cryptomator/.github/workflows/release-check.yml

name: Release Check

on:
  push:
    branches:
      - 'release/**'
      - 'hotfix/**'

defaults:
  run:
    shell: bash

env:
  JAVA_DIST: 'temurin'
  JAVA_VERSION: 25

jobs:
  check-preconditions:
    name: Validate commits pushed to release/hotfix branch to fulfill release requirements
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: Setup Java
        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: 'maven'
      - id: validate-pom-version
        name: Validate POM version
        run: |
          if [[ $GITHUB_REF =~ refs/heads/(hotfix|release)/[0-9]+\.[0-9]+\.[0-9]+.* ]]; then
            SEM_VER_STR=${GITHUB_REF##*/}
          else
            echo "Failed to parse version"
            exit 1
          fi

          if [[ ${SEM_VER_STR} == `mvn help:evaluate -Dexpression=project.version -q -DforceStdout` ]]; then
            echo "semVerStr=${SEM_VER_STR}" >> $GITHUB_OUTPUT
          else
            echo "Version not set in POM"
            exit 1
          fi
      - name: Validate release in org.cryptomator.Cryptomator.metainfo.xml file
        run: |
          if ! grep -q "<release date=\".*\" version=\"${{ steps.validate-pom-version.outputs.semVerStr }}\">" dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml; then
            echo "Release not set in dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml"
            exit 1
          fi
      - name: Cache NVD DB
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/.m2/repository/org/owasp/dependency-check-data/
          key: dependency-check-${{ github.run_id }}
          restore-keys: |
            dependency-check
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5
      - name: Run org.owasp:dependency-check plugin
        id: dependency-check
        continue-on-error: true
        run: mvn -B verify -Pdependency-check -DskipTests
        env:
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}