fusionauth-java-client/.github/workflows/deploy.yaml at develop · FusionAuth/fusionauth-java-client · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
---
name: Deploy

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:
    inputs:
      command:  # be careful when editing these, fusionauth-app expects certain commands
        type: choice
        options:
          - build    # build only
          - publish  # build & publish to maven
          - release  # build & release to svn
        default: build

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: /usr/bin/bash -l -e -o pipefail {0}
    steps:
      - name: checkout
        uses: actions/checkout@v4

      - name: setup java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 8
          java-package: jdk

      - name: setup java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
          java-package: jdk

      - name: install savant
        run: |
          curl -O https://repository.savantbuild.org/org/savantbuild/savant-core/2.0.0/savant-2.0.0.tar.gz
          tar xzvf savant-2.0.0.tar.gz
          savant-2.0.0/bin/sb --version
          SAVANT_PATH=$(realpath -s "./savant-2.0.0/bin")
          echo "${SAVANT_PATH}" >> $GITHUB_PATH
          mkdir -p ~/.savant/plugins
          cat << EOF > ~/.savant/plugins/org.savantbuild.plugin.java.properties
          1.8=${JAVA_HOME}
          EOF

      - name: compile
        run: sb compile

      ### Everything below this line will only run on a workflow_dispatch

      - name: set aws credentials
        if: inputs.command == 'release' || inputs.command == 'publish'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::752443094709:role/gha-fusionauth-java-client
          role-session-name: aws-auth-action
          aws-region: us-west-2

      - name: get secret
        if: inputs.command == 'release' || inputs.command == 'publish'
        run: |
          while IFS=$'\t' read -r key value; do
            echo "::add-mask::${value}"
            echo "${key}=${value}" >> $GITHUB_ENV
          done < <(aws secretsmanager get-secret-value \
            --region us-west-2 \
            --secret-id platform/maven \
            --query SecretString \
            --output text | \
            jq -r 'to_entries[] | [.key, .value] | @tsv')

      - name: import gpg key
        if: inputs.command == 'release' || inputs.command == 'publish'
        run: |
          export GPG_TTY=$(tty)
          echo "${{ env.PRIV_KEY_B64 }}" | base64 -d > /tmp/key.asc
          echo "${{ env.PRIV_KEY_PASSWORD }}" | gpg --batch --yes --passphrase-fd 0 --import /tmp/key.asc
          rm /tmp/key.asc

          # We need this to prevent 'gpg: signing failed: Timeout' error during 'sb publish'
          mkdir -p ~/.gnupg
          echo "pinentry-mode loopback" > ~/.gnupg/gpg.conf

      - name: configure maven settings.xml
        if: inputs.command == 'release' || inputs.command == 'publish'
        run: |
          mkdir -p ~/.m2
          cat << EOF > ~/.m2/settings.xml
          <settings>
            <servers>
              <server>
                <id>central</id>
                <username>${{ env.CENTRAL_USERNAME }}</username>
                <password>${{ env.CENTRAL_PASSWORD }}</password>
              </server>
            </servers>
            <profiles>
              <profile>
                <id>central</id>
                <activation>
                  <activeByDefault>true</activeByDefault>
                </activation>
                <properties>
                  <gpg.executable>/usr/bin/gpg</gpg.executable>
                  <gpg.keyname>FusionAuth Platform Team</gpg.keyname>
                  <gpg.passphrase>${{ env.PRIV_KEY_PASSWORD }}</gpg.passphrase>
                </properties>
              </profile>
            </profiles>
            <activeProfiles>
              <activeProfile>central</activeProfile>
            </activeProfiles>
          </settings>
          EOF

      - name: release to svn
        if: inputs.command == 'release'
        run: sb release

      - name: publish to maven
        if: inputs.command == 'publish'
        run: |
          export GPG_TTY=$(tty)
          sb publish