From fcf6367f30ac341c4009de12cd8ac175c1aef3b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Nicoll?= <stephane.nicoll@broadcom.com>
Date: Tue, 4 Mar 2025 16:37:40 +0100
Subject: [PATCH] Add verification step for deployments

Closes gh-1473
---
 .../workflows/build-and-deploy-snapshot.yml   | 11 +++
 .github/workflows/release.yml                 | 13 ++++
 .github/workflows/verify.yml                  | 77 +++++++++++++++++++
 3 files changed, 101 insertions(+)
 create mode 100644 .github/workflows/verify.yml

diff --git a/.github/workflows/build-and-deploy-snapshot.yml b/.github/workflows/build-and-deploy-snapshot.yml
index eea40c2f..3f47abc5 100644
--- a/.github/workflows/build-and-deploy-snapshot.yml
+++ b/.github/workflows/build-and-deploy-snapshot.yml
@@ -43,3 +43,14 @@ jobs:
           webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
     outputs:
       version: ${{ steps.build-and-publish.outputs.version }}
+  verify:
+    name: Verify
+    needs: build-and-deploy-snapshot
+    uses: ./.github/workflows/verify.yml
+    secrets:
+      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
+      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+    with:
+      version: ${{ needs.build-and-deploy-snapshot.outputs.version }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 45584bd5..7867cd13 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,10 +34,23 @@ jobs:
           username: ${{ secrets.ARTIFACTORY_USERNAME }}
     outputs:
       version: ${{ steps.build-and-publish.outputs.version }}
+  verify:
+    name: Verify
+    needs: build-and-stage-release
+    uses: ./.github/workflows/verify.yml
+    secrets:
+      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
+      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+    with:
+      staging: true
+      version: ${{ needs.build-and-stage-release.outputs.version }}
   sync-to-maven-central:
     name: Sync to Maven Central
     needs:
       - build-and-stage-release
+      - verify
     runs-on: ubuntu-latest
     steps:
       - name: Check Out Code
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
new file mode 100644
index 00000000..54ce9b02
--- /dev/null
+++ b/.github/workflows/verify.yml
@@ -0,0 +1,77 @@
+name: Verify
+on:
+  workflow_call:
+    inputs:
+      staging:
+        description: 'Whether the release to verify is in the staging repository'
+        required: false
+        default: false
+        type: boolean
+      version:
+        description: 'Version to verify'
+        required: true
+        type: string
+    secrets:
+      google-chat-webhook-url:
+        description: 'Google Chat Webhook URL'
+        required: true
+      repository-password:
+        description: 'Password for authentication with the repository'
+        required: false
+      repository-username:
+        description: 'Username for authentication with the repository'
+        required: false
+      token:
+        description: 'Token to use for authentication with GitHub'
+        required: true
+jobs:
+  verify:
+    name: Verify
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Out Release Verification Tests
+        uses: actions/checkout@v4
+        with:
+          ref: 'cbe06d1b44f4bb5a094d516e59680e61a89e30aa'
+          repository: spring-projects/spring-ws-release-verification
+          token: ${{ secrets.token }}
+      - name: Check Out Send Notification Action
+        uses: actions/checkout@v4
+        with:
+          path: send-notification
+          sparse-checkout: .github/actions/send-notification
+      - name: Set Up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'liberica'
+          java-version: 17
+      - name: Set Up Gradle
+        uses: gradle/actions/setup-gradle@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2
+        with:
+          cache-read-only: false
+      - name: Configure Gradle Properties
+        shell: bash
+        run: |
+          mkdir -p $HOME/.gradle
+          echo 'org.gradle.daemon=false' >> $HOME/.gradle/gradle.properties
+      - name: Run Release Verification Tests
+        env:
+          RVT_OSS_REPOSITORY_PASSWORD: ${{ secrets.repository-password }}
+          RVT_OSS_REPOSITORY_USERNAME: ${{ secrets.repository-username }}
+          RVT_RELEASE_TYPE: oss
+          RVT_STAGING: ${{ inputs.staging }}
+          RVT_VERSION: ${{ inputs.version }}
+        run: ./gradlew spring-ws-release-verification-tests:test
+      - name: Upload Build Reports on Failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-reports
+          path: '**/build/reports/'
+      - name: Send Notification
+        if: failure()
+        uses: ./send-notification/.github/actions/send-notification
+        with:
+          run-name: ${{ format('{0} | Verification | {1}', github.ref_name, inputs.version) }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.google-chat-webhook-url }}