embed-code-gradle-plugin/.github/workflows/publish.yml at master · SpineEventEngine/embed-code-gradle-plugin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Publish

on:
  push:
    branches:
      - master

permissions:
  contents: read

concurrency:
  group: gradle-plugin-portal
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7

      - name: Set Up Java 17 for Compatibility Tests
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: Save Java 17 Toolchain
        shell: bash
        run: echo "EMBED_CODE_JAVA_17_HOME=$JAVA_HOME" >> "$GITHUB_ENV"

      - name: Set Up Java 25
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 25

      - name: Set Up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Check Plugin Version
        shell: bash
        run: ./gradlew :gradle-plugin:checkVersionIncrement --stacktrace

      - name: Check Build
        shell: bash
        run: >-
          ./gradlew
          -Dorg.gradle.java.installations.paths="$EMBED_CODE_JAVA_17_HOME"
          :buildSrc:check check

      - name: Decrypt Gradle Plugin Portal Credentials
        shell: bash
        env:
          GRADLE_PORTAL_CREDENTIALS_KEY: ${{ secrets.GRADLE_PORTAL_CREDENTIALS_KEY }}
        run: |
          if [[ -z "$GRADLE_PORTAL_CREDENTIALS_KEY" ]]; then
            echo "::error::The GRADLE_PORTAL_CREDENTIALS_KEY secret is unavailable." \
              "Grant this repository access to the organization secret."
            exit 1
          fi

          mkdir -p "$HOME/.gradle"
          umask 077
          printf '%s' "$GRADLE_PORTAL_CREDENTIALS_KEY" |
            gpg \
              --quiet \
              --batch \
              --yes \
              --pinentry-mode loopback \
              --passphrase-fd 0 \
              --output "$HOME/.gradle/gradle.properties" \
              --decrypt .github/keys/gradle-plugin-portal.secret.properties.gpg
          chmod 600 "$HOME/.gradle/gradle.properties"

      - name: Validate Plugin Portal Publication
        shell: bash
        run: ./gradlew :gradle-plugin:publishPlugins --validate-only

      - name: Publish to Gradle Plugin Portal
        shell: bash
        run: ./gradlew :gradle-plugin:publishPlugins

      - name: Remove Decrypted Credentials
        if: ${{ always() }}
        shell: bash
        run: rm -f "$HOME/.gradle/gradle.properties"