ci: publish releases to the Stream Maven repository

Gradle stages a signed tree under build/staged-repo when streamPublishTargets includes streamRepo; a separate upload job pushes it with the build-conventions action. The GitHub release is created only after the upload, with the Stream repository card. Central stays available by changing PUBLISH_TARGETS.

Author: aleksandar-apostolov

.github/workflows/release.yml

@@ -6,52 +6,177 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  pull-requests: read
+
+env:
+  # Where releases go: streamRepo, central, or streamRepo,central. Central is a manual
+  # escape hatch for a release that has to go out when the Stream repository cannot take it.
+  PUBLISH_TARGETS: streamRepo
+
 jobs:
   Release:
     name: 🚀 Release
     if: github.event.pull_request.merged && startsWith(github.head_ref, 'release-')
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      stream_repo: ${{ steps.version.outputs.stream_repo }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
-      - uses: actions/github-script@v5
-        with:
-          script: |
-            const get_change_log_diff = require('./scripts/get_changelog_diff.js')
-            core.exportVariable('CHANGELOG', get_change_log_diff())
 
-            // Getting the release version from the PR source branch
-            // Source branch looks like this: release-1.0.0
-            const version = context.payload.pull_request.head.ref.split('-')[1]
-            core.exportVariable('VERSION', version)
+      # Getting the release version (the tag) from the PR source branch
+      # Source branch looks like this: release-v1.0.0
+      - name: Read the version
+        id: version
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          echo "version=${HEAD_REF#release-}" >> "$GITHUB_OUTPUT"
+          echo "stream_repo=${{ contains(env.PUBLISH_TARGETS, 'streamRepo') }}" >> "$GITHUB_OUTPUT"
+
+      - name: Write the signing keyring
+        run: |
+          sudo bash -c "echo '$GPG_KEY_CONTENTS' | base64 -d > '$SIGNING_SECRET_KEY_RING_FILE'"
+        env:
+          GPG_KEY_CONTENTS: ${{ secrets.GPG_KEY_CONTENTS }}
+          SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}
 
       - name: Build artifacts
         run: ./gradlew jar javadocJar sourcesJar
 
+      # An env var rather than -P, so a value with a space cannot split into a second argument.
+      - name: Select publish targets
+        run: echo "ORG_GRADLE_PROJECT_streamPublishTargets=$PUBLISH_TARGETS" >> "$GITHUB_ENV"
+
+      # Stages a signed Maven-2 tree under build/staged-repo for the upload job.
+      - name: Stage for the Stream repository
+        if: ${{ contains(env.PUBLISH_TARGETS, 'streamRepo') }}
+        run: ./gradlew publishReleasePublicationToStreamRepoStagingRepository --max-workers 1
+        env:
+          STREAM_KEY: ${{ secrets.STREAM_KEY }}
+          STREAM_SECRET: ${{ secrets.STREAM_SECRET }}
+          STREAM_APP_ID: ${{ secrets.STREAM_APP_ID }}
+          SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
+          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+          SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}
+
       - name: Publish to MavenCentral
-        run: |
-          sudo bash -c "echo '$GPG_KEY_CONTENTS' | base64 -d > '$SIGNING_SECRET_KEY_RING_FILE'"
-          ./gradlew publishReleasePublicationToSonatypeRepository --max-workers 1 closeAndReleaseSonatypeStagingRepository
+        if: ${{ contains(env.PUBLISH_TARGETS, 'central') }}
+        run: ./gradlew publishReleasePublicationToSonatypeRepository --max-workers 1 closeAndReleaseSonatypeStagingRepository
         env:
           STREAM_KEY: ${{ secrets.STREAM_KEY }}
           STREAM_SECRET: ${{ secrets.STREAM_SECRET }}
           STREAM_APP_ID: ${{ secrets.STREAM_APP_ID }}
-          GPG_KEY_CONTENTS: ${{ secrets.GPG_KEY_CONTENTS }}
           OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
           OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
           SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
           SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
           SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}
           SONATYPE_STAGING_PROFILE_ID: ${{ secrets.SONATYPE_STAGING_PROFILE_ID }}
 
+      # Handed to a job that has never seen the signing key -- the reason Gradle stages to a
+      # directory instead of writing to the bucket itself.
+      - name: Hand the staged tree to the upload job
+        if: ${{ contains(env.PUBLISH_TARGETS, 'streamRepo') }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: stream-repo-staged
+          path: build/staged-repo
+          retention-days: 1
+          if-no-files-found: error
+
+  # Separate job: secrets are injected per job, so this one holds the R2 credential and never the
+  # signing key, and the Release job holds the signing key and never the R2 credential.
+  Upload:
+    name: ☁️ Upload to the Stream repository
+    needs: Release
+    if: ${{ needs.Release.outputs.stream_repo == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download the staged tree
+        uses: actions/download-artifact@v4
+        with:
+          name: stream-repo-staged
+          path: build/staged-repo
+
+      - name: Publish to the Stream repository
+        uses: GetStream/stream-build-conventions-android/.github/actions/publish-to-stream-repo@v1.0.1
+        with:
+          staged-directory: build/staged-repo
+          channel: releases
+          endpoint: ${{ secrets.STREAM_REPO_ENDPOINT }}
+          bucket: ${{ secrets.STREAM_REPO_BUCKET }}
+          access-key-id: ${{ secrets.STREAM_REPO_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.STREAM_REPO_SECRET_ACCESS_KEY }}
+
+  # The tag and the GitHub release only once the artifact is actually resolvable: after the
+  # upload when the Stream repository is a target, straight after publishing when it is not.
+  GitHub-Release:
+    name: 🏷️ Create the GitHub release
+    needs: [Release, Upload]
+    if: >-
+      ${{ always()
+          && needs.Release.result == 'success'
+          && (needs.Upload.result == 'success' || needs.Upload.result == 'skipped') }}
+    runs-on: ubuntu-latest
+    permissions:
+      # write is needed to create the tag and the GitHub release
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const get_change_log_diff = require('./scripts/get_changelog_diff.js')
+            require('fs').writeFileSync('changes.md', get_change_log_diff())
+
+      # Customers need a repository line to see a version that is not on Central.
+      - name: Write the release notes
+        env:
+          TAG: ${{ needs.Release.outputs.version }}
+        run: |
+          VERSION="${TAG#v}"
+          : > notes.md
+          if [ "$PUBLISH_TARGETS" == "streamRepo" ]; then
+            cat > notes.md <<EOF
+          > [!IMPORTANT]
+          > **\`io.getstream.client:stream-java:$VERSION\` is published to the Stream Maven repository, not Maven Central.**
+          >
+          > Gradle (\`build.gradle.kts\`):
+          > \`\`\`kotlin
+          > repositories {
+          >     mavenCentral()
+          >     maven("https://stream-io-repo.com")
+          > }
+          > \`\`\`
+          >
+          > Maven (\`pom.xml\`):
+          > \`\`\`xml
+          > <repositories>
+          >   <repository>
+          >     <id>stream</id>
+          >     <url>https://stream-io-repo.com</url>
+          >   </repository>
+          > </repositories>
+          > \`\`\`
+
+          EOF
+          fi
+          cat changes.md >> notes.md
+
       - name: Create release on GitHub
         uses: ncipollo/release-action@v1
         with:
-          body: ${{ env.CHANGELOG }}
-          tag: ${{ env.VERSION }}
+          bodyFile: notes.md
+          tag: ${{ needs.Release.outputs.version }}
+          commit: ${{ github.event.pull_request.merge_commit_sha }}
           token: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -30,7 +30,18 @@ For the client-side integrations (web and mobile) have a look at the JavaScript,
 
 ## ⚙️ Installation
 
-Add the following dependency to your `pom.xml`:
+Releases are published to the Stream Maven repository. Add it next to Maven Central, then add the dependency.
+
+In your `pom.xml`:
+
+```xml
+<repositories>
+    <repository>
+        <id>stream</id>
+        <url>https://stream-io-repo.com</url>
+    </repository>
+</repositories>
+```
 
 ```xml
 <dependency>
@@ -43,7 +54,14 @@ Add the following dependency to your `pom.xml`:
 or in your `build.gradle`:
 
 ```gradle
-implementation 'io.getstream.client:stream-java:$stream_version'
+repositories {
+    mavenCentral()
+    maven { url 'https://stream-io-repo.com' }
+}
+
+dependencies {
+    implementation 'io.getstream.client:stream-java:$stream_version'
+}
 ```
 
 In case you want to download the artifact and put it manually into your project,

publish.gradle

@@ -25,6 +25,15 @@ if (secretPropsFile.exists()) {
     ext["sonatypeStagingProfileId"] = System.getenv('SONATYPE_STAGING_PROFILE_ID')
 }
 
+// Where to publish: "streamRepo", "central", or both, comma-separated. CI always passes it;
+// with nothing passed this stays on Central so a local publishToMavenLocal behaves as before.
+// streamRepo stages a Maven-2 tree under build/staged-repo for a separate upload job.
+def publishTargets = (findProperty("streamPublishTargets") ?: "central").toString()
+        .split(",").collect { it.trim() }.findAll { !it.isEmpty() }.toSet()
+if (publishTargets.isEmpty() || !(publishTargets - ["central", "streamRepo"]).isEmpty()) {
+    throw new GradleException("'streamPublishTargets' must be a comma-separated subset of central, streamRepo but was '$publishTargets'")
+}
+
 nexusPublishing {
     repositories {
         sonatype {
@@ -87,6 +96,14 @@ afterEvaluate {
                 }
             }
         }
+        if ("streamRepo" in publishTargets) {
+            repositories {
+                maven {
+                    name = "streamRepoStaging"
+                    url = layout.buildDirectory.dir("staged-repo").get().asFile.toURI()
+                }
+            }
+        }
     }
 }