Skip to content

Bumping version for next v2.1 release (#3156) #45

Bumping version for next v2.1 release (#3156)

Bumping version for next v2.1 release (#3156) #45

Workflow file for this run

name: Release v2.1
on:
push:
tags:
- 'v2.1.*'
workflow_dispatch:
inputs:
skipPublish:
description: 'Skip publishing docker images and JARs to Central Portal?'
required: true
default: true
type: boolean
tag:
description: 'Custom release tag value.'
required: true
type: string
# needed when a workflow wants to use OIDC (OpenID Connect) to authenticate to cloud
permissions:
id-token: write
contents: write
packages: write
pull-requests: write
# global env vars, available in all jobs and steps
env:
ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
MAVEN_OPTS: '-Xmx4g'
jobs:
# resolves tag value
# outputs the resolved release tag value in the release-tag output var
resolve-tag:
name: Resolve tag
runs-on: ubuntu-latest
outputs:
release-tag: ${{ steps.resolve_tag.outputs.tag }}
steps:
- uses: actions/checkout@v5
- name: Set reference
id: vars
run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
- name: Resolve tag
id: resolve_tag
run: |
TAG=${{ inputs.tag != null && inputs.tag || steps.vars.outputs.tag }}
echo "Resolved tag for the release $TAG"
echo "tag=${TAG}" >> $GITHUB_OUTPUT
# creates a new release if it's not existing
# outputs the upload URL in the release-upload-url output var
create-release:
name: Create release
needs: resolve-tag
runs-on: ubuntu-latest
outputs:
release-upload-url: ${{ steps.create_release.outputs.upload_url }}
steps:
- name: Create release
id: create_release
uses: softprops/action-gh-release@v2
with:
token: ${{ secrets.GITHUB_TOKEN }}
tag_name: ${{needs.resolve-tag.outputs.release-tag}}
name: Release ${{needs.resolve-tag.outputs.release-tag}}
draft: false
prerelease: true
# builds coordinator, zips stargate-lib folder and uploads the zip to the created release
build:
name: Build coordinator
needs: create-release
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- name: Set up JDK 11
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '11'
cache: maven
- name: Setup Maven
run: |
mkdir -p ~/.m2
cat <<EOF > ~/.m2/settings.xml
<settings>
<servers>
<server>
<id>artifactory-snapshots</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-releases</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-dse</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
</servers>
</settings>
EOF
- name: Build with Maven
run: |
cd coordinator/
./mvnw -B -ntp versions:set -DremoveSnapshot versions:commit
./mvnw -B -ntp -q -ff -P all clean package -DskipTests
- name: Zip-up `stargate-lib`
run: |
cd coordinator/
zip -r stargate-jars.zip starctl* stargate-lib
# uploads the jars by referencing the release-upload-url from create-release job
- name: Upload jars
uses: shogo82148/actions-upload-release-asset@v1
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
upload_url: ${{needs.create-release.outputs.release-upload-url}}
asset_name: stargate-jars.zip
asset_path: coordinator/stargate-jars.zip
# builds api uber-jars, zips and uploads the created release
build-apis:
name: Build APIs
needs: create-release
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
# install both Java 11 & Java 17, keep paths in vars
- name: Set up JDK 11
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '11'
cache: maven
- run: echo "JAVA_11=$JAVA_HOME" >> $GITHUB_ENV
- name: Set up JDK 17
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '17'
cache: maven
- run: echo "JAVA_17=$JAVA_HOME" >> $GITHUB_ENV
- name: Setup Maven
run: |
mkdir -p ~/.m2
cat <<EOF > ~/.m2/settings.xml
<settings>
<servers>
<server>
<id>artifactory-snapshots</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-releases</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-dse</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
</servers>
</settings>
EOF
- name: Build bridge protos library
if: ${{ !inputs.skipPublish }}
run: |
cd coordinator/
JAVA_HOME=$JAVA_11 ./mvnw -B -ntp versions:set -DremoveSnapshot versions:commit
JAVA_HOME=$JAVA_11 ./mvnw -B -ntp clean install -DskipTests -pl bridge-proto -am
- name: Build APIs with Maven
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp versions:set -DremoveSnapshot versions:commit
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp clean package -Dquarkus.package.type=uber-jar -DskipTests
- name: Zip-up APIs
run: |
zip -j stargate-restapi.zip apis/sgv2-restapi/target/sgv2-restapi-*-runner.jar apis/sgv2-restapi/start-restapi.sh
zip -j stargate-docsapi.zip apis/sgv2-docsapi/target/sgv2-docsapi-*-runner.jar apis/sgv2-docsapi/start-docsapi.sh
zip -j stargate-graphqlapi.zip apis/sgv2-graphqlapi/target/sgv2-graphqlapi-*-runner.jar apis/sgv2-graphqlapi/start-graphqlapi.sh
- name: Upload API Zips
uses: shogo82148/actions-upload-release-asset@v1
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
upload_url: ${{needs.create-release.outputs.release-upload-url}}
asset_path: stargate-*api.zip
# publish coordinator and sgv2-quarkus-common JARs to the Central Portal
publish-central:
name: Publish to Central Portal
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
# install both Java 11 & Java 17, keep paths in vars
- name: Set up JDK 11
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '11'
cache: maven
- run: echo "JAVA_11=$JAVA_HOME" >> $GITHUB_ENV
- name: Set up JDK 17
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '17'
cache: maven
- run: echo "JAVA_17=$JAVA_HOME" >> $GITHUB_ENV
- name: Setup Maven
env:
SONATYPE_CENTRAL_USERNAME: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
SONATYPE_CENTRAL_TOKEN: ${{ secrets.SONATYPE_CENTRAL_TOKEN }}
run: |
mkdir -p ~/.m2
cat <<EOF > ~/.m2/settings.xml
<settings>
<servers>
<server>
<id>central</id>
<username>${SONATYPE_CENTRAL_USERNAME}</username>
<password>${SONATYPE_CENTRAL_TOKEN}</password>
</server>
<server>
<id>artifactory-snapshots</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-releases</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-dse</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
</servers>
</settings>
EOF
- id: install-secret-key
name: Install gpg secret key
run: |
cat <(echo -e "${{ secrets.OSSRH_GPG_SECRET_KEY }}") | gpg --batch --import
# coordinator jars
# continue on error as sometimes deploy works even if an error is reported and we want to try next step as well
- name: Publish coordinator JARs
if: ${{ !inputs.skipPublish }}
continue-on-error: true
run: |
cd coordinator/
JAVA_HOME=$JAVA_11 ./mvnw -B -ntp versions:set -DremoveSnapshot versions:commit
JAVA_HOME=$JAVA_11 ./mvnw -B -ntp -Dgpg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} clean deploy -DskipTests -P deploy,all
# explicitly only -pl sgv2-quarkus-common
- name: Publish Quarkus Common JAR
if: ${{ !inputs.skipPublish }}
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp versions:set -DremoveSnapshot versions:commit
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp -pl sgv2-quarkus-common -am -Dgpg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} clean deploy -DskipTests -P deploy
# publishes the docker images for the coordinator and the APIs
publish-docker:
name: Publish docker images
needs: resolve-tag
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
# install both Java 11 & Java 17, keep paths in vars
- name: Set up JDK 11
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '11'
cache: maven
- run: echo "JAVA_11=$JAVA_HOME" >> $GITHUB_ENV
- name: Set up JDK 17
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '17'
cache: maven
- run: echo "JAVA_17=$JAVA_HOME" >> $GITHUB_ENV
- name: Setup Maven
run: |
mkdir -p ~/.m2
cat <<EOF > ~/.m2/settings.xml
<settings>
<servers>
<server>
<id>artifactory-snapshots</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-releases</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-dse</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
</servers>
</settings>
EOF
- name: Install coordinator
run: |
cd coordinator/
JAVA_HOME=$JAVA_11 ./mvnw -B -ntp versions:set -DremoveSnapshot versions:commit
JAVA_HOME=$JAVA_11 ./mvnw -B -ntp clean install -P all -DskipTests
# only set version here
- name: Install APIs
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp versions:set -DremoveSnapshot versions:commit
cd ../
- name: Set up Docker QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
# build and push images to Docker hub
# if input.skipPublish is true we are still having tasks for building images without push
# this enables build docker check without pushing
- name: Login to DockerHub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_TOKEN }}
- name: Build and push (coordinator, DockerHub)
if: ${{ !inputs.skipPublish }}
run: |
cd coordinator/
./build_docker_images.sh -p -t ${{needs.resolve-tag.outputs.release-tag}}
- name: Build without push (coordinator, DockerHub)
if: ${{ inputs.skipPublish }}
run: |
cd coordinator/
./build_docker_images.sh -t ${{needs.resolve-tag.outputs.release-tag}}
- name: Build and push (apis, DockerHub)
if: ${{ !inputs.skipPublish }}
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp clean package -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.push=true -Dquarkus.container-image.tag=${{needs.resolve-tag.outputs.release-tag}}
cd ../
- name: Build without push (apis, DockerHub)
if: ${{ inputs.skipPublish }}
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp clean package -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.tag=${{needs.resolve-tag.outputs.release-tag}}
cd ../
# repeat the same for the AWS ECR
- name: Configure AWS credentials via OIDC
uses: aws-actions/configure-aws-credentials@v5
with:
role-to-assume: ${{ secrets.ECR_FEDERATED_ROLE }}
aws-region: us-east-1
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v2
with:
mask-password: 'true'
- name: Build and push (coordinator, Amazon ECR)
if: ${{ !inputs.skipPublish }}
run: |
cd coordinator/
./build_docker_images.sh -p -t ${{needs.resolve-tag.outputs.release-tag}} -r ${{ secrets.ECR_REPOSITORY }}
# downloads and prepares datastax assets
- name: Download branding assets
if: ${{ !inputs.skipPublish }}
run : |
curl https://www.datastax.com/favicon.ico -o ./apis/sgv2-quarkus-common/src/main/resources/META-INF/branding/favicon.ico
curl https://cdn.sanity.io/files/bbnkhnhl/production/cf8b48832cfd43cdb24aec0e0d1c656e9234b620.zip -o icons.zip
unzip -j icons.zip 'Brand\ Icons/astra-square.png' -d ./apis/sgv2-quarkus-common/src/main/resources/META-INF/branding/
mv ./apis/sgv2-quarkus-common/src/main/resources/META-INF/branding/astra-square.png ./apis/sgv2-quarkus-common/src/main/resources/META-INF/branding/logo.png
- name: Build and push (graphqlapi, Amazon ECR)
if: ${{ !inputs.skipPublish }}
env:
QUARKUS_APPLICATION_NAME: 'Astra DB GraphQL API'
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp clean package -pl sgv2-graphqlapi -am -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.push=true -Dquarkus.container-image.registry=${{ secrets.ECR_REPOSITORY }} -Dquarkus.container-image.tag=${{needs.resolve-tag.outputs.release-tag}}
- name: Build and push (docsapi, Amazon ECR)
if: ${{ !inputs.skipPublish }}
env:
QUARKUS_APPLICATION_NAME: 'Astra DB Document API'
QUARKUS_SMALLRYE_OPENAPI_INFO_DESCRIPTION: 'The Astra DB Document API modifies and queries data stored as unstructured JSON documents in collections. See the [documentation site](https://docs.datastax.com/en/astra-serverless/docs/develop/dev-with-doc.html) for additional information.'
QUARKUS_SMALLRYE_OPENAPI_INFO_TERMS_OF_SERVICE: 'https://www.datastax.com/legal'
QUARKUS_SMALLRYE_OPENAPI_INFO_CONTACT_NAME: 'DataStax'
QUARKUS_SMALLRYE_OPENAPI_INFO_CONTACT_URL: 'https://www.datastax.com/contact-us'
QUARKUS_SMALLRYE_OPENAPI_INFO_LICENSE_NAME: ''
QUARKUS_SMALLRYE_OPENAPI_INFO_LICENSE_URL: ''
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp clean package -pl sgv2-docsapi -am -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.push=true -Dquarkus.container-image.registry=${{ secrets.ECR_REPOSITORY }} -Dquarkus.container-image.tag=${{needs.resolve-tag.outputs.release-tag}}
- name: Build and push (restapi, Amazon ECR)
if: ${{ !inputs.skipPublish }}
env:
QUARKUS_APPLICATION_NAME: 'Astra DB REST API'
QUARKUS_SMALLRYE_OPENAPI_INFO_DESCRIPTION: 'The Astra DB REST API exposes CRUD access to data stored in Cassandra tables. See the [documentation site](https://docs.datastax.com/en/astra-serverless/docs/develop/dev-with-rest.html) for additional information.'
QUARKUS_SMALLRYE_OPENAPI_INFO_TERMS_OF_SERVICE: 'https://www.datastax.com/legal'
QUARKUS_SMALLRYE_OPENAPI_INFO_CONTACT_NAME: 'DataStax'
QUARKUS_SMALLRYE_OPENAPI_INFO_CONTACT_URL: 'https://www.datastax.com/contact-us'
QUARKUS_SMALLRYE_OPENAPI_INFO_LICENSE_NAME: ''
QUARKUS_SMALLRYE_OPENAPI_INFO_LICENSE_URL: ''
run: |
cd apis/
JAVA_HOME=$JAVA_17 ./mvnw -B -ntp clean package -pl sgv2-restapi -am -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.push=true -Dquarkus.container-image.registry=${{ secrets.ECR_REPOSITORY }} -Dquarkus.container-image.tag=${{needs.resolve-tag.outputs.release-tag}}
# signs all docker images with cosign
# skip whole job if we did not push images
sign-images:
name: Sign container images
needs: [resolve-tag, publish-docker]
if: ${{ !inputs.skipPublish }}
runs-on: ubuntu-latest
strategy:
matrix:
image: [restapi, graphqlapi, docsapi]
env:
# not a newest version, this reflects riptano action target version
# 22-Jul-2025, tatu: pre-2.0.0 no longer supported, use current latest
COSIGN_VERSION: v2.5.3
steps:
- name: Install Cosign
uses: sigstore/cosign-installer@main
with:
cosign-release: ${COSIGN_VERSION}
- name: Configure AWS credentials via OIDC
uses: aws-actions/configure-aws-credentials@v5
with:
role-to-assume: ${{ secrets.ECR_FEDERATED_ROLE }}
aws-region: us-east-1
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v2
with:
mask-password: 'true'
# we need to sign also images created by additional tags
# in this case v2 tag
- name: Sign a docker image
shell: bash
env:
COSIGN_IMAGE: ${{ secrets.ECR_REPOSITORY }}/stargateio/${{ matrix.image }}:${{ needs.resolve-tag.outputs.release-tag }}
COSIGN_IMAGE_V2: ${{ secrets.ECR_REPOSITORY }}/stargateio/${{ matrix.image }}:v2.1
COSIGN_PRIVATE_BASE64: ${{ secrets.COSIGN_PRIVATE_BASE64}}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD}}
COSIGN_KEY_FILE: _cosign_key_
AUX_KEY: signedby
AUX_VALUE: stargate
run: |
echo $COSIGN_PRIVATE_BASE64 | base64 --decode > $COSIGN_KEY_FILE
echo "=== signing image [$COSIGN_IMAGE] ..."
cosign sign --key $COSIGN_KEY_FILE -a $AUX_KEY=$AUX_VALUE $COSIGN_IMAGE
echo "=== signing image [$COSIGN_IMAGE_V2] ..."
cosign sign --key $COSIGN_KEY_FILE -a $AUX_KEY=$AUX_VALUE $COSIGN_IMAGE_V2
# creates a PR for bumping the versions to the next snapshot
# only executed if we have created the new release
create-pr:
name: Version upgrade PR
needs: [create-release]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
# since we only bump the versions, Java 17 only is fine here
- name: Set up JDK 17
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '17'
cache: maven
- name: Setup Maven
run: |
mkdir -p ~/.m2
cat <<EOF > ~/.m2/settings.xml
<settings>
<servers>
<server>
<id>artifactory-snapshots</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-releases</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
<server>
<id>artifactory-dse</id>
<username>${ARTIFACTORY_USERNAME}</username>
<password>${ARTIFACTORY_PASSWORD}</password>
</server>
</servers>
</settings>
EOF
- name: Generate changelog
continue-on-error: true
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: ./update_changelog.sh
- name: Update version numbers (coordinator)
run: |
cd coordinator/
./mvnw -B -ntp release:update-versions -DautoVersionSubmodules=true versions:commit -P all
./mvnw -B -ntp xml-format:xml-format fmt:format -P all
- name: Update version numbers (apis)
run: |
cd apis/
./mvnw -B -ntp release:update-versions -DautoVersionSubmodules=true versions:commit
./mvnw -B -ntp xml-format:xml-format fmt:format
- name: Rev Version
if: success()
uses: peter-evans/create-pull-request@v7
with:
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: "Bumping version for next v2.1 release"
title: "Bumping version for next v2.1 release"
branch-suffix: "short-commit-hash"
base: "v2.1"
labels: "v2.1"
# dispatch release event
dispatch:
name: Dispatch release event
needs: [ 'resolve-tag', 'build', 'publish-central', 'publish-docker']
if: ${{ always() }}
continue-on-error: true
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
repo: [ 'riptano/c2']
include:
- repo: riptano/c2
secret: STARGATE_GH_RELEASE
steps:
- name: Repository dispatch
uses: peter-evans/repository-dispatch@v4
with:
token: ${{ secrets[matrix.secret] }}
repository: ${{ matrix.repo }}
event-type: stargate-v21-release
client-payload: '{"version": "${{ needs.resolve-tag.outputs.release-tag}}"}'