artefact version
        id: artefact_version
        run: echo "version=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)" >> $GITHUB_OUTPUT
      - name: Publish to Maven Central
        if: ${{ !endsWith(steps.artefact_version.outputs.version, '-SNAPSHOT') && github.ref == 'refs/heads/main' }}
        run: mvn --batch-mode deploy -P gpg-sign -P nexus-staging
      - name: Publish to GitHub Packages
        if: ${{ !endsWith(steps.artefact_version.outputs.version, '-SNAPSHOT') && github.ref == 'refs/heads/main' }}
        run: mvn --batch-mode deploy -P gpg-sign -P deploy-github-packages
        env:
          GITHUB_TOKEN: ${{ github.token }}