Skip to content

Commit 9c213fb

Browse files
alithegalitheg
committed
Fix name of workflow
1 parent 82c0d88 commit 9c213fb

1 file changed

Lines changed: 300 additions & 0 deletions

File tree

‎.github/workflows/distribute-maven.yml‎

Lines changed: 300 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,300 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
name: Distribute from ATR to RAO Maven Staging
19+
run-name: "${{ inputs.atr-id }}"
20+
21+
on:
22+
workflow_dispatch:
23+
inputs:
24+
atr-id:
25+
description: 'Run ID (from ATR)'
26+
required: true
27+
asf-uid:
28+
description: 'Originating user ID'
29+
required: true
30+
project:
31+
description: 'Project in ATR to pull files from'
32+
required: true
33+
version:
34+
description: 'Version in ATR to pull files from'
35+
required: true
36+
phase:
37+
description: 'Expected release phase in ATR'
38+
required: true
39+
distribution-owner-namespace:
40+
description: "Owner namespace"
41+
required: true
42+
distribution-package:
43+
description: 'Package/project name in ATR'
44+
required: true
45+
distribution-version:
46+
description: 'Distribution version'
47+
required: true
48+
atr-host:
49+
description: 'ATR host (for testing purposes)'
50+
required: false
51+
default: 'release-test.apache.org'
52+
ssh-port:
53+
description: 'SSH port for ATR (for testing purposes)'
54+
required: false
55+
default: '2222'
56+
57+
jobs:
58+
distribute:
59+
permissions:
60+
id-token: write
61+
contents: read
62+
runs-on: ubuntu-latest
63+
env:
64+
ATR_HOST: ${{ inputs.atr-host }}
65+
SSH_PORT: ${{ inputs.ssh-port }}
66+
WORKFLOW: distribute-maven.yml
67+
NJORD_STORE: atr-deployment-${{ inputs.distribution-package }}-${{ inputs.distribution-version }}
68+
RAO_USERNAME: ${{ secrets.RAO_USERNAME }}
69+
RAO_PASSWORD: ${{ secrets.RAO_PASSWORD }}
70+
TAG_NAME: "${{ inputs.distribution-owner-namespace }}-${{ inputs.distribution-package }}-${{ inputs.distribution-version }}"
71+
steps:
72+
- name: Sleep for 5 seconds
73+
run: sleep 5s
74+
shell: bash
75+
- name: Create settings.xml
76+
run: |
77+
mkdir -p ~/.m2
78+
cat > ~/.m2/settings.xml << EOF
79+
<?xml version="1.0" encoding="UTF-8"?>
80+
<settings>
81+
<pluginGroups>
82+
<pluginGroup>eu.maveniverse.maven.plugins</pluginGroup>
83+
</pluginGroups>
84+
<servers>
85+
<server>
86+
<id>rao3</id>
87+
<username>${RAO_USERNAME}</username>
88+
<password>${RAO_PASSWORD}</password>
89+
<configuration>
90+
<njord.publisher>sonatype-nx3</njord.publisher>
91+
<njord.publisher.sonatype-nx3.baseUrl>https://repository.apache.org:4443/</njord.publisher.sonatype-nx3.baseUrl>
92+
</configuration>
93+
</server>
94+
</servers>
95+
</settings>
96+
EOF
97+
98+
- name: Set up JDK 17
99+
uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e
100+
with:
101+
java-version: '17'
102+
distribution: 'temurin'
103+
overwrite-settings: false
104+
- name: Set up Maven 3.9+
105+
uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1
106+
with:
107+
maven-version: 3.9.12
108+
109+
- name: Create a GitHub OIDC JWT
110+
id: create-github-jwt
111+
shell: bash
112+
run: |
113+
set -euo pipefail
114+
url="${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=atr-test-v1"
115+
jwt="$(curl -sS --fail-with-body -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "$url" | jq -r .value)"
116+
echo "::add-mask::$jwt"
117+
echo "jwt=$jwt" >> "$GITHUB_OUTPUT"
118+
119+
- name: Generate an ephemeral SSH key
120+
id: generate-ssh-key
121+
shell: bash
122+
run: |
123+
set -euxo pipefail
124+
ssh-keygen -t ed25519 -N "" -f "$RUNNER_TEMP/ssh_key"
125+
echo "ssh_private_key_path=$RUNNER_TEMP/ssh_key" >> "$GITHUB_OUTPUT"
126+
echo "ssh_public_key=$(cat "$RUNNER_TEMP/ssh_key.pub")" >> "$GITHUB_OUTPUT"
127+
128+
- name: Register the ephemeral SSH key with ATR
129+
shell: bash
130+
run: |
131+
set -euxo pipefail
132+
case "${ATR_HOST}" in
133+
*.apache.org) ;;
134+
*) echo "atr-host must match *.apache.org"; exit 1;;
135+
esac
136+
jq -n --arg publisher github \
137+
--arg jwt "$JWT" \
138+
--arg key "$SSH_PUBLIC_KEY" \
139+
--arg uid "$INPUTS_ASF_UID" \
140+
--arg phase "$INPUTS_PHASE" \
141+
--arg project_name "$INPUTS_PROJECT" \
142+
--arg version "$INPUTS_VERSION" \
143+
'{publisher:$publisher, jwt:$jwt, ssh_key:$key, asf_uid:$uid, project_name:$project_name, phase:$phase, version:$version}' |
144+
curl -sS --fail-with-body -X POST -H 'Content-Type: application/json' -d @- \
145+
"https://${ATR_HOST}/api/distribute/ssh/register"
146+
env:
147+
JWT: ${{ steps.create-github-jwt.outputs.jwt }}
148+
SSH_PUBLIC_KEY: ${{ steps.generate-ssh-key.outputs.ssh_public_key }}
149+
INPUTS_PROJECT: ${{ inputs.project }}
150+
INPUTS_VERSION: ${{ inputs.version }}
151+
INPUTS_PHASE: ${{ inputs.phase }}
152+
INPUTS_ASF_UID: ${{ inputs.asf-uid }}
153+
154+
- name: Report status back to ATR
155+
shell: bash
156+
run: |
157+
set -euxo pipefail
158+
jq -n --arg publisher github \
159+
--arg jwt "$JWT" \
160+
--arg workflow "$WORKFLOW" \
161+
--arg run_id $RUN_ID \
162+
--arg project_name "$INPUTS_PROJECT" \
163+
'{publisher:$publisher, jwt:$jwt, workflow:$workflow, run_id:$run_id, project_name:$project_name, status:"in_progress", message:"Compiling distribution"}' |
164+
curl -sS --fail-with-body -X POST -H 'Content-Type: application/json' -d @- \
165+
"https://${ATR_HOST}/api/distribute/task/status"
166+
env:
167+
JWT: ${{ steps.create-github-jwt.outputs.jwt }}
168+
RUN_ID: ${{ github.run_id }}
169+
INPUTS_PROJECT: ${{ inputs.project }}
170+
171+
- name: Download from ATR using rsync
172+
shell: bash
173+
run: |
174+
set -euxo pipefail
175+
if ! [[ "${SSH_PORT}" =~ ^[0-9]+$ ]]
176+
then
177+
echo "::error::ssh-port must be an integer"
178+
exit 1
179+
fi
180+
: "${INPUTS_DISTRIBUTION_PACKAGE:?package is required}"
181+
: "${INPUTS_VERSION:?version is required}"
182+
command -v rsync > /dev/null || { sudo apt-get update -y && sudo apt-get install -y rsync; }
183+
mkdir stg
184+
rsync -av \
185+
-e "ssh -p 2222 -i $SSH_PRIVATE_KEY_PATH -o StrictHostKeyChecking=accept-new" \
186+
-- \
187+
"github@${ATR_HOST}:/${INPUTS_PROJECT}/${INPUTS_VERSION}/maven/" ./stg/
188+
env:
189+
INPUTS_PROJECT: ${{ inputs.project }}
190+
INPUTS_VERSION: ${{ inputs.version }}
191+
INPUTS_DISTRIBUTION_OWNER_NAMESPACE: ${{ inputs.distribution-owner-namespace }}
192+
INPUTS_DISTRIBUTION_PACKAGE: ${{ inputs.distribution-package }}
193+
# INPUTS_DETAILS: ${{ inputs.details }}
194+
SSH_PRIVATE_KEY_PATH: ${{ steps.generate-ssh-key.outputs.ssh_private_key_path }}
195+
196+
- name: Get store ID and publish
197+
shell: bash
198+
run: |
199+
set -euxo pipefail
200+
echo "Importing Njord bundle"
201+
NJORD_STORE=$(mvn njord:import-all -Dnjord.dir=./stg | sed -En 's/.*Imported to (.+) staged.*/\1/p')
202+
echo "Validating store: $NJORD_STORE"
203+
mvn njord:validate -Dnjord.store=$NJORD_STORE -Dnjord.publisher=sonatype-cp -Dnjord.details=true -q | sed -n '/Central Requirements/,/ArtifactStore.*failed validation/{/ArtifactStore.*failed validation/!s/^\[ERROR\] *//p}' | tee .err
204+
echo "Publishing store: $NJORD_STORE"
205+
mvn njord:publish -Dnjord.store=$NJORD_STORE
206+
mvn njord:drop -Dnjord.store=$NJORD_STORE
207+
env:
208+
INPUTS_DISTRIBUTION_OWNER_NAMESPACE: ${{ inputs.distribution-owner-namespace }}
209+
INPUTS_DISTRIBUTION_PACKAGE: ${{ inputs.distribution-package }}
210+
INPUTS_DISTRIBUTION_VERSION: ${{ inputs.distribution-version }}
211+
212+
- name: Report status back to ATR
213+
shell: bash
214+
run: |
215+
set -euxo pipefail
216+
jq -n --arg publisher github \
217+
--arg jwt "$JWT" \
218+
--arg workflow "$WORKFLOW" \
219+
--arg run_id $RUN_ID \
220+
--arg project_name "$INPUTS_PROJECT" \
221+
'{publisher:$publisher, jwt:$jwt, workflow:$workflow, run_id:$run_id, project_name:$project_name, status:"in_progress", message:"Recording distribution"}' |
222+
curl -sS --fail-with-body -X POST -H 'Content-Type: application/json' -d @- \
223+
"https://${ATR_HOST}/api/distribute/task/status"
224+
env:
225+
JWT: ${{ steps.create-github-jwt.outputs.jwt }}
226+
RUN_ID: ${{ github.run_id }}
227+
INPUTS_PROJECT: ${{ inputs.project }}
228+
229+
- name: Record distribution on ATR
230+
shell: bash
231+
run: |
232+
set -euxo pipefail
233+
DETAILS_JSON=false
234+
[ "${INPUTS_DETAILS}" = "true" ] && DETAILS_JSON=true
235+
jq -n --arg publisher github \
236+
--arg jwt "$JWT" \
237+
--arg uid "$INPUTS_ASF_UID" \
238+
--arg project "$INPUTS_PROJECT" \
239+
--arg version "$INPUTS_VERSION" \
240+
--arg phase "$INPUTS_PHASE" \
241+
--arg platform "MAVEN" \
242+
--arg distribution_owner_namespace "$INPUTS_DISTRIBUTION_OWNER_NAMESPACE" \
243+
--arg distribution_package "$INPUTS_DISTRIBUTION_PACKAGE" \
244+
--arg distribution_version "$INPUTS_DISTRIBUTION_VERSION" \
245+
--argjson details "$DETAILS_JSON" \
246+
'{publisher:$publisher, jwt:$jwt, asf_uid:$uid, project:$project, version:$version, phase:$phase, platform:$platform, distribution_owner_namespace:$distribution_owner_namespace, distribution_package:$distribution_package, distribution_version:$distribution_version, staging:false, details:$details}' |
247+
curl -sS --fail-with-body -X POST -H 'Content-Type: application/json' -d @- \
248+
"https://${ATR_HOST}/api/distribute/record_from_workflow"
249+
env:
250+
INPUTS_PROJECT: ${{ inputs.project }}
251+
INPUTS_VERSION: ${{ inputs.version }}
252+
INPUTS_PHASE: ${{ inputs.phase }}
253+
INPUTS_ASF_UID: ${{ inputs.asf-uid }}
254+
INPUTS_DISTRIBUTION_OWNER_NAMESPACE: ${{ inputs.distribution-owner-namespace }}
255+
INPUTS_DISTRIBUTION_PACKAGE: ${{ inputs.distribution-package }}
256+
INPUTS_DISTRIBUTION_VERSION: ${{ inputs.distribution-version }}
257+
INPUTS_DETAILS: "false"
258+
JWT: ${{ steps.create-github-jwt.outputs.jwt }}
259+
260+
- name: Report status back to ATR
261+
shell: bash
262+
if: failure()
263+
run: |
264+
set -euxo pipefail
265+
jq -n --arg publisher github \
266+
--arg jwt "$JWT" \
267+
--arg workflow "$WORKFLOW" \
268+
--arg run_id $RUN_ID \
269+
--arg project_name "$INPUTS_PROJECT" \
270+
--arg err "$([ -f .err ] && [ -s .err ] && echo "Build failed: $(cat .err)" || echo "Github workflow failed")" \
271+
--arg status "failed" \
272+
'{publisher:$publisher, jwt:$jwt, workflow:$workflow, run_id:$run_id, project_name:$project_name, status:$status, message:$err}' |
273+
curl -sS --fail-with-body -X POST -H 'Content-Type: application/json' -d @- \
274+
"https://${ATR_HOST}/api/distribute/task/status"
275+
env:
276+
JWT: ${{ steps.create-github-jwt.outputs.jwt }}
277+
RUN_ID: ${{ github.run_id }}
278+
STATUS: ${{ job.status }}
279+
INPUTS_PROJECT: ${{ inputs.project }}
280+
281+
282+
- name: Report status back to ATR
283+
shell: bash
284+
if: success()
285+
run: |
286+
set -euxo pipefail
287+
jq -n --arg publisher github \
288+
--arg jwt "$JWT" \
289+
--arg workflow "$WORKFLOW" \
290+
--arg run_id $RUN_ID \
291+
--arg project_name "$INPUTS_PROJECT" \
292+
--arg status "success" \
293+
'{publisher:$publisher, jwt:$jwt, workflow:$workflow, run_id:$run_id, project_name:$project_name, status:$status, message:"GitHub workflow succeeded"}' |
294+
curl -sS --fail-with-body -X POST -H 'Content-Type: application/json' -d @- \
295+
"https://${ATR_HOST}/api/distribute/task/status"
296+
env:
297+
JWT: ${{ steps.create-github-jwt.outputs.jwt }}
298+
RUN_ID: ${{ github.run_id }}
299+
STATUS: ${{ job.status }}
300+
INPUTS_PROJECT: ${{ inputs.project }}

0 commit comments

Comments
 (0)