[ACL-296] Move publishing to Maven Central#367
Merged
Conversation
dili91
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
dili91
force-pushed
the
ACL-296-fix-snapshot-release-403
branch
from
July 25, 2025 12:18
0ad4578 to
d2cd9cf
Compare
dili91
commented
Jul 30, 2025
| paymentResponse.getData().getId(), | ||
| paymentResponse.getData().getResourceToken(), | ||
| URI.create("http://localhost:8080/donations/callback")); | ||
| return tlClient.hppLinkBuilder() |
Contributor
Author
There was a problem hiding this comment.
This was a leftover, unrelated to the main changes contained PR
dili91
marked this pull request as ready for review
July 30, 2025 10:20
tl-luca-baggi
previously approved these changes
Jul 30, 2025
…rets - Update workflow-branch.yml to use MAVEN_CENTRAL_USERNAME, MAVEN_CENTRAL_PASSWORD, PGP_SIGNING_IN_MEMORY_KEY secrets - Update workflow-main.yml to use correct secret names for Maven Central publishing - Update workflow-pr-fork.yml to use correct secret names for snapshot releases
tl-luca-baggi
approved these changes
Aug 7, 2025
kplattret
added a commit
to TrueLayer/truelayer-signing
that referenced
this pull request
Jun 25, 2026
The legacy OSSRH / Nexus host (s01.oss.sonatype.org) was EOL'd by Sonatype on 30 June 2025 and now returns HTTP 402, which broke the 0.3.0 release. Migrate publishing to the Sonatype Central Portal, mirroring TrueLayer/truelayer-java#367. - Replace gradle-nexus.publish-plugin with com.vanniktech.maven.publish 0.34.0; publish via mavenPublishing { publishToMavenCentral(true); signAllPublications() } (Central Portal default, automatic release). - Drop the dead OSSRH URLs from gradle.properties. - Switch the release trigger from a git-diff to a hosted-version check: query repo1.maven.org for the artifact's POM and publish only on 404 (200 skips, any other status fails the job), mirroring the Python workflow. Gate on a non-SNAPSHOT version and serialize publishes with a concurrency group. - Use Central Portal credentials (mavenCentral / signingInMemory env). Co-Authored-By: Claude Opus 4.8 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR migrates the publishing pipeline from Bintray/JCenter to Maven Central using the vanniktech gradle-maven-publish-plugin and resolves the 403 errors we were experiencing with the previous publishing setup.
Background
The Nexus Repository Manager v2 and dependent services, including OSSRH, reached end-of-life on June 30, 2025. This necessitated the migration to either a newer version of Nexus Sonatype(v3) or to Maven Central for our publishing pipeline.
Considering that:
I'm proposing to move our publishing directly to Maven Central.
Changes for us
Impact for customers
Customers don't have to change anything to use stable releases of the library.
There's only a consequence for customers making use of SNAPSHOTs releases: As mentioned in our README, they will have to use the updated repository link in their projects.
Migration Guide
This implementation follows the official migration guide: https://vanniktech.github.io/gradle-maven-publish-plugin/central/
For signing key configuration, this helpful comment was referenced: vanniktech/gradle-maven-publish-plugin#201 (comment). More precisely, that thread helped me understanding the expected format for the key expected by the publishing plugin.