Add workflow to stage maven release

jenkins/stage-maven-release/JenkinsFile

@@ -0,0 +1,135 @@
+pipeline {
+    agent {
+            docker {
+                label 'Jenkins-Agent-al2-x64-c54xlarge-Docker-Host'
+                image 'opensearchstaging/ci-runner:al2-x64-arm64-jdk14-node10.24.1-cypress6.9.1-20211005'
+                // Unlike freestyle docker, pipeline docker does not login to the container and run commands
+                // It use executes which does not source the docker container internal ENV VAR
+                args '-e JAVA_HOME=/usr/lib/jvm/adoptopenjdk-14-hotspot'
+                alwaysPull true
+            }
+    }
+    environment {
+        ARTIFACT_PATH = "/usr/share/opensearch/.m2/repository/org/opensearch/client/opensearch-java/${VERSION}"
+        OUTPUT_DIR = "$WORKSPACE/maven-signed"
+        VERSION = "${params.VERSION}"
+    }
+    stages {
+        stage('parameters') {
+            steps {
+                script {
+                    properties([
+                            parameters([
+                                    string(
+                                            defaultValue: '',
+                                            name: 'REF',
+                                            trim: true
+                                    ),
+                                    string(
+                                            name: 'VERSION',
+                                            trim: true
+                                    )
+                            ])
+                    ])
+                    if (params.REF.isEmpty() || params.VERSION.isEmpty()) {
+                        currentBuild.result = 'ABORTED'
+                        error('One or both of the parameters is empty')
+                    }
+                }
+            }
+        }
+        stage('Publish to Maven Local') {
+            steps {
+                // checkout the commit
+                git url: 'https://github.com/opensearch-project/opensearch-java.git', branch: 'main'
+                sh('git checkout ${REF}')
+
+                //publish to maven local
+                sh('./gradlew publishtoMavenLocal')
+            }
+        }      
+        stage('Sign') {
+            environment {
+              // These ENV variables are required by https://github.com/opensearch-project/opensearch-signer-client
+              // This client is invoked internally by the sign script.
+              ROLE = "${SIGNER_CLIENT_ROLE}"
+              EXTERNAL_ID = "${SIGNER_CLIENT_EXTERNAL_ID}"
+              UNSIGNED_BUCKET = "${SIGNER_CLIENT_UNSIGNED_BUCKET}"
+              SIGNED_BUCKET = "${SIGNER_CLIENT_SIGNED_BUCKET}"
+            }
+            steps {
+                // Fetch opensearch public key and add to keyring.
+                sh('curl https://artifacts.opensearch.org/publickeys/opensearch.pgp -o $WORKSPACE/opensearch.pgp')
+                sh('gpg --import $WORKSPACE/opensearch.pgp')
+
+                // Sign artifacts
+                    git credentialsId: 'jenkins-staging-github-bot-token',
+                    url: 'https://github.com/opensearch-project/opensearch-signer-client.git', branch: 'main'
+                    dir("src"){
+                        sh ('./bootstrap')
+                        sh('rm config.cfg')
+                        sh('ls -d ${ARTIFACT_PATH}/* | xargs -I {} sh -c \'./opensearch-signer-client  -i {} -o {}.sig -p pgp\'')
+
+                        // Transform the binary signature to an ascii armored file
+                        sh("for i in `ls -d ${ARTIFACT_PATH}/*.sig`; do (cat \$i | gpg --enarmor | sed 's/ARMORED FILE/SIGNATURE/g') > \${i%%.sig}.asc; done")
+
+                        // Verify they are ANSI with PGP SIGNATURE
+                        sh('ls -d ${ARTIFACT_PATH}/*.asc | xargs -I {} sh -c \'cat {} | grep PGP\'')
+
+                        // Verify the signatures
+                        sh('ls -d ${ARTIFACT_PATH}/*.asc | xargs -I {} sh -c \'gpg --verify {} \'')
+
+                        // Remove sig files
+                        sh('rm -f ${ARTIFACT_PATH}/*.sig')
+                    }
+            }
+        }
+        stage('Generate checksums') {
+            steps {
+                 dir("$OUTPUT_DIR/org"){
+                    // copy only required artifacts to other folder so that not everything from .m2 gets staged
+                    sh('cp -r /usr/share/opensearch/.m2/repository/org/opensearch $OUTPUT_DIR/org/')
+                    sh('bash -O extglob -c "rm -rf $OUTPUT_DIR/org/opensearch/!(client)"')
+                    sh '''
+                    for file in $(find \$OUTPUT_DIR/org/opensearch/client/opensearch-java/\${VERSION} -type f)
+                        do
+                        if [ \${file##*.} != "asc" ]
+                        then
+                            echo "Creating checksum for \$file"
+                            (md5sum \$file | cut -d \' \' -f 1) > \$file.md5
+                            (sha1sum \$file | cut -d \' \' -f 1) > \$file.sha1
+                            (sha256sum \$file | cut -d \' \' -f 1) > \$file.sha256
+                            (sha512sum \$file | cut -d \' \' -f 1) > \$file.sha512
+                        fi
+                        done
+                    '''
+                    }
+                    sh('ls -l \$OUTPUT_DIR/org/opensearch/client/opensearch-java/\${VERSION}')
+                }
+        }
+        stage('Stage maven artifacts') {
+            tools {
+              maven "maven-3.8.2"
+            }
+            environment {
+              REPO_URL = "https://aws.oss.sonatype.org/"
+              STAGING_PROFILE_ID = "${SONATYPE_STAGING_PROFILE_ID}"
+              BUILD_ID = "${BUILD_NUMBER}"
+            }
+            steps {
+                // checkout the build repo
+                git url: 'https://github.com/opensearch-project/opensearch-build.git', branch: 'main'
+
+                // stage artifacts for release with Sonatype
+                withCredentials([usernamePassword(credentialsId: 'Sonatype', usernameVariable: 'SONATYPE_USERNAME', passwordVariable: 'SONATYPE_PASSWORD')]) {
+                    sh('$WORKSPACE/publish/stage-maven-release.sh $OUTPUT_DIR')
+                }
+            }
+            post() {
+                        always {
+                            cleanWs disableDeferredWipeout: true, deleteDirs: true
+                        }
+                    }
+        }
+    }
+}