[skip ci] attempting to fix secret resolution

Author: jdaugherty

.github/workflows/release.yml

@@ -1,7 +1,7 @@
 name: Release
 on:
   release:
-    types: [published]
+    types: [ published ]
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   JAVA_VERSION: '17.0.15' # this must be a specific version for reproducible builds
@@ -49,13 +49,18 @@ jobs:
         uses: grails/github-actions/pre-release@asf
         env:
           RELEASE_VERSION: ${{ steps.release_version.outputs.value }}
-      - name: "🧩 Run Assemble"
-        id: assemble
-        run: ./gradlew -U assemble
       - name: "🔐 Generate key file for artifact signing"
         env:
           SECRING_FILE: ${{ secrets.SECRING_FILE }}
         run: echo $SECRING_FILE | base64 -d > ${{ github.workspace }}/secring.gpg
+      - name: "🧩 Run Assemble"
+        id: assemble
+        run: |
+          ./gradlew -U assemble -Psigning.secretKeyRingFile=${{ github.workspace }}/secring.gpg
+        env:
+          GRAILS_PUBLISH_RELEASE: 'true'
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
       - name: "📤 Publish to Maven Central"
         env:
           GRAILS_PUBLISH_RELEASE: 'true'

build.gradle

@@ -1,3 +1,7 @@
+import java.time.Instant
+import java.time.ZoneOffset
+import java.time.format.DateTimeFormatter
+
 version = projectVersion
 group = 'org.grails.plugins'
 
@@ -17,6 +21,16 @@ repositories {
     }
 }
 
+ext {
+    buildInstant = java.util.Optional.ofNullable(System.getenv("SOURCE_DATE_EPOCH"))
+            .filter(s -> !s.isEmpty())
+            .map(Long::parseLong)
+            .map(Instant::ofEpochSecond)
+            .orElseGet(Instant::now)
+    formattedBuildDate = DateTimeFormatter.ISO_INSTANT.format(buildInstant)
+    buildDate = (buildInstant as Instant).atZone(ZoneOffset.UTC) // for reproducible builds
+}
+
 dependencies {
 
     compileOnly platform("org.apache.grails:grails-bom:$grailsVersion")

settings.gradle

@@ -5,23 +5,29 @@ plugins {
 
 def isCI = System.getenv().containsKey('CI')
 def isLocal = !isCI
-def isAuthenticated = System.getenv().containsKey('DEVELOCITY_ACCESS_KEY')
+def isReproducibleBuild = System.getenv('SOURCE_DATE_EPOCH') != null
+if (isReproducibleBuild) {
+    gradle.settingsEvaluated {
+        logger.warn('*************** Remote Build Cache Disabled due to Reproducible Build ********************')
+        logger.warn("Build date will be set to (SOURCE_DATE_EPOCH=${System.getenv("SOURCE_DATE_EPOCH")})")
+    }
+}
 
 develocity {
     server = 'https://ge.grails.org'
     buildScan {
         tag('grails-plugins')
         tag('grails-mail')
-        publishing.onlyIf { isAuthenticated }
+        publishing.onlyIf { it.authenticated }
         uploadInBackground = isLocal
     }
 }
 
 buildCache {
-    local { enabled = isLocal }
+    local { enabled = (isLocal && !isReproducibleBuild) || (isCI && isReproducibleBuild) }
     remote(develocity.buildCache) {
-        push = isCI && isAuthenticated
-        enabled = true
+        push = isCI
+        enabled = !isReproducibleBuild
     }
 }