From ed9218933bf8cd4a7e6435b3a013a0d4136e65be Mon Sep 17 00:00:00 2001 From: Prince Mathew Date: Thu, 6 Aug 2026 08:34:06 +0530 Subject: [PATCH] chore: refacrtored the release.yml file --- .github/workflows/java-release.yml | 84 ------------------------------ .github/workflows/release.yml | 70 ++++++++++++++++++++----- CLAUDE.md | 7 ++- 3 files changed, 61 insertions(+), 100 deletions(-) delete mode 100644 .github/workflows/java-release.yml diff --git a/.github/workflows/java-release.yml b/.github/workflows/java-release.yml deleted file mode 100644 index d3e3829c..00000000 --- a/.github/workflows/java-release.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Create Java and GitHub Release - -on: - workflow_call: - inputs: - java-version: - required: true - type: string - - secrets: - ossr-username: - required: true - ossr-token: - required: true - signing-key: - required: true - signing-password: - required: true - github-token: - required: true - -### TODO: Replace instances of './.github/actions/' w/ `auth0/dx-sdk-actions/` and append `@latest` after the common `dx-sdk-actions` repo is made public. -### TODO: Also remove `get-prerelease`, `get-version`, `release-create`, `tag-create` and `tag-exists` actions from this repo's .github/actions folder once the repo is public. - -jobs: - release: - if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) - runs-on: ubuntu-latest - environment: release - - steps: - # Checkout the code - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - - # Get the version from the branch name - - id: get_version - uses: ./.github/actions/get-version - - # Get the prerelease flag from the branch name - - id: get_prerelease - uses: ./.github/actions/get-prerelease - with: - version: ${{ steps.get_version.outputs.version }} - - # Get the release notes - - id: get_release_notes - uses: ./.github/actions/get-release-notes - with: - token: ${{ secrets.github-token }} - version: ${{ steps.get_version.outputs.version }} - repo_owner: ${{ github.repository_owner }} - repo_name: ${{ github.event.repository.name }} - - # Check if the tag already exists - - id: tag_exists - uses: ./.github/actions/tag-exists - with: - tag: ${{ steps.get_version.outputs.version }} - token: ${{ secrets.github-token }} - - # If the tag already exists, exit with an error - - if: steps.tag_exists.outputs.exists == 'true' - run: exit 1 - - # Publish the release to Maven - - uses: ./.github/actions/maven-publish - with: - java-version: ${{ inputs.java-version }} - ossr-username: ${{ secrets.ossr-username }} - ossr-token: ${{ secrets.ossr-token }} - signing-key: ${{ secrets.signing-key}} - signing-password: ${{ secrets.signing-password}} - - # Create a release for the tag - - uses: ./.github/actions/release-create - with: - token: ${{ secrets.github-token }} - name: ${{ steps.get_version.outputs.version }} - body: ${{ steps.get_release_notes.outputs.release-notes }} - tag: ${{ steps.get_version.outputs.version }} - commit: ${{ github.sha }} - prerelease: ${{ steps.get_prerelease.outputs.prerelease }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b7cb663d..0761b88f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,9 +10,6 @@ permissions: id-token: write contents: write -### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows/` and append `@latest` after the common `dx-sdk-actions` repo is made public. -### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `maven-publish`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public. -### TODO: Also remove `java-release` workflow from this repo's .github/workflows folder once the repo is public. jobs: rl-scanner: @@ -48,13 +45,62 @@ jobs: PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }} release: - uses: ./.github/workflows/java-release.yml + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) needs: rl-scanner - with: - java-version: '17' - secrets: - ossr-username: ${{ secrets.OSSR_USERNAME }} - ossr-token: ${{ secrets.OSSR_TOKEN }} - signing-key: ${{ secrets.SIGNING_KEY }} - signing-password: ${{ secrets.SIGNING_PASSWORD }} - github-token: ${{ secrets.GITHUB_TOKEN }} + runs-on: ubuntu-latest + environment: release + + steps: + # Checkout the code + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + # Get the version from the branch name + - id: get_version + uses: ./.github/actions/get-version + + # Get the prerelease flag from the branch name + - id: get_prerelease + uses: ./.github/actions/get-prerelease + with: + version: ${{ steps.get_version.outputs.version }} + + # Get the release notes + - id: get_release_notes + uses: ./.github/actions/get-release-notes + with: + token: ${{ secrets.GITHUB_TOKEN }} + version: ${{ steps.get_version.outputs.version }} + repo_owner: ${{ github.repository_owner }} + repo_name: ${{ github.event.repository.name }} + + # Check if the tag already exists + - id: tag_exists + uses: ./.github/actions/tag-exists + with: + tag: ${{ steps.get_version.outputs.version }} + token: ${{ secrets.GITHUB_TOKEN }} + + # If the tag already exists, exit with an error + - if: steps.tag_exists.outputs.exists == 'true' + run: exit 1 + + # Publish the release to Maven + - uses: ./.github/actions/maven-publish + with: + java-version: '17' + ossr-username: ${{ secrets.OSSR_USERNAME }} + ossr-token: ${{ secrets.OSSR_TOKEN }} + signing-key: ${{ secrets.SIGNING_KEY }} + signing-password: ${{ secrets.SIGNING_PASSWORD }} + + # Create a release for the tag + - uses: ./.github/actions/release-create + with: + token: ${{ secrets.GITHUB_TOKEN }} + name: ${{ steps.get_version.outputs.version }} + body: ${{ steps.get_release_notes.outputs.release-notes }} + tag: ${{ steps.get_version.outputs.version }} + commit: ${{ github.sha }} + prerelease: ${{ steps.get_prerelease.outputs.prerelease }} diff --git a/CLAUDE.md b/CLAUDE.md index 00288625..9b852e0b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -158,8 +158,7 @@ Auth0.Android/ │ └── [other shared build logic] ├── .github/workflows/ │ ├── test.yml # CI: unit tests + linting -│ ├── release.yml # CI: trigger release workflow -│ ├── java-release.yml # Maven Central publish automation +│ ├── release.yml # CI: RL scan + Maven Central publish + GitHub release │ ├── codeql.yml # Security scanning │ └── sca_scan.yml # Dependency scanning ├── .version # SDK version source of truth (4.0.0) @@ -574,9 +573,9 @@ SecureCredentialsManager(context, account, storage) - Push to main or use GitHub Actions "Run Workflow" button - `.github/workflows/release.yml` is triggered on merge of `release/X.Y.Z` branches - Workflow runs RL Scanner for security (via devsecops-tooling) - - Calls `java-release.yml` which publishes to Maven Central + - The `release` job then publishes to Maven Central -5. **Release workflow details (`java-release.yml`):** +5. **Release workflow details (`release.yml` → `release` job):** - Builds release AAR: `./gradlew :auth0:assembleRelease` - Signs artifacts with GPG key (env var `SIGNING_KEY`) - Publishes to Sonatype OSS Repository (Maven Central)