release.yml

name: Release

on:
  pull_request:
    types: [closed]
    branches:
      - main

permissions:
  contents: read
  pull-requests: read

env:
  # Where releases go: streamRepo, central, or streamRepo,central. Central is a manual
  # escape hatch for a release that has to go out when the Stream repository cannot take it.
  PUBLISH_TARGETS: streamRepo

jobs:
  Release:
    name: 🚀 Release
    if: github.event.pull_request.merged && startsWith(github.head_ref, 'release-')
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      stream_repo: ${{ steps.version.outputs.stream_repo }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Getting the release version from the PR source branch
      # Source branch looks like this: release-1.0.0
      - name: Read the version
        id: version
        env:
          HEAD_REF: ${{ github.head_ref }}
        run: |
          echo "version=${HEAD_REF#release-}" >> "$GITHUB_OUTPUT"
          echo "stream_repo=${{ contains(env.PUBLISH_TARGETS, 'streamRepo') }}" >> "$GITHUB_OUTPUT"

      - name: Write the signing keyring
        run: |
          sudo bash -c "echo '$GPG_KEY_CONTENTS' | base64 -d > '$SIGNING_SECRET_KEY_RING_FILE'"
        env:
          GPG_KEY_CONTENTS: ${{ secrets.GPG_KEY_CONTENTS }}
          SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}

      # An env var rather than -P, so a value with a space cannot split into a second argument.
      - name: Select publish targets
        run: echo "ORG_GRADLE_PROJECT_streamPublishTargets=$PUBLISH_TARGETS" >> "$GITHUB_ENV"

      # Stages a signed Maven-2 tree under build/staged-repo for the upload job.
      - name: Stage for the Stream repository
        if: ${{ contains(env.PUBLISH_TARGETS, 'streamRepo') }}
        run: ./gradlew publishAllPublicationsToStreamRepoStagingRepository --no-daemon --max-workers 1
        env:
          STREAM_KEY: ${{ secrets.STREAM_KEY }}
          STREAM_SECRET: ${{ secrets.STREAM_SECRET }}
          SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}

      - name: Publish to MavenCentral
        if: ${{ contains(env.PUBLISH_TARGETS, 'central') }}
        run: ./gradlew publishToSonatype --no-daemon --max-workers 1 closeAndReleaseSonatypeStagingRepository
        env:
          STREAM_KEY: ${{ secrets.STREAM_KEY }}
          STREAM_SECRET: ${{ secrets.STREAM_SECRET }}
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
          SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}
          SONATYPE_STAGING_PROFILE_ID: ${{ secrets.SONATYPE_STAGING_PROFILE_ID }}

      # Handed to a job that has never seen the signing key -- the reason Gradle stages to a
      # directory instead of writing to the bucket itself.
      - name: Hand the staged tree to the upload job
        if: ${{ contains(env.PUBLISH_TARGETS, 'streamRepo') }}
        uses: actions/upload-artifact@v4
        with:
          name: stream-repo-staged
          path: build/staged-repo
          retention-days: 1
          if-no-files-found: error

  # Separate job: secrets are injected per job, so this one holds the R2 credential and never the
  # signing key, and the Release job holds the signing key and never the R2 credential.
  Upload:
    name: ☁️ Upload to the Stream repository
    needs: Release
    if: ${{ needs.Release.outputs.stream_repo == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Download the staged tree
        uses: actions/download-artifact@v4
        with:
          name: stream-repo-staged
          path: build/staged-repo

      - name: Publish to the Stream repository
        uses: GetStream/stream-build-conventions-android/.github/actions/publish-to-stream-repo@v1.0.1
        with:
          staged-directory: build/staged-repo
          channel: releases
          endpoint: ${{ secrets.STREAM_REPO_ENDPOINT }}
          bucket: ${{ secrets.STREAM_REPO_BUCKET }}
          access-key-id: ${{ secrets.STREAM_REPO_ACCESS_KEY_ID }}
          secret-access-key: ${{ secrets.STREAM_REPO_SECRET_ACCESS_KEY }}

  # The tag and the GitHub release only once the artifact is actually resolvable: after the
  # upload when the Stream repository is a target, straight after publishing when it is not.
  GitHub-Release:
    name: 🏷️ Create the GitHub release
    needs: [Release, Upload]
    if: >-
      ${{ always()
          && needs.Release.result == 'success'
          && (needs.Upload.result == 'success' || needs.Upload.result == 'skipped') }}
    runs-on: ubuntu-latest
    permissions:
      # write is needed to create the tag and the GitHub release
      contents: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/github-script@v7
        with:
          script: |
            const get_change_log_diff = require('./scripts/get_changelog_diff.js')
            require('fs').writeFileSync('changes.md', get_change_log_diff())

      # Customers need a repository line to see a version that is not on Central.
      - name: Write the release notes
        env:
          VERSION: ${{ needs.Release.outputs.version }}
        run: |
          : > notes.md
          if [ "$PUBLISH_TARGETS" == "streamRepo" ]; then
            cat > notes.md <<EOF
          > [!IMPORTANT]
          > **\`io.getstream:stream-chat-java:$VERSION\` is published to the Stream Maven repository, not Maven Central.**
          >
          > Gradle (\`build.gradle.kts\`):
          > \`\`\`kotlin
          > repositories {
          >     mavenCentral()
          >     maven("https://stream-io-repo.com")
          > }
          > \`\`\`
          >
          > Maven (\`pom.xml\`):
          > \`\`\`xml
          > <repositories>
          >   <repository>
          >     <id>stream</id>
          >     <url>https://stream-io-repo.com</url>
          >   </repository>
          > </repositories>
          > \`\`\`

          EOF
          fi
          cat changes.md >> notes.md

      - name: Create release on GitHub
        uses: ncipollo/release-action@v1
        with:
          bodyFile: notes.md
          tag: ${{ needs.Release.outputs.version }}
          commit: ${{ github.event.pull_request.merge_commit_sha }}
          token: ${{ secrets.GITHUB_TOKEN }}