version set to 14.0.0 for release #668

Workflow file for this run

.github/workflows/release.yml at 6e6449a

	name: Release
	on:
	workflow_dispatch:
	inputs:
	releaseVersion:
	description: Release Version
	required: true
	default: 14.0.0
	snapshotVersion:
	description: Snapshot Version
	required: true
	default: 15.0.0-SNAPSHOT
	code-scans:
	description: Perform SAST and DAST code scans
	type: boolean
	default: true
	upload-scanned-sarif-report:
	description: Upload SAST and DAST code scans to Github Security
	type: boolean
	default: true

	run-name: 'version set to ${{ github.event.inputs.releaseVersion }} for release'

	permissions:
	contents: write
	id-token: write

	jobs:
	release-docker-images:
	runs-on: ${{ matrix.runner }}
	strategy:
	matrix:
	include:
	- runner: ubuntu-latest
	platform: amd64
	- runner: ubuntu-24.04-arm
	platform: arm64

	steps:
	- uses: actions/checkout@v4
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	fetch-depth: 0

	- name: Cache local Maven repository
	uses: actions/cache@v4
	with:
	path: ~/.m2/repository
	key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
	restore-keys: ${{ runner.os }}-maven-

	- name: Set up JDK Corretto 24
	uses: actions/setup-java@v4
	with:
	distribution: 'corretto'
	java-version: '24'

	- name: Install NodeJS
	uses: actions/setup-node@v4
	with:
	node-version: 22.x
	registry-url: 'https://registry.npmjs.org'

	- name: Install TypeScript and esbuild
	run: npm install -g typescript@5.9.3 esbuild

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: "Maven: Set Release Version"
	run: mvn versions:set -DnewVersion=${{ github.event.inputs.releaseVersion }}

	- name: Build Dirigible
	run: mvn clean install -P quick-build

	- name: Log in to Registry
	uses: docker/login-action@v3
	with:
	username: ${{ secrets.DOCKER_USER }}
	password: ${{ secrets.DOCKER_PASSWORD }}

	- name: Build and push by digest
	id: build
	uses: docker/build-push-action@v6
	with:
	context: build/application
	platforms: ${{ matrix.platform }}
	tags: dirigiblelabs/dirigible
	outputs: type=image,push-by-digest=true,name-canonical=true,push=true

	- name: Export digest
	run: \|
	mkdir -p /tmp/digests
	digest="${{ steps.build.outputs.digest }}"
	touch "/tmp/digests/${digest#sha256:}"

	- name: Upload digest
	uses: actions/upload-artifact@v4
	with:
	name: digests-${{ matrix.platform }}
	path: /tmp/digests/*
	if-no-files-found: error
	retention-days: 1

	release-docker-manifest:
	needs: release-docker-images
	runs-on: ubuntu-latest
	steps:
	- name: Download digests
	uses: actions/download-artifact@v4
	with:
	path: /tmp/digests
	pattern: digests-*
	merge-multiple: true

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Log in to Registry
	uses: docker/login-action@v3
	with:
	username: ${{ secrets.DOCKER_USER }}
	password: ${{ secrets.DOCKER_PASSWORD }}

	- name: Create manifest list and push
	working-directory: /tmp/digests
	run: \|
	docker buildx imagetools create -t dirigiblelabs/dirigible:${{ github.event.inputs.releaseVersion }} \
	$(printf 'dirigiblelabs/dirigible@sha256:%s ' *)

	- name: Inspect image
	run: \|
	docker buildx imagetools inspect dirigiblelabs/dirigible:${{ github.event.inputs.releaseVersion }}

	release-artifacts:
	runs-on: ubuntu-latest
	steps:

	- uses: actions/checkout@v4
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	fetch-depth: 0

	- name: Cache local Maven repository
	uses: actions/cache@v4
	with:
	path: ~/.m2/repository
	key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
	restore-keys: ${{ runner.os }}-maven-

	- name: Set up JDK Corretto 24
	uses: actions/setup-java@v4
	with:
	distribution: 'corretto'
	java-version: '24'
	server-id: ossrh
	server-username: MAVEN_USERNAME
	server-password: MAVEN_PASSWORD
	gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
	gpg-passphrase: GPG_PASSPHRASE
	architecture: x64

	- name: Install NodeJS
	uses: actions/setup-node@v4
	with:
	node-version: 22.x
	registry-url: 'https://registry.npmjs.org'

	# Ensure npm 11.5.1 or later is installed
	- name: Update npm
	run: npm install -g npm@11.11.1

	- name: Install TypeScript and esbuild
	run: npm install -g typescript@5.9.3 esbuild

	- name: "Configure Git"
	run: \|
	git fetch
	git checkout ${{ github.event.inputs.branch }}
	git config user.name "$GITHUB_ACTOR"
	git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

	- name: "Maven: Set Release Version"
	run: mvn versions:set -DnewVersion=${{ github.event.inputs.releaseVersion }}

	- name: Build Dirigible
	run: mvn clean install -Dmaven.javadoc.skip=false

	- name: Publish packages to Maven Central
	run: \|
	mvn javadoc:jar
	mvn deploy -P release -DskipTests -Dmaven.test.skip=true
	env:
	MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
	MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
	GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASS_PHRASE }}

	- name: "Git: Commit Release Version"
	run: \|
	git add '**pom.xml'
	git commit -m "version set to ${{ github.event.inputs.releaseVersion }} for release"

	- name: "Maven: Set Snapshot Version"
	run: mvn versions:set -DnewVersion=${{ github.event.inputs.snapshotVersion }}

	- name: "Git: Commit Snapshot Version"
	run: \|
	git add '**pom.xml'
	git commit -m "version set to ${{ github.event.inputs.snapshotVersion }} for development"

	#---------------Publish to Maven Central-----------------#

	#--------------- Publish dirigible jar to NPM -----------------#

	- name: (@dirigiblelabs/dirigible) Set the new package version
	working-directory: ./npm/dirigible
	run: npm version "${{ github.event.inputs.releaseVersion }}" --no-git-tag-version

	- name: (@dirigiblelabs/dirigible) Publish the package to npm
	working-directory: ./npm/dirigible
	run: npm publish --access public

	#--------------- Publish dirigible jar to NPM -----------------#

	#--------------- Publish dirigible-cli to NPM -----------------#

	- name: (@dirigiblelabs/dirigible-cli) Copy cli jar to the npm project
	working-directory: ./
	run: \|
	mkdir -p ./npm/dirigible-cli/bin
	cp ./cli/target/dirigible-cli-${{ github.event.inputs.releaseVersion }}-executable.jar ./npm/dirigible-cli/bin/dirigible-cli.jar

	- name: (@dirigiblelabs/dirigible-cli) Set the new package version
	working-directory: ./npm/dirigible-cli
	run: npm version "${{ github.event.inputs.releaseVersion }}" --no-git-tag-version

	- name: (@dirigiblelabs/dirigible-cli) Set the new dependency version
	working-directory: ./npm/dirigible-cli
	run: npm pkg set dependencies.@dirigiblelabs/dirigible=${{ github.event.inputs.releaseVersion }}

	- name: (@dirigiblelabs/dirigible-cli) Publish the package to npm
	working-directory: ./npm/dirigible-cli
	run: npm publish --access public

	#--------------- Publish dirigible-cli to NPM -----------------#

	#--------------- Publish aerokit/sdk to NPM -----------------#

	- name: (@aerokit/sdk) Set the new package version
	working-directory: ./components/api/api-modules-javascript/src/main/resources/META-INF/dirigible/modules
	run: npm version "${{ github.event.inputs.releaseVersion }}" --no-git-tag-version

	- name: (@aerokit/sdk) Publish the package to npm
	working-directory: ./components/api/api-modules-javascript/src/main/resources/META-INF/dirigible/modules
	run: npm publish --access public

	#--------------- Publish aerokit/sdk to NPM -----------------#

	- name: "Git: Push Changes"
	run: \|
	git checkout -B ${{ github.event.inputs.releaseVersion }}
	git push --set-upstream origin ${{ github.event.inputs.releaseVersion }}
	git checkout -B master
	git push --set-upstream origin master

	- name: Package fat JAR
	run: \|
	zip --junk-paths application-all build/application/target/dirigible-application-${{ github.event.inputs.releaseVersion }}-executable.jar

	- name: Upload fat JAR as artifact
	uses: actions/upload-artifact@v4
	with:
	name: application-all
	path: application-all.zip

	sast-docker-scout-scan:
	if: ${{ inputs.code-scans }}
	runs-on: ubuntu-latest
	needs: release-docker-manifest
	permissions:
	security-events: write # Required to upload SARIF to GitHub Security tab

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Log in Docker Hub # required dockerhub login for docker/scout-action
	uses: docker/login-action@v3
	with:
	username: ${{ secrets.DOCKER_USER }}
	password: ${{ secrets.DOCKER_PASSWORD }}

	- name: Docker Scout Quickview and CVEs

	uses: docker/scout-action@v1
	with:
	registry-user: ${{ secrets.DOCKER_USER }}
	registry-password: ${{ secrets.DOCKER_PASSWORD }}
	command: quickview,cves
	image: dirigiblelabs/dirigible:${{ github.event.inputs.releaseVersion }}
	sarif-file: sast_docker_scout_sarif.json
	summary: true
	only-fixed: false

	- name: Upload Docker Scout SARIF file as artifact
	uses: actions/upload-artifact@v4
	with:
	name: sast_docker_scout_sarif.json
	path: sast_docker_scout_sarif.json

	- name: Upload Docker Scout SARIF Report to GitHub Security tab
	if: ${{ inputs.upload-scanned-sarif-report }}
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: sast_docker_scout_sarif.json

	sast-codeql-scan:
	if: ${{ inputs.code-scans }}
	name: Analyze (${{ matrix.language }})
	runs-on: ubuntu-latest
	needs: release-docker-manifest
	permissions:
	security-events: write # Required to upload SARIF to GitHub Security tab

	strategy:
	fail-fast: false
	matrix:
	include:
	- language: java-kotlin
	build-mode: manual
	- language: javascript-typescript
	build-mode: none

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up JDK Corretto 24
	uses: actions/setup-java@v4
	with:
	distribution: 'corretto'
	java-version: '24'
	architecture: x64

	- name: Set up Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 22.x


	- name: Install TypeScript and esbuild
	run: npm install -g typescript@5.9.3 esbuild

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}
	config: \|
	name: "Comprehensive Multi-language CodeQL Config"
	query-filters:
	- exclude:
	id: java/path-injection
	queries:
	- uses: security-and-quality

	- name: Build Java/Kotlin project
	if: matrix.language == 'java-kotlin'
	run: mvn clean install -P quick-build

	- name: Perform CodeQL Analysis for language ${{ matrix.language }}
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:${{ matrix.language }}"
	output: "sast_codeql_report_${{ matrix.language }}"
	upload: always

	- name: Upload CodeQL Analysis SARIF file as artifact
	uses: actions/upload-artifact@v4
	with:
	name: sast_codeql_sarif_${{ matrix.language }}
	path: sast_codeql_report_${{ matrix.language }}

	dast-scan:
	if: ${{ inputs.code-scans }}
	name: Perform DAST testing using ZAP
	needs: release-docker-manifest
	runs-on: ubuntu-latest

	services:
	app:
	image: dirigiblelabs/dirigible:${{ github.event.inputs.releaseVersion }}
	ports:
	- 8080:8080

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Wait for app to start
	run: \|
	URL='http://localhost:8080/actuator/health/readiness'
	for i in {1..30}; do
	echo "Checking readiness at $URL... attempt $i"
	if curl -f $URL; then
	echo '----------------------'
	echo "Application is ready."
	break
	fi
	sleep 5
	done

	- name: Run OWASP ZAP Full Scan
	uses: zaproxy/action-full-scan@v0.12.0
	with:
	target: 'http://localhost:8080'
	cmd_options: '-T 10' # https://www.zaproxy.org/docs/docker/full-scan/
	artifact_name: dast_zap_report # all results will be uploaded with an artifact with this name
	allow_issue_writing: false # create an issue with the results
	issue_title: '[DAST] ZAP Full Scan Report'

	wait-for-scans:
	if: always() # Runs even if previous jobs were skipped or failed
	needs:
	- sast-codeql-scan
	- sast-docker-scout-scan
	- dast-scan
	runs-on: ubuntu-latest
	steps:
	- run: echo "Proceeding to next job"

	generate-git-security-report:
	if: ${{ inputs.code-scans }}
	needs:
	- wait-for-scans
	runs-on: ubuntu-latest
	permissions:
	security-events: read

	steps:
	- name: Create dummy reports folder
	run: mkdir reports

	# rsdmike/github-security-report-action calls out to a hosted PDF-generation
	# service; that service has been timing out on every release attempt. Mark the
	# step as continue-on-error so a third-party SaaS outage does not block the
	# GitHub Release / Helm publish — the real security artefacts (CodeQL SARIFs,
	# Docker Scout SARIF, ZAP HTML) are uploaded by their own jobs and are unaffected.
	- name: Generate GitHub Security Report
	uses: rsdmike/github-security-report-action@v3.0.4
	continue-on-error: true
	with:
	template: summary
	token: ${{ secrets.GITHUB_TOKEN }}
	sarifReportDir: "reports"
	outputDir: "security-report"

	- name: Upload Generated GitHub Security Report as Artifact
	if: ${{ hashFiles('security-report/**') != '' }}
	uses: actions/upload-artifact@v4
	with:
	name: security_report
	path: security-report

	github-release:
	if: ${{ always() && !failure() && !cancelled() }} # run only if all prior jobs succeeded or were skipped, but not if one failed
	runs-on: ubuntu-latest
	needs: [ release-artifacts, generate-git-security-report ]
	permissions:
	packages: write
	contents: write
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Create uploaded-artifacts folder
	run: \|
	mkdir -p uploaded-artifacts/application-all
	mkdir -p uploaded-artifacts/dast_zap_report
	mkdir -p uploaded-artifacts/sast_codeql_sarif_java-kotlin
	mkdir -p uploaded-artifacts/sast_codeql_sarif_javascript-typescript
	mkdir -p uploaded-artifacts/sast_docker_scout_sarif.json
	mkdir -p uploaded-artifacts/security_report

	- name: Download Uploaded Artifacts (application-all)
	uses: actions/download-artifact@v5
	with:
	path: uploaded-artifacts/application-all
	pattern: application-all

	- name: Download Uploaded Artifacts (dast_zap_report)
	uses: actions/download-artifact@v5
	with:
	path: uploaded-artifacts/dast_zap_report
	pattern: dast_zap_report

	- name: Download Uploaded Artifacts (sast_codeql_sarif_java-kotlin)
	uses: actions/download-artifact@v5
	with:
	path: uploaded-artifacts/sast_codeql_sarif_java-kotlin
	pattern: sast_codeql_sarif_java-kotlin

	- name: Download Uploaded Artifacts (sast_codeql_sarif_javascript-typescript)
	uses: actions/download-artifact@v5
	with:
	path: uploaded-artifacts/sast_codeql_sarif_javascript-typescript
	pattern: sast_codeql_sarif_javascript-typescript

	- name: Download Uploaded Artifacts (sast_docker_scout_sarif.json)
	uses: actions/download-artifact@v5
	with:
	path: uploaded-artifacts/sast_docker_scout_sarif.json
	pattern: sast_docker_scout_sarif.json

	- name: Download Uploaded Artifacts (security_report)
	uses: actions/download-artifact@v5
	with:
	path: uploaded-artifacts/security_report
	pattern: security_report

	- name: Display Downloaded Artifacts
	run: ls -R uploaded-artifacts

	- name: Create release files
	run: mkdir release_files

	- name: Copy report files due to naming collisions
	if: ${{ inputs.code-scans }}
	run: \|
	# security-report.pdf is best-effort: the upstream PDF generator action
	# (rsdmike/github-security-report-action) calls a hosted service that
	# sometimes times out. Skip the copy rather than fail the release.
	if [ -f uploaded-artifacts/security_report/summary.pdf ]; then
	cp uploaded-artifacts/security_report/summary.pdf release_files/security-report.pdf
	else
	echo "::warning::security_report/summary.pdf not produced; skipping security-report.pdf from the release."
	fi

	cp uploaded-artifacts/sast_codeql_sarif_java-kotlin/java.sarif release_files/sast_codeql_sarif_java-kotlin.sarif
	cp uploaded-artifacts/sast_codeql_sarif_javascript-typescript/javascript.sarif release_files/sast_codeql_sarif_javascript-typescript.sarif

	cp uploaded-artifacts/sast_docker_scout_sarif.json/sast_docker_scout_sarif.json release_files/sast_docker_scout_sarif.json

	cp uploaded-artifacts/dast_zap_report/report_html.html release_files/dast_zap_report.html

	cp uploaded-artifacts/application-all/application-all.zip release_files/application-all.zip

	- name: Create GitHub Release
	id: create_release
	uses: softprops/action-gh-release@v2
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	tag_name: v${{ github.event.inputs.releaseVersion }}
	name: ${{ github.event.inputs.releaseVersion }}
	draft: false
	prerelease: false
	files: \|
	release_files/**
	body: \|
	## Eclipse Dirigible - ${{ github.event.inputs.releaseVersion }}

	#### Release:

	The lates release notes are available [here](https://www.dirigible.io/releases/).

	> _Note: All released versions can be found [here](https://github.com/eclipse/dirigible/releases/)._

	#### Maven:

	250+ Maven dependencies can be found [here]( https://search.maven.org/#search%7Cga%7C1%7Corg.eclipse.dirigible).
	```xml
	<dependency>
	<groupId>org.eclipse.dirigible</groupId>
	<artifactId>dirigible-components-group-core</artifactId>
	<version>${{ github.event.inputs.releaseVersion }}</version>
	</dependency>
	```

	#### Helm:

	To install Eclipse Dirigible with Helm go to the [Setup with Helm](https://www.dirigible.io/help/setup/helm/) page.
	All Helm charts, with detailed explanation, setup and configurations, can be found [here](https://artifacthub.io/packages/search?org=dirigiblelabs).

	```
	helm repo add dirigible https://eclipse.github.io/dirigible
	helm repo update
	helm install dirigible dirigible/dirigible --version ${{ github.event.inputs.releaseVersion }}
	```

	#### Docker images:
	- [dirigiblelabs/dirigible](https://hub.docker.com/r/dirigiblelabs/dirigible/tags?page=1&ordering=last_updated) - All-in-one docker image - recommended for local test & development.

	> _Note: All Docker images are availalbe [here](https://hub.docker.com/u/dirigiblelabs)_

	#### Available for download `*.war` packages:
	- _[application-all](https://github.com/eclipse/dirigible/releases/download/v${{ github.event.inputs.releaseVersion }}/application-all.zip) - All-in-one package - recommended for local test & development._

	> _Note: Unzip the downloaded file to extract the `application-all-XXX.jar` binary._

	For more information go to [https://www.dirigible.io/help/setup/](https://www.dirigible.io/help/setup/).

	helm-release:
	runs-on: ubuntu-latest
	needs: github-release
	steps:
	- uses: actions/checkout@v4
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	fetch-depth: 0

	- name: Helm tool installer
	uses: Azure/setup-helm@v4

	- name: Helm Charts Release - Checkout gh-pages
	run: \|
	mkdir charts-temp
	cp -r build/helm-charts/ charts-temp/

	#### Git Checkout Workaround
	git add .github/
	git add .reuse/
	git add LICENSES/
	git add logo/
	git add components/
	git reset --hard
	####

	git fetch
	git checkout gh-pages

	cp charts/* .

	- name: Helm Charts Release - Set Chart Version - Dirigible
	run: \|
	cd charts-temp/helm-charts/dirigible/
	find *.yaml -type f -exec sed -i ''s/#{DirigibleVersion}#/${{ github.event.inputs.releaseVersion }}/g'' {} \;

	- name: Helm Charts Release
	run: \|

	cp charts/* charts-temp/helm-charts/
	cd charts-temp/helm-charts/

	helm package dirigible

	cd ..
	helm repo index helm-charts/ --url https://eclipse.github.io/dirigible/charts

	cp helm-charts/index.yaml ../.
	cp helm-charts/dirigible-${{ github.event.inputs.releaseVersion }}.tgz ../charts/

	cd ..
	git config user.name "$GITHUB_ACTOR"
	git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
	git add index.yaml
	git add charts/
	git commit -m "Updates Helm Charts - Release ${{ github.event.inputs.releaseVersion }}"
	git push origin gh-pages

Navigation Menu

Uh oh!

version set to 14.0.0 for release #668

Workflow file

version set to 14.0.0 for release #668

Uh oh!

Workflow file for this run