Skip to content

Commit 5d2f32d

Browse files
lbroudouxlbroudoux
committed
chore: #103 Add SBOM generation in automated release process
Signed-off-by: Laurent Broudoux <[email protected]> Signed-off-by: Laurent Broudoux <[email protected]>
1 parent 661f75b commit 5d2f32d

File tree

3 files changed

+183
-8
lines changed

3 files changed

+183
-8
lines changed

‎.github/workflows/release.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: release
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
branch:
6+
description: 'Branch to release'
7+
required: true
8+
version:
9+
description: 'Release version'
10+
required: true
11+
nextVersion:
12+
description: 'Next version after release (-SNAPSHOT will be added automatically)'
13+
required: true
14+
jobs:
15+
release:
16+
name: Release
17+
runs-on: ubuntu-latest
18+
permissions:
19+
issues: write
20+
contents: write
21+
deployments: write
22+
id-token: write
23+
steps:
24+
- name: Checkout Code
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
with:
27+
ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}
28+
fetch-depth: 0
29+
ref: ${{ github.event.inputs.branch }}
30+
31+
- name: Set up JDK 17 for x64
32+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
33+
with:
34+
java-version: '17'
35+
distribution: 'temurin'
36+
architecture: x64
37+
cache: maven
38+
39+
- name: Set release version
40+
run: mvn -B -q versions:set -DnewVersion=${{ github.event.inputs.version }}
41+
42+
- name: Commit, push and tag changes
43+
run: |
44+
git config user.name "microcks-bot"
45+
git config user.email "[email protected]"
46+
git commit -m "Releasing version ${{ github.event.inputs.version }}" .
47+
git tag ${{ github.event.inputs.version }}
48+
git push origin ${{ github.event.inputs.version }}
49+
50+
- name: Stage release artifacts
51+
run: mvn -B -Prelease clean deploy -DaltDeploymentRepository=local::default::file://`pwd`/target/staging-deploy
52+
53+
- name: Publish package with JReleaser
54+
env:
55+
JRELEASER_NEXUS2_USERNAME: ${{ secrets.JRELEASER_NEXUS2_USERNAME }}
56+
JRELEASER_NEXUS2_PASSWORD: ${{ secrets.JRELEASER_NEXUS2_PASSWORD }}
57+
JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
58+
JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
59+
JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.JRELEASER_GPG_PUBLIC_KEY }}
60+
JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
61+
run: mvn -N -Prelease jreleaser:assemble jreleaser:full-release
62+
63+
# Persist logs
64+
- name: JReleaser release output
65+
if: always()
66+
uses: actions/upload-artifact@v4
67+
with:
68+
name: jreleaser-release
69+
path: |
70+
target/jreleaser/trace.log
71+
target/jreleaser/output.properties
72+
73+
- name: Set next iteration version
74+
run: mvn -B -q versions:set -DnewVersion=${{ github.event.inputs.nextVersion }}-SNAPSHOT
75+
76+
- name: Commit, push and tag changes
77+
run: |
78+
git commit -m "Setting SNAPSHOT version ${{ github.event.inputs.nextVersion }}-SNAPSHOT" .
79+
git push origin ${{ github.event.inputs.branch }}

‎jreleaser.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
project:
2+
name: Microcks Jenkins Plugin
3+
description: Microcks API mocking and Testing - Jenkins Plugin
4+
longDescription: Microcks API mocking and Testing - Jenkins Plugin
5+
copyright: The Microcks Authors
6+
java:
7+
version: 17
8+
9+
signing:
10+
active: ALWAYS
11+
armored: true
12+
13+
assemble:
14+
archive:
15+
microcks-jenkins-plugin:
16+
active: ALWAYS
17+
stereotype: NONE
18+
options:
19+
longFileMode: POSIX
20+
formats:
21+
- ZIP
22+
- TGZ
23+
fileSets:
24+
- input: target/staging-deploy
25+
includes:
26+
- '**/*.*'
27+
28+
files:
29+
active: ALWAYS
30+
artifacts:
31+
- path: 'target/site/microcks-jenkins-plugin-{{projectVersion}}.spdx-sbom.json'
32+
33+
deploy:
34+
maven:
35+
nexus2:
36+
sonatype:
37+
active: ALWAYS
38+
snapshotSupported: false
39+
url: https://oss.sonatype.org/service/local
40+
snapshotUrl: https://oss.sonatype.org/content/repositories/snapshots
41+
stagingProfileId: c3fae58a8dda9
42+
closeRepository: false
43+
releaseRepository: false
44+
stagingRepositories:
45+
- target/staging-deploy
46+
pomchecker:
47+
failOnWarning: false
48+
failOnError: false
49+
strict: false
50+
51+
release:
52+
github:
53+
overwrite: true
54+
releaseName: '{{tagName}}'
55+
tagName: '{{projectVersion}}'
56+
changelog:
57+
formatted: ALWAYS
58+
preset: conventional-commits
59+
contributors:
60+
format: '- {{contributorName}}{{#contributorUsernameAsLink}} ({{.}}){{/contributorUsernameAsLink}}'

‎pom.xml‎

Lines changed: 44 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -156,21 +156,57 @@
156156
<plugins>
157157
<plugin>
158158
<groupId>org.apache.maven.plugins</groupId>
159-
<artifactId>maven-gpg-plugin</artifactId>
160-
<version>1.6</version>
161-
<configuration>
162-
<passphrase>${gpg.passphrase}</passphrase>
163-
</configuration>
159+
<artifactId>maven-javadoc-plugin</artifactId>
160+
<version>3.11.2</version>
164161
<executions>
165162
<execution>
166-
<id>sign-artifacts</id>
167-
<phase>verify</phase>
163+
<id>attach-javadoc</id>
168164
<goals>
169-
<goal>sign</goal>
165+
<goal>jar</goal>
170166
</goals>
171167
</execution>
172168
</executions>
173169
</plugin>
170+
<plugin>
171+
<groupId>org.apache.maven.plugins</groupId>
172+
<artifactId>maven-source-plugin</artifactId>
173+
<version>3.2.1</version>
174+
<executions>
175+
<execution>
176+
<id>attach-source</id>
177+
<goals>
178+
<goal>jar</goal>
179+
</goals>
180+
</execution>
181+
</executions>
182+
</plugin>
183+
<plugin>
184+
<groupId>org.spdx</groupId>
185+
<artifactId>spdx-maven-plugin</artifactId>
186+
<version>0.7.4</version>
187+
<executions>
188+
<execution>
189+
<id>build-spdx</id>
190+
<phase>package</phase>
191+
<goals>
192+
<goal>createSPDX</goal>
193+
</goals>
194+
</execution>
195+
</executions>
196+
<configuration>
197+
<spdxFile>${project.reporting.outputDirectory}/${project.artifactId}-${project.version}.spdx-sbom.json</spdxFile>
198+
<spdxDocumentNamespace>http://spdx.org/spdxpackages/${project.artifactId}-${project.version}</spdxDocumentNamespace>
199+
</configuration>
200+
</plugin>
201+
<plugin>
202+
<groupId>org.jreleaser</groupId>
203+
<artifactId>jreleaser-maven-plugin</artifactId>
204+
<version>1.15.0</version>
205+
<inherited>false</inherited>
206+
<configuration>
207+
<configFile>jreleaser.yml</configFile>
208+
</configuration>
209+
</plugin>
174210
</plugins>
175211
</build>
176212
</profile>

0 commit comments

Comments
 (0)