Skip to content

Commit 360d75d

Browse files
bevzzzbevzzz
committed
ci: migrate to central-publishing-maven-plugin
OSSRH platform was sunset on June 30, 2025 and the recommended way to publish Maven artifacts is now via 'central-publishing-maven-plugin'. https://central.sonatype.org/pages/ossrh-eol/ The new Publishing Platform doubles as a staging server and will verify the artifact's checksums and GPG-signatures. 1. We replace nexus-staging-maven-plugin with central-publishing-maven-plugin and drop the explicit <distributionManagement> configuration (we use the plugin's default configuration). 2. Default settings for 'mvn deploy' is to NOT auto-publish and out wait until the artifact is 'verified'. We override these in our GitHub CI to autoPublish=true and waitUntil=published. This allows testing deployment changes and running mvn-deploy locally without running a risk of accidentally publishing an artifact. 3. Move ./decrypt_secret.sh to tools/ and add an encrypt_secret.sh script for convenience 4. Update create-release.yaml GH workflow
1 parent 42f6742 commit 360d75d

4 files changed

Lines changed: 55 additions & 35 deletions

File tree

‎.github/workflows/create-release.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
env:
1717
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
1818
run: |
19-
./decrypt_secret.sh
19+
./tools/decrypt_secret.sh
2020
- name: Deploy
2121
env:
2222
OKTA_DUMMY_CI_PW: ${{ secrets.OKTA_DUMMY_CI_PW }}
@@ -26,7 +26,10 @@ jobs:
2626
run: |
2727
export GPG_TTY=$(tty)
2828
mvn -DskipTests clean package
29-
mvn -s settings.xml deploy
29+
mvn -s settings.xml \
30+
-Dcentral-publishing.autoPublish=true \
31+
-Dcentral-publishing.waitUntil=published \
32+
deploy
3033
- name: Archive artifacts
3134
uses: actions/upload-artifact@v4
3235
with:

‎pom.xml‎

Lines changed: 22 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
<packaging>jar</packaging>
88
<version>6.0.0-SNAPSHOT</version>
99

10-
<name>Weaviate Java Client</name>
11-
<description>A Java client for Weaviate Vector Search Engine</description>
10+
<name>${project.groupId}:${project.artifactId}</name>
11+
<description>Official Java client for Weaviate Vector Search Engine</description>
1212
<url>https://github.com/weaviate/java-client</url>
1313

1414
<organization>
@@ -45,17 +45,6 @@
4545
<tag>6.0.0-beta2</tag>
4646
</scm>
4747

48-
<distributionManagement>
49-
<snapshotRepository>
50-
<id>ossrh</id>
51-
<url>https://s01.oss.sonatype.org/content/repositories/snapshots/</url>
52-
</snapshotRepository>
53-
<repository>
54-
<id>ossrh</id>
55-
<url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
56-
</repository>
57-
</distributionManagement>
58-
5948
<properties>
6049
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
6150
<project.reporting.sourceEncoding>UTF-8</project.reporting.sourceEncoding>
@@ -392,7 +381,7 @@
392381
<plugin>
393382
<groupId>org.apache.maven.plugins</groupId>
394383
<artifactId>maven-gpg-plugin</artifactId>
395-
<version>1.6</version>
384+
<version>3.2.8</version>
396385
<executions>
397386
<execution>
398387
<id>sign-artifacts</id>
@@ -401,9 +390,9 @@
401390
<goal>sign</goal>
402391
</goals>
403392
<configuration>
393+
<!-- ${gpg.keyname} is set in settings.xml from settings.tar.gpg archive -->
404394
<useAgent>true</useAgent>
405-
<keyname>${gpg.keyname}</keyname>
406-
<passphraseServerId>${gpg.keyname}</passphraseServerId>
395+
<bestPractices>true</bestPractices>
407396
<gpgArguments>
408397
<arg>--batch</arg>
409398
<arg>--pinentry-mode</arg>
@@ -421,33 +410,33 @@
421410
<artifactId>maven-install-plugin</artifactId>
422411
<version>3.0.0-M1</version>
423412
</plugin>
413+
414+
<!-- Maven includes maven-deploy-plugin by default, but we want to delegate -->
415+
<!-- deployement to a third-party plugin. We add this entry to override <skip> -->
416+
<!-- and ensure we dont' accidentaily publish twice. -->
424417
<plugin>
425418
<artifactId>maven-deploy-plugin</artifactId>
426419
<version>3.0.0-M1</version>
427420
<configuration>
428421
<skip>true</skip>
429422
</configuration>
430423
</plugin>
424+
431425
<plugin>
432-
<groupId>org.sonatype.plugins</groupId>
433-
<artifactId>nexus-staging-maven-plugin</artifactId>
434-
<version>1.6.13</version>
426+
<groupId>org.sonatype.central</groupId>
427+
<artifactId>central-publishing-maven-plugin</artifactId>
428+
<version>0.8.0</version>
435429
<extensions>true</extensions>
436-
<executions>
437-
<execution>
438-
<id>default-deploy</id>
439-
<phase>deploy</phase>
440-
<goals>
441-
<goal>deploy</goal>
442-
</goals>
443-
</execution>
444-
</executions>
445430
<configuration>
446-
<serverId>ossrh</serverId>
447-
<nexusUrl>https://s01.oss.sonatype.org</nexusUrl>
448-
<autoReleaseAfterClose>true</autoReleaseAfterClose>
431+
<!-- Auto-publishing is disabled by default to prevent accidental deployments. -->
432+
<!-- When testing, it is therefore safe to run `mvn deploy` from your local machine, -->
433+
<!-- as publishing will require manual action. -->
434+
<!-- In CI we override this option to true and waitUtil=published. -->
435+
<autoPublish>${central-publishing.autoPublish}</autoPublish>
436+
<waitUntil>${central-publishing.waitUntil}</waitUntil>
449437
</configuration>
450438
</plugin>
439+
451440
<plugin>
452441
<artifactId>maven-site-plugin</artifactId>
453442
<version>3.9.1</version>
@@ -484,8 +473,8 @@
484473
<artifactId>maven-gpg-plugin</artifactId>
485474
</plugin>
486475
<plugin>
487-
<groupId>org.sonatype.plugins</groupId>
488-
<artifactId>nexus-staging-maven-plugin</artifactId>
476+
<groupId>org.sonatype.central</groupId>
477+
<artifactId>central-publishing-maven-plugin</artifactId>
489478
</plugin>
490479
</plugins>
491480
</build>

decrypt_secret.sh renamed to tools/decrypt_secret.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#!/usr/bin/env bash
22
set -euo pipefail
33

4+
# Options:
45
# --batch to prevent interactive command
56
# --yes to assume "yes" for questions
67
gpg --quiet --batch --yes --decrypt --passphrase="$GPG_PASSPHRASE" --output secrets.tar secrets.tar.gpg

‎tools/encrypt_secret.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# This script generates a GPG-ecrypted tarball with our signing GPG key
5+
# and Maven Central Repository credentials.
6+
#
7+
# Make sure that key.gpg, settings.xml, and passphrase.env exist in the current directory.
8+
# Delete these files after the script has run. Only commit secrets.tar.gpg!
9+
10+
rm -f secrets.tar &&
11+
tar --no-xattrs -czf secrets.tar key.gpg settings.xml passphrase.env
12+
13+
rm -f secrets.tar.gpg &&
14+
gpg --batch --symmetric \
15+
--passphrase "$GPG_PASSPHRASE" \
16+
--output secrets.tar.gpg \
17+
secrets.tar
18+
19+
rm -f secrets.tar
20+
21+
echo "Tarball secrets.tar.gpg generated successfully."
22+
echo "Remember to delete the plaintext files. Only commit secrets.tar.gpg to source control!"
23+
echo
24+
echo " \$ git add secrets.tar.gpg && git commit -m 'ci: update secrets.tar.gpg'"
25+
echo " \$ rm key.gpg settings.xml passphrase.env"
26+
echo
27+

0 commit comments

Comments
 (0)