[actions] manage builds for both commits and tags.

.github/workflows/actions.yml

@@ -21,17 +21,36 @@ jobs:
       with:
         java-version: 17
         distribution: temurin
+    # ONLY FOR NEW RELEASE TAGS
+    - name: setup gpg necessities
+      if: startsWith(github.ref, 'refs/tags/')
+      run: sudo bash -c "echo '$GPG_KEY_CONTENTS' | base64 -d > $WORKSPACE/'$SIGNING_SECRET_KEY_RING_FILE'"
+      env:
+        WORKSPACE: ${{ github.workspace }}
+        GPG_KEY_CONTENTS: ${{ secrets.GPG_KEY_CONTENTS }}
+        SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}
+    # ONLY FOR NEW RELEASE TAGS
+    - name: rewrite */build.gradle to require signing
+      if: startsWith(github.ref, 'refs/tags/')
+      run: |
+        sed -i "s/signing {}/signing { sign(publishing.publications) }/" */build.gradle
     - name: apt install
       run: |
-        echo y | sudo apt-get install doxygen cmake ninja-build libasound2-dev
-    - name: stupid NDK setup workaround for GitHub Actions
-      run: sudo mkdir -p /usr/local/lib/android/sdk/ndk && sudo chmod 777 /usr/local/lib/android/sdk/ndk
-    - name: copy settings
-      run: mkdir -p ~/.m2 && cp .github/workflows/m2_settings.xml ~/.m2/settings.xml
+        echo y | sudo apt-get install doxygen cmake ninja-build
     - name: build
       run:
         ./build-native.sh
         ./gradlew --warning-mode all build
+    # ONLY FOR NEW RELEASE TAGS
+    - name: publish
+      if: startsWith(github.ref, 'refs/tags/')
+      run: ./gradlew --warning-mode all publish
+      env:
+        OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+        OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+        SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
+        SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+        SIGNING_SECRET_KEY_RING_FILE: ${{ format('{0}/{1}', github.workspace, secrets.SIGNING_SECRET_KEY_RING_FILE) }}
     - name: upload artifact
       if: success()
       uses: actions/upload-artifact@v2