Releasing and Publishing via GH actions

I am trying to automate publishing the SDKs for Python, Java, GO, and Node. My main goal is to make the CI run whenever a new PR is created against main branch that will:

bump the version in all files.
publish the new release to the related public registry (for each language)

Problem:

right now the problem is that the publish step is not taking the artifacts from the release step, but rather the one before that, as if they are not synced.

For the release step, we're using semantic-release package with several plugins.
The ADMIN_TOKEN is a personal token of a user with write permissions.
The publishing step is different for each language, but I am certain this is unrelated since it worked before I complicated the workflow.

Possible issue:

Without the if statements, the release and publish steps are synced, but then the semantic-release creates another commit that creates another release (e.g. 2 releases and publishing in one run, not wanted). With the current if, the publish step takes the older release instead the newly created one (for example, if the new run creates release 1.0.40, the publish will take version 1.0.39).

Does anyone have some input on these 2 steps or the if statements? For example, this is the current variation of the Java workflow:

  release:
    runs-on: ubuntu-latest
    if: "!startsWith(github.event.head_commit.message, 'chore')"
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
        token: ${{ secrets.ADMIN_TOKEN }}

    - name: setup nodejs
      uses: actions/setup-node@v3
      with:
        node-version: '16'

    - name: release using semantic-release
      env:
        GITHUB_TOKEN: ${{ secrets.ADMIN_TOKEN }}
        GIT_AUTHOR_NAME: ****
        GIT_AUTHOR_EMAIL: ****
        GIT_COMMITTER_NAME: ****
        GIT_COMMITTER_EMAIL: ****
      run: |
        sudo apt-get update
        sudo apt-get install python
        pip install --user bumpversion
        npm install @semantic-release/changelog
        npm install @semantic-release/exec
        npm install @semantic-release/git
        npm install @semantic-release/github
        npx semantic-release

  publish:
    runs-on: ubuntu-latest
    needs: [release]
    if: "!startsWith(github.event.head_commit.message, 'chore')"
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
      with:
        token: ${{ secrets.ADMIN_TOKEN }}

    - name: Configure GPG Key
      run: |
            cat <(echo -e "${{ secrets.GPG_SIGNING_KEY }}") | gpg --batch --import
            gpg --list-secret-keys --keyid-format LONG

    - name: Set up Maven Central Repository
      uses: actions/setup-java@v3
      with:
          java-version: 8
          distribution: zulu
          server-id: ossrh
          server-username: ${{ secrets.MAVEN_USERNAME }}
          server-password: ${{ secrets.MAVEN_PASSWORD }}
          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}

    - name: Publish package
      run: mvn clean deploy $MVN_ARGS -P central --no-transfer-progress --batch-mode -Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}
      env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MVN_ARGS: "--settings build-settings.xml"
          <more ENVS>

In case it is relevant, the .releaserc file is:

{
  "debug": true,
  "branches": [ "main" ],
  "plugins": [
    ["@semantic-release/commit-analyzer", {
        "preset": "angular",
        "releaseRules": [
            {"type": "release","release": "patch"}
    ]}],
    "@semantic-release/release-notes-generator",
    "@semantic-release/changelog",
    [
      "@semantic-release/exec",
      {
        "prepareCmd": "bump2version --allow-dirty --current-version ${lastRelease.version} --new-version ${nextRelease.version} patch"
      }
    ],
    [
      "@semantic-release/git",
      {
        "message": "chore(release): ${nextRelease.version} release notes\n\n${nextRelease.notes}"
      }
    ],
    "@semantic-release/github"
  ]
}

I also asked in GH: https://github.com/orgs/community/discussions/40749

Solution

The quick fix I found is to split the release and publish steps into two different workflows (different files). I am certain with a bit more dive-in, one can merge those two with some proper if conditioning.

NOTE: The publish action steps are specific to Java, but can be changed to be valid for any other language. The main structure is the main answer here.

The release step: The semantic-release creates a secondary commit to the main branch with "chore" commit message. in order to overcome this, I added the if to skip this type of commit.

name: release
on:
  workflow_dispatch:
  push:
    branches:
      - main
jobs:
  release:
    runs-on: ubuntu-latest
    if: "github.event_name == 'push' && github.ref == 'refs/heads/main' && !startsWith(github.event.head_commit.message, 'chore')"
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
        token: ${{ secrets.ADMIN_TOKEN }}

    - name: setup nodejs
      uses: actions/setup-node@v3
      with:
        node-version: '16'

    - name: release using semantic-release
      env:
        GITHUB_TOKEN: ${{ secrets.ADMIN_TOKEN }}
        GIT_AUTHOR_NAME: secrets.automation.dev
        GIT_AUTHOR_EMAIL: secrets.automation.dev@il.ibm.com
        GIT_COMMITTER_NAME: secrets.automation.dev
        GIT_COMMITTER_EMAIL: secrets.automation.dev@il.ibm.com
      run: |
        sudo apt-get update
        sudo apt-get install python
        pip install --user bumpversion
        npm install @semantic-release/changelog
        npm install @semantic-release/exec
        npm install @semantic-release/git
        npm install @semantic-release/github
        npx semantic-release

The publish step: The "release" event has several initiators so I added the published type to make sure the publishing happens only if a new release was published to GitHub.

name: publish artifact
on:
  workflow_dispatch:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.ADMIN_TOKEN }}

      - name: Configure GPG Key
        run: |
          cat <(echo -e "${{ secrets.GPG_SIGNING_KEY }}") | gpg --batch --import
          gpg --list-secret-keys --keyid-format LONG

      - name: Set up Maven Central Repository
        uses: actions/setup-java@v3
        with:
          java-version: 8
          distribution: zulu
          server-id: ossrh
          server-username: ${{ secrets.MAVEN_USERNAME }}
          server-password: ${{ secrets.MAVEN_PASSWORD }}
          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Publish package
        run: mvn clean deploy $MVN_ARGS -P central --no-transfer-progress --batch-mode -Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}
        env:
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MVN_ARGS: "--settings build-settings.xml"
          <other envs>