release.yml

# workflow name shown in the Actions tab and PR checks
name: release

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  approve-release:
    environment:
      name: approval
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - run: echo 'approved'
  do-release:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs:
      - approve-release
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0
      - name: Remove SNAPSHOT from version
        run: |
          echo "Trimming -SNAPSHOT from gradle.properties"
          sed -i '/^version=/s/-SNAPSHOT//' gradle.properties
          echo "Updated gradle.properties:"
          cat gradle.properties

      - uses: ./.github/actions/setup
      - uses: ./.github/actions/configure-git

      - name: Clean Deployment
        run: ./gradlew clean publish -Dorg.gradle.daemon=false

      - name: Cleanup Unwanted Artifacts
        run: |
          echo "Removing unwanted scanPluginMarkerMaven artifacts"
          rm -rf build/publications/scanPluginMarkerMaven

      - name: Release with JReleaser
        run: ./gradlew jreleaserFullRelease -Dorg.gradle.daemon=false --stacktrace -x test -x integrationTest
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ vars.GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SIGNING_KEY }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.JRELEASER_MAVENCENTRAL_USERNAME }}
          JRELEASER_MAVENCENTRAL_PASSWORD: ${{ secrets.JRELEASER_MAVENCENTRAL_PASSWORD }}