merge 1.9.0-beta04

PirateNetwork · Jul 14, 2023 · 399111b · 399111b
2 parents 753fe9c + 8e92ea2
commit 399111b
Show file tree

Hide file tree

Showing 184 changed files with 5,510 additions and 1,956 deletions.
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
@@ -8,7 +8,7 @@ runs:
       run: |
         echo "home=${HOME}" >> "$GITHUB_ENV"
     - name: Set up Java
-      uses: actions/setup-java@2c7a4878f5d120bd643426d54ae1209b29cc01a3
+      uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc
       with:
         distribution: 'temurin'
         java-version: 17
@@ -31,13 +31,13 @@ runs:
         echo "org.gradle.daemon=false" >> ~/.gradle/gradle.properties
     - name: Gradle Wrapper Cache
       id: gradle-wrapper-cache
-      uses: actions/cache@0865c47f36e68161719c5b124609996bb5c40129
+      uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
       with:
         path: ~/.gradle/wrapper
         key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles(format('{0}{1}', github.workspace, '/gradle/wrapper/gradle-wrapper.properties')) }}
     - name: Gradle Dependency Cache
       id: gradle-dependency-cache
-      uses: actions/cache@0865c47f36e68161719c5b124609996bb5c40129
+      uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
       with:
         path: ~/.gradle/caches/modules-2
         key: ${{ runner.os }}-gradle-deps-${{ hashFiles(format('{0}{1}', github.workspace, '/gradle.properties')) }}
@@ -48,7 +48,7 @@ runs:
 # 2. Relying on the sha for an exact match so that the prime_cache job is re-used by all dependent jobs in a single workflow run
     - name: Gradle Build Cache
       id: gradle-build-cache
-      uses: actions/cache@0865c47f36e68161719c5b124609996bb5c40129
+      uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
       with:
         path: |
           ~/.gradle/caches/build-cache-1
@@ -59,7 +59,7 @@ runs:
           ${{ runner.os }}-gradle-build-
     - name: Rust Cache
       id: rust-cache
-      uses: actions/cache@0865c47f36e68161719c5b124609996bb5c40129
+      uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7
       with:
         path: |
           sdk-lib/target

diff --git a/.github/workflows/deploy-release.yml b/.github/workflows/deploy-release.yml
@@ -1,9 +1,7 @@
 # Expected secrets
 # MAVEN_CENTRAL_USERNAME - Username for Maven Central.
 # MAVEN_CENTRAL_PASSWORD - Password for Maven Central.
-# MAVEN_SIGNING_KEYRING_FILE_BASE64 - Base64 encoded GPG keyring file.
-# MAVEN_SIGNING_KEY_ID - ID for the key in the GPG keyring file.
-# MAVEN_SIGNING_PASSWORD - Password for the key in the GPG keyring file.
+# MAVEN_SIGNING_KEY_ASCII - GPG key without a password which has ASCII-armored and then BASE64-encoded.
 
 name: Deploy Release
 
@@ -20,57 +18,62 @@ jobs:
     steps:
       - name: Checkout
         timeout-minutes: 1
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
       # Gradle Wrapper validation can be flaky
       # https://github.com/gradle/wrapper-validation-action/issues/40
       - name: Gradle Wrapper Validation
         timeout-minutes: 1
         uses: gradle/wrapper-validation-action@e6e38bacfdf1a337459f332974bb2327a31aaf4b
 
+  check_secrets:
+    environment: deployment
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    outputs:
+      has-secrets: ${{ steps.check_secrets.outputs.defined }}
+    steps:
+      - id: check_secrets
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          MAVEN_SIGNING_KEY: ${{ secrets.MAVEN_SIGNING_KEY_ASCII }}
+        if: "${{ env.MAVEN_CENTRAL_USERNAME != '' && env.MAVEN_CENTRAL_PASSWORD != '' && env.MAVEN_SIGNING_KEY != '' }}"
+        run: echo "::set-output name=defined::true"
+
   deploy_release:
     environment: deployment
-    needs: validate_gradle_wrapper
+    needs: [validate_gradle_wrapper, check_secrets]
+    if: needs.check_secrets.outputs.has-secrets == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - name: Checkout
         timeout-minutes: 1
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
       - name: Setup
         id: setup
         timeout-minutes: 30
         uses: ./.github/actions/setup
-      - name: Export Maven Signing Key
-        env:
-          MAVEN_SIGNING_KEYRING_FILE_BASE64: ${{ secrets.MAVEN_SIGNING_KEYRING_FILE_BASE64 }}
-          GPG_KEY_PATH: ${{ format('{0}/keyring.gpg', env.home) }}
-        shell: bash
-        run: |
-          echo ${MAVEN_SIGNING_KEYRING_FILE_BASE64} | base64 --decode > ${GPG_KEY_PATH}
-      # While not strictly necessary, this sanity checks the build before attempting to upload.
-      # This adds minimal additional build time, since most of the work is cached and re-used
-      # in the next step.
       - name: Deploy to Maven Local
         timeout-minutes: 25
         env:
-          ORG_GRADLE_PROJECT_IS_SNAPSHOT: true
-          ORG_GRADLE_PROJECT_RELEASE_SIGNING_ENABLED: false
+          ORG_GRADLE_PROJECT_IS_SNAPSHOT: false
+          ORG_GRADLE_PROJECT_ZCASH_ASCII_GPG_KEY: ${{ secrets.MAVEN_SIGNING_KEY_ASCII }}
         run: |
-          ./gradlew publishToMavenLocal --no-parallel
+          ./gradlew publishReleasePublicationToMavenLocalRepository --no-parallel
+      # Note that GitHub Actions appears to have issues with environment variables that contain periods,
+      # so the GPG variables are done as command line arguments instead.
       - name: Deploy to Maven Central
         timeout-minutes: 8
         env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
           ORG_GRADLE_PROJECT_IS_SNAPSHOT: false
-          ORG_GRADLE_PROJECT_RELEASE_SIGNING_ENABLED: true
-          GPG_KEY_PATH: ${{ format('{0}/keyring.gpg', env.home) }}
-          GPG_KEY_ID: ${{ secrets.MAVEN_SIGNING_KEY_ID }}
-          GPG_PASSWORD: ${{ secrets.MAVEN_SIGNING_PASSWORD }}
+          ORG_GRADLE_PROJECT_ZCASH_MAVEN_PUBLISH_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          ORG_GRADLE_PROJECT_ZCASH_MAVEN_PUBLISH_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          ORG_GRADLE_PROJECT_ZCASH_ASCII_GPG_KEY: ${{ secrets.MAVEN_SIGNING_KEY_ASCII }}
         run: |
-          ./gradlew publish -Psigning.secretKeyRingFile=$GPG_KEY_PATH -Psigning.keyId=$GPG_KEY_ID -Psigning.password=$GPG_PASSWORD --no-parallel
-          ./gradlew closeAndReleaseRepository --no-parallel
+          ./gradlew publishReleasePublicationToMavenCentralRepository --no-parallel
       - name: Collect Artifacts
         timeout-minutes: 1
         if: ${{ always() }}
@@ -83,8 +86,8 @@ jobs:
           zip -r ${BINARIES_ZIP_PATH} . -i *build/outputs/*
       - name: Upload Artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
-        timeout-minutes: 1
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb
+        timeout-minutes: 2
         with:
           name: Release binaries
           path: ~/artifacts
diff --git a/.github/workflows/deploy-snapshot.yml b/.github/workflows/deploy-snapshot.yml
@@ -28,23 +28,38 @@ jobs:
     steps:
       - name: Checkout
         timeout-minutes: 1
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
       # Gradle Wrapper validation can be flaky
       # https://github.com/gradle/wrapper-validation-action/issues/40
       - name: Gradle Wrapper Validation
         timeout-minutes: 1
         uses: gradle/wrapper-validation-action@e6e38bacfdf1a337459f332974bb2327a31aaf4b
 
+  check_secrets:
+    environment: deployment
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    outputs:
+      has-secrets: ${{ steps.check_secrets.outputs.defined }}
+    steps:
+      - id: check_secrets
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+        if: "${{ env.MAVEN_CENTRAL_USERNAME != '' && env.MAVEN_CENTRAL_PASSWORD != '' }}"
+        run: echo "::set-output name=defined::true"
+
   deploy_snapshot:
     environment: deployment
-    needs: validate_gradle_wrapper
+    needs: [validate_gradle_wrapper, check_secrets]
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - name: Checkout
         timeout-minutes: 1
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
       - name: Setup
         id: setup
         timeout-minutes: 30
@@ -56,18 +71,16 @@ jobs:
         timeout-minutes: 25
         env:
           ORG_GRADLE_PROJECT_IS_SNAPSHOT: true
-          ORG_GRADLE_PROJECT_RELEASE_SIGNING_ENABLED: false
         run: |
-          ./gradlew publishToMavenLocal --no-parallel
+          ./gradlew publishReleasePublicationToMavenLocalRepository --no-parallel
       - name: Deploy to Maven Central
         timeout-minutes: 8
         env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          ORG_GRADLE_PROJECT_ZCASH_MAVEN_PUBLISH_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          ORG_GRADLE_PROJECT_ZCASH_MAVEN_PUBLISH_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
           ORG_GRADLE_PROJECT_IS_SNAPSHOT: true
-          ORG_GRADLE_PROJECT_RELEASE_SIGNING_ENABLED: false
         run: |
-          ./gradlew publish --no-parallel
+          ./gradlew publishReleasePublicationToMavenCentralRepository --no-parallel
       - name: Collect Artifacts
         timeout-minutes: 1
         if: ${{ always() }}
@@ -80,8 +93,8 @@ jobs:
           zip -r ${BINARIES_ZIP_PATH} . -i *build/outputs/*
       - name: Upload Artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
-        timeout-minutes: 1
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb
+        timeout-minutes: 2
         with:
           name: Snapshot binaries
           path: ~/artifacts