From af0a0d5e07f9e469aa941cb5fb3fab024b99e2d2 Mon Sep 17 00:00:00 2001
From: Petr Fedchenkov <giggsoff@gmail.com>
Date: Tue, 23 Jun 2026 14:31:10 +0300
Subject: [PATCH] NGSOK-1746 Add workflow to publish artifacts to GitHub
 Packages on release

Publish Spark artifacts to the arenadata GitHub Packages Maven registry
when a release is created. Uses mvn deploy with deployAtEnd so the whole
reactor builds before any upload, avoiding partial releases that cannot be
re-published. Manual dispatch supports resuming the reactor via -rf, and
the release tag is verified against the pom version before publishing.
---
 .github/workflows/publish.yml | 74 +++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000000000..a32e9a12629e4
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,74 @@
+name: Publish
+
+on:
+  release:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      resume_from:
+        description: 'Resume the reactor from this project (maven -rf, e.g. :spark-sql_2.13). Leave empty to build all.'
+        required: false
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  JAVA_VERSION: '17'
+  MAVEN_ARGS: -B -V -e -ntp
+  MAVEN_OPTS: -Xmx4g -XX:ReservedCodeCacheSize=1g -XX:MaxMetaspaceSize=2g
+  SPARK_PROFILES: -Pscala-2.13 -Phadoop-3 -Phive -Phive-thriftserver -Pyarn -Pkubernetes -Phadoop-cloud -Pconnect -Pvolcano
+  # -rf <project> when a resume point is given on manual dispatch, otherwise empty.
+  RESUME_ARG: ${{ inputs.resume_from != '' && format('-rf {0}', inputs.resume_from) || '' }}
+
+jobs:
+  publish:
+    name: "Publish to GitHub Packages (arenadata)"
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-java@v5
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
+          distribution: temurin
+          cache: maven
+          # server-id must match the <distributionManagement> repository id in pom.xml
+          server-id: github
+          server-username: GITHUB_ACTOR
+          server-password: GITHUB_TOKEN
+
+      - name: Verify release tag matches pom version
+        if: github.event_name == 'release'
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          POM_VERSION="$(./build/mvn -q -N help:evaluate -Dexpression=project.version -DforceStdout)"
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          echo "pom version: '$POM_VERSION'"
+          echo "tag version: '$TAG_VERSION'"
+          if [[ "$POM_VERSION" != "$TAG_VERSION" ]]; then
+            echo "::error::Release tag ('$TAG_VERSION') does not match pom version ('$POM_VERSION'). Aborting publish."
+            exit 1
+          fi
+
+      # deployAtEnd builds the whole reactor first and defers all uploads until
+      # every module has built successfully, so a failure mid-reactor does not
+      # leave a partial release. GitHub Packages does not allow re-publishing an
+      # existing version, so this all-or-nothing behavior is what we want.
+      - name: Build and deploy artifacts
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          ./build/mvn ${{ env.MAVEN_ARGS }} deploy
+          -DskipTests -DdeployAtEnd=true
+          ${{ env.SPARK_PROFILES }}
+          ${{ env.RESUME_ARG }}