azure-pipelines-release.yml

# Maven
# Build your Java project and run tests with Apache Maven.
# Add steps that analyze code, save build artifacts, deploy, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/java

trigger:
- none

pr:
- none

pool:
  vmImage: ubuntu-latest

parameters:
  - name: RELEASE_VERSION
    type: string
    displayName: Version to release, e.g. 1.0.0

variables:
  - group: 'oss-secrets'
  - name: JDK_VERSION
    value: '1.21'
  - name: MAVEN_CACHE_FOLDER
    value: $(Pipeline.Workspace)/.m2/repository
  - name: MAVEN_OPTIONS
    value: '-Dmaven.repo.local=$(MAVEN_CACHE_FOLDER) -Xmx3072m'
  - name: MAVEN_COMMAND_LINE_ARGUMENTS
    value: '--batch-mode -Prelease-docs'
  - name: GNUPGHOME 
    value: $(Pipeline.Workspace)/.gnupg
  
steps:

- checkout: self
  persistCredentials: 'true'
  clean: 'true'

- script: |
    ./gpg_import_test.sh
    ./gpg_cleanup_test.sh
  displayName: Pipeline unit tests  
  workingDirectory: $(Build.SourcesDirectory)/.azure-pipelines/tests

- task: Cache@2
  displayName: Cache Maven local repo
  inputs:
    key: 'maven | "$(Agent.OS)" | **/pom.xml'
    restoreKeys: |
      maven | "$(Agent.OS)"
      maven
    path: $(MAVEN_CACHE_FOLDER)

- task: Maven@4
  displayName: Set project version to ${{ parameters.RELEASE_VERSION }}
  inputs:
    jdkVersionOption: ${{ variables.JDK_VERSION }}
    goals: $(MAVEN_COMMAND_LINE_ARGUMENTS) versions:set -DnewVersion=${{ parameters.RELEASE_VERSION }}
    publishJUnitResults: false

- task: Maven@4
  displayName: Build and test
  inputs:
    jdkVersionOption: ${{ variables.JDK_VERSION }}
    mavenOptions: $(MAVEN_OPTIONS)
    goals: '$(MAVEN_COMMAND_LINE_ARGUMENTS) verify'

- script: |
    git config --global user.email "ci@dev.azure.com"
    git config --global user.name "[CI]"
  displayName: Configure git

- script: |
    git add pom.xml README.md
    git commit -m "[skip ci] Set version to ${{ parameters.RELEASE_VERSION }}"
    git tag ${{ parameters.RELEASE_VERSION }}
    git push --atomic origin HEAD:$(Build.SourceBranchName) ${{ parameters.RELEASE_VERSION }}
  displayName: Commit release version and create release tag

- task: DownloadSecureFile@1
  name: gpgkey
  displayName: 'Download secret signing key'
  inputs:
    secureFile: 'secret_signing_key_F5CE35A802DF35C1.gpg'

- task: ShellScript@2
  displayName: Import GPG key
  inputs:
    scriptPath: .azure-pipelines/scripts/gpg_import.sh
    args: '$(gpgkey.secureFilePath)'

- task: MavenAuthenticate@0
  displayName: Auth to OSS Nexus
  inputs:
    mavenServiceConnections: OSS Sonatype Nexus

- task: Maven@4
  displayName: Deploying to Maven Central ${{ parameters.RELEASE_VERSION }}
  inputs:
    jdkVersionOption: ${{ variables.JDK_VERSION }}
    goals: $(MAVEN_COMMAND_LINE_ARGUMENTS) deploy -Prelease -Dgpg.keyname=$(GPG_KEY_ID)
    publishJUnitResults: false
  env:
    MAVEN_GPG_PASSPHRASE: $(GPG_PASSPHRASE)

- script: |
    gh auth login
    gh release create ${{ parameters.RELEASE_VERSION }} --generate-notes
  displayName: Create Github Release
  env:
    GITHUB_TOKEN: $(GITHUB_TOKEN)

- task: ShellScript@2
  displayName: Cleanup GPGHOME
  condition: always()
  inputs:
    scriptPath: .azure-pipelines/scripts/gpg_cleanup.sh