# The contents of this file are subject to the terms of the Common Development and
|
# Distribution License (the License). You may not use this file except in compliance with the
|
# License.
|
#
|
# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
# specific language governing permission and limitations under the License.
|
#
|
# When distributing Covered Software, include this CDDL Header Notice in each file and include
|
# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
# Header, with the fields enclosed by brackets [] replaced by your own identifying
|
# information: "Portions copyright [year] [name of copyright owner]".
|
#
|
# Copyright 2022-2026 3A Systems, LLC.
|
|
name: Release
|
|
on:
|
workflow_dispatch:
|
inputs:
|
releaseVersion:
|
description: "Default version to use when preparing a release."
|
required: true
|
default: "X.Y.Z"
|
developmentVersion:
|
description: "Default version to use for new local working copy."
|
required: true
|
default: "X.Y.Z-SNAPSHOT"
|
|
concurrency:
|
group: ${{ github.workflow }}-${{ github.ref }}
|
cancel-in-progress: false
|
|
permissions:
|
contents: read
|
|
jobs:
|
release-maven:
|
runs-on: 'ubuntu-latest'
|
# contents: write is required to push the release commits and tags produced by
|
# maven-release-plugin, to create the GitHub release and to update the wiki.
|
permissions:
|
contents: write
|
steps:
|
- name: Print github context
|
env:
|
GITHUB_CONTEXT: ${{ toJSON(github) }}
|
run: echo "$GITHUB_CONTEXT"
|
- name: Install rpm for distribution
|
shell: bash
|
run: |
|
sudo apt-get update
|
sudo apt-get install -y rpm
|
- uses: actions/checkout@v6
|
with:
|
fetch-depth: 0
|
submodules: recursive
|
- name: Set up Java for publishing to Maven Central Repository OSS
|
uses: actions/setup-java@v5
|
with:
|
java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
|
distribution: 'temurin'
|
server-id: ossrh
|
server-username: MAVEN_USERNAME
|
server-password: MAVEN_PASSWORD
|
- name: Cache Maven packages
|
uses: actions/cache@v5
|
with:
|
path: ~/.m2/repository
|
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
|
restore-keys: ${{ runner.os }}-m2-repository
|
- name: Install gpg secret key
|
env:
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
if: ${{ env.GPG_PRIVATE_KEY!=''}}
|
run: |
|
cat <(echo -e "${{ secrets.GPG_PRIVATE_KEY }}") | gpg --batch --import
|
gpg --list-secret-keys --keyid-format LONG
|
git config --global user.signingkey B02611B009E5302EB58D102D6C2EDF3C90D33841
|
- name: Configure Git User
|
run: |
|
git config --global user.name "Open Identity Platform Community"
|
git config --global user.email "open-identity-platform-opendj@googlegroups.com"
|
- name: Release and publish to the Maven Central Repository
|
env:
|
GITHUB_ACTOR: ${{ github.actor }}
|
GITHUB_TOKEN: ${{ github.token }}
|
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
|
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
|
MAVEN_OPTS: -Dhttps.protocols=TLSv1.2 -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.retryHandler.count=10
|
if: ${{ env.MAVEN_USERNAME!='' && env.MAVEN_PASSWORD!='' }}
|
run: mvn --batch-mode -Darguments="-Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}" -DsignTag=true -DtagNameFormat="${{ github.event.inputs.releaseVersion }}" -DreleaseVersion=${{ github.event.inputs.releaseVersion }} -DdevelopmentVersion=${{ github.event.inputs.developmentVersion }} release:prepare release:perform --file pom.xml
|
# Hand the just-released server zip to the release-msi job (the MSI can only be
|
# built on Windows), so it does not have to rebuild opendj-server-legacy.
|
- name: Upload the server zip for the MSI job
|
continue-on-error: true
|
uses: actions/upload-artifact@v7
|
with:
|
name: release-server-zip
|
retention-days: 1
|
path: target/checkout/opendj-server-legacy/target/package/*.zip
|
# A missing zip means release-msi cannot build: fail this step (the job keeps
|
# going thanks to continue-on-error, but the loss is visible).
|
if-no-files-found: error
|
- name: Release on GitHub
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
with:
|
name: ${{ github.event.inputs.releaseVersion }}
|
tag_name: ${{ github.event.inputs.releaseVersion }}
|
draft: false
|
prerelease: false
|
fail_on_unmatched_files: false
|
generate_release_notes: true
|
files: |
|
target/checkout/opendj-server-legacy/target/package/*.zip
|
target/checkout/opendj-ldap-toolkit/target/*.zip
|
target/checkout/opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb
|
target/checkout/opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm
|
target/checkout/opendj-packages/opendj-docker/target/Dockerfile.zip
|
target/checkout/opendj-packages/opendj-openshift-template/*.yaml
|
target/checkout/opendj-doc-generated-ref/target/*.zip
|
target/checkout/opendj-dsml-servlet/target/*.war
|
target/checkout/opendj-rest2ldap-servlet/target/*.war
|
- uses: actions/checkout@v6
|
continue-on-error: true
|
with:
|
repository: ${{ github.repository }}.wiki
|
path: ${{ github.event.repository.name }}.wiki
|
fetch-depth: 0
|
- name: Publish docs to wiki
|
continue-on-error: true
|
shell: bash
|
env:
|
GITHUB_ACTOR: ${{ github.actor }}
|
GITHUB_TOKEN: ${{ github.token }}
|
run: |
|
cd ${{ github.event.repository.name }}.wiki
|
rm -rf asciidoc
|
mkdir asciidoc
|
cp -R ../target/checkout/opendj-doc-generated-ref/target/asciidoc/pdf ../${{ github.event.repository.name }}.wiki/asciidoc
|
git add -A
|
git commit -a -m "upload docs after release ${{ github.event.inputs.releaseVersion }}"
|
git tag -f ${{ github.event.inputs.releaseVersion }}
|
git push --quiet --force
|
git push --quiet --force origin ${{ github.event.inputs.releaseVersion }}
|
|
- uses: actions/checkout@v6
|
continue-on-error: true
|
with:
|
repository: OpenIdentityPlatform/doc.openidentityplatform.org
|
path: doc.openidentityplatform.org
|
token: ${{ secrets.OIP_PAT_GH_TOKEN }}
|
- name: Publish docs to site
|
continue-on-error: true
|
shell: bash
|
run: |
|
export REPO_NAME_LC=$(echo '${{github.event.repository.name}}' | tr '[:upper:]' '[:lower:]')
|
export SITE_DOC_FOLDER=${REPO_NAME_LC}-doc-generated-ref
|
export TAG_NAME='${{github.event.repository.name}}-${{ github.event.inputs.releaseVersion }}'
|
cd doc.openidentityplatform.org
|
git tag -f ${TAG_NAME}
|
git push --quiet --force origin ${TAG_NAME}
|
|
# The MSI can only be built on Windows. Reuses the server zip built by release-maven
|
# (installed into the local repo), so only the opendj-msi-standard module is built here.
|
# continue-on-error: an MSI failure must not break the release.
|
release-msi:
|
name: Windows MSI release
|
runs-on: 'windows-latest'
|
continue-on-error: true
|
# contents: write is required by action-gh-release to attach the MSI to the release;
|
# the workflow-level default above is contents: read.
|
permissions:
|
contents: write
|
needs:
|
- release-maven
|
steps:
|
- uses: actions/checkout@v6
|
with:
|
ref: ${{ github.event.inputs.releaseVersion }}
|
submodules: recursive
|
- name: Set up Java
|
uses: actions/setup-java@v5
|
with:
|
java-version: '11'
|
distribution: 'temurin'
|
# restore, not the full cache action: the install:install-file below puts a
|
# dependency-less generated pom for opendj-server-legacy into the local repository,
|
# and saving that under the key build-maven restores from would seed every later
|
# Windows build with it.
|
- name: Cache Maven packages
|
uses: actions/cache/restore@v5
|
with:
|
path: ~/.m2/repository
|
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
|
restore-keys: ${{ runner.os }}-m2-repository
|
- name: Setup WiX (.NET tool)
|
shell: bash
|
run: |
|
echo "DOTNET_ROLL_FORWARD=Major" >> "$GITHUB_ENV"
|
export DOTNET_ROLL_FORWARD=Major
|
dotnet tool install --global wix --version 5.0.2 || dotnet tool update --global wix --version 5.0.2
|
echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
|
export PATH="$HOME/.dotnet/tools:$PATH"
|
wix --version
|
wix extension add -g WixToolset.UI.wixext/5.0.2 || true
|
- name: Download the server zip built by release-maven
|
uses: actions/download-artifact@v8
|
with:
|
name: release-server-zip
|
path: server-zip
|
- name: Install the server zip into the local Maven repository
|
shell: bash
|
run: |
|
# The artifact carries both zips and the slim one sorts first ('-' < '.'), so
|
# filter it out: the slim zip lacks the JDBC/Cassandra backend drivers and the
|
# MSI must be packaged from the full server zip.
|
ZIP=$(ls server-zip/*.zip | grep -v -- '-slim\.zip$' | head -1)
|
echo "Installing $ZIP as opendj-server-legacy:${{ github.event.inputs.releaseVersion }}:zip"
|
mvn --batch-mode install:install-file -Dfile="$ZIP" \
|
-DgroupId=org.openidentityplatform.opendj -DartifactId=opendj-server-legacy \
|
-Dversion=${{ github.event.inputs.releaseVersion }} -Dpackaging=zip
|
- name: Build the MSI (packaging only, no rebuild)
|
env:
|
MAVEN_OPTS: -Dhttps.protocols=TLSv1.2 -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.retryHandler.count=10
|
# -P: do not rely on the wix.exe file-activation of distribution-windows-msi. The
|
# profile now lives in opendj-msi-standard and wraps its <build>, and the module is
|
# part of every reactor, so -pl always resolves it; what -P buys is forcing the
|
# plugins on when wix.exe is not under %USERPROFILE%\.dotnet\tools. Without it this
|
# builds a pom that produces nothing, and fail_on_unmatched_files below is the only
|
# symptom - the job's continue-on-error swallows everything else.
|
run: mvn --batch-mode --errors -DskipTests package -pl :opendj-msi-standard -Pdistribution-windows-msi --file pom.xml
|
- name: Attach the MSI to the GitHub release
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
with:
|
tag_name: ${{ github.event.inputs.releaseVersion }}
|
fail_on_unmatched_files: true
|
files: opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi
|
|
release-docker:
|
name: Docker release
|
runs-on: 'ubuntu-latest'
|
needs:
|
- release-maven
|
# packages: write is required for the GHCR login that authenticates with GITHUB_TOKEN.
|
permissions:
|
contents: read
|
packages: write
|
steps:
|
- uses: actions/checkout@v6
|
with:
|
ref: ${{ github.event.inputs.releaseVersion }}
|
fetch-depth: 1
|
submodules: recursive
|
- name: Docker meta
|
id: meta
|
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
|
with:
|
images: |
|
${{ github.repository }}
|
ghcr.io/${{ github.repository }}/${{ github.event.repository.name }}
|
tags: |
|
type=raw,value=latest
|
type=raw,value=${{ github.event.inputs.releaseVersion }}
|
- name: Set up QEMU
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
- name: Set up Docker Buildx
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
- name: Login to DockerHub
|
uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
|
with:
|
username: ${{ secrets.DOCKER_USERNAME }}
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
- name: Login to GHCR
|
uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
|
with:
|
registry: ghcr.io
|
username: ${{ github.repository_owner }}
|
password: ${{ secrets.GITHUB_TOKEN }}
|
- name: Build and push image
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
continue-on-error: true
|
with:
|
context: ./opendj-packages/opendj-docker
|
file: ./opendj-packages/opendj-docker/Dockerfile
|
build-args: |
|
VERSION=${{ github.event.inputs.releaseVersion }}
|
platforms: linux/amd64, linux/arm64/8, linux/ppc64le, linux/s390x, linux/riscv64 #, linux/arm/v7
|
push: true
|
tags: ${{ steps.meta.outputs.tags }}
|
labels: ${{ steps.meta.outputs.labels }}
|
release-docker-alpine:
|
name: Docker release
|
runs-on: 'ubuntu-latest'
|
needs:
|
- release-maven
|
# packages: write is required for the GHCR login that authenticates with GITHUB_TOKEN.
|
permissions:
|
contents: read
|
packages: write
|
steps:
|
- uses: actions/checkout@v6
|
with:
|
ref: ${{ github.event.inputs.releaseVersion }}
|
fetch-depth: 1
|
submodules: recursive
|
- name: Docker meta
|
id: meta
|
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
|
with:
|
images: |
|
${{ github.repository }}
|
ghcr.io/${{ github.repository }}/${{ github.event.repository.name }}
|
tags: |
|
type=raw,value=alpine
|
type=raw,value=${{ github.event.inputs.releaseVersion }}-alpine
|
- name: Set up QEMU
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
- name: Set up Docker Buildx
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
- name: Login to DockerHub
|
uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
|
with:
|
username: ${{ secrets.DOCKER_USERNAME }}
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
- name: Login to GHCR
|
uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
|
with:
|
registry: ghcr.io
|
username: ${{ github.repository_owner }}
|
password: ${{ secrets.GITHUB_TOKEN }}
|
- name: Build and push image
|
continue-on-error: true
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
with:
|
context: ./opendj-packages/opendj-docker
|
file: ./opendj-packages/opendj-docker/Dockerfile-alpine
|
build-args: |
|
VERSION=${{ github.event.inputs.releaseVersion }}
|
platforms: linux/amd64, linux/arm64/8, linux/s390x, linux/ppc64le, linux/386, linux/riscv64
|
push: true
|
tags: ${{ steps.meta.outputs.tags }}
|
labels: ${{ steps.meta.outputs.labels }}
|
