# The contents of this file are subject to the terms of the Common Development and # Distribution License (the License). You may not use this file except in compliance with the # License. # # You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the # specific language governing permission and limitations under the License. # # When distributing Covered Software, include this CDDL Header Notice in each file and include # the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL # Header, with the fields enclosed by brackets [] replaced by your own identifying # information: "Portions copyright [year] [name of copyright owner]". # # Copyright 2021-2026 3A Systems, LLC. name: Package/Deploy on: workflow_run: branches: [ 'sustaining/4.10.x','master' ] workflows: ["Build","Release"] types: [completed] concurrency: group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }} cancel-in-progress: false # contents: write is required to push the generated documentation to the project wiki # with github.token. The doc site push uses a separate PAT, not this token. # actions: read is required to download the MSI artifact from the triggering Build run # (a permissions block sets every unlisted scope to none). permissions: contents: write actions: read jobs: package-deploy-maven: # head_repository states the trust boundary instead of leaving it to be re-derived. # The checkout below takes its ref from the triggering run, and the branches filter # above matches that run's head branch NAME - which a fork can also call master. What # actually keeps the ref trusted is event=='push': a Build run for a pull request # carries event 'pull_request', and a push to a fork runs the fork's own workflows, # never ours. The repository check makes that explicit for the next reader, and for # the next person tempted to relax the event condition. if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }} runs-on: 'ubuntu-latest' steps: - name: Print github context env: GITHUB_CONTEXT: ${{ toJSON(github) }} run: echo "$GITHUB_CONTEXT" - name: Install rpm for distribution if: runner.os == 'Linux' shell: bash run: | sudo apt-get update sudo apt-get install -y rpm - uses: actions/checkout@v6 with: fetch-depth: 0 submodules: recursive ref: ${{ github.event.workflow_run.head_branch }} # The committed opendj-server-legacy/lib/*.exe are what every Linux-built server zip # ships - the snapshots this job publishes, and later the tagged releases and their # Maven Central artifacts - while only a Windows job can rebuild them. Nothing used # to make the two meet, so a native source change that was never re-committed as a # refreshed binary shipped the old wrapper while CI stayed green (master carried such # a gap for weeks). The triggering Build run compiled them from source already, so # take its binaries and commit them here rather than rebuild. # # Here rather than in build.yml: this workflow already holds contents: write for the # wiki push, so build-maven - which runs the whole Maven plugin tree - stays # read-only, and it only runs at all once the Build succeeded on a push to a release # branch. The cost is latency: the refresh lands after the full matrix, not minutes # into it. Committing before the Maven steps below also means the snapshot zip this # job publishes carries the fresh launchers. # # This only works because the Makefile passes /Brepro to both cl and link: the output # is a function of the sources, not of the build time. Without it every run would # produce different bytes and this would commit on every push. An MSVC toolchain bump # on the runner image does change them, and that refresh commit is correct - the # committed binary then matches what CI verifies. Pushes made with GITHUB_TOKEN do # not start new workflow runs, so this cannot loop; a PAT would break that. - name: Download the launchers built by the triggering Build run continue-on-error: true uses: actions/download-artifact@v8 with: name: windows-exe-11 run-id: ${{ github.event.workflow_run.id }} github-token: ${{ secrets.GITHUB_TOKEN }} path: ${{ runner.temp }}/windows-exe - name: Commit the rebuilt launchers shell: bash env: # NOT github.ref: on a workflow_run event that is the default branch, not the # branch the triggering run was for. BRANCH: ${{ github.event.workflow_run.head_branch }} BUILT: ${{ runner.temp }}/windows-exe HEAD_SHA: ${{ github.event.workflow_run.head_sha }} RUN_ID: ${{ github.event.workflow_run.id }} run: | set -e if ! ls "$BUILT"/*.exe >/dev/null 2>&1; then echo "::warning title=No launcher binaries from the Build run::windows-exe-11 could not be downloaded, leaving opendj-server-legacy/lib/*.exe as committed." exit 0 fi cp "$BUILT"/*.exe opendj-server-legacy/lib/ # status --porcelain, not diff: it reports a brand-new launcher that was never # git-added just as well as a modified one. if [ -z "$(git status --porcelain -- opendj-server-legacy/lib)" ]; then echo "Committed launchers already match the sources." exit 0 fi git status --porcelain -- opendj-server-legacy/lib git config user.name "Open Identity Platform Community" git config user.email "open-identity-platform-opendj@googlegroups.com" git add -- opendj-server-legacy/lib git commit --quiet \ -m "Refresh the Windows native launchers" \ -m "Rebuilt from opendj-server-legacy/src/build-tools/windows for ${HEAD_SHA} by the Build workflow (run ${RUN_ID})." # The checkout is of the branch, which may have moved on since the Build run, and # it can move again while we push: rebase onto the current tip and retry. An # identical refresh already there leaves an empty commit that rebase drops, and # the push then has nothing to send. # # This step runs before the Maven deploy, the package uploads and the wiki push, # so it must not be the thing that costs them: a refresh that cannot be landed # warns and lets the job carry on. The next push to this branch retries it, and # nothing downstream depends on the committed binaries being current - the Build # run that produced them compiled its own. # # The Maven steps below must build the tree the triggering Build validated. The # rebase moves the worktree onto the branch tip, which can carry commits that # Build run never saw, so remember the refresh as it was made - the tree as # checked out, plus the launchers - and come back to it however this step ends. # (The checkout above takes the branch by NAME, not the triggering run's SHA, so # that tree is the tip as of a moment ago rather than HEAD_SHA itself; what this # keeps is the rebase from widening the gap.) REFRESHED=$(git rev-parse HEAD) # A trap rather than a line on the push-success path: all four ways out of the # loop below - fetch failure, rebase conflict, three lost races, and the push # that lands - can be taken after a rebase has already moved the worktree, and # 'git rebase --abort' returns to the state that rebase started from, which on # attempt 2 or 3 is the result of the previous attempt rather than $REFRESHED. # # --force matters: when the abort above fails - it is masked by '|| true' - a # plain 'checkout --detach' stops on "you need to resolve your current index # first" and leaves the worktree mid-rebase for the Maven steps. trap 'git checkout --quiet --force --detach "$REFRESHED" || echo "::warning title=Could not restore the validated tree::the build continues on the current $BRANCH tip."' EXIT for attempt in 1 2 3; do # Guarded like everything else in this block: bare, it is the one command left # that could still take the job down with it. The step runs under set -e with # no continue-on-error, so a transient fetch failure would skip the Maven # deploy, all nine artifact uploads, the MSI attachment and both documentation # pushes over a refresh that is allowed to fail. if ! git fetch --quiet origin "$BRANCH"; then echo "::warning title=Could not refresh the launcher binaries::$BRANCH could not be fetched. Refresh opendj-server-legacy/lib/*.exe from the windows-exe-11 artifact of Build run ${RUN_ID} and commit them." exit 0 fi if ! git rebase --quiet FETCH_HEAD; then git rebase --abort || true echo "::warning title=Could not refresh the launcher binaries::$BRANCH moved on and the rebuilt launchers conflict with it. Refresh opendj-server-legacy/lib/*.exe from the windows-exe-11 artifact of Build run ${RUN_ID} and commit them." exit 0 fi if git push --quiet origin "HEAD:refs/heads/$BRANCH"; then # A refresh that already landed leaves the rebase with nothing to replay and # the push with nothing to send, both of them silently successful: report # what happened rather than claiming a push that was a no-op. if [ "$(git rev-parse HEAD)" = "$(git rev-parse FETCH_HEAD)" ]; then echo "The launchers committed on $BRANCH already match the rebuilt ones." else echo "Refreshed launchers pushed to $BRANCH." fi exit 0 fi echo "$BRANCH moved while pushing - retrying ($attempt/3)." done echo "::warning title=Could not refresh the launcher binaries::$BRANCH kept moving under this job. Refresh opendj-server-legacy/lib/*.exe from the windows-exe-11 artifact of Build run ${RUN_ID} and commit them." - name: Set up Java for publishing to Maven Central Repository OSS uses: actions/setup-java@v5 with: java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}} distribution: 'temurin' server-id: ossrh server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD - name: Cache Maven packages uses: actions/cache@v5 with: path: ~/.m2/repository key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }} restore-keys: ${{ runner.os }}-m2-repository - name: Install gpg secret key env: GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} if: ${{ env.GPG_PRIVATE_KEY!=''}} run: | cat <(echo -e "${{ secrets.GPG_PRIVATE_KEY }}") | gpg --batch --import gpg --list-secret-keys --keyid-format LONG - name: Build package local env: MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }} MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }} MAVEN_OPTS: -Dhttps.protocols=TLSv1.2 -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.retryHandler.count=10 if: ${{ !(github.event.workflow_run.event=='push' && env.MAVEN_USERNAME!='' && env.MAVEN_PASSWORD!='')}} run: mvn --batch-mode --errors --update-snapshots -Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }} package --file pom.xml - name: Publish to the Maven Central Repository env: MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }} MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }} MAVEN_OPTS: -Dhttps.protocols=TLSv1.2 -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.retryHandler.count=10 if: ${{ github.event.workflow_run.event=='push' && env.MAVEN_USERNAME!='' && env.MAVEN_PASSWORD!=''}} run: mvn --batch-mode --errors --update-snapshots -Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }} deploy --file pom.xml - name: Build Javadoc continue-on-error: true run: mvn javadoc:aggregate - name: Upload artifacts OpenDJ Server uses: actions/upload-artifact@v7 with: name: OpenDJ Server path: opendj-server-legacy/target/package/*.zip - name: Upload artifacts OpenDJ SDK Toolkit uses: actions/upload-artifact@v7 with: name: OpenDJ SDK Toolkit path: opendj-ldap-toolkit/target/*.zip - name: Upload artifacts OpenDJ Debian Package uses: actions/upload-artifact@v7 with: name: OpenDJ Debian Package path: opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb - name: Upload artifacts OpenDJ RPM Package uses: actions/upload-artifact@v7 with: name: OpenDJ RPM Package path: opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm # The MSI can only be built on Windows; reuse the one already built by the triggering # Build run (windows-latest-11 artifact) instead of rebuilding it here. - name: Download Windows build artifact (contains the MSI) continue-on-error: true uses: actions/download-artifact@v8 with: name: windows-latest-11 run-id: ${{ github.event.workflow_run.id }} github-token: ${{ secrets.GITHUB_TOKEN }} path: windows-build - name: Upload artifacts OpenDJ MSI Package continue-on-error: true uses: actions/upload-artifact@v7 with: name: OpenDJ MSI Package path: windows-build/opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi # Make a silently-missing MSI visible: the step fails (job continues via # continue-on-error) instead of warning and publishing nothing. if-no-files-found: error - name: Upload artifacts OpenDJ Docker Packages uses: actions/upload-artifact@v7 with: name: OpenDJ Docker Packages path: opendj-packages/opendj-docker/target/Dockerfile.zip - name: Upload artifacts OpenDJ Openshift template uses: actions/upload-artifact@v7 with: name: OpenDJ Openshift template path: opendj-packages/opendj-openshift-template/*.yaml - name: Upload artifacts OpenDJ Doc Generated Reference uses: actions/upload-artifact@v7 with: name: OpenDJ Doc Generated References path: opendj-doc-generated-ref/target/*.zip - name: Upload artifacts OpenDJ DSML Gateway uses: actions/upload-artifact@v7 with: name: OpenDJ DSML Gateway path: opendj-dsml-servlet/target/*.war - name: Upload artifacts OpenDJ Commons REST LDAP Gateway uses: actions/upload-artifact@v7 with: name: OpenDJ Commons REST LDAP Gateway path: opendj-rest2ldap-servlet/target/*.war - name: Configure Git User run: | git config --global user.name "Open Identity Platform Community" git config --global user.email "open-identity-platform-opendj@googlegroups.com" cd .. - uses: actions/checkout@v6 continue-on-error: true with: repository: ${{ github.repository }}.wiki path: ${{ github.event.repository.name }}.wiki - name: Publish docs to wiki continue-on-error: true shell: bash env: GITHUB_ACTOR: ${{ github.actor }} GITHUB_TOKEN: ${{ github.token }} run: | cd ${{ github.event.repository.name }}.wiki rm -rf asciidoc mkdir asciidoc cp -R ../opendj-doc-generated-ref/target/asciidoc/pdf ../${{ github.event.repository.name }}.wiki/asciidoc git add -A git commit -a -m "upload docs after deploy ${{ github.sha }}" git push --quiet --force - uses: actions/checkout@v6 continue-on-error: true with: repository: OpenIdentityPlatform/doc.openidentityplatform.org path: doc.openidentityplatform.org token: ${{ secrets.OIP_PAT_GH_TOKEN }} - name: Publish docs to site continue-on-error: true shell: bash run: | export REPO_NAME_LC=$(echo '${{github.event.repository.name}}' | tr '[:upper:]' '[:lower:]') export SITE_DOC_FOLDER=${REPO_NAME_LC}-doc-generated-ref cd doc.openidentityplatform.org rm -rf ${REPO_NAME_LC}/modules cp -R ../${SITE_DOC_FOLDER}/target/asciidoc/antora/modules ../doc.openidentityplatform.org/${REPO_NAME_LC} rm -rf ${REPO_NAME_LC}/apidocs cp -R ../target/reports/apidocs ../doc.openidentityplatform.org/${REPO_NAME_LC} git add -A if ! git diff-index --quiet HEAD; then echo "committing changes to the docs repository" git commit -a -m "upload ${{github.event.repository.name}} docs after deploy ${{ github.sha }}" git push --force https://github.com/OpenIdentityPlatform/doc.openidentityplatform.org.git fi