From 5daee3c54f790ad7b0123a146b16453826357864 Mon Sep 17 00:00:00 2001 From: Sylvain Wallez Date: Mon, 10 Feb 2025 12:14:06 +0100 Subject: [PATCH 1/2] Add release CI pipeline --- .buildkite/configure_signing.sh | 25 --------- .buildkite/release_central.yaml | 14 +++++ .buildkite/{pipeline.yml => release_dra.yml} | 2 +- .ci/Dockerfile | 3 ++ .ci/configure_signing.sh | 52 ++++++++++++++++++ .ci/make.sh | 35 ++++++++++-- .ci/release_central.sh | 27 ++++++++++ .ci/{release.sh => release_dra.sh} | 0 .github/workflows/release_central.yml | 56 ++++++++++++++++++++ build.gradle.kts | 3 +- catalog-info.yaml | 38 ++++++++++++- java-client/build.gradle.kts | 16 ++++++ 12 files changed, 240 insertions(+), 31 deletions(-) delete mode 100755 .buildkite/configure_signing.sh create mode 100644 .buildkite/release_central.yaml rename .buildkite/{pipeline.yml => release_dra.yml} (83%) create mode 100755 .ci/configure_signing.sh create mode 100755 .ci/release_central.sh rename .ci/{release.sh => release_dra.sh} (100%) create mode 100644 .github/workflows/release_central.yml diff --git a/.buildkite/configure_signing.sh b/.buildkite/configure_signing.sh deleted file mode 100755 index cfdba0d07..000000000 --- a/.buildkite/configure_signing.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash - -#see https://central.sonatype.org/publish/publish-gradle/#distributing-your-public-key - -set -e - -mkdir -p /tmp -keyring_file="/tmp/keyring.gpg" - -vault kv get --field="keyring" kv/ci-shared/release-eng/team-release-secrets/elasticsearch-java/gpg | base64 -d > $keyring_file -signing_password=$(vault kv get --field="passphase" kv/ci-shared/release-eng/team-release-secrets/elasticsearch-java/gpg) -signing_key=$(vault kv get --field="key_id" kv/ci-shared/release-eng/team-release-secrets/elasticsearch-java/gpg) - -maven_username=$(vault kv get --field="username" kv/ci-shared/release-eng/team-release-secrets/elasticsearch-java/maven_central) -maven_password=$(vault kv get --field="password" kv/ci-shared/release-eng/team-release-secrets/elasticsearch-java/maven_central) - -cat > gradle.properties < $keyring_file +## NOTE: passphase is the name of the field. +signing_password=$(vault kv get --field="passphase" $vault_path/gpg) +signing_key=$(vault kv get --field="key_id" $vault_path/gpg) + +maven_username=$(vault kv get --field="username" $vault_path/maven_central) +maven_password=$(vault kv get --field="password" $vault_path/maven_central) + +cat >> gradle.properties < missing version parameter\033[0m" + exit 1 + fi + echo -e "\033[36;1mTARGET: release artefact $VERSION\033[0m" TASK=release TASK_ARGS=("$VERSION" "$output_folder") ;; @@ -159,7 +169,7 @@ if [[ "$CMD" == "assemble" ]]; then fi build_image - echo -e "\033[34;1mINFO:\033[0m Building version ${assemble_version}\033[0m" + echo -e "\033[34;1mINFO:\033[0m Building version ${assemble_version}\033[0m" docker run --rm --env VERSION=$assemble_version -u "$(id -u)" \ $git_mount $src_mount $output_mount \ $docker_image \ @@ -176,6 +186,25 @@ if [[ "$CMD" == "assemble" ]]; then fi fi +if [[ "$CMD" == "release" ]]; then + rm -rf .ci/output/repository + build_image + echo -e "\033[34;1mINFO:\033[0m Building version ${VERSION}\033[0m" + + if [[ "$DRY_RUN" = "false" ]]; then + echo "Dry run: building and publishing to the local repository" + gradle_task="java-client:publishAllPublicationsToBuildRepository" + else + echo "Releasing to Maven (pretending for now)" + gradle_task="java-client:publishAllPublicationsToBuildRepository" + #gradle_task="java-client:publishAllPublicationsToMavenCentralSnapshotRepository" + fi + docker run --rm --env VERSION=$VERSION -u "$(id -u)" \ + $git_mount $src_mount $output_mount \ + $docker_image \ + $gradle_task +fi + if [[ "$CMD" == "bump" ]]; then echo $VERSION > config/version.txt fi diff --git a/.ci/release_central.sh b/.ci/release_central.sh new file mode 100755 index 000000000..72f41fb6d --- /dev/null +++ b/.ci/release_central.sh @@ -0,0 +1,27 @@ +#!/usr/bin/env bash +# +# Licensed to Elasticsearch B.V. under one or more contributor +# license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright +# ownership. Elasticsearch B.V. licenses this file to you under +# the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +#see https://central.sonatype.org/publish/publish-gradle/#distributing-your-public-key + +set -euo pipefail + +.ci/configure_signing.sh + +.ci/make.sh release $VERSION diff --git a/.ci/release.sh b/.ci/release_dra.sh similarity index 100% rename from .ci/release.sh rename to .ci/release_dra.sh diff --git a/.github/workflows/release_central.yml b/.github/workflows/release_central.yml new file mode 100644 index 000000000..3829dcb14 --- /dev/null +++ b/.github/workflows/release_central.yml @@ -0,0 +1,56 @@ +name: "Release to Maven Central" + +on: + workflow_dispatch: + inputs: + branch: + description: "Branch or tag ref to run the workflow on" + required: true + version: + description: "The version to release. Must start with the one in config/version.txt" + required: true + dry_run: + description: Used to test other workflow steps, does not publish to Maven Central. + type: boolean + required: true + default: false + +env: + BRANCH: ${{ inputs.branch }} + VERSION: ${{ inputs.version }} + DRY_RUN: ${{ inputs.dry_run }} + +jobs: + validate-version: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} + fetch-depth: '1' + - name: Validate version + shell: bash + run: | + repo_version="$(cat config/version.txt)" + if [[ ! "$VERSION" = $repo_version* ]]; then + echo "Workflow version ($VERSION) and config/version.txt ($repo_version) do not match." + exit 1 + fi + + maven-central-deploy: + name: "Deploy to Maven Central (Buildkite)" + runs-on: ubuntu-latest + needs: + - validate-version + steps: + - id: buildkite-run + uses: elastic/oblt-actions/buildkite/run@v1 + with: + pipeline: "elasticsearch-java-release" + wait-for: true + token: ${{ secrets.BUILDKITE_TOKEN }} + branch: ${{ inputs.branch }} + env-vars: | + DRY_RUN=${{ inputs.dry_run }} + VERSION=${{ inputs.version }} diff --git a/build.gradle.kts b/build.gradle.kts index 205dc0e96..3f9418659 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -25,7 +25,8 @@ allprojects { if (System.getenv("VERSION")==null) { version = (File(project.rootDir, "config/version.txt").readText().trim() + "-SNAPSHOT") } - else if (System.getenv("VERSION").endsWith("-SNAPSHOT")) { + else if (System.getenv("VERSION").contains("-")) { + // Either SNAPSHOT or a version qualifier included in $VERSION for ad-hoc releases version = System.getenv("VERSION") } else { diff --git a/catalog-info.yaml b/catalog-info.yaml index 562e4cfdf..250fb44cb 100644 --- a/catalog-info.yaml +++ b/catalog-info.yaml @@ -21,8 +21,44 @@ spec: name: elasticsearch-java spec: repository: elastic/elasticsearch-java - pipeline_file: ".buildkite/pipeline.yml" + pipeline_file: ".buildkite/release_dra.yml" teams: devtools-team: {} everyone: access_level: READ_ONLY + + +--- +# yaml-language-server: $schema=https://gist.githubusercontent.com/elasticmachine/988b80dae436cafea07d9a4a460a011d/raw/rre.schema.json +apiVersion: backstage.io/v1alpha1 +kind: Resource +metadata: + name: buildkite-pipeline-elasticsearch-java-release + description: Buildkite Release pipeline for elasticsearch-java + links: + - title: Pipeline + url: https://buildkite.com/elastic/elasticsearch-java-release + tags: + - buildkite + - gpg-sign + - maven-central +spec: + type: buildkite-pipeline + owner: group:devtools-team + system: buildkite + implementation: + apiVersion: buildkite.elastic.dev/v1 + kind: Pipeline + metadata: + description: Elasticsearch Java Client Release + name: elasticsearch-java-release + spec: + repository: elastic/elasticsearch-java + pipeline_file: ".buildkite/release_central.yml" + provider_settings: + trigger_mode: none + teams: + devtools-team: + access_level: MANAGE_BUILD_AND_READ + everyone: + access_level: READ_ONLY diff --git a/java-client/build.gradle.kts b/java-client/build.gradle.kts index aeef67fe1..a011fb180 100644 --- a/java-client/build.gradle.kts +++ b/java-client/build.gradle.kts @@ -27,6 +27,7 @@ plugins { `java-library` checkstyle `maven-publish` + signing id("com.github.jk1.dependency-license-report") version "2.2" id("de.thetaphi.forbiddenapis") version "3.4" } @@ -115,6 +116,12 @@ tasks.withType { } } +signing { + // Only sign if a key has been configured in gradle.properties + isRequired = providers.gradleProperty("signing.keyId").isPresent + sign(publishing.publications) +} + publishing { repositories { maven { @@ -128,6 +135,15 @@ publishing { name = "Build" url = uri("${rootProject.buildDir}/repository") } + + maven { + name = "MavenCentralSnapshot" + url = uri("https://s01.oss.sonatype.org/content/repositories/snapshots/") + credentials { + username = providers.gradleProperty("ossrhUsername").getOrNull() + password = providers.gradleProperty("ossrhPassword").getOrNull() + } + } } publications { From feeb70b1263b5d2cf8e1c6ad6e5bf843ac219ea8 Mon Sep 17 00:00:00 2001 From: Sylvain Wallez Date: Mon, 10 Feb 2025 13:26:39 +0100 Subject: [PATCH 2/2] Rename DRA build pipeline to its original name --- .buildkite/{release_dra.yml => pipeline.yml} | 2 +- catalog-info.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename .buildkite/{release_dra.yml => pipeline.yml} (91%) diff --git a/.buildkite/release_dra.yml b/.buildkite/pipeline.yml similarity index 91% rename from .buildkite/release_dra.yml rename to .buildkite/pipeline.yml index 23a05a2ae..ada0fd49f 100644 --- a/.buildkite/release_dra.yml +++ b/.buildkite/pipeline.yml @@ -1,5 +1,5 @@ steps: - - label: ":java: :elasticsearch: Elasticsearch Java API client - {{matrix.workflow}}" + - label: ":java: :elasticsearch: Elasticsearch Java API client DRA - {{matrix.workflow}}" agents: provider: "gcp" branches: [ "main", "7.17", "8.17", "8.18", "8.x", "9.0" ] diff --git a/catalog-info.yaml b/catalog-info.yaml index 250fb44cb..6c1077dbc 100644 --- a/catalog-info.yaml +++ b/catalog-info.yaml @@ -21,7 +21,7 @@ spec: name: elasticsearch-java spec: repository: elastic/elasticsearch-java - pipeline_file: ".buildkite/release_dra.yml" + pipeline_file: ".buildkite/pipeline.yml" teams: devtools-team: {} everyone: