Skip to content

Commit ab9a839

Browse files
swallezl-trotta
swallez
and
l-trotta
authored
Add release CI pipeline (#934)
* Add release CI pipeline * Rename DRA build pipeline to its original name --------- Co-authored-by: Laura Trotta <153528055+l-trotta@users.noreply.github.com>
1 parent c1da668 commit ab9a839

File tree

12 files changed

+240
-31
lines changed

12 files changed

+240
-31
lines changed

‎.buildkite/configure_signing.sh

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎.buildkite/pipeline.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
steps:
2-
- label: ":java: :elasticsearch: Elasticsearch Java API client - {{matrix.workflow}}"
2+
- label: ":java: :elasticsearch: Elasticsearch Java API client DRA - {{matrix.workflow}}"
33
agents:
44
provider: "gcp"
55
branches: [ "main", "7.17", "8.17", "8.18", "8.x", "9.0" ]
@@ -8,4 +8,4 @@ steps:
88
workflow:
99
- "snapshot"
1010
- "staging"
11-
command: ".ci/release.sh {{matrix.workflow}}"
11+
command: ".ci/release_dra.sh {{matrix.workflow}}"

‎.buildkite/release_central.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
agents:
2+
provider: "gcp"
3+
4+
steps:
5+
- label: ":java: :elasticsearch: Elasticsearch Java API client - Release"
6+
key: "release"
7+
command: ".ci/release_central.sh"
8+
artifact_paths:
9+
- ".ci/output/repository/**/*"
10+
11+
#notify:
12+
# - slack: "#devtools-notify"
13+
# # skip slack messages if no failures and dry-run mode
14+
# if: 'build.state != "passed" && build.env("dry_run") == "false"'

‎.ci/Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,9 @@ COPY --chown=$BUILDER_UID:$BUILDER_GID config ./config/
5050
COPY --chown=$BUILDER_UID:$BUILDER_GID java-client/build.gradle.kts ./java-client/
5151
RUN ./gradlew resolveDependencies
5252

53+
# Note: trailing '*' avoids failing if the file doesn't exist
54+
COPY --chown=$BUILDER_UID:$BUILDER_GID gradle.properties* ./
55+
5356
# Build artifacts. Expects these mounted directories:
5457
# /elasticsearch-java/.git - git index (read-only)
5558
# /elasticsearch-java/java-client/src - source files (read-only)

‎.ci/configure_signing.sh

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/usr/bin/env bash
2+
3+
#
4+
# Licensed to Elasticsearch B.V. under one or more contributor
5+
# license agreements. See the NOTICE file distributed with
6+
# this work for additional information regarding copyright
7+
# ownership. Elasticsearch B.V. licenses this file to you under
8+
# the Apache License, Version 2.0 (the "License"); you may
9+
# not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing,
15+
# software distributed under the License is distributed on an
16+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
17+
# KIND, either express or implied. See the License for the
18+
# specific language governing permissions and limitations
19+
# under the License.
20+
#
21+
22+
#see https://central.sonatype.org/publish/publish-gradle/#distributing-your-public-key
23+
24+
set -euo pipefail
25+
26+
if grep -sq "signing.keyId" gradle.properties; then
27+
# Keys already present
28+
exit 0
29+
fi
30+
31+
mkdir -p /tmp
32+
keyring_file="/tmp/keyring.gpg"
33+
34+
vault_path="kv/ci-shared/release-eng/team-release-secrets/elasticsearch-java"
35+
36+
vault kv get --field="keyring" $vault_path/gpg | base64 -d > $keyring_file
37+
## NOTE: passphase is the name of the field.
38+
signing_password=$(vault kv get --field="passphase" $vault_path/gpg)
39+
signing_key=$(vault kv get --field="key_id" $vault_path/gpg)
40+
41+
maven_username=$(vault kv get --field="username" $vault_path/maven_central)
42+
maven_password=$(vault kv get --field="password" $vault_path/maven_central)
43+
44+
cat >> gradle.properties <<EOF
45+
signing.keyId=${signing_key: -8}
46+
signing.password=${signing_password}
47+
signing.secretKeyRingFile=${keyring_file}
48+
49+
ossrhUsername=${maven_username}
50+
ossrhPassword=${maven_password}
51+
EOF
52+

‎.ci/make.sh

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,9 @@
4242
# Bootstrap
4343
# ------------------------------------------------------- #
4444

45-
script_path=$(dirname "$(realpath -s "$0")")
45+
set -euo pipefail
46+
47+
script_path=$(dirname "$(realpath "$0")")
4648
repo=$(realpath "$script_path/../")
4749

4850
# shellcheck disable=SC1090
@@ -51,7 +53,6 @@ TASK=$1
5153
TASK_ARGS=()
5254
VERSION=$2
5355
STACK_VERSION=$VERSION
54-
set -euo pipefail
5556

5657
product="elastic/elasticsearch-java"
5758
output_folder=".ci/output"
@@ -81,6 +82,15 @@ case $CMD in
8182
exit 1
8283
fi
8384
echo -e "\033[36;1mTARGET: assemble artefact $VERSION\033[0m"
85+
TASK=assemble
86+
TASK_ARGS=("$VERSION" "$output_folder")
87+
;;
88+
release)
89+
if [ -z "$VERSION" ]; then
90+
echo -e "\033[31;1mTARGET: release -> missing version parameter\033[0m"
91+
exit 1
92+
fi
93+
echo -e "\033[36;1mTARGET: release artefact $VERSION\033[0m"
8494
TASK=release
8595
TASK_ARGS=("$VERSION" "$output_folder")
8696
;;
@@ -159,7 +169,7 @@ if [[ "$CMD" == "assemble" ]]; then
159169
fi
160170

161171
build_image
162-
echo -e "\033[34;1mINFO:\033[0m Building version ${assemble_version}\033[0m"
172+
echo -e "\033[34;1mINFO:\033[0m Building version ${assemble_version}\033[0m"
163173
docker run --rm --env VERSION=$assemble_version -u "$(id -u)" \
164174
$git_mount $src_mount $output_mount \
165175
$docker_image \
@@ -176,6 +186,25 @@ if [[ "$CMD" == "assemble" ]]; then
176186
fi
177187
fi
178188

189+
if [[ "$CMD" == "release" ]]; then
190+
rm -rf .ci/output/repository
191+
build_image
192+
echo -e "\033[34;1mINFO:\033[0m Building version ${VERSION}\033[0m"
193+
194+
if [[ "$DRY_RUN" = "false" ]]; then
195+
echo "Dry run: building and publishing to the local repository"
196+
gradle_task="java-client:publishAllPublicationsToBuildRepository"
197+
else
198+
echo "Releasing to Maven (pretending for now)"
199+
gradle_task="java-client:publishAllPublicationsToBuildRepository"
200+
#gradle_task="java-client:publishAllPublicationsToMavenCentralSnapshotRepository"
201+
fi
202+
docker run --rm --env VERSION=$VERSION -u "$(id -u)" \
203+
$git_mount $src_mount $output_mount \
204+
$docker_image \
205+
$gradle_task
206+
fi
207+
179208
if [[ "$CMD" == "bump" ]]; then
180209
echo $VERSION > config/version.txt
181210
fi

‎.ci/release_central.sh

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Licensed to Elasticsearch B.V. under one or more contributor
4+
# license agreements. See the NOTICE file distributed with
5+
# this work for additional information regarding copyright
6+
# ownership. Elasticsearch B.V. licenses this file to you under
7+
# the Apache License, Version 2.0 (the "License"); you may
8+
# not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing,
14+
# software distributed under the License is distributed on an
15+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
# KIND, either express or implied. See the License for the
17+
# specific language governing permissions and limitations
18+
# under the License.
19+
#
20+
21+
#see https://central.sonatype.org/publish/publish-gradle/#distributing-your-public-key
22+
23+
set -euo pipefail
24+
25+
.ci/configure_signing.sh
26+
27+
.ci/make.sh release $VERSION

‎.ci/release.sh renamed to ‎.ci/release_dra.sh

File renamed without changes.

‎.github/workflows/release_central.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: "Release to Maven Central"
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
branch:
7+
description: "Branch or tag ref to run the workflow on"
8+
required: true
9+
version:
10+
description: "The version to release. Must start with the one in config/version.txt"
11+
required: true
12+
dry_run:
13+
description: Used to test other workflow steps, does not publish to Maven Central.
14+
type: boolean
15+
required: true
16+
default: false
17+
18+
env:
19+
BRANCH: ${{ inputs.branch }}
20+
VERSION: ${{ inputs.version }}
21+
DRY_RUN: ${{ inputs.dry_run }}
22+
23+
jobs:
24+
validate-version:
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v4
29+
with:
30+
ref: ${{ inputs.ref }}
31+
fetch-depth: '1'
32+
- name: Validate version
33+
shell: bash
34+
run: |
35+
repo_version="$(cat config/version.txt)"
36+
if [[ ! "$VERSION" = $repo_version* ]]; then
37+
echo "Workflow version ($VERSION) and config/version.txt ($repo_version) do not match."
38+
exit 1
39+
fi
40+
41+
maven-central-deploy:
42+
name: "Deploy to Maven Central (Buildkite)"
43+
runs-on: ubuntu-latest
44+
needs:
45+
- validate-version
46+
steps:
47+
- id: buildkite-run
48+
uses: elastic/oblt-actions/buildkite/run@v1
49+
with:
50+
pipeline: "elasticsearch-java-release"
51+
wait-for: true
52+
token: ${{ secrets.BUILDKITE_TOKEN }}
53+
branch: ${{ inputs.branch }}
54+
env-vars: |
55+
DRY_RUN=${{ inputs.dry_run }}
56+
VERSION=${{ inputs.version }}

‎build.gradle.kts

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ allprojects {
2525
if (System.getenv("VERSION")==null) {
2626
version = (File(project.rootDir, "config/version.txt").readText().trim() + "-SNAPSHOT")
2727
}
28-
else if (System.getenv("VERSION").endsWith("-SNAPSHOT")) {
28+
else if (System.getenv("VERSION").contains("-")) {
29+
// Either SNAPSHOT or a version qualifier included in $VERSION for ad-hoc releases
2930
version = System.getenv("VERSION")
3031
}
3132
else {

‎catalog-info.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,39 @@ spec:
2626
devtools-team: {}
2727
everyone:
2828
access_level: READ_ONLY
29+
30+
31+
---
32+
# yaml-language-server: $schema=https://gist.githubusercontent.com/elasticmachine/988b80dae436cafea07d9a4a460a011d/raw/rre.schema.json
33+
apiVersion: backstage.io/v1alpha1
34+
kind: Resource
35+
metadata:
36+
name: buildkite-pipeline-elasticsearch-java-release
37+
description: Buildkite Release pipeline for elasticsearch-java
38+
links:
39+
- title: Pipeline
40+
url: https://buildkite.com/elastic/elasticsearch-java-release
41+
tags:
42+
- buildkite
43+
- gpg-sign
44+
- maven-central
45+
spec:
46+
type: buildkite-pipeline
47+
owner: group:devtools-team
48+
system: buildkite
49+
implementation:
50+
apiVersion: buildkite.elastic.dev/v1
51+
kind: Pipeline
52+
metadata:
53+
description: Elasticsearch Java Client Release
54+
name: elasticsearch-java-release
55+
spec:
56+
repository: elastic/elasticsearch-java
57+
pipeline_file: ".buildkite/release_central.yml"
58+
provider_settings:
59+
trigger_mode: none
60+
teams:
61+
devtools-team:
62+
access_level: MANAGE_BUILD_AND_READ
63+
everyone:
64+
access_level: READ_ONLY

‎java-client/build.gradle.kts

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ plugins {
2727
`java-library`
2828
checkstyle
2929
`maven-publish`
30+
signing
3031
id("com.github.jk1.dependency-license-report") version "2.2"
3132
id("de.thetaphi.forbiddenapis") version "3.4"
3233
}
@@ -115,6 +116,12 @@ tasks.withType<Javadoc> {
115116
}
116117
}
117118

119+
signing {
120+
// Only sign if a key has been configured in gradle.properties
121+
isRequired = providers.gradleProperty("signing.keyId").isPresent
122+
sign(publishing.publications)
123+
}
124+
118125
publishing {
119126
repositories {
120127
maven {
@@ -128,6 +135,15 @@ publishing {
128135
name = "Build"
129136
url = uri("${rootProject.buildDir}/repository")
130137
}
138+
139+
maven {
140+
name = "MavenCentralSnapshot"
141+
url = uri("https://s01.oss.sonatype.org/content/repositories/snapshots/")
142+
credentials {
143+
username = providers.gradleProperty("ossrhUsername").getOrNull()
144+
password = providers.gradleProperty("ossrhPassword").getOrNull()
145+
}
146+
}
131147
}
132148

133149
publications {

0 commit comments

Comments
 (0)