Align with commercial build support

.github/actions/release-train-build/action.yml

@@ -0,0 +1,36 @@
+name: Build Release
+runs:
+  using: composite
+  steps:
+    - name: Build Release
+      shell: bash
+      run: |
+        echo Build and Publish
+
+        printf "allprojects {
+                    afterEvaluate {
+                        pluginManager.withPlugin('maven-publish') {
+                            publishing {
+                                repositories {
+                                    maven {
+                                        url = System.getenv('GITHUB_WORKSPACE') + '/deployment-repository'
+                                        name = 'deployment'
+                                    }
+                                }
+                            }
+                        }
+
+                        repositories {
+                            maven {
+                                name = 'Release Train'
+                                url = System.getenv('RELEASE_TRAIN_MAVEN_REPOSITORY_URL')
+                                credentials {
+                                    username = System.getenv('RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME')
+                                    password = System.getenv('RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD')
+                                }
+                            }
+                        }
+                    }
+                }" > repositories-init.gradle
+
+        ./gradlew build publishAllPublicationsToDeploymentRepository --init-script repositories-init.gradle -x test -x integrationTest

.github/actions/release-train-build/deployment-spec.yml

@@ -0,0 +1,11 @@
+artifactory:
+  artifacts:
+    - pattern: "/**/spring-*-docs.zip"
+      properties:
+        zip.deployed: "false"
+        zip.name: "spring-pulsar"
+        zip.type: "docs"
+maven-central:
+  excludes:
+    - "/**/*.zip"
+    - "/**/*.zip.asc"

.github/actions/release-train-test/action.yml

@@ -0,0 +1,23 @@
+name: Test Release
+runs:
+  using: composite
+  steps:
+    - name: Test Release
+      shell: bash
+      run:  |
+        printf "allprojects {
+            afterEvaluate {
+               repositories {
+                    maven {
+                        name = 'Release Train'
+                        url = System.getenv('RELEASE_TRAIN_MAVEN_REPOSITORY_URL')
+                        credentials {
+                            username = System.getenv('RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME')
+                            password = System.getenv('RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD')
+                        }
+                    }
+                }
+            }
+        }" > repositories-init.gradle
+
+        ./gradlew check --init-script repositories-init.gradle

.github/workflow-generator.yml

@@ -0,0 +1,23 @@
+workflow:
+  generator:
+    project:
+      java:
+        versions:
+          primary: 25
+    workflows:
+      release-train:
+        join:
+          watch: false
+        ready:
+          watch: false
+        leave:
+          watch: false
+        build:
+          env:
+            ARTIFACTORY_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            ARTIFACTORY_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
+        test:
+          runs-on: ubuntu22-4-16
+          env:
+            ARTIFACTORY_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            ARTIFACTORY_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD

.github/workflows/ci-pr.yml

@@ -5,14 +5,20 @@ on:
     branches:
       - 'main'
       - '1.2.x'
+      - '*.x-internal'
     paths-ignore:
       - '.github/**'
 
+# The secrets in PRs are available only for Dependabot scope. Used only by private repositories.
+env:
+  ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_RO_USERNAME }}
+  ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_RO_PASSWORD }}
+
 jobs:
   prerequisites:
     name: Pre-requisites for building
     runs-on: ubuntu-latest
-    if: github.repository == 'spring-projects/spring-pulsar'
+    if: github.repository_owner == 'spring-projects'
     outputs:
       runjobs: ${{ steps.continue.outputs.runjobs }}
       project_version: ${{ steps.continue.outputs.project_version }}

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - 'main'
       - '1.2.x'
+      - '*.x-internal'
     paths-ignore:
       - '.github/**'
   schedule:
@@ -16,15 +17,15 @@ env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
   COMMIT_OWNER: ${{ github.event.pusher.name }}
   COMMIT_SHA: ${{ github.sha }}
-  ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
-  ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
+  ARTIFACTORY_USERNAME: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+  ARTIFACTORY_PASSWORD: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
   GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
 
 jobs:
   prerequisites:
     name: Pre-requisites for building
     runs-on: ubuntu-latest
-    if: github.repository == 'spring-projects/spring-pulsar'
+    if: github.repository_owner == 'spring-projects'
     outputs:
       runjobs: ${{ steps.continue.outputs.runjobs }}
       project_version: ${{ steps.continue.outputs.project_version }}
@@ -45,6 +46,8 @@ jobs:
       - id: should-deploy-artifacts
         name: Check Deploy Artifacts using Secrets
         if: ${{ runner.os == 'Linux' }}
+        env:
+          ARTIFACTORY_PASSWORD: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
         run: |
           if [[ -z "$ARTIFACTORY_PASSWORD" ]] ; then
             echo "result=false" >> $GITHUB_OUTPUT
@@ -127,14 +130,14 @@ jobs:
         with:
           artifact-properties: |
             /**/*docs-*.zip::zip.name=spring-pulsar,zip.type=docs,zip.deployed=false
-          uri: 'https://repo.spring.io'
-          repository: 'libs-snapshot-local'
+          uri: ${{ vars.COMMERCIAL && 'https://usw1.packages.broadcom.com' || 'https://repo.spring.io' }}
+          repository: ${{ vars.COMMERCIAL && 'spring-enterprise-maven-dev-local' || 'libs-snapshot-local' }}
           build-name: 'spring-pulsar-2.0.x'
           folder: 'deployment-repository'
           signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
           signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          username: ${{ secrets.ARTIFACTORY_USERNAME }}
-          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+          username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_USERNAME }}
+          password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
 
       - name: Stage Local Artifacts for Publishing to Central
         if: ${{ steps.deploy-location.outputs.deploy_location == 'central' }}
@@ -184,6 +187,8 @@ jobs:
     name: Deploy Antora Docs
     needs: [build_jdk_25, check_samples]
     runs-on: ubuntu-latest
+    # OSS-only: commercial docs are handled separately and the docs secrets do not exist here.
+    if: ${{ !vars.COMMERCIAL }}
     steps:
       - uses: actions/checkout@v7
       - uses: spring-io/spring-gradle-build-action@v2
@@ -214,7 +219,8 @@ jobs:
     permissions:
       contents: write
     timeout-minutes: 120
-    if: ${{ !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
+    # OSS-only: commercial releases are performed by the release-train workflows.
+    if: ${{ !vars.COMMERCIAL && !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
     env:
       REPO: ${{ github.repository }}
       BRANCH: ${{ github.ref_name }}

.github/workflows/post-release.yml

@@ -0,0 +1,21 @@
+name: Post-Release
+
+on:
+  push:
+    tags:
+      - v*
+
+run-name: Post-release for ${{ github.ref_name }}
+
+jobs:
+  release:
+    permissions:
+      contents: write
+      issues: write
+
+    uses: spring-io/spring-github-workflows/.github/workflows/spring-post-release.yml@main
+    with:
+      preview: true
+    secrets:
+      GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      SPRING_RELEASE_CHAT_WEBHOOK_URL: ${{ secrets.SPRING_RELEASE_GCHAT_WEBHOOK_URL }}

.github/workflows/release-train-build.yml

@@ -0,0 +1,92 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Build"
+run-name: "${{ inputs.callback-ref }} – Build"
+"on":
+  workflow_dispatch:
+    inputs:
+      callback:
+        description: "Repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      callback-ref:
+        description: "Ref in the callback repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      release-train-maven-repository-url:
+        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
+        required: true
+        type: "string"
+permissions:
+  contents: "read"
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+jobs:
+  build-release:
+    name: "Build Release"
+    runs-on: "ubuntu22-2-8"
+    steps:
+    - name: "Prevent Re-runs"
+      id: "prevent-re-runs"
+      run: |-
+        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
+          exit 1
+        fi
+    - name: "Set up Java"
+      id: "set-up-java"
+      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
+      with:
+        distribution: "liberica"
+        java-version: "25"
+    - name: "Check Out Code"
+      id: "check-out-code"
+      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+    - name: "Build Release"
+      id: "build-release"
+      uses: "./.github/actions/release-train-build"
+      env:
+        ARTIFACTORY_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
+        ARTIFACTORY_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
+    - name: "Upload Deployment Repository"
+      id: "upload-deployment-repository"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        name: "deployment-repository"
+        path: "deployment-repository/**"
+    - name: "Upload Deployment Spec"
+      id: "upload-deployment-spec"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        archive: "false"
+        if-no-files-found: "ignore"
+        name: "deployment-spec"
+        path: ".github/actions/release-train-build/deployment-spec.yml"
+    - name: "Save Build System Caches"
+      id: "save-build-system-caches"
+      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
+      with:
+        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
+        path: |-
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+    - name: "Send Callback"
+      id: "send-callback"
+      if: "${{ !cancelled() }}"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run callback \
+        --repo ${{ inputs.callback }} \
+        --ref ${{ inputs.callback-ref }} \
+        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
+        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
+        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }} \
+        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
+        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/release-train-join.yml

@@ -0,0 +1,43 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Join"
+run-name: "${{ inputs.release-train }} – Join"
+"on":
+  workflow_dispatch:
+    inputs:
+      deployment-destination:
+        description: "Destination to which the release should be deployed"
+        options:
+        - "Maven Central"
+        - "Spring Enterprise"
+        required: true
+        type: "choice"
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  join-release-train:
+    name: "Join Release Train"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Join Release Train"
+      id: "join-release-train"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run join \
+        --repo ${{ inputs.release-train-repository }} \
+        --ref ${{ inputs.release-train }} \
+        --field commit-hash=${{ github.sha }} \
+        --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }}

.github/workflows/release-train-leave.yml

@@ -0,0 +1,34 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Leave"
+run-name: "${{ inputs.release-train }} – Leave"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  leave:
+    name: "Leave"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Leave"
+      id: "leave"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run leave \
+        --repo ${{ inputs.release-train-repository }} \
+        --ref ${{ inputs.release-train }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }}