SDK Updates: v1.0.0

.github/workflows/release.yml

@@ -0,0 +1,95 @@
+name: Release
+on:
+  push:
+    branches: ['main']
+    paths:
+      - '.github/workflows/release.yml'
+      - 'pom.xml'
+  workflow_dispatch:
+
+env:
+  # SDK identity baked in at generation time from the in-memory build context,
+  # so the workflow never reads pom.xml at runtime.
+  SDK_VERSION: '1.0.0'
+  SDK_GROUP_ID: 'com.alohi'
+  SDK_ARTIFACT_ID: 'signplus'
+  RELEASE_TAG: 'v1.0.0'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create tag if it does not exist
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh api "repos/${{ github.repository }}/git/refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "::notice::Tag $RELEASE_TAG already exists, nothing to do"
+            exit 0
+          fi
+          gh api -X POST "repos/${{ github.repository }}/git/refs" \
+            -f ref="refs/tags/$RELEASE_TAG" \
+            -f sha="${{ github.sha }}"
+          echo "::notice::Created tag $RELEASE_TAG at ${{ github.sha }}"
+      - name: Check required publishing secrets
+        id: secrets
+        # Publishing is enabled by default. Secrets cannot be referenced in a
+        # step-level `if:`, so read them into env here and skip the publish steps
+        # (succeeding, not failing) when a required secret is unset or empty.
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+        run: |
+          # GPG_PASSPHRASE is intentionally not required: passphrase-less signing
+          # keys are common in CI, so its absence must not block publishing.
+          if [ -n "$MAVEN_CENTRAL_USERNAME" ] && [ -n "$MAVEN_CENTRAL_PASSWORD" ] && [ -n "$GPG_PRIVATE_KEY" ]; then
+            echo "ok=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ok=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Maven Central credentials or GPG signing key not set; skipping Maven Central publishing."
+          fi
+      # Maven Central (Sonatype) requires GPG-signed artifacts plus -sources and
+      # -javadoc jars. The generated pom.xml attaches those via the
+      # `release-sign-artifacts` profile (activated by -DperformRelease=true) and
+      # publishes through the central-publishing-maven-plugin (server id: central).
+      - uses: actions/setup-java@v4
+        if: steps.secrets.outputs.ok == 'true'
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          server-id: 'central'
+          server-username: MAVEN_CENTRAL_USERNAME
+          server-password: MAVEN_CENTRAL_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase: GPG_PASSPHRASE
+      - name: Publish to Maven Central
+        if: steps.secrets.outputs.ok == 'true'
+        # Idempotent: Maven Central is immutable, so re-running for an
+        # already-published version (e.g. enabling publishing on an existing
+        # tag) skips the deploy instead of failing.
+        run: |
+          GROUP_PATH="${SDK_GROUP_ID//./\/}"
+          POM_URL="https://repo1.maven.org/maven2/${GROUP_PATH}/${SDK_ARTIFACT_ID}/${SDK_VERSION}/${SDK_ARTIFACT_ID}-${SDK_VERSION}.pom"
+          if curl -sfI "$POM_URL" >/dev/null 2>&1; then
+            echo "::notice::$SDK_GROUP_ID:$SDK_ARTIFACT_ID:$SDK_VERSION already published to Maven Central, skipping deploy"
+          else
+            mvn --batch-mode -DperformRelease=true -DskipTests deploy
+          fi
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      - name: Create GitHub release
+        if: steps.secrets.outputs.ok == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "::notice::Release $RELEASE_TAG already exists"
+          else
+            gh release create "$RELEASE_TAG" --title "$RELEASE_TAG" --generate-notes
+          fi

.gitignore

@@ -29,6 +29,9 @@ build/
 gradle-app.setting
 !gradle-wrapper.jar
 
+# Kotlin
+.kotlin
+
 # IntelliJ
 out/
 .idea/