Release Auth Sample #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Auth Sample | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'SDK Version (semver, e.g., 1.0.0 or 1.0.0-beta.1)' | |
| required: true | |
| type: string | |
| draft: | |
| description: 'Make draft release' | |
| required: false | |
| type: boolean | |
| default: false | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| environment: release | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v5 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| - name: Setup Android SDK | |
| uses: android-actions/setup-android@v3 | |
| with: | |
| cmdline-tools-version: 12266719 | |
| - name: Set up Gradle | |
| uses: gradle/actions/setup-gradle@v5 | |
| - name: Set release version | |
| run: | | |
| RELEASE_VERSION="${{ inputs.version }}" | |
| echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV | |
| echo "Release version: $RELEASE_VERSION" | |
| - name: Validate version format | |
| run: | | |
| if [[ ! "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then | |
| echo "Invalid version format. Use semantic versioning (e.g., 1.0.0 or 1.0.0-beta.1)" | |
| exit 1 | |
| fi | |
| echo "Version format is valid: $RELEASE_VERSION" | |
| - name: Check if tag already exists | |
| run: | | |
| if git rev-parse "v$RELEASE_VERSION" >/dev/null 2>&1; then | |
| echo "Tag v$RELEASE_VERSION already exists!" | |
| exit 1 | |
| fi | |
| echo "Tag v$RELEASE_VERSION is available" | |
| - name: Build release AAR | |
| run: ./gradlew :sdk:assembleRelease -PreleaseVersion=$RELEASE_VERSION | |
| - name: Build Maven artifacts locally | |
| run: ./gradlew :sdk:publishReleasePublicationToMavenLocalRepository -PreleaseVersion=$RELEASE_VERSION | |
| # --- Attestation: release assets --- | |
| - name: Generate release asset attestation | |
| uses: actions/attest-build-provenance@v3 | |
| id: release-attest | |
| with: | |
| subject-path: sdk/build/outputs/aar/sdk-release.aar | |
| # --- Attestation: Maven artifacts --- | |
| - name: Generate Maven artifact attestation | |
| uses: actions/attest-build-provenance@v3 | |
| id: maven-attest | |
| with: | |
| subject-path: ~/.m2/repository/com/idmelabs/auth/android-auth-sample-code/${{ env.RELEASE_VERSION }}/* | |
| - name: Save attestation bundle alongside Maven artifacts | |
| run: | | |
| ATTESTATION_BUNDLE_PATH="${{ steps.maven-attest.outputs.bundle-path }}" | |
| MAVEN_DIR=~/.m2/repository/com/idmelabs/auth/android-auth-sample-code/$RELEASE_VERSION | |
| if [[ -f "$ATTESTATION_BUNDLE_PATH" ]]; then | |
| cp "$ATTESTATION_BUNDLE_PATH" "$MAVEN_DIR/android-auth-sample-code-${RELEASE_VERSION}.intoto.jsonl" | |
| echo "Saved attestation bundle as android-auth-sample-code-${RELEASE_VERSION}.intoto.jsonl" | |
| fi | |
| # --- Publish Maven artifacts + attestation to GitHub Packages --- | |
| - name: Publish Maven artifacts to GitHub Packages | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| GROUP_ID="com.idmelabs.auth" | |
| ARTIFACT_ID="android-auth-sample-code" | |
| VERSION="$RELEASE_VERSION" | |
| GROUP_PATH=$(echo "$GROUP_ID" | tr '.' '/') | |
| GITHUB_URL="https://maven.pkg.github.com/IDme/android-auth-sample-code" | |
| echo "========================================" | |
| echo "Deploying Maven Package" | |
| echo "========================================" | |
| echo "Coordinates: ${GROUP_ID}:${ARTIFACT_ID}:${VERSION}" | |
| echo "URL: ${GITHUB_URL}" | |
| echo "========================================" | |
| MAVEN_DIR=~/.m2/repository/${GROUP_PATH}/${ARTIFACT_ID}/${VERSION} | |
| cd "$MAVEN_DIR" | |
| upload_file() { | |
| local file="$1" | |
| local remote_path="$2" | |
| local url="${GITHUB_URL}/${GROUP_PATH}/${ARTIFACT_ID}/${VERSION}/${remote_path}" | |
| echo "Uploading: $file -> $remote_path" | |
| response=$(curl -s -w "\n%{http_code}" \ | |
| -X PUT \ | |
| -H "Authorization: Bearer ${GITHUB_TOKEN}" \ | |
| -H "Content-Type: application/octet-stream" \ | |
| --data-binary "@${file}" \ | |
| "$url") | |
| http_code=$(echo "$response" | tail -n1) | |
| if [ "$http_code" -ge 200 ] && [ "$http_code" -lt 300 ]; then | |
| echo " Success (HTTP $http_code)" | |
| return 0 | |
| else | |
| echo " Failed (HTTP $http_code)" | |
| body=$(echo "$response" | sed '$d') | |
| echo " Response: $body" | |
| return 1 | |
| fi | |
| } | |
| # Deploy POM | |
| if ! upload_file "${ARTIFACT_ID}-${VERSION}.pom" "${ARTIFACT_ID}-${VERSION}.pom"; then | |
| echo "Error: Failed to deploy POM" | |
| exit 1 | |
| fi | |
| # Deploy AAR | |
| if ! upload_file "${ARTIFACT_ID}-${VERSION}.aar" "${ARTIFACT_ID}-${VERSION}.aar"; then | |
| echo "Error: Failed to deploy AAR" | |
| exit 1 | |
| fi | |
| # Deploy module metadata if exists | |
| if [[ -f "${ARTIFACT_ID}-${VERSION}.module" ]]; then | |
| upload_file "${ARTIFACT_ID}-${VERSION}.module" "${ARTIFACT_ID}-${VERSION}.module" || \ | |
| echo "Warning: Failed to deploy module metadata (non-critical)" | |
| fi | |
| # Deploy attestation bundle if exists | |
| if [[ -f "${ARTIFACT_ID}-${VERSION}.intoto.jsonl" ]]; then | |
| upload_file "${ARTIFACT_ID}-${VERSION}.intoto.jsonl" "${ARTIFACT_ID}-${VERSION}.intoto.jsonl" || \ | |
| echo "Warning: Failed to deploy attestation bundle (non-critical)" | |
| fi | |
| echo "========================================" | |
| echo "Maven package deployed successfully!" | |
| echo "========================================" | |
| - name: Display Maven artifacts | |
| continue-on-error: true | |
| run: | | |
| echo "Maven artifacts in local repository:" | |
| ls -la ~/.m2/repository/com/idmelabs/auth/android-auth-sample-code/$RELEASE_VERSION/ | |
| echo "" | |
| echo "Generated POM content:" | |
| cat ~/.m2/repository/com/idmelabs/auth/android-auth-sample-code/$RELEASE_VERSION/android-auth-sample-code-$RELEASE_VERSION.pom | |
| - name: Publish to Maven Central (Sonatype OSSRH) | |
| env: | |
| SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} | |
| SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} | |
| SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }} | |
| SIGNING_KEY: ${{ secrets.SIGNING_KEY }} | |
| SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }} | |
| run: | | |
| ./gradlew :sdk:publishReleasePublicationToSonatypeRepository \ | |
| closeAndReleaseSonatypeStagingRepository \ | |
| -PreleaseVersion=$RELEASE_VERSION | |
| - name: Create Git tag | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git tag -a "v$RELEASE_VERSION" -m "Auth Sample Code v$RELEASE_VERSION" | |
| git push origin "v$RELEASE_VERSION" | |
| - name: Create GitHub Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: v${{ env.RELEASE_VERSION }} | |
| name: Auth Sample Code v${{ env.RELEASE_VERSION }} | |
| files: | | |
| sdk/build/outputs/aar/sdk-release.aar | |
| ${{ steps.release-attest.outputs.bundle-path }} | |
| draft: ${{ inputs.draft }} | |
| make_latest: ${{ !inputs.draft }} | |
| - name: Release Summary | |
| run: | | |
| echo "**Auth Sample Code v$RELEASE_VERSION Released!**" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Release Details" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Version:** $RELEASE_VERSION" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Tag:** v$RELEASE_VERSION" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Draft:** ${{ inputs.draft }}" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Maven Coordinates" >> $GITHUB_STEP_SUMMARY | |
| echo "\`com.idmelabs.auth:android-auth-sample-code:$RELEASE_VERSION\`" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Published To" >> $GITHUB_STEP_SUMMARY | |
| echo "- GitHub Packages: https://github.com/IDme/android-auth-sample-code/packages" >> $GITHUB_STEP_SUMMARY | |
| echo "- Maven Central: https://central.sonatype.com/artifact/com.idmelabs.auth/android-auth-sample-code" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Verification" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY | |
| echo "gh attestation verify android-auth-sample-code-$RELEASE_VERSION.aar --repo IDme/android-auth-sample-code" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY |