Skip to content

Commit 2c9922d

Browse files
author
Komal Yadav
committed
Add exit gate
updated
1 parent 63524d1 commit 2c9922d

File tree

2 files changed

+87
-24
lines changed

2 files changed

+87
-24
lines changed

‎.github/workflows/tag-release.yml‎

Lines changed: 14 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright © 2022 Cask Data, Inc.
1+
# Copyright © 2025 Cask Data, Inc.
22
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
33
# use this file except in compliance with the License. You may obtain a copy of
44
# the License at
@@ -26,10 +26,7 @@ jobs:
2626
uses: 'google-github-actions/get-secretmanager-secrets@v0'
2727
with:
2828
secrets: |-
29-
CDAP_OSSRH_USERNAME:cdapio-github-builds/CDAP_OSSRH_USERNAME
30-
CDAP_OSSRH_PASSWORD:cdapio-github-builds/CDAP_OSSRH_PASSWORD
31-
CDAP_GPG_PASSPHRASE:cdapio-github-builds/CDAP_GPG_PASSPHRASE
32-
CDAP_GPG_PRIVATE_KEY:cdapio-github-builds/CDAP_GPG_PRIVATE_KEY
29+
secure_publish_bucket:cdapio-github-builds/publish_bucket
3330
3431
- name: Checkout Repository
3532
uses: actions/checkout@v4
@@ -44,25 +41,18 @@ jobs:
4441
restore-keys: |
4542
${{ runner.os }}-maven-${{ github.workflow }}
4643
47-
- name: Set up GPG conf
48-
run: |
49-
echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
50-
echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
51-
52-
- name: Import GPG key
53-
run: |
54-
echo "$GPG_PRIVATE_KEY" > private.key
55-
gpg --import --batch private.key
56-
env:
57-
GPG_PRIVATE_KEY: ${{ steps.secrets.outputs.CDAP_GPG_PRIVATE_KEY }}
58-
5944
- name: Run tests
6045
run: mvn clean test -fae -T 2 -B -V -DcloudBuild -Dmaven.wagon.http.retryHandler.count=5 -Dmaven.wagon.httpconnectionManager.ttlSeconds=30
6146

62-
- name: Publish to Maven Central
63-
run: mvn clean -B -V -DskipTests deploy -P release -Dgpg.passphrase=$CDAP_GPG_PASSPHRASE -Dmaven.wagon.http.retryHandler.count=5 -Dmaven.wagon.httpconnectionManager.ttlSeconds=30
64-
env:
65-
CDAP_OSSRH_USERNAME: ${{ steps.secrets.outputs.CDAP_OSSRH_USERNAME }}
66-
CDAP_OSSRH_PASSWORD: ${{ steps.secrets.outputs.CDAP_OSSRH_PASSWORD }}
67-
CDAP_GPG_PASSPHRASE: ${{ steps.secrets.outputs.CDAP_GPG_PASSPHRASE }}
68-
MAVEN_OPTS: '-Xmx3200m'
47+
- name: 'Submit Build to Google Cloud Build'
48+
id: gcb
49+
working-directory: e2e
50+
run: |
51+
APP_VERSION=$(mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec)
52+
echo "APP_VERSION=${APP_VERSION}" >> $GITHUB_ENV
53+
54+
echo "Submitting build to Google Cloud Build for version ${APP_VERSION}, ref ${{ inputs.ref }}"
55+
gcloud builds submit . \
56+
--config=cloudbuild-release.yaml \
57+
--project='cdap-github-builds' \
58+
--substitutions="_APP_VERSION=${APP_VERSION},_SECURE_PUBLISH_BUCKET_NAME=${{ steps.gcp_secrets.outputs.secure_publish_bucket }}"

‎cloudbuild-release.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
steps:
2+
# Step 1: Build Artifacts and Generate SBOM
3+
- name: 'maven:3.8-jdk-8'
4+
id: build-and-sbom
5+
entrypoint: 'mvn'
6+
env:
7+
- 'MAVEN_OPTS=-Xmx3200m'
8+
args:
9+
- -B
10+
- -V
11+
- -DskipTests
12+
- clean
13+
- package # Build and package
14+
- -P release
15+
- org.cyclonedx:cyclonedx-maven-plugin:2.7.10:makeAggregateBom # Generate SBOM
16+
17+
# Step 2: Prepare and Stage Artifacts for Secure Publishing
18+
- name: 'gcr.io/cloud-builders/gsutil'
19+
id: stage-for-secure-publishing
20+
entrypoint: 'bash'
21+
args:
22+
- -c
23+
- |
24+
set -ex
25+
26+
# Check if substitutions are provided
27+
if [[ -z "${_SECURE_PUBLISH_BUCKET_NAME}" || "${_SECURE_PUBLISH_BUCKET_NAME}" == "YOUR_SECURE_PUBLISH_BUCKET_NAME" ]]; then
28+
echo "ERROR: _SECURE_PUBLISH_BUCKET_NAME substitution is missing or not set."
29+
exit 1
30+
fi
31+
if [[ -z "${_APP_VERSION}" ]]; then
32+
echo "ERROR: _APP_VERSION substitution is missing."
33+
exit 1
34+
fi
35+
36+
SECURE_GCS_PATH="gs://${_SECURE_PUBLISH_BUCKET_NAME}"
37+
STAGING_DIR="/workspace/secure-staging"
38+
mkdir -p "$${STAGING_DIR}"
39+
40+
echo "Gathering Maven artifacts for Secure Publishing..."
41+
# Find all relevant artifacts from the build in the root target directory
42+
find /workspace/target -maxdepth 1 -type f \( -name "*.pom" -o -name "*.jar" \) ! -name "original-*.jar" ! -name "*-tests.jar" -exec cp {} "$${STAGING_DIR}/" \;
43+
44+
# Add the aggregate SBOM if it's at the root target
45+
if [ -f /workspace/target/bom.json ]; then
46+
cp /workspace/target/bom.json "$${STAGING_DIR}/bom.json"
47+
else
48+
echo "WARNING: bom.json not found in /workspace/target"
49+
fi
50+
51+
echo "Uploading artifacts to Secure Publishing bucket: $${SECURE_GCS_PATH}"
52+
# Check if there are files to upload
53+
if [ -n "$(ls -A "$${STAGING_DIR}")" ]; then
54+
gsutil -m cp -r "$${STAGING_DIR}/." "$${SECURE_GCS_PATH}/"
55+
else
56+
echo "No artifacts found in $${STAGING_DIR} to upload."
57+
exit 1
58+
fi
59+
60+
echo "Generating manifest.json"
61+
cd "$${STAGING_DIR}"
62+
printf '{\n "artifacts": [\n' > /workspace/manifest.json
63+
# escape double quotes in file names
64+
find . -type f -exec printf ' "%s",\n' {} \; | sed 's/"/\\"/g; s/^ "\\"/ "/' | sed '$ s/,$//' >> /workspace/manifest.json
65+
printf ' ]\n}\n' >> /workspace/manifest.json
66+
cd /workspace
67+
gsutil cp /workspace/manifest.json "$${SECURE_GCS_PATH}/manifest.json"
68+
echo "Secure Publishing staging complete."
69+
70+
options:
71+
requestedVerifyOption: VERIFIED
72+
logging: CLOUD_LOGGING_ONLY
73+
machineType: 'E2_HIGHCPU_32'

0 commit comments

Comments
 (0)