feat(protocol): expose analyzer quick fixes in scan output (#9) #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to Maven Central + GitHub Release | |
| # Cuts a release. Triggered by pushing a version tag (vX.Y.Z), or manually | |
| # from the Actions tab with an explicit version. | |
| # | |
| # On a run it: | |
| # 1. derives the release version from the tag (v0.2.0 -> 0.2.0) — Maven | |
| # Central rejects -SNAPSHOT, so versions:set strips it, | |
| # 2. builds, tests, GPG-signs and deploys the parent pom + attached source | |
| # zip + attached distribution zip to Maven Central via the Sonatype | |
| # Central Portal. This is a single-module project with packaging=pom; | |
| # its deploy attaches: parent pom + source zip (classifier=src) + dist | |
| # zip (classifier=dist). No daemon/cli JARs are published to Central, | |
| # 3. creates a GitHub Release carrying two assets: a whole-repo source | |
| # zip (git archive of HEAD) and the assembled distribution bundle | |
| # (sonar-predictor-dist-<version>.zip — bin/sonar{,.bat} + lib/*.jar + | |
| # plugins/*.jar). Users install by downloading + extracting the zip. | |
| # | |
| # Required repo secrets: | |
| # OSS_NEXUS_USER - Sonatype Central Portal token username | |
| # OSS_NEXUS_PASS - Sonatype Central Portal token password | |
| # MAVEN_GPG_PRIVATE_KEY - ASCII-armored GPG private key for signing | |
| # MAVEN_GPG_PASSPHRASE - passphrase for that key (omit if the key has none) | |
| # GITHUB_TOKEN is provided automatically. | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Release version (e.g. 0.2.0) — required for manual runs' | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (full history for git archive + release notes) | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up JDK 21 + GPG | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| server-id: central | |
| server-username: OSS_NEXUS_USER | |
| server-password: OSS_NEXUS_PASS | |
| gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| gpg-passphrase: MAVEN_GPG_PASSPHRASE | |
| - name: Set up Node.js (JS analyzer tests need a Node runtime) | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Derive release version | |
| id: version | |
| env: | |
| INPUT_VERSION: ${{ inputs.version }} | |
| run: | | |
| set -euo pipefail | |
| if [ -n "${INPUT_VERSION:-}" ]; then | |
| VERSION="${INPUT_VERSION}" | |
| else | |
| # github.ref_name is the tag, e.g. v0.2.0 -> 0.2.0 | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| fi | |
| if [ -z "${VERSION}" ]; then | |
| echo "::error::could not determine release version" | |
| exit 1 | |
| fi | |
| echo "version=${VERSION}" >> "$GITHUB_OUTPUT" | |
| echo "Release version: ${VERSION}" | |
| - name: Strip -SNAPSHOT / set release version | |
| run: | | |
| set -euo pipefail | |
| mvn -B -ntp versions:set \ | |
| -DnewVersion="${{ steps.version.outputs.version }}" \ | |
| -DgenerateBackupPoms=false | |
| - name: Build the source bundle (whole-repo git archive of HEAD) | |
| # Built BEFORE the deploy: the release profile's build-helper plugin | |
| # attaches this zip (from the repo root) to the Maven Central upload, | |
| # so the whole-repo source ships on Central as well as on the | |
| # GitHub Release. | |
| run: | | |
| set -euo pipefail | |
| VERSION="${{ steps.version.outputs.version }}" | |
| git archive --format=zip \ | |
| --prefix="sonar-predict-${VERSION}/" \ | |
| -o "sonar-predict-${VERSION}-src.zip" HEAD | |
| ls -la "sonar-predict-${VERSION}-src.zip" | |
| - name: Build, sign and deploy to Maven Central | |
| env: | |
| OSS_NEXUS_USER: ${{ secrets.OSS_NEXUS_USER }} | |
| OSS_NEXUS_PASS: ${{ secrets.OSS_NEXUS_PASS }} | |
| MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| run: | | |
| set -euo pipefail | |
| mvn -B -ntp -Prelease clean deploy | |
| - name: Create the GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| VERSION="${{ steps.version.outputs.version }}" | |
| SRC_ZIP="sonar-predict-${VERSION}-src.zip" | |
| DIST_ZIP="target/sonar-predictor-dist-${VERSION}.zip" | |
| if [ ! -f "${DIST_ZIP}" ]; then | |
| echo "::error::distribution bundle not found at ${DIST_ZIP}" | |
| ls -la target || true | |
| exit 1 | |
| fi | |
| if [ -n "${GITHUB_REF_NAME:-}" ] && [ "${GITHUB_REF_TYPE:-}" = "tag" ]; then | |
| TAG="${GITHUB_REF_NAME}" | |
| else | |
| TAG="v${VERSION}" | |
| fi | |
| gh release create "${TAG}" \ | |
| --title "sonar-predictor ${VERSION}" \ | |
| --generate-notes \ | |
| "${SRC_ZIP}" \ | |
| "${DIST_ZIP}" |