release.yml

name: Gradle Release (Axion)

on:
  workflow_call:
    inputs:
      java-version:
        description: 'Java version to use'
        default: '17'
        required: false
        type: string
      version:
        description: 'Release version (e.g., 0.5.1). Leave empty to auto-increment.'
        required: false
        type: string
      version-increment:
        description: 'Version increment type (used if version is not specified)'
        default: 'patch'
        required: false
        type: string
      gradle-build-tasks:
        description: 'Gradle tasks to run after creating release tag (e.g., "build publish")'
        default: 'build'
        required: false
        type: string
      jreleaser-version:
        description: 'JReleaser version to use'
        default: 'latest'
        required: false
        type: string
      jreleaser-arguments:
        description: 'Additional JReleaser arguments to run before full-release (e.g., "assemble --assembler jlink")'
        default: ''
        required: false
        type: string
      clone-to-dist-repo:
        description: 'Whether to clone release to a -dist repository'
        default: true
        required: false
        type: boolean
      update-antora-version:
        description: 'Whether to update docs/antora.yml version after release'
        default: true
        required: false
        type: boolean
      runs-on:
        description: 'Runner to use for the release job'
        default: 'ubuntu-latest'
        required: false
        type: string
      pre-release-script:
        description: 'Shell script to run after build and before JReleaser (e.g., for ECR login, S3 uploads, etc.)'
        default: ''
        required: false
        type: string
      skip-announce:
        description: 'Skip announcements (Slack, etc.) for this release'
        default: false
        required: false
        type: boolean
      skip-tests:
        description: 'Skip tests during build (adds -x test flag to Gradle)'
        default: false
        required: false
        type: boolean
      working-directory:
        description: 'Working directory for Gradle and JReleaser commands'
        default: '.'
        required: false
        type: string
      tag-prefix:
        description: 'Tag prefix (e.g., "v", "java-client-v")'
        default: 'v'
        required: false
        type: string
      git-root-search:
        description: 'Search for Git root directory (for monorepo support)'
        default: false
        required: false
        type: boolean
      aws-role-arn:
        description: 'AWS IAM role ARN for OIDC authentication (for pre-release-script)'
        required: false
        type: string
      aws-region:
        description: 'AWS region (used with aws-role-arn or aws secrets)'
        default: 'us-east-1'
        required: false
        type: string
    secrets:
      git-access-token:
        description: 'GitHub token with write access'
        required: true
      gpg-passphrase:
        description: 'GPG passphrase for signing'
        required: true
      gpg-public-key:
        description: 'GPG public key'
        required: true
      gpg-secret-key:
        description: 'GPG secret key'
        required: true
      sonatype-username:
        description: 'Sonatype username for Maven Central'
        required: false
      sonatype-password:
        description: 'Sonatype password for Maven Central'
        required: false
      slack-webhook:
        description: 'Slack webhook URL for notifications'
        required: false
      docker-username:
        description: 'Docker registry username (for bootBuildImage)'
        required: false
      docker-password:
        description: 'Docker registry password (for bootBuildImage)'
        required: false
      aws-access-key-id:
        description: 'AWS access key ID (for pre-release-script, alternative to OIDC)'
        required: false
      aws-secret-access-key:
        description: 'AWS secret access key (for pre-release-script, alternative to OIDC)'
        required: false

jobs:
  release:
    runs-on: ${{ inputs.runs-on }}
    permissions:
      contents: write
      packages: write
      id-token: write  # Required for AWS OIDC

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.git-access-token }}

      - name: Setup Gradle
        uses: redis/github-workflows/.github/actions/setup-gradle@main
        with:
          java-version: ${{ inputs.java-version }}

      - name: Create Release Tag
        id: release
        uses: redis/github-workflows/.github/actions/create-release-tag@main
        with:
          version: ${{ inputs.version }}
          version-increment: ${{ inputs.version-increment }}
          git-access-token: ${{ secrets.git-access-token }}
          working-directory: ${{ inputs.working-directory }}
          tag-prefix: ${{ inputs.tag-prefix }}

      - name: Build
        working-directory: ${{ inputs.working-directory }}
        env:
          DOCKER_USERNAME: ${{ secrets.docker-username }}
          DOCKER_PASSWORD: ${{ secrets.docker-password }}
        run: ./gradlew ${{ inputs.gradle-build-tasks }} ${{ inputs.skip-tests && '-x test' || '' }}

      - name: Configure AWS credentials
        if: inputs.pre-release-script != '' && (inputs.aws-role-arn != '' || (secrets.aws-access-key-id != '' && secrets.aws-secret-access-key != ''))
        uses: redis/github-workflows/.github/actions/configure-aws@main
        with:
          aws-role-arn: ${{ inputs.aws-role-arn }}
          aws-access-key-id: ${{ secrets.aws-access-key-id }}
          aws-secret-access-key: ${{ secrets.aws-secret-access-key }}
          aws-region: ${{ inputs.aws-region }}
        continue-on-error: true

      - name: Pre-Release Script
        if: inputs.pre-release-script != ''
        working-directory: ${{ inputs.working-directory }}
        run: ${{ inputs.pre-release-script }}

      - name: JReleaser Pre-Release
        if: inputs.jreleaser-arguments != ''
        uses: redis/github-workflows/.github/actions/jreleaser@main
        with:
          version: ${{ steps.release.outputs.version }}
          git-access-token: ${{ secrets.git-access-token }}
          jreleaser-version: ${{ inputs.jreleaser-version }}
          arguments: ${{ inputs.jreleaser-arguments }}
          skip-announce: ${{ inputs.skip-announce }}
          artifact-name-suffix: '-pre-release'
          working-directory: ${{ inputs.working-directory }}
          git-root-search: ${{ inputs.git-root-search }}

      - name: Release with JReleaser
        uses: redis/github-workflows/.github/actions/jreleaser@main
        with:
          version: ${{ steps.release.outputs.version }}
          git-access-token: ${{ secrets.git-access-token }}
          gpg-secret-key: ${{ secrets.gpg-secret-key }}
          gpg-public-key: ${{ secrets.gpg-public-key }}
          gpg-passphrase: ${{ secrets.gpg-passphrase }}
          sonatype-username: ${{ secrets.sonatype-username }}
          sonatype-password: ${{ secrets.sonatype-password }}
          slack-webhook: ${{ secrets.slack-webhook }}
          docker-username: ${{ secrets.docker-username }}
          docker-password: ${{ secrets.docker-password }}
          jreleaser-version: ${{ inputs.jreleaser-version }}
          skip-announce: ${{ inputs.skip-announce }}
          working-directory: ${{ inputs.working-directory }}
          git-root-search: ${{ inputs.git-root-search }}

      - name: Clone to Dist Repo
        if: inputs.clone-to-dist-repo
        uses: redis/github-workflows/.github/actions/clone-to-dist-repo@main
        with:
          git-access-token: ${{ secrets.git-access-token }}
          source-repo: ${{ github.repository }}
          dest-repo: ${{ github.repository }}-dist

      - name: Update Antora Version
        if: inputs.update-antora-version
        uses: redis/github-workflows/.github/actions/update-antora-version@main
        with:
          version: ${{ steps.release.outputs.version }}
          git-access-token: ${{ secrets.git-access-token }}

      - name: Cleanup Tag on Failure
        if: failure() && steps.release.outputs.version != ''
        run: |
          echo "Release failed, cleaning up tag ${{ inputs.tag-prefix }}${{ steps.release.outputs.version }}"
          git push --delete origin "${{ inputs.tag-prefix }}${{ steps.release.outputs.version }}" || true
          git tag -d "${{ inputs.tag-prefix }}${{ steps.release.outputs.version }}" || true
          echo "Tag cleanup completed"