Repository navigation

Build with '-Prelease' (Run) #3

Workflow file for this run

.github/workflows/build-with-release-profile-run.yml at 45c6be6

	name: Build with '-Prelease' (Run)

	# Workflow_run job for release profile build verification.
	# This workflow has access to secrets and runs the actual build.
	# Triggered by build-with-release-profile.yml completion.
	# See: https://securitylab.github.com/research/github-actions-preventing-pwn-requests

	on:
	workflow_run:
	workflows: ["Build with '-Prelease' (Trigger)"]
	types:
	- completed

	permissions: {}

	jobs:
	build:
	# Only run for successful trigger workflow from main repository
	if: >
	github.event.workflow_run.conclusion == 'success' &&
	github.event.workflow_run.repository.full_name == 'a2aproject/a2a-java' &&
	(
	(github.event.workflow_run.event == 'push' &&
	contains(fromJSON('["main", "0.3.x"]'), github.event.workflow_run.head_branch)) \|\|
	github.event.workflow_run.event == 'workflow_dispatch' \|\|
	contains(fromJSON('["kkhan", "jmesnil", "ehsavoie", "maeste"]'), github.event.workflow_run.actor.login)
	)
	runs-on: ubuntu-latest
	permissions:
	contents: read
	actions: read # Required to download artifacts
	statuses: write # Required to report status back to PR

	steps:
	- name: Download PR info
	uses: actions/download-artifact@v8
	with:
	name: pr-info
	github-token: ${{ github.token }}
	run-id: ${{ github.event.workflow_run.id }}

	- name: Extract PR info
	id: pr_info
	run: \|
	if [ -f pr_number ]; then
	PR_NUMBER=$(cat pr_number)
	echo "pr_number=${PR_NUMBER}" >> $GITHUB_OUTPUT
	echo "PR Number: ${PR_NUMBER}"
	else
	echo "No PR number (push event)"
	fi

	PR_SHA=$(cat pr_sha)
	echo "pr_sha=${PR_SHA}" >> $GITHUB_OUTPUT
	echo "PR SHA: ${PR_SHA}"

	PR_REF=$(cat pr_ref)
	echo "pr_ref=${PR_REF}" >> $GITHUB_OUTPUT
	echo "PR Ref: ${PR_REF}"

	- name: Report pending status to PR
	if: steps.pr_info.outputs.pr_sha
	uses: actions/github-script@v9
	with:
	script: \|
	await github.rest.repos.createCommitStatus({
	owner: context.repo.owner,
	repo: context.repo.repo,
	sha: '${{ steps.pr_info.outputs.pr_sha }}',
	state: 'pending',
	context: 'Build with -Prelease',
	description: 'Building with release profile...',
	target_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
	});

	- name: Checkout PR code
	uses: actions/checkout@v7
	with:
	ref: ${{ steps.pr_info.outputs.pr_sha }}
	# Safe: the job-level if condition restricts this to allow-listed actors
	# and protected branch pushes. This file is always loaded from the default
	# branch, so fork PRs cannot modify the allow-list.
	allow-unsafe-pr-checkout: true

	- name: Set up JDK 17
	uses: actions/setup-java@v5
	with:
	java-version: '17'
	distribution: 'temurin'
	cache: maven

	# Use secrets to import GPG key
	- name: Import GPG key
	uses: crazy-max/ghaction-import-gpg@v7
	with:
	gpg_private_key: ${{ secrets.GPG_SIGNING_KEY }}
	passphrase: ${{ secrets.GPG_SIGNING_PASSPHRASE }}

	# Create settings.xml for Maven since it needs the 'central-a2asdk-temp' server.
	# Populate with username and password from secrets
	- name: Create settings.xml
	run: \|
	mkdir -p ~/.m2
	echo "<settings><servers><server><id>central-a2asdk-temp</id><username>${{ secrets.CENTRAL_TOKEN_USERNAME }}</username><password>${{ secrets.CENTRAL_TOKEN_PASSWORD }}</password></server></servers></settings>" > ~/.m2/settings.xml

	- name: Validate Maven Central credentials
	run: \|
	TOKEN=$(printf "%s:%s" "${{ secrets.CENTRAL_TOKEN_USERNAME }}" "${{ secrets.CENTRAL_TOKEN_PASSWORD }}" \| base64)
	HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
	-H "Authorization: Bearer $TOKEN" \
	-X POST \
	"https://central.sonatype.com/api/v1/publisher/status?id=nonexistent")
	if [ "$HTTP_STATUS" != "404" ]; then
	echo "::error::Maven Central credentials validation failed (HTTP $HTTP_STATUS, expected 404)"
	exit 1
	fi
	echo "Maven Central credentials are valid"

	# Build with the same settings as the deploy job
	# -s uses the settings file we created.
	- name: Build with same arguments as deploy job
	run: >
	mvn -B install
	-s ~/.m2/settings.xml
	-P release
	-DskipTests
	-Drelease.auto.publish=true
	env:
	# GPG passphrase is set as an environment variable for the gpg plugin to use
	GPG_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}

	- name: Build Summary
	if: always()
	run: \|
	if [ "${{ job.status }}" = "success" ]; then
	echo "✅ Release profile build succeeded"
	if [ -n "${{ steps.pr_info.outputs.pr_number }}" ]; then
	echo " PR #${{ steps.pr_info.outputs.pr_number }} is ready for release"
	fi
	else
	echo "❌ Release profile build failed"
	if [ -n "${{ steps.pr_info.outputs.pr_number }}" ]; then
	echo " PR #${{ steps.pr_info.outputs.pr_number }} has release profile issues"
	fi
	fi

	- name: Report status to PR
	if: always() && steps.pr_info.outputs.pr_sha
	uses: actions/github-script@v9
	with:
	script: \|
	const state = '${{ job.status }}' === 'success' ? 'success' : 'failure';
	const description = state === 'success'
	? '✅ Release profile build passed'
	: '❌ Release profile build failed';

	await github.rest.repos.createCommitStatus({
	owner: context.repo.owner,
	repo: context.repo.repo,
	sha: '${{ steps.pr_info.outputs.pr_sha }}',
	state: state,
	context: 'Build with -Prelease',
	description: description,
	target_url: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
	});

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

Build with '-Prelease' (Run) #3

Workflow file

Build with '-Prelease' (Run) #3

Uh oh!

Workflow file for this run