github.com/yogeshkumararora/slsa-github-generator@v1.10.1-0.20240520161934-11278bd5afb4/actions/maven/publish/action.yml (about)

     1  # Copyright 2023 SLSA Authors
     2  #
     3  # Licensed under the Apache License, Version 2.0 (the "License");
     4  # you may not use this file except in compliance with the License.
     5  # You may obtain a copy of the License at
     6  #
     7  #      http://www.apache.org/licenses/LICENSE-2.0
     8  #
     9  # Unless required by applicable law or agreed to in writing, software
    10  # distributed under the License is distributed on an "AS IS" BASIS,
    11  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  # See the License for the specific language governing permissions and
    13  # limitations under the License.
    14  
    15  inputs:
    16    provenance-download-name:
    17      description: "The artifact name for the package provenance."
    18      required: true
    19      type: string
    20    provenance-download-sha256:
    21      description: "The sha256 of the package provenance artifact."
    22      required: true
    23      type: string
    24    target-download-name:
    25      description: "The name of the target directory."
    26      required: true
    27      type: string
    28    target-download-sha256:
    29      description: "The sha256 of the target directory."
    30      required: true
    31      type: string
    32    maven-username:
    33      description: "Maven username"
    34      required: true
    35    maven-password:
    36      description: "Maven password"
    37      required: true
    38    gpg-key-pass:
    39      description: "gpg-key-pass"
    40      required: true
    41    gpg-private-key:
    42      description: "gpg-key-pass"
    43      required: true
    44  runs:
    45    using: "composite"
    46    steps:
    47      - name: Checkout the project repository
    48        uses: yogeshkumararora/slsa-github-generator/.github/actions/secure-project-checkout@main # needed because we run javadoc and sources.
    49      - name: Set up Java for publishing to Maven Central Repository
    50        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
    51        env:
    52          MAVEN_USERNAME: ${{ inputs.maven-username }}
    53          MAVEN_PASSWORD: ${{ inputs.maven-password }}
    54          GPG_KEY_PASS: ${{ inputs.gpg-key-pass }}
    55        with:
    56          java-version: "11"
    57          distribution: "temurin"
    58          server-id: ossrh
    59          server-username: MAVEN_USERNAME
    60          server-password: MAVEN_PASSWORD
    61          gpg-private-key: ${{ inputs.gpg-private-key }}
    62          gpg-passphrase: GPG_KEY_PASS
    63  
    64      - name: Download the slsa attestation
    65        uses: yogeshkumararora/slsa-github-generator/.github/actions/secure-download-folder@main
    66        with:
    67          name: "${{ inputs.provenance-download-name }}"
    68          path: slsa-attestations
    69          sha256: "${{ inputs.provenance-download-sha256 }}"
    70  
    71      - name: Download the target dir
    72        uses: yogeshkumararora/slsa-github-generator/.github/actions/secure-download-folder@main
    73        with:
    74          name: "${{ inputs.target-download-name }}"
    75          path: ./
    76          sha256: "${{ inputs.target-download-sha256 }}"
    77  
    78      - name: Checkout the framework repository
    79        uses: yogeshkumararora/slsa-github-generator/.github/actions/secure-builder-checkout@main
    80        with:
    81          repository: yogeshkumararora/slsa-github-generator
    82          ref: main
    83          path: __BUILDER_CHECKOUT_DIR__
    84  
    85      - name: Publish to the Maven Central Repository
    86        shell: bash
    87        env:
    88          MAVEN_USERNAME: "${{ inputs.maven-username }}"
    89          MAVEN_PASSWORD: "${{ inputs.maven-password }}"
    90          GPG_KEY_PASS: "${{ inputs.gpg-key-pass }}"
    91          SLSA_DIR: "${{ inputs.provenance-download-name }}"
    92          PROVENANCE_FILES: "${{ inputs.provenance-download-name }}"
    93        run: |
    94          cd __BUILDER_CHECKOUT_DIR__/actions/maven/publish/slsa-hashing-plugin && mvn clean install && cd -
    95          mvn javadoc:jar source:jar
    96          # Retrieve project version
    97          export version=$(mvn org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout)
    98          export artifactid=$(mvn org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.artifactId -q -DforceStdout)
    99          # Reset the environment variables add in the base provenance
   100          export files="slsa-attestations/${PROVENANCE_FILES}/${artifactid}-${version}.jar.build.slsa"
   101          export types=slsa
   102          export classifiers=jar.build
   103          # Find all necessary built jar files and attach them to the environment variable deploy
   104          while read -r name; do
   105            target=$(echo "${name}" | rev | cut -d- -f1 | rev)
   106            files=$files,$name
   107            types=$types,${target##*.}
   108            classifiers=$classifiers,${target%.*}
   109          done <<<"$(find ./ -name "$artifactid-$version-*.jar")"
   110          # Find all generated provenance files and attach them the the environment variable for deploy
   111          while read -r name; do
   112            target=$(echo "${name}" | rev | cut -d- -f1 | rev)
   113            files=$files,$name
   114            types=$types",slsa"
   115            classifiers=$classifiers,${target::-9}
   116          done <<<"$(find ./ -name "$artifactid-$version-*.jar.build.slsa")"
   117          # Sign and deploy the files to the ossrh remote repository
   118          mvn validate jar:jar -Dfile=target/"${artifactid}"-"${version}".jar -Durl=https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/ -DrepositoryId=ossrh -Dfiles="${files}" -Dtypes="${types}" -Dclassifiers="${classifiers}" -DpomFile=pom.xml gpg:sign-and-deploy-file