Restore GitHub workflows

2026-09-17 12:09:16 +00:00 · 2026-08-20 15:20:55 -07:00
parent 66e0c06991
commit 3294eade2e
9 changed files with 623 additions and 0 deletions
@@ -0,0 +1,76 @@
+name: Build and Deploy Snapshot
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - '4.1.x'
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  build-and-deploy-snapshot:
+    name: Build and Deploy Snapshot
+    if: ${{ github.repository == 'spring-projects/spring-boot' || github.repository == 'spring-projects/spring-boot-commercial' }}
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build and Publish
+        id: build-and-publish
+        uses: ./.github/actions/build
+        with:
+          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
+          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          gradle-cache-read-only: false
+          publish: true
+      - name: Deploy
+        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
+        with:
+          build-name: ${{ vars.COMMERCIAL && format('spring-boot-commercial-{0}', '4.1.x') || format('spring-boot-{0}', '4.1.x') }}
+          folder: 'deployment-repository'
+          password: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
+          project: ${{ vars.COMMERCIAL && 'spring' }}
+          repository: ${{ vars.COMMERCIAL && 'spring-enterprise-maven-dev-local' || 'libs-snapshot-local' }}
+          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          threads: 8
+          uri: ${{ vars.COMMERCIAL_DEPLOY_REPO_URL || 'https://repo.spring.io' }}
+          username: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_USERNAME }}
+      - name: Send Notification
+        if: always()
+        uses: ./.github/actions/send-notification
+        with:
+          build-scan-url: ${{ steps.build-and-publish.outputs.build-scan-url }}
+          run-name: ${{ format('{0} | Linux | Java 25', github.ref_name) }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
+    outputs:
+      version: ${{ steps.build-and-publish.outputs.version }}
+  trigger-docs-build:
+    name: Trigger Docs Build
+    needs: build-and-deploy-snapshot
+    permissions:
+      actions: write
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-sha=${{ github.sha }} -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-deploy-snapshot.outputs.version }}
+  verify:
+    name: Verify
+    needs: build-and-deploy-snapshot
+    uses: ./.github/workflows/verify.yml
+    secrets:
+      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
+      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+    with:
+      version: ${{ needs.build-and-deploy-snapshot.outputs.version }}
@@ -0,0 +1,24 @@
+name: Build Pull Request
+on: pull_request
+permissions:
+  contents: read
+jobs:
+  build:
+    name: Build Pull Request
+    if: ${{ github.repository == 'spring-projects/spring-boot' }}
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build
+        id: build
+        uses: ./.github/actions/build
+      - name: Print JVM Thread Dumps When Cancelled
+        if: cancelled()
+        uses: ./.github/actions/print-jvm-thread-dumps
+      - name: Upload Build Reports
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: build-reports
+          path: '**/build/reports/'
@@ -0,0 +1,67 @@
+name: CI
+on:
+  push:
+    branches:
+      - '4.1.x'
+permissions:
+  contents: read
+jobs:
+  ci:
+    name: '${{ matrix.os.name}} | Java ${{ matrix.java.version}}'
+    if: ${{ github.repository == 'spring-projects/spring-boot' || github.repository == 'spring-projects/spring-boot-commercial' }}
+    runs-on: ${{ matrix.os.id }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - id: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+            name: Linux
+          - id: windows-latest
+            name: Windows
+        java:
+          - version: 17
+            toolchain: true
+          - version: 21
+            toolchain: true
+          - version: 25
+            toolchain: false
+          - version: 26
+            toolchain: true
+        exclude:
+          - os:
+              name: Linux
+            java:
+              version: 25
+          - os:
+              name: ${{ github.repository == 'spring-projects/spring-boot-commercial' && 'Windows' }}
+    steps:
+      - name: Prepare Windows runner
+        if: ${{ runner.os == 'Windows' }}
+        run: |
+          git config --global core.autocrlf true
+          git config --global core.longPaths true
+          Stop-Service -name Docker
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build
+        id: build
+        uses: ./.github/actions/build
+        with:
+          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
+          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          gradle-cache-read-only: false
+          java-early-access: ${{ matrix.java.early-access || 'false' }}
+          java-distribution: ${{ matrix.java.distribution }}
+          java-toolchain: ${{ matrix.java.toolchain }}
+          java-version: ${{ matrix.java.version }}
+      - name: Send Notification
+        if: always()
+        uses: ./.github/actions/send-notification
+        with:
+          build-scan-url: ${{ steps.build.outputs.build-scan-url }}
+          run-name: ${{ format('{0} | {1} | Java {2}', github.ref_name, matrix.os.name, matrix.java.version) }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
@@ -0,0 +1,45 @@
+name: Distribute
+on:
+  workflow_dispatch:
+    inputs:
+      build-number:
+        description: 'Number of the build to use to create the bundle'
+        required: true
+        type: string
+      create-bundle:
+        description: 'Whether to create the bundle. If unchecked, only the bundle distribution is executed'
+        required: true
+        type: boolean
+        default: true
+      version:
+        description: 'Version to bundle and distribute'
+        required: true
+        type: string
+permissions:
+  contents: read
+jobs:
+  distribute-spring-enterprise-release-bundle:
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Create Bundle
+        if: ${{ vars.COMMERCIAL && inputs.create-bundle }}
+        shell: bash
+        run: |
+          curl -s -u "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}:${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}" \
+            -X POST -H "X-JFrog-Signing-Key-Name: packagesKey" -H "Content-Type: application/json" \
+            "https://usw1.packages.broadcom.com/lifecycle/api/v2/release_bundle?project=spring" \
+            -d '{"release_bundle_name": "TNZ-spring-boot-commercial", "release_bundle_version": "${{ inputs.version }}", "skip_docker_manifest_resolution": true, "source_type": "builds", "source": {"builds": [ {"build_repository": "spring-build-info", "build_name": "spring-boot-commercial-${{ inputs.version }}", "build_number": "${{ inputs.build-number }}", "include_dependencies": false}]}}' | \
+            jq -e 'if has("repository_key") then . else halt_error end'
+      - name: Sleep
+        if: ${{ vars.COMMERCIAL && inputs.create-bundle }}
+        shell: bash
+        run: sleep 30
+      - name: Distribute Bundle
+        if: ${{ vars.COMMERCIAL }}
+        shell: bash
+        run: |
+          curl -s -u "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}:${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}" \
+            -X POST -H "Content-Type: application/json" \
+            "https://usw1.packages.broadcom.com/lifecycle/api/v2/distribution/distribute/TNZ-spring-boot-commercial/${{ inputs.version }}?project=spring" \
+            -d '{"auto_create_missing_repositories": "false", "distribution_rules": [{"site_name": "JP-SaaS"}], "modifications": {"mappings": [{"input": "spring-enterprise-maven-prod-local/(.*)", "output": "spring-enterprise/$1"}]}}' | \
+            jq -e 'if has("id") then . else halt_error end'
@@ -0,0 +1,131 @@
+name: Release Milestone
+on:
+  push:
+    tags:
+      - v4.1.0-M[0-9]
+      - v4.1.0-RC[0-9]
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  build-and-stage-release:
+    name: Build and Stage Release
+    if: ${{ github.repository == 'spring-projects/spring-boot' }}
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build and Publish
+        id: build-and-publish
+        uses: ./.github/actions/build
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          gradle-cache-read-only: false
+          publish: true
+      - name: Stage Release
+        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
+        with:
+          build-name: ${{ format('spring-boot-{0}', steps.build-and-publish.outputs.version)}}
+          folder: 'deployment-repository'
+          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+          repository: 'libs-staging-local'
+          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          threads: 8
+          uri: 'https://repo.spring.io'
+          username: ${{ secrets.ARTIFACTORY_USERNAME }}
+    outputs:
+      version: ${{ steps.build-and-publish.outputs.version }}
+  verify:
+    name: Verify
+    needs: build-and-stage-release
+    uses: ./.github/workflows/verify.yml
+    secrets:
+      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_RO_PASSWORD }}
+      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_RO_USERNAME }}
+      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
+      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+    with:
+      staging: true
+      version: ${{ needs.build-and-stage-release.outputs.version }}
+  sync-to-maven-central:
+    name: Sync to Maven Central
+    if: ${{ !vars.COMMERCIAL }}
+    needs:
+      - build-and-stage-release
+      - verify
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Sync to Maven Central
+        uses: ./.github/actions/sync-to-maven-central
+        with:
+          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
+          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
+          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
+          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
+  promote-release:
+    name: Promote Release
+    needs:
+      - build-and-stage-release
+      - sync-to-maven-central
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Set up JFrog CLI
+        uses: jfrog/setup-jfrog-cli@deda456d982fc5e9a7a020b63eb0d2968aedd33e # v5.1.0
+        env:
+          JF_ENV_SPRING: ${{ secrets.JF_ARTIFACTORY_SPRING }}
+      - name: Promote build
+        run: jfrog rt build-promote ${{ format('spring-boot-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-milestone-local
+  publish-gradle-plugin:
+    name: Publish Gradle Plugin
+    if: ${{ !vars.COMMERCIAL }}
+    needs:
+      - build-and-stage-release
+      - sync-to-maven-central
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Publish
+        uses: ./.github/actions/publish-gradle-plugin
+        with:
+          gradle-plugin-publish-key: ${{ secrets.GRADLE_PLUGIN_PUBLISH_KEY }}
+          gradle-plugin-publish-secret: ${{ secrets.GRADLE_PLUGIN_PUBLISH_SECRET }}
+          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
+          plugin-version: ${{ needs.build-and-stage-release.outputs.version }}
+  trigger-docs-build:
+    name: Trigger Docs Build
+    needs:
+      - build-and-stage-release
+      - promote-release
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-stage-release.outputs.version }}
+  create-github-release:
+    name: Create GitHub Release
+    needs:
+      - build-and-stage-release
+      - promote-release
+      - publish-gradle-plugin
+      - trigger-docs-build
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Create GitHub Release
+        uses: ./.github/actions/create-github-release
+        with:
+          commercial: ${{ vars.COMMERCIAL }}
+          milestone: ${{ needs.build-and-stage-release.outputs.version }}
+          pre-release: true
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
@@ -0,0 +1,179 @@
+name: Release
+on:
+  push:
+    tags:
+      - v4.1.[0-9]+
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  build-and-stage-release:
+    name: Build and Stage Release
+    if: ${{ github.repository == 'spring-projects/spring-boot' || github.repository == 'spring-projects/spring-boot-commercial' }}
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build and Publish
+        id: build-and-publish
+        uses: ./.github/actions/build
+        with:
+          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
+          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          gradle-cache-read-only: false
+          publish: true
+      - name: Stage Release
+        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
+        with:
+          build-name: ${{ vars.COMMERCIAL && format('spring-boot-commercial-{0}', steps.build-and-publish.outputs.version) || format('spring-boot-{0}', steps.build-and-publish.outputs.version) }}
+          folder: 'deployment-repository'
+          password: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
+          project: ${{ vars.COMMERCIAL && 'spring' }}
+          repository: ${{ vars.COMMERCIAL && 'spring-enterprise-maven-stage-local' || 'libs-staging-local' }}
+          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          threads: 8
+          uri: ${{ vars.COMMERCIAL_DEPLOY_REPO_URL || 'https://repo.spring.io' }}
+          username: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_USERNAME }}
+      - name: Send Notification
+        if: failure()
+        uses: ./.github/actions/send-notification
+        with:
+          run-name: ${{ format('{0} | Release Staging | {1}', github.ref_name, inputs.version) }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
+    outputs:
+      version: ${{ steps.build-and-publish.outputs.version }}
+  verify:
+    name: Verify
+    needs: build-and-stage-release
+    uses: ./.github/workflows/verify.yml
+    secrets:
+      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
+      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+    with:
+      staging: true
+      version: ${{ needs.build-and-stage-release.outputs.version }}
+  sync-to-maven-central:
+    name: Sync to Maven Central
+    if: ${{ !vars.COMMERCIAL }}
+    needs:
+      - build-and-stage-release
+      - verify
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Sync to Maven Central
+        uses: ./.github/actions/sync-to-maven-central
+        with:
+          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
+          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
+          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
+          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
+  promote-release:
+    name: Promote Release
+    needs:
+      - build-and-stage-release
+      - sync-to-maven-central
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Set up JFrog CLI
+        uses: jfrog/setup-jfrog-cli@deda456d982fc5e9a7a020b63eb0d2968aedd33e # v5.1.0
+        env:
+          JF_ENV_SPRING: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_JF_ARTIFACTORY_SPRING || secrets.JF_ARTIFACTORY_SPRING }}
+      - name: Promote open source build
+        if: ${{ !vars.COMMERCIAL }}
+        run: jfrog rt build-promote ${{ format('spring-boot-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-release-local
+      - name: Promote commercial build
+        if: ${{ vars.COMMERCIAL }}
+        run: jfrog rt build-promote ${{ format('spring-boot-commercial-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} spring-enterprise-maven-prod-local --project spring
+  publish-gradle-plugin:
+    name: Publish Gradle Plugin
+    if: ${{ !vars.COMMERCIAL }}
+    needs:
+      - build-and-stage-release
+      - sync-to-maven-central
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Publish
+        uses: ./.github/actions/publish-gradle-plugin
+        with:
+          gradle-plugin-publish-key: ${{ secrets.GRADLE_PLUGIN_PUBLISH_KEY }}
+          gradle-plugin-publish-secret: ${{ secrets.GRADLE_PLUGIN_PUBLISH_SECRET }}
+          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
+          plugin-version: ${{ needs.build-and-stage-release.outputs.version }}
+  publish-to-sdkman:
+    name: Publish to SDKMAN!
+    if: ${{ !vars.COMMERCIAL }}
+    needs:
+      - build-and-stage-release
+      - sync-to-maven-central
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Publish to SDKMAN!
+        uses: ./.github/actions/publish-to-sdkman
+        with:
+          make-default: true
+          sdkman-consumer-key: ${{ secrets.SDKMAN_CONSUMER_KEY }}
+          sdkman-consumer-token: ${{ secrets.SDKMAN_CONSUMER_TOKEN }}
+          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
+  update-homebrew-tap:
+    name: Update Homebrew Tap
+    needs:
+      - build-and-stage-release
+      - sync-to-maven-central
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Update Homebrew Tap
+        uses: ./.github/actions/update-homebrew-tap
+        with:
+          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+  trigger-docs-build:
+    name: Trigger Docs Build
+    needs:
+      - build-and-stage-release
+      - promote-release
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-stage-release.outputs.version }}
+  create-github-release:
+    name: Create GitHub Release
+    needs:
+      - build-and-stage-release
+      - promote-release
+      - publish-gradle-plugin
+      - publish-to-sdkman
+      - trigger-docs-build
+      - update-homebrew-tap
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Create GitHub Release
+        uses: ./.github/actions/create-github-release
+        with:
+          commercial: ${{ vars.COMMERCIAL }}
+          latest: true
+          milestone: ${{ needs.build-and-stage-release.outputs.version }}
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
@@ -0,0 +1,13 @@
+name: "Run CodeQL Analysis"
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+permissions: read-all
+jobs:
+  run-analysis:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@7dc305df87410aa851b873d2f1fd33ccbb7d0aa8
@@ -0,0 +1,53 @@
+name: Run System Tests
+on:
+  push:
+    branches:
+      - '4.1.x'
+permissions:
+  contents: read
+jobs:
+  run-system-tests:
+    name: "Java ${{ matrix.java.version}}"
+    if: ${{ github.repository == 'spring-projects/spring-boot' }}
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
+    strategy:
+      matrix:
+        java:
+          - version: 17
+            toolchain: true
+          - version: 21
+            toolchain: true
+    steps:
+      - name: Switch Docker to Overlay2
+        shell: bash
+        run: |
+          echo '{"storage-driver":"overlay2"}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+      - name: Check Out Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Prepare Gradle Build
+        uses: ./.github/actions/prepare-gradle-build
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          java-toolchain: ${{ matrix.java.toolchain }}
+          java-version: ${{ matrix.java.version }}
+      - name: Run System Tests
+        id: run-system-tests
+        shell: bash
+        run: ./gradlew systemTest
+      - name: Show docker info
+        if: always()
+        shell: bash
+        run: docker version ; docker info
+      - name: List docker images
+        if: always()
+        shell: bash
+        run: docker image ls --digests
+      - name: Send Notification
+        if: always()
+        uses: ./.github/actions/send-notification
+        with:
+          build-scan-url: ${{ steps.run-system-tests.outputs.build-scan-url }}
+          run-name: ${{ format('{0} | System Tests | Java {1}', github.ref_name, matrix.java.version) }}
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
@@ -0,0 +1,35 @@
+name: Trigger Docs Build
+on:
+  push:
+    branches: '4.1.x'
+    paths: [ 'antora/*' ]
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: 'Version being build (e.g. 1.0.3-SNAPSHOT)'
+        required: false
+      build-sha:
+        description: Enter the SHA to build (e.g. 82c97891569821a7f91a77ca074232e0b54ca7a5)
+        required: false
+      build-refname:
+        description: 'Git refname to build (e.g., 1.0.x)'
+        required: false
+
+permissions:
+  contents: read
+jobs:
+  trigger-docs-build:
+    name: Trigger Docs Build
+    if: github.repository_owner == 'spring-projects'
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    permissions:
+      actions: write
+    steps:
+    - name: Check Out
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: docs-build
+    - name: Trigger Workflow
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r docs-build -f build-refname=${{ github.event.inputs.build-refname }} -f build-sha=${{ github.event.inputs.build-sha }} -f build-version=${{ github.event.inputs.build-version }}