From 57da31e6d274b5d0108d768d2b5fe24f797b99f3 Mon Sep 17 00:00:00 2001
From: "Mateusz \"Serafin\" Gajewski" <github@wendigo.pl>
Date: Thu, 26 Feb 2026 14:52:11 -0500
Subject: [PATCH] Add release automation

---
 .github/workflows/release.yml | 110 ++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..f16c71f
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,110 @@
+name: Release new version
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+
+    steps:
+      - name: Check if release is running from master
+        run: |
+          if [ "${GITHUB_REF}" != "refs/heads/master" ]; then
+            echo "Release is only allowed from master branch"
+            exit 1
+          fi
+
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install java
+        uses: actions/setup-java@v5
+        with:
+          java-version: 25
+          distribution: 'temurin'
+          gpg-private-key: ${{ secrets.RELEASE_GPG_SECRET_KEY }}
+          gpg-passphrase: MAVEN_GPG_PASSPHRASE
+          cache: 'maven'
+
+      - name: Configure git
+        run: |
+          git config user.name "Trino Release"
+          git config user.email "trino-bot@trino.io"
+
+      - name: Lock branch before release
+        uses: github/lock@v3
+        id: release-lock
+        with:
+          mode: lock
+
+      - name: Prepare build image
+        run: ./build-image.sh
+
+      - name: Run ./mvnw release:prepare
+        env:
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+        run: |
+          ./mvnw -B release:prepare -Poss-release
+
+      - name: Determine release version
+        run: |
+          export VERSION=$(grep 'scm.tag=' release.properties | cut -d'=' -f2)
+          echo "VERSION=${VERSION}" >> $GITHUB_ENV
+          echo "Releasing version: ${VERSION}"
+
+      - name: Run ./mvnw release:perform to local staging
+        env:
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+        run: |
+          ./mvnw -B release:perform -Poss-release
+
+      - name: Display git status and history
+        run: |
+          git status
+          git log --oneline -n 2
+
+      - name: Run njord:validate
+        env:
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+          MAVENCENTRAL_USERNAME: ${{ vars.RELEASE_MAVEN_CENTRAL_USERNAME }}
+          MAVENCENTRAL_PASSWORD: ${{ secrets.RELEASE_MAVEN_CENTRAL_TOKEN }}
+        run: |
+          ./mvnw njord:list
+          ./mvnw njord:status
+          ./mvnw njord:validate
+
+      - name: Run njord:publish
+        env:
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+          MAVENCENTRAL_USERNAME: ${{ vars.RELEASE_MAVEN_CENTRAL_USERNAME }}
+          MAVENCENTRAL_PASSWORD: ${{ secrets.RELEASE_MAVEN_CENTRAL_TOKEN }}
+        run:
+          ./mvnw njord:publish -Poss-release
+
+      - name: Push git changes
+        run: |
+          git status
+          git describe
+          git push origin master
+          git push origin --tags
+
+      - name: Unlock branch after a release
+        uses: github/lock@v3
+        id: release-unlock
+        with:
+          mode: unlock
+
+      - name: Create release notes
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          gh release create "${VERSION}" \
+              --repo="${GITHUB_REPOSITORY}" \
+              --title="${GITHUB_REPOSITORY#*/} ${VERSION}" \
+              --generate-notes