Add AnalysisPlugin interface for tracking analysis decisions

.github/scripts/ci-build.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 set -ev
 
-# gpg key handling for github action build
+# this is importing the private key on the CI machine
 if [[ -n "${GPG_PRIVATE_KEY}" && -n "${GPG_PASSPHRASE}" ]]; then
-    echo "GPG environment variables validated successfully"
+    echo -e "#\n# GPG - importing private key on local machine\n#\n"
     echo "${GPG_PRIVATE_KEY}" | \
     gpg --batch \
         --yes \
@@ -16,9 +16,45 @@ if [[ -n "${GPG_PRIVATE_KEY}" && -n "${GPG_PASSPHRASE}" ]]; then
     export GPG_TTY=$(tty)
 fi
 
+# verify that the GPG agent is working by signing and verifying a test message
+# and configure MAVEN_SIGNING_ARGS to use the GPG key and passphrase for signing, or skip signing if not configured
+if [[ -n "${GPG_KEY_ID}" && -n "${GPG_PASSPHRASE}" ]]; then
+    echo -e "#\n# GPG signing to configure and activate GPG agent\n#\n"
+    echo "test" | \
+    gpg --batch \
+        --yes \
+        --local-user "${GPG_KEY_ID}" \
+        --pinentry-mode loopback \
+        --passphrase "${GPG_PASSPHRASE}" \
+        --clearsign | \
+    gpg --verify
+    echo -e "#\n# GPG signing to configure and activate GPG agent\n#\n"
+    MAVEN_SIGNING_ARGS=" -Dgpg.keyname=${GPG_KEY_ID} -Dgpg.passphraseEnvName=GPG_PASSPHRASE"
+else 
+    echo -e "#\n# GPG signing environment variables not configured, SKIPPING GPG signing\n#\n"
+    MAVEN_SIGNING_ARGS=" -Dgpg.skip=true"
+fi
+
 # build
+echo -e "#\n# gradle and maven versions\n#\n"
 ./gradlew --no-daemon --version
 ./mvnw --version
-./gradlew --no-daemon -Dmaven.repo.local=dist/m2 --continue :build "$@"
+
+echo -e "#\n# build bnd and bndtools\n#\n"
+./gradlew \
+    --no-daemon \
+    -Dmaven.repo.local=dist/m2 \
+    -Dbnd.sonatype.release.description=${GITHUB_JOB}_${GITHUB_RUN_NUMBER} \
+    --continue \
+    build "$@"
+
+echo -e "#\n# build gradle plugins\n#\n"
 ./gradlew --no-daemon -Dmaven.repo.local=dist/m2 --continue :gradle-plugins:build
-./mvnw -Dmaven.repo.local=dist/m2 --batch-mode --no-transfer-progress install
+
+echo -e "#\n# build maven plugins\n#\n"
+./mvnw \
+    -Dmaven.repo.local=dist/m2 \
+    --batch-mode \
+    --no-transfer-progress \
+    $MAVEN_SIGNING_ARGS \
+    install

.github/scripts/ci-publish.sh

@@ -1,4 +1,43 @@
 #!/usr/bin/env bash
 set -ev
-./gradlew --no-daemon -Dmaven.repo.local=dist/m2 :publish :gradle-plugins:publish "$@"
-./mvnw -Dmaven.repo.local=dist/m2  --batch-mode -Pdist -Dreleaserepo=file:dist/bundles deploy
+
+# Prepare GPG arguments for Maven and Gradle if environment variables are set
+GPG_ARGS=""
+GRADLE_GPG_ARGS=""
+if [[ -n "${GPG_KEY_ID:-}" ]]; then
+	GPG_ARGS="-Dgpg.keyname=${GPG_KEY_ID}"
+	GRADLE_GPG_ARGS="-Psigning.gnupg.keyName=${GPG_KEY_ID}"
+	if [[ -n "${GPG_PASSPHRASE:-}" ]]; then
+		GRADLE_GPG_ARGS="${GRADLE_GPG_ARGS} -Psigning.gnupg.passphrase=${GPG_PASSPHRASE}"
+	fi
+fi
+
+# Detect snapshot build: if #-snapshot is commented out in cnf/build.bnd,
+# the build produces SNAPSHOT versions
+IS_SNAPSHOT=false
+if grep -qE '^#-snapshot:' cnf/build.bnd 2>/dev/null; then
+	IS_SNAPSHOT=true
+fi
+
+# 1. publish gradle-plugins to dist/bundles
+./gradlew --no-daemon -Dmaven.repo.local=dist/m2 ${GRADLE_GPG_ARGS} :gradle-plugins:publish "$@"
+
+# 2. publish maven-plugins to dist/bundles (enforce dist profile, and explicitly disable jfrog)
+./mvnw -Dmaven.repo.local=dist/m2 --batch-mode -Pdist,\!jfrog -Dreleaserepo=file:dist/bundles ${GPG_ARGS} deploy
+# publish again for jfrog (with env.CANONICAL=true, where jfrog profile is chosen)
+./mvnw -Dmaven.repo.local=dist/m2 --batch-mode -Pdist -Dreleaserepo=file:dist/bundles ${GPG_ARGS} deploy
+
+# 3. publish bnd workspace to dist/bundles (and JFrog if CANONICAL)
+./gradlew --no-daemon -Dmaven.repo.local=dist/m2 :publish "$@"
+
+# 4. Upload to Sonatype Central Portal (separate from building)
+if [[ -n "${SONATYPE_BEARER:-}" ]]; then
+	SONATYPE_OPTS=""
+	if [[ -n "${SONATYPE_PUBLISHING_TYPE:-}" ]]; then
+		SONATYPE_OPTS="--publishing-type ${SONATYPE_PUBLISHING_TYPE}"
+	fi
+	if [[ "${IS_SNAPSHOT}" == "true" ]]; then
+		SONATYPE_OPTS="${SONATYPE_OPTS} --snapshot"
+	fi
+	./.github/scripts/sonatype-upload.sh ${SONATYPE_OPTS} dist/bundles
+fi

.github/scripts/docs.sh

@@ -4,8 +4,5 @@ cd docs
 ruby --version
 gem --version
 bundle --version
+bash ./scripts/sync-baseline-version.sh
 bundle exec jekyll build
-
-# create search index under _site/pagefind
-pwd
-./pagefind --verbose --site _site --output-subdir pagefindindex