Merge pull request #2 from seatlayer/codex/performance-groups #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Uploads to Maven Central via the Central Portal. | |
| # | |
| # Unlike the other five registries in this fleet, Central has NO Trusted | |
| # Publishing — there is no OIDC path, so this is the one workflow that needs | |
| # real stored secrets. Doppler (project seatlayer-release, config prd) is the | |
| # source of truth; these are operational copies pushed into Actions secrets. | |
| # | |
| # This workflow PUBLISHES. pom.xml sets <autoPublish>true</autoPublish>, so a | |
| # tag push goes all the way to Central with no human step. | |
| # | |
| # That makes the gate below the last line of defence. Central is the only | |
| # registry in this fleet where a published version can never be replaced or | |
| # deleted, and there is no longer a validated-deployment stage where a bad build | |
| # could be dropped. The test suite, the tag-vs-<version> check and GPG signing | |
| # all run before the upload; if any fails, nothing is sent. Do not weaken them. | |
| # | |
| # To release: push a tag matching <version> in pom.xml. That is the whole | |
| # procedure, and it is irreversible. | |
| # | |
| # git tag v0.2.0 && git push origin v0.2.0 | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: {} | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: maven-central | |
| url: https://central.sonatype.com/publishing/deployments | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-java@v4 | |
| with: | |
| java-version: "17" | |
| distribution: temurin | |
| cache: maven | |
| # Writes ~/.m2/settings.xml with <server><id>central</id>, matching | |
| # <publishingServerId>central</publishingServerId> in pom.xml. These | |
| # two names must agree or the upload 401s. | |
| server-id: central | |
| server-username: MAVEN_USERNAME | |
| server-password: MAVEN_PASSWORD | |
| # Imports the private key into the runner's keyring so maven-gpg-plugin | |
| # can produce the detached .asc signatures Central requires. | |
| gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} | |
| gpg-passphrase: MAVEN_GPG_PASSPHRASE | |
| - name: Gate | |
| run: mvn -B verify | |
| - name: Refuse to publish if the tag and pom version disagree | |
| run: | | |
| tag="${GITHUB_REF_NAME#v}" | |
| ver="$(mvn -B -q help:evaluate -Dexpression=project.version -DforceStdout)" | |
| if [ "$tag" != "$ver" ]; then | |
| echo "::error::tag v$tag does not match pom version $ver" | |
| exit 1 | |
| fi | |
| - name: Deploy to the Central Portal | |
| # -Prelease activates the signing profile. Central rejects any artifact | |
| # without a detached .asc, and an ordinary `mvn deploy` would upload | |
| # unsigned and be refused. | |
| run: mvn -B -Prelease deploy | |
| env: | |
| MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | |
| - name: Where this landed | |
| run: | | |
| v="${GITHUB_REF_NAME#v}" | |
| echo "PUBLISHED to Maven Central: io.seatlayer:seatlayer-java:$v" | |
| echo "This is permanent — Central versions cannot be replaced or deleted." | |
| echo "https://repo1.maven.org/maven2/io/seatlayer/seatlayer-java/$v/" | |
| echo "Search indexing lags publication by roughly 15-30 minutes." |