ci-publish.yaml

name: Publish CI

on:
  release:
    types: [published]
  workflow_dispatch:

permissions: {}

jobs:
  build:
    permissions:
      contents: read
      id-token: write
      attestations: write
    runs-on: ubuntu-latest
    outputs:
      artifact_name: ${{ steps.release.outputs.artifact_name }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.release.tag_name || github.sha }}

      - name: Set up JDK
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: "temurin"
          java-version: |
            8
            11
            17
            25
            21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0

      - name: Resolve and validate release version
        id: release
        env:
          IS_RELEASE: ${{ github.event_name == 'release' }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          project_version="$(./gradlew -q properties --property version | sed -n 's/^version: //p')"
          if [[ -z "${project_version}" ]]; then
            echo "::error::Could not resolve the project version."
            exit 1
          fi
          if [[ "${IS_RELEASE}" == "true" ]]; then
            expected_tag="cyclonedx-gradle-plugin-${project_version}"
            if [[ "${RELEASE_TAG}" != "${expected_tag}" ]]; then
              echo "::error::Release tag '${RELEASE_TAG}' does not match project version '${project_version}' (expected '${expected_tag}')."
              exit 1
            fi
          fi
          echo "artifact_name=release-artifacts-${project_version}-${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
          echo "version=${project_version}" >> "${GITHUB_OUTPUT}"

      - name: Build release artifacts with Gradle
        run: ./gradlew build -i

      - name: Summarize release artifacts
        env:
          IS_RELEASE: ${{ github.event_name == 'release' }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
        run: |
          if [[ "${IS_RELEASE}" == "true" ]]; then
            mode="Production release"
          else
            mode="Non-publishing rehearsal"
          fi
          artifacts=(
            "build/libs/cyclonedx-gradle-plugin-${RELEASE_VERSION}.jar"
            "build/libs/cyclonedx-gradle-plugin-${RELEASE_VERSION}-sources.jar"
            "build/libs/cyclonedx-gradle-plugin-${RELEASE_VERSION}-javadoc.jar"
            "build/reports/cyclonedx-direct/cyclonedx-gradle-plugin-${RELEASE_VERSION}-cyclonedx.json"
          )
          {
            echo "## ${mode}"
            echo
            echo "- Version: \`${RELEASE_VERSION}\`"
            echo "- Commit: \`${GITHUB_SHA}\`"
            echo "- Source ref: \`${GITHUB_REF}\`"
            echo
            echo "| Artifact | SHA-256 |"
            echo "| --- | --- |"
            for artifact in "${artifacts[@]}"; do
              digest="$(sha256sum "${artifact}" | cut -d ' ' -f 1)"
              echo "| \`${artifact}\` | \`${digest}\` |"
            done
          } >> "${GITHUB_STEP_SUMMARY}"

      - name: Attest release provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: |
            build/libs/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}.jar
            build/libs/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}-sources.jar
            build/libs/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}-javadoc.jar
            build/reports/cyclonedx-direct/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}-cyclonedx.json

      - name: Attest implementation SBOM
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: build/libs/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}.jar
          sbom-path: build/reports/cyclonedx-direct/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}-cyclonedx.json

      - name: Verify release attestations
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
        run: |
          implementation_jar="build/libs/cyclonedx-gradle-plugin-${RELEASE_VERSION}.jar"
          release_sbom="build/reports/cyclonedx-direct/cyclonedx-gradle-plugin-${RELEASE_VERSION}-cyclonedx.json"
          artifacts=(
            "${implementation_jar}"
            "build/libs/cyclonedx-gradle-plugin-${RELEASE_VERSION}-sources.jar"
            "build/libs/cyclonedx-gradle-plugin-${RELEASE_VERSION}-javadoc.jar"
            "${release_sbom}"
          )
          for artifact in "${artifacts[@]}"; do
            gh attestation verify "${artifact}" \
              --repo "${GITHUB_REPOSITORY}" \
              --signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/ci-publish.yaml" \
              --source-ref "${GITHUB_REF}" \
              --source-digest "${GITHUB_SHA}" \
              --deny-self-hosted-runners
          done
          gh attestation verify "${implementation_jar}" \
            --repo "${GITHUB_REPOSITORY}" \
            --signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/ci-publish.yaml" \
            --source-ref "${GITHUB_REF}" \
            --source-digest "${GITHUB_SHA}" \
            --deny-self-hosted-runners \
            --predicate-type "https://cyclonedx.org/bom"

      - name: Upload release artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.release.outputs.artifact_name }}
          if-no-files-found: error
          path: |
            build/libs/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}.jar
            build/libs/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}-sources.jar
            build/libs/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}-javadoc.jar
            build/reports/cyclonedx-direct/cyclonedx-gradle-plugin-${{ steps.release.outputs.version }}-cyclonedx.json

      - name: Publish to Gradle portal
        if: github.event_name == 'release'
        env:
          GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
          GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
        run: ./gradlew publishPlugins

  publish-release-sbom:
    if: github.event_name == 'release'
    needs: build
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.build.outputs.artifact_name }}
          path: release-artifacts

      - name: Publish SBOM to GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          RELEASE_VERSION: ${{ needs.build.outputs.version }}
        run: |
          mapfile -t release_sboms < <(
            find release-artifacts -type f \
              -name "cyclonedx-gradle-plugin-${RELEASE_VERSION}-cyclonedx.json"
          )
          if [[ "${#release_sboms[@]}" -ne 1 ]]; then
            echo "::error::Expected one release SBOM, found ${#release_sboms[@]}."
            exit 1
          fi
          gh release upload "${RELEASE_TAG}" "${release_sboms[0]}" --repo "${GITHUB_REPOSITORY}" --clobber