Automate deploy with GHA (#946)

Author: clairemcginty

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Sonatype Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+
+jobs:
+  release:
+    name: Release
+    runs-on: 'ubuntu-latest'
+    environment: main_env
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure GHA bot # used to commit release and snapshot versions
+        # GHA Bot (which sets next snapshot version) should be authenticated by actions/checkout, see:
+        # https://github.com/actions/checkout/blob/main/README.md#push-a-commit-using-the-built-in-token
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Cache Maven packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2
+          key: Linux-java11-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: Linux-java11-m2
+      - name: Set up JDK 11
+        uses: actions/setup-java@v4
+        with:
+          java-version: '11'
+          distribution: 'adopt'
+          # setup-java generates a settings.xml pointing deployments to Sonatype
+          # See https://github.com/actions/setup-java/blob/v3.11.0/docs/advanced-usage.md#publishing-using-apache-maven
+          server-id: ossrh
+          server-username: SONATYPE_USERNAME
+          server-password: SONATYPE_TOKEN
+          gpg-private-key: ${{ secrets.GPG_KEY }}
+          gpg-passphrase: MAVEN_GPG_PASSPHRASE
+      - name: Release
+        env:
+          MAVEN_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          MAVEN_CENTRAL_TOKEN: ${{ secrets.SONATYPE_TOKEN }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        # Todo - remove dry-run flag once validated in GHA
+        run: |
+          export GPG_TTY=$(tty)
+          mvn -B release:prepare release:perform -DreleaseVersion=${{ github.event.inputs.version }} -DdryRun=true

README.md

@@ -286,12 +286,23 @@ expected to honor this code.
 
 ## Release
 
-Every push to master will deploy a snapshot version to Sonatype.
+Trigger the [release](https://github.com/spotify/dbeam/actions/workflows/release.yml) workflow manually. This workflow requires a
+single input, `version`, which should be set to the desired semantic version in the format `{major_version}.{minor_version}.{patch_version}`.
+It will update versions in all `pom.xml` files, push a tag `vx.y.z`, package, sign, and deploy artifacts to Sonatype, and finally bump all
+`pom.xml`s to the next development SNAPSHOT version.
+
 You can check the deployment in the following links:
 
 - https://github.com/spotify/dbeam/actions
 - https://oss.sonatype.org/#nexus-search;quick~dbeam-core
 
+You can also do a manual release. First, export env variables $SONATYPE_USERNAME, $SONATYPE_PASSWORD (for information on generating a token see [here](https://help.sonatype.com/en/user-tokens.html)), $MAVEN_GPG_KEY_NAME.
+Then, you can run `maven release` to deploy to Sonatype and automatically push commits bumping the project version:
+
+```shell
+mvn -s sonatype-settings.xml -DreleaseVersion={NEW_VERSION} release:prepare release:perform # Run with -DdryRun=true first to validate pom modification
+```
+
 ## Future roadmap
 
 DBeam is mature, maintained and used in production since August 2017. No major features or development planned.

github-settings.xml

@@ -92,9 +92,8 @@
       <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
     </repository>
     <snapshotRepository>
-      <id>github</id>
-      <name>GitHub OWNER Apache Maven Packages</name>
-      <url>https://maven.pkg.github.com/spotify/dbeam</url>
+      <id>ossrh</id>
+      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
     </snapshotRepository>
   </distributionManagement>
 
@@ -439,19 +438,11 @@
   <repositories>
     <repository>
       <releases>
-        <enabled>false</enabled>
+        <enabled>true</enabled>
       </releases>
       <snapshots>
         <enabled>true</enabled>
       </snapshots>
-      <id>apache.snapshots</id>
-      <name>Apache Development Snapshot Repository</name>
-      <url>https://repository.apache.org/content/repositories/snapshots/</url>
-    </repository>
-    <repository>
-      <snapshots>
-        <enabled>false</enabled>
-      </snapshots>
       <id>ossrh</id>
       <name>Sonatype OSS</name>
       <url>https://oss.sonatype.org/content/repositories/releases/</url>