From 02153736bea4975eece9de735ec59b995e57062f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 07:29:54 +0000 Subject: [PATCH 1/4] Update GitHub Actions dependencies --- .github/workflows/build.yml | 4 ++-- .github/workflows/release.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7068c192..9570f819 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: version: 2026.10.9 - uses: SonarSource/ci-github-actions/build-gradle@v2 @@ -55,7 +55,7 @@ jobs: name: Promote steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: cache_save: false version: 2026.10.9 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 25bfa40b..efeca064 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,7 +10,7 @@ jobs: permissions: id-token: write contents: write - uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v6 + uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v7 with: publishToBinaries: true mavenCentralSync: true From e82a37e5ee03c101502b0861c0f07034f7ce6852 Mon Sep 17 00:00:00 2001 From: Michal Zgliczynski Date: Tue, 20 Oct 2026 14:14:55 +0200 Subject: [PATCH 2/4] Complete migration to draft-first release workflow v7 --- .github/workflows/release.yml | 10 +++++++--- README.md | 14 ++++++++++++++ 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index efeca064..ef6e79eb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,9 +1,12 @@ name: sonar-release on: - release: - types: - - published + workflow_dispatch: + inputs: + version: + description: 'Full version including build number, e.g. 1.2.3.456' + required: true + type: string jobs: release: @@ -12,6 +15,7 @@ jobs: contents: write uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v7 with: + version: ${{ inputs.version }} publishToBinaries: true mavenCentralSync: true slackChannel: ops-ci-experience diff --git a/README.md b/README.md index 8e640e31..77178cb7 100644 --- a/README.md +++ b/README.md @@ -40,6 +40,20 @@ Also note that the version no longer follows SonarQube Server's versions. The `s See the [releases](https://github.com/SonarSource/sonar-plugin-api/releases) for changelogs. +## Releasing + +After the build and promotion succeed for the commit to release, go to **Actions → sonar-release → Run workflow**. +Select the branch containing that commit and enter the full version including the build number (for example, `14.1.0.5543`). +You can also start the workflow from the CLI: + +```sh +gh workflow run release.yml --repo SonarSource/sonar-plugin-api --ref -f version= +``` + +The workflow creates or reuses a draft GitHub release, publishes the artifacts and Javadoc, and publishes the release after all publication steps succeed. +Start releases through this workflow; do not manually publish the GitHub release. +If a release fails, fix the cause and re-run the failed workflow from GitHub Actions using the same version. The draft remains available for the retry. + ## Deprecation Policy From 62591a9066febf493d7ed65e513fae275e097c62 Mon Sep 17 00:00:00 2001 From: Michal Zgliczynski Date: Tue, 20 Oct 2026 14:24:14 +0200 Subject: [PATCH 3/4] Diagnose build-number ref creation permissions --- .github/workflows/build.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9570f819..6d4a2e61 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -25,6 +25,36 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + - name: Diagnose build-number ref permissions + env: + GH_TOKEN: ${{ github.token }} + BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} + run: | + refs=() + cleanup() { + for ref in "${refs[@]}"; do + gh api --method DELETE "repos/$GITHUB_REPOSITORY/git/refs/$ref" || true + done + } + trap cleanup EXIT + probe() { + local label="$1" sha="$2" ref response + ref="build-number-diagnostic/$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$label" + echo "Testing $label ($sha)" + if response=$(gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \ + -f "ref=refs/$ref" -f "sha=$sha" 2>&1); then + refs+=("$ref") + echo "SUCCESS: $label" + else + echo "FAILED: $label: $response" + fi + } + probe base "$BASE_SHA" + probe previous-success 02153736bea4975eece9de735ec59b995e57062f + probe previous-failure e82a37e5ee03c101502b0861c0f07034f7ce6852 + probe head "$HEAD_SHA" + probe merge "$GITHUB_SHA" - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: version: 2026.10.9 From 7bf3d20c6288ec0d19a9b9446fe24f2fbdc9eb4e Mon Sep 17 00:00:00 2001 From: Michal Zgliczynski Date: Tue, 20 Oct 2026 14:25:33 +0200 Subject: [PATCH 4/4] Allocate build number against PR head and share with promotion --- .github/workflows/build.yml | 43 +++++++++++-------------------------- 1 file changed, 12 insertions(+), 31 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6d4a2e61..13227471 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,44 +21,24 @@ jobs: name: Build runs-on: github-ubuntu-latest-s timeout-minutes: 30 + outputs: + BUILD_NUMBER: ${{ steps.build-number.outputs.BUILD_NUMBER }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - name: Diagnose build-number ref permissions - env: - GH_TOKEN: ${{ github.token }} - BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }} - HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} - run: | - refs=() - cleanup() { - for ref in "${refs[@]}"; do - gh api --method DELETE "repos/$GITHUB_REPOSITORY/git/refs/$ref" || true - done - } - trap cleanup EXIT - probe() { - local label="$1" sha="$2" ref response - ref="build-number-diagnostic/$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$label" - echo "Testing $label ($sha)" - if response=$(gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \ - -f "ref=refs/$ref" -f "sha=$sha" 2>&1); then - refs+=("$ref") - echo "SUCCESS: $label" - else - echo "FAILED: $label: $response" - fi - } - probe base "$BASE_SHA" - probe previous-success 02153736bea4975eece9de735ec59b995e57062f - probe previous-failure e82a37e5ee03c101502b0861c0f07034f7ce6852 - probe head "$HEAD_SHA" - probe merge "$GITHUB_SHA" - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: version: 2026.10.9 + - name: Allocate build number + id: build-number + uses: SonarSource/ci-github-actions/get-build-number@v2 + env: + # Ref creation accepts the PR head; the build still uses the merge commit. + GITHUB_SHA: ${{ github.event.pull_request.head.sha || github.sha }} - uses: SonarSource/ci-github-actions/build-gradle@v2 + env: + BUILD_NUMBER: ${{ steps.build-number.outputs.BUILD_NUMBER }} with: artifactory-reader-role: private-reader artifactory-deployer-role: qa-deployer @@ -89,7 +69,8 @@ jobs: with: cache_save: false version: 2026.10.9 - - uses: SonarSource/ci-github-actions/get-build-number@v2 - uses: SonarSource/ci-github-actions/promote@v2 + env: + BUILD_NUMBER: ${{ needs.build.outputs.BUILD_NUMBER }} with: promote-pull-request: true