release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-*"   # pre-release tags (v0.1.0-rc1, etc.)

permissions:
  contents: write   # to create the GitHub Release

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Derive version from tag
        id: ver
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"

      - name: Build and test
        run: ./gradlew build --no-configuration-cache --stacktrace -PVERSION=${{ steps.ver.outputs.version }}

      - name: Publish to Maven Central
        env:
          # Sonatype Central Portal credentials (https://central.sonatype.com/account)
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          # ASCII-armored private key (`gpg --armor --export-secret-keys <key-id>`)
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
          # SIGNING_KEY_ID is currently the 16-char long key ID, but Gradle's
          # PgpKeyId.normaliseKeyId() only accepts the 8-char short form.
          # Trim to the last 8 hex chars here so the secret can keep its
          # canonical long-form value and we don't need to keep nagging
          # whoever maintains the org secrets to shorten it.
          SIGNING_KEY_ID_RAW: ${{ secrets.SIGNING_KEY_ID }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_KEY_PASSWORD }}
        run: |
          export ORG_GRADLE_PROJECT_signingInMemoryKeyId="${SIGNING_KEY_ID_RAW: -8}"
          ./gradlew publishAndReleaseToMavenCentral \
            --no-configuration-cache \
            --stacktrace \
            -PVERSION=${{ steps.ver.outputs.version }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true
          name: ${{ github.ref_name }}
          fail_on_unmatched_files: false
          # Glob across every module's build/libs/ so the release page picks up
          # api-log-core / -jpa / -r2dbc / -mybatis without per-module entries.
          files: |
            **/build/libs/*.jar
            **/build/libs/*.asc