Skip to content

Release

Release #12

Workflow file for this run

name: Release
on:
workflow_dispatch:
inputs:
run_maven_release:
type: boolean
default: false
required: false
description: Choose whether to do maven release
run_github_release:
type: boolean
default: false
required: false
description: Choose whether to do Github release
run_s3_upload:
type: boolean
default: false
required: false
description: Choose whether to do S3 upload
run_lambda_publish:
type: boolean
default: false
required: false
description: Choose whether to do lambda publish
run_rl_scan:
type: boolean
default: false
required: false
description: Choose whether to run Reversing lab scan
permissions:
packages: write
contents: write
id-token: write
env:
GITHUB_USERNAME: ${{ github.actor }}
PROD_BUCKET: ${{ secrets.PROD_BUCKET }}
jobs:
maven_release:
if: inputs.run_maven_release
needs:
- reversing_lab_scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v3
- name: Publish
run: ./gradlew publish closeAndReleaseSonatypeStagingRepository
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# The secrets are for publishing the build artifacts to the Maven Central.
SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
SONATYPE_TOKEN: ${{ secrets.SONATYPE_TOKEN }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}
github_release:
if: inputs.run_github_release
needs:
- reversing_lab_scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Build agent
run: ./gradlew clean build -x test
- name: Release and upload artifacts
run: |
VERSION=$(unzip -p agent/build/libs/solarwinds-apm-agent.jar META-INF/MANIFEST.MF | grep Implementation-Version | awk '{ print $2 }')
VERSION=$(echo $VERSION | sed 's/[^a-z0-9.-]//g') # remove illegal characters
echo "Current version is $VERSION"
response=$(curl -fs -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer ${GITHUB_TOKEN}"\
-H "X-GitHub-Api-Version: 2022-11-28" \
https://api.github.com/repos/$GITHUB_REPOSITORY/releases \
-d '{"tag_name":"v'"$VERSION"'", "name":"v'"$VERSION"'", "body":"New release: v'"$VERSION"'", "draft":false, "prerelease":false}')
release_id=$(echo "$response" | jq -r '.id')
echo "version: $VERSION" > version.txt
SHA256=$(sha256sum agent/build/libs/solarwinds-apm-agent.jar | awk '{print $1}')
echo "sha256: $SHA256" > checksum.txt
# Function to upload a file to GitHub release
upload_file_to_release() {
local release_id="$1"
local file_path="$2"
# Extract filename from file path
file_name=$(basename "$file_path")
# Upload file to GitHub release
curl -fs \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer $GITHUB_TOKEN" \
-H "Content-Type: application/octet-stream" \
--data-binary @"$file_path" \
"https://uploads.github.com/repos/$GITHUB_REPOSITORY/releases/$release_id/assets?name=$file_name"
}
# Upload file to GitHub release
upload_file_to_release "$release_id" "version.txt"
upload_file_to_release "$release_id" "checksum.txt"
upload_file_to_release "$release_id" "agent/build/libs/solarwinds-apm-agent.jar"
upload_file_to_release "$release_id" "custom/shared/src/main/resources/solarwinds-apm-config.json"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
s3-prod-upload: # this job uploads the jar and default config json to prod s3
if: inputs.run_s3_upload
needs:
- reversing_lab_scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Build
run: ./gradlew clean build -x test
- name: Aws setup
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_S3_ROLE_ARN_SSP_PROD }}
aws-region: "us-east-1"
- name: Set agent version env
run: |
echo "AGENT_VERSION=$(cd agent/build/libs && unzip -p solarwinds-apm-agent.jar META-INF/MANIFEST.MF | grep Implementation-Version | awk '{ print $2 }' | sed 's/[^a-z0-9.-]//g')" >> $GITHUB_ENV
- name: Check version doesn't exist
run: |
# make sure this version hasn't been pushed to prod yet
if curl -f -s "https://agent-binaries.cloud.solarwinds.com/apm/java/$AGENT_VERSION/solarwinds-apm-config.json" > /dev/null; then
echo "This version has been deployed to production already!"
exit 1
fi
- name: Copy to S3
run: |
aws s3 cp agent/build/libs/solarwinds-apm-agent.jar \
s3://$PROD_BUCKET/apm/java/$AGENT_VERSION/solarwinds-apm-agent.jar \
--acl public-read
aws s3 cp custom/shared/src/main/resources/solarwinds-apm-config.json \
s3://$PROD_BUCKET/apm/java/$AGENT_VERSION/solarwinds-apm-config.json \
--acl public-read
- name: Copy to S3(latest)
run: |
aws s3 cp s3://$PROD_BUCKET/apm/java/$AGENT_VERSION/solarwinds-apm-agent.jar \
s3://$PROD_BUCKET/apm/java/latest/solarwinds-apm-agent.jar \
--acl public-read
aws s3 cp s3://$PROD_BUCKET/apm/java/$AGENT_VERSION/solarwinds-apm-config.json \
s3://$PROD_BUCKET/apm/java/latest/solarwinds-apm-config.json \
--acl public-read
touch VERSION
echo "version: $AGENT_VERSION" >> VERSION
SHA256=$(sha256sum agent/build/libs/solarwinds-apm-agent.jar)
echo "sha256: $SHA256" >> VERSION
aws s3 cp VERSION \
s3://$PROD_BUCKET/apm/java/latest/VERSION \
--acl public-read
lambda-publish:
if: inputs.run_lambda_publish
needs:
- reversing_lab_scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Aws setup
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_LAMBDA_ROLE_PROD }}
aws-region: "us-east-1"
- name: Build agent
run: ./gradlew clean build -x test
- name: Create zip
run: ./gradlew :agent-lambda:lambda-layer
- name: Set agent version
id: set_version
uses: ./.github/actions/version
- name: Create lambda layer
run: |
regions=(
"ap-northeast-1"
"ap-northeast-2"
"ap-south-1"
"ap-southeast-1"
"ap-southeast-2"
"ca-central-1"
"eu-central-1"
"eu-north-1"
"eu-west-1"
"eu-west-2"
"eu-west-3"
"sa-east-1"
"us-east-1"
"us-east-2"
"us-west-1"
"us-west-2")
VERSION=$(echo "$AGENT_VERSION" | sed 's/[.]/_/g')
LAYER_NAME="solarwinds-apm-java-$VERSION"
touch arns.txt
layer_size=$(stat --printf=%s agent-lambda/build/lambda-layer/layer.zip)
set +e
for region in "${regions[@]}"; do
status=0
aws lambda publish-layer-version \
--layer-name $LAYER_NAME \
--compatible-runtimes "java21" "java17" "java11" "java8.al2" \
--compatible-architectures "x86_64" "arm64" \
--description "Solarwinds' apm java lambda instrumentation layer, version: $AGENT_VERSION" \
--region "$region" \
--zip-file fileb://agent-lambda/build/lambda-layer/layer.zip \
--output json > output.json
status=$?
if [ "$status" != 0 ]; then
echo "FAILED: publish $region"
continue
fi
pub_versionarn=$(jq -r '.LayerVersionArn' output.json)
pub_arn=$(jq -r '.LayerArn' output.json)
pub_version=$(jq -r '.Version' output.json)
pub_size=$(jq -r '.Content.CodeSize' output.json)
echo '-- verifying published layer --'
if [ "$pub_size" != "$layer_size" ]; then
echo "FAILED: Region = $region, versonArn = $pub_versionarn published size = $pub_size, expected size = $layer_size"
continue
fi
aws lambda add-layer-version-permission \
--region "$region" \
--layer-name "$pub_arn" \
--version-number "$pub_version" \
--principal '*' \
--action lambda:GetLayerVersion \
--statement-id global-GetLayerVersion
status=$?
if [ "$status" != 0 ]; then
echo "FAILED: add permission region = $region, versionArn = $pub_versionarn"
continue
fi
echo "$pub_versionarn" >> arns.txt
done
env:
AGENT_VERSION: ${{ steps.set_version.outputs.version }}
- uses: actions/upload-artifact@v4
with:
path: arns.txt
name: arns
sign_release:
needs:
- github_release
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Build agent
run: ./gradlew clean build -x test
- name: Sign and download signed jar
run: |
response=$(curl -fs \
-H "Authorization: Bearer $SIGN_PATH_API_TOKEN" \
-F "ProjectSlug=$SIGN_PATH_PROJECT_SLUG" \
-F "ArtifactConfigurationSlug=$SIGN_PATH_ARTIFACT_SLUG" \
-F "SigningPolicySlug=$SIGN_PATH_SIGNING_POLICY" \
-F "Artifact=@agent/build/libs/solarwinds-apm-agent.jar" \
https://app.signpath.io/API/v1/$SIGN_PATH_ORG_ID/SigningRequests)
SIGNING_REQUEST_ID=$(echo "$response" | jq -r '.signingRequestId')
state=""
while [[ "$state" != "true" ]]
do
response=$(curl -fsSL \
-H "Authorization: Bearer $SIGN_PATH_API_TOKEN" \
https://app.signpath.io/API/v1/$SIGN_PATH_ORG_ID/SigningRequests/$SIGNING_REQUEST_ID)
state=$(echo "$response" | jq -r ".isFinalStatus")
status_state=$(echo "$response" | jq -r ".status")
echo "Status -> $status_state"
sleep 5
done
curl -fs \
-o agent/build/libs/solarwinds-apm-agent-signed.jar \
-H "Authorization: Bearer $SIGN_PATH_API_TOKEN" \
https://app.signpath.io/API/v1/$SIGN_PATH_ORG_ID/SigningRequests/$SIGNING_REQUEST_ID/SignedArtifact
env:
SIGN_PATH_API_TOKEN: ${{ secrets.SIGN_PATH_API_TOKEN }}
SIGN_PATH_PROJECT_SLUG: ${{ secrets.SIGN_PATH_PROJECT_SLUG }}
SIGN_PATH_SIGNING_POLICY: ${{ secrets.SIGN_PATH_SIGNING_POLICY }}
SIGN_PATH_ORG_ID: ${{ secrets.SIGN_PATH_ORG_ID }}
SIGN_PATH_ARTIFACT_SLUG: ${{ secrets.SIGN_PATH_ARTIFACT_SLUG }}
- name: Set agent version
id: set_version
uses: ./.github/actions/version
- name: Upload signed artifact
run: |
response=$(curl -fsL \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer ${GITHUB_TOKEN}"\
-H "X-GitHub-Api-Version: 2022-11-28" \
https://api.github.com/repos/$GITHUB_REPOSITORY/releases/tags/v$VERSION)
release_id=$(echo "$response" | jq -r '.id')
# Function to upload a file to GitHub release
upload_file_to_release() {
local release_id="$1"
local file_path="$2"
# Extract filename from file path
file_name=$(basename "$file_path")
# Upload file to GitHub release
curl -fs \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer $GITHUB_TOKEN" \
-H "Content-Type: application/octet-stream" \
--data-binary @"$file_path" \
"https://uploads.github.com/repos/$GITHUB_REPOSITORY/releases/$release_id/assets?name=$file_name"
}
# Upload file to GitHub release
upload_file_to_release "$release_id" "agent/build/libs/solarwinds-apm-agent-signed.jar"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.set_version.outputs.version }}
reversing_lab_scan:
if: inputs.run_rl_scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Build agent
id: build
run: |
./gradlew clean build -x test
echo "agent_version=$(cd agent/build/libs && unzip -p solarwinds-apm-agent.jar META-INF/MANIFEST.MF | grep Implementation-Version | awk '{ print $2 }' | sed 's/[^a-z0-9.-]//g')" >> $GITHUB_OUTPUT
- name: Scan Jar
id: rl-scan
uses: reversinglabs/gh-action-rl-scanner-cloud-only@v1
with:
artifact-to-scan: agent/build/libs/solarwinds-apm-agent.jar
rl-verbose: true
rl-portal-server: solarwinds
rl-portal-org: SolarWinds
rl-portal-group: SaaS-Agents-SWO
rl-package-url: apm-java/solarwinds-apm-agent@${{ steps.build.outputs.agent_version }}
env:
RLPORTAL_ACCESS_TOKEN: ${{ secrets.RL_ACCESS_TOKEN }}
- name: Scan SDK Jar
id: rl-scan

Check failure on line 429 in .github/workflows/release.yml

View workflow run for this annotation

GitHub Actions / Release

Invalid workflow file

The workflow is not valid. .github/workflows/release.yml (Line: 429, Col: 13): The identifier 'rl-scan' may not be used more than once within the same scope.
uses: reversinglabs/gh-action-rl-scanner-cloud-only@v1
with:
artifact-to-scan: solarwinds-otel-sdk/build/libs/solarwinds-otel-sdk.jar
rl-verbose: true
rl-portal-server: solarwinds
rl-portal-org: SolarWinds
rl-portal-group: SaaS-Agents-SWO
rl-package-url: apm-java/solarwinds-otel-sdk@${{ steps.build.outputs.agent_version }}
env:
RLPORTAL_ACCESS_TOKEN: ${{ secrets.RL_ACCESS_TOKEN }}