ADFA-4085: Decouple plugin-api release from weekly-release workflow

.github/workflows/release-plugin-api.yml

@@ -0,0 +1,59 @@
+name: Release plugin-api (manual)
+
+on:
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+concurrency:
+ group: release-plugin-api
+ cancel-in-progress: false
+
+jobs:
+
+ release-plugin-api:
+ runs-on: self-hosted
+ permissions:
+ contents: write
+ steps:
+ - uses: actions/checkout@v4
+ with:
+ ref: main
+ persist-credentials: false
+
+ - name: Build plugin-api jar
+ run: |
+ flox activate -d flox/base -- \
+ ./gradlew --console=plain --no-daemon :plugin-api:createPluginApiJar
+
+ - name: Build plugin-builder jar
+ run: |
+ flox activate -d flox/base -- \
+ ./gradlew --console=plain --no-daemon -p plugin-api/plugin-builder :jar
+
+ - name: Stage plugin-api release assets
+ run: |
+ mkdir -p .release
+ cp plugin-api/build/libs/plugin-api-*.jar .release/plugin-api.jar
+ cp plugin-api/plugin-builder/build/libs/plugin-builder-*.jar .release/gradle-plugin.jar
+ ( cd .release && sha256sum plugin-api.jar gradle-plugin.jar > checksums.txt )
+ ls -la .release
+
+ - name: Replace plugin-api-latest release
+ env:
+ GH_TOKEN: ${{ github.token }}
+ shell: flox activate -d flox/base -- bash -eo pipefail {0}
+ run: |
+ TARGET_SHA="$(git rev-parse HEAD)"
+ if gh release view plugin-api-latest >/dev/null 2>&1; then
+ gh release delete plugin-api-latest --cleanup-tag --yes
+ sleep 10
+ fi
+ gh release create plugin-api-latest \
+ --target "$TARGET_SHA" \
+ --title "plugin-api (latest)" \
+ --notes "built from ${TARGET_SHA} on $(date -u +'%Y-%m-%d %H:%M:%S UTC')" \
+ .release/plugin-api.jar \
+ .release/gradle-plugin.jar \
+ .release/checksums.txt

.github/workflows/weekly-release.yml

@@ -24,6 +24,7 @@ jobs:
  with:
  ref: main
  fetch-depth: 0
+ persist-credentials: false
 
  - name: Compute CalVer version
  id: compute
@@ -38,6 +39,7 @@ jobs:
  id: previous
  env:
  GH_TOKEN: ${{ github.token }}
+ shell: flox activate -d flox/base -- bash -eo pipefail {0}
  run: |
  PREVIOUS_TAG=$(gh release list --json tagName \
  --jq '[.[] | select(.tagName | test("^[0-9]+\\.[0-9]+$"))] | .[0].tagName // ""')
@@ -62,49 +64,6 @@ jobs:
  echo "version_id=$VERSION_ID" >> "$GITHUB_OUTPUT"
  echo "Jira version $VERSION → id $VERSION_ID"
 
- release-plugin-api:
- needs: prepare
- runs-on: self-hosted
- permissions:
- contents: write
- steps:
- - uses: actions/checkout@v4
- with:
- ref: main
-
- - name: Build plugin-api jar
- run: |
- flox activate -d flox/base -- \
- ./gradlew --console=plain --no-daemon :plugin-api:createPluginApiJar
-
- - name: Build plugin-builder jar
- run: |
- flox activate -d flox/base -- \
- ./gradlew --console=plain --no-daemon -p plugin-api/plugin-builder :jar
-
- - name: Stage plugin-api release assets
- run: |
- mkdir -p .release
- cp plugin-api/build/libs/plugin-api-*.jar .release/plugin-api.jar
- cp plugin-api/plugin-builder/build/libs/plugin-builder-*.jar .release/gradle-plugin.jar
- ( cd .release && sha256sum plugin-api.jar gradle-plugin.jar > checksums.txt )
- ls -la .release
-
- - name: Replace plugin-api-latest release
- env:
- GH_TOKEN: ${{ github.token }}
- run: |
- if gh release view plugin-api-latest >/dev/null 2>&1; then
- gh release delete plugin-api-latest --cleanup-tag --yes
- fi
- gh release create plugin-api-latest \
- --target "$GITHUB_SHA" \
- --title "plugin-api (latest)" \
- --notes "built from ${GITHUB_SHA} on $(date -u +'%Y-%m-%d %H:%M:%S UTC')" \
- .release/plugin-api.jar \
- .release/gradle-plugin.jar \
- .release/checksums.txt
-
  pull-apk:
  needs: prepare
  runs-on: self-hosted
@@ -121,6 +80,7 @@ jobs:
  - uses: actions/checkout@v4
  with:
  ref: main
+ persist-credentials: false
 
  - name: Reset staging directory
  run: |
@@ -218,7 +178,7 @@ jobs:
  run: rm -rf "$STAGING_DIR"
 
  release-codeonthego:
- needs: [prepare, pull-apk, release-plugin-api]
+ needs: [prepare, pull-apk]
  runs-on: self-hosted
  permissions:
  contents: write
@@ -227,12 +187,14 @@ jobs:
  with:
  ref: main
  fetch-depth: 0
+ persist-credentials: false
 
  - name: Tag and create GitHub Release (idempotent)
  env:
  GH_TOKEN: ${{ github.token }}
  VERSION: ${{ needs.prepare.outputs.version }}
  PREVIOUS_TAG: ${{ needs.prepare.outputs.previous_tag }}
+ shell: flox activate -d flox/base -- bash -eo pipefail {0}
  run: |
  if gh release view "$VERSION" >/dev/null 2>&1; then
  echo "Release $VERSION already exists; skipping creation."
@@ -304,6 +266,11 @@ jobs:
  contents: read
  actions: write
  steps:
+ - uses: actions/checkout@v4
+ with:
+ ref: main
+ persist-credentials: false
+
  - name: Close Jira version (idempotent)
  env:
  JIRA_EMAIL: ${{ secrets.JIRA_EMAIL }}
@@ -329,6 +296,7 @@ jobs:
  env:
  GH_TOKEN: ${{ steps.app-token.outputs.token }}
  NEXT_VERSION: ${{ needs.prepare.outputs.next_version }}
+ shell: flox activate -d flox/base -- bash -eo pipefail {0}
  run: |
  gh variable set NEXT_RELEASE_VERSION --body "$NEXT_VERSION" --repo "$GITHUB_REPOSITORY"
  echo "NEXT_RELEASE_VERSION set to $NEXT_VERSION"