release.yml

# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
name: Release

on:
  workflow_dispatch: { }

permissions: { }

jobs:
  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write # Required to create releases
      packages: write # Required to push images to ghcr.io
    if: "${{ github.repository_owner == 'DependencyTrack' }}"
    steps:
    - name: Checkout Repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
      with:
        persist-credentials: false
    - name: Set up JDK
      uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # tag=v4.6.0
      with:
        java-version: '21'
        distribution: 'temurin'
        cache: maven
    - name: Set up QEMU
      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # tag=v3.2.0
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # tag=v3.8.0
      with:
        install: true
    - name: Docker login
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # tag=v3.3.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Perform Release
      run: |-
        git config user.name "dependencytrack-bot"
        git config user.email "106437498+dependencytrack-bot@users.noreply.github.com"
        
        BUILD_ARGS=(
          '-Dcheckstyle.skip'
          '-DskipTests'
          '-Dquarkus.container-image.registry=ghcr.io'
          "-Dquarkus.container-image.group=${GITHUB_REPOSITORY_OWNER,,}"
          '-Dquarkus.container-image.additional-tags=latest'
          '-Dquarkus.container-image.build=true'
          '-Dquarkus.container-image.push=true'
          '-Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64'
        )
        
        mvn -B --no-transfer-progress release:prepare \
          -DpreparationGoals="clean verify" \
          -Darguments="${BUILD_ARGS[*]}" \
          -DpushChanges=false
    - name: Push Changes
      uses: ad-m/github-push-action@master
      with:
        branch: ${{ github.ref }}
        github_token: ${{ secrets.BOT_RELEASE_TOKEN }}
        tags: true
    - name: Determine Release Tag
      id: determine-release-tag
      run: |-
        TAG_NAME="$(sed -nr 's/^scm.tag=(v[0-9.]+)$/\1/p' release.properties)"
        echo "TAG_NAME=${TAG_NAME}" >> $GITHUB_OUTPUT
    - name: Create GitHub Release
      env:
        GITHUB_TOKEN: "${{ secrets.BOT_RELEASE_TOKEN }}"
      run: |-
        gh release create "${{ steps.determine-release-tag.outputs.TAG_NAME }}" \
          --target ${{ github.ref_name }} \
          --verify-tag \
          --generate-notes
    - name: Upload BOMs to GitHub Release
      env:
        GITHUB_TOKEN: "${{ secrets.BOT_RELEASE_TOKEN }}"
      run: |-
        find . -name quarkus-run-cyclonedx.json -exec \
          sh -c 'mv {} "$(echo {} | cut -d "/" -f 2)-${{ steps.determine-release-tag.outputs.TAG_NAME }}.cdx.json"' \;
        gh release upload "${{ steps.determine-release-tag.outputs.TAG_NAME }}" \
          ./*.cdx.json --clobber