Skip to content

Commit 7174790

Browse files
bevzzzbevzzz
committed
ci: migrate to central-publishing-maven-plugin
OSSRH platform was sunset on June 30, 2025 and the recommended way to publish Maven artifacts is now via 'central-publishing-maven-plugin'. https://central.sonatype.org/pages/ossrh-eol/ The new Publishing Platform doubles as a staging server and will verify the artifact's checksums and GPG-signatures. 1. We replace nexus-staging-maven-plugin with central-publishing-maven-plugin and drop the explicit <distributionManagement> configuration (we use the plugin's default configuration). 2. Default settings for 'mvn deploy' is to NOT auto-publish and out wait until the artifact is 'verified'. We override these in our GitHub CI to autoPublish=true and waitUntil=published. This allows testing deployment changes and running mvn-deploy locally without running a risk of accidentally publishing an artifact. 3. Move ./decrypt_secret.sh to tools/ and add an encrypt_secret.sh script for convenience 4. Update create-release.yaml GH workflow
1 parent 9a70054 commit 7174790

4 files changed

Lines changed: 54 additions & 33 deletions

File tree

‎.github/workflows/create-release.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
env:
1717
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
1818
run: |
19-
./decrypt_secret.sh
19+
./tools/decrypt_secret.sh
2020
- name: Deploy
2121
env:
2222
OKTA_DUMMY_CI_PW: ${{ secrets.OKTA_DUMMY_CI_PW }}
@@ -25,8 +25,12 @@ jobs:
2525
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
2626
run: |
2727
export GPG_TTY=$(tty)
28+
source ./passphrase.env # load $MAVEN_GPG_PASSHRASE for maven-gpg-plugin
2829
mvn -DskipTests clean package
29-
mvn -s settings.xml deploy
30+
mvn -s settings.xml \
31+
-Dcentral-publishing.autoPublish=true \
32+
-Dcentral-publishing.waitUntil=published \
33+
deploy
3034
- name: Archive artifacts
3135
uses: actions/upload-artifact@v4
3236
with:

‎pom.xml‎

Lines changed: 20 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -39,17 +39,6 @@
3939
<tag>5.3.0</tag>
4040
</scm>
4141

42-
<distributionManagement>
43-
<snapshotRepository>
44-
<id>ossrh</id>
45-
<url>https://s01.oss.sonatype.org/content/repositories/snapshots/</url>
46-
</snapshotRepository>
47-
<repository>
48-
<id>ossrh</id>
49-
<url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
50-
</repository>
51-
</distributionManagement>
52-
5342
<properties>
5443
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
5544
<project.reporting.sourceEncoding>UTF-8</project.reporting.sourceEncoding>
@@ -366,7 +355,7 @@
366355
<plugin>
367356
<groupId>org.apache.maven.plugins</groupId>
368357
<artifactId>maven-gpg-plugin</artifactId>
369-
<version>1.6</version>
358+
<version>3.2.8</version>
370359
<executions>
371360
<execution>
372361
<id>sign-artifacts</id>
@@ -375,9 +364,9 @@
375364
<goal>sign</goal>
376365
</goals>
377366
<configuration>
367+
<!-- ${gpg.keyname} is set in settings.xml from settings.tar.gpg archive -->
378368
<useAgent>true</useAgent>
379-
<keyname>${gpg.keyname}</keyname>
380-
<passphraseServerId>${gpg.keyname}</passphraseServerId>
369+
<bestPractices>true</bestPractices>
381370
<gpgArguments>
382371
<arg>--batch</arg>
383372
<arg>--pinentry-mode</arg>
@@ -395,33 +384,33 @@
395384
<artifactId>maven-install-plugin</artifactId>
396385
<version>3.0.0-M1</version>
397386
</plugin>
387+
388+
<!-- Maven includes maven-deploy-plugin by default, but we want to delegate -->
389+
<!-- deployement to a third-party plugin. We add this entry to override <skip> -->
390+
<!-- and ensure we dont' accidentaily publish twice. -->
398391
<plugin>
399392
<artifactId>maven-deploy-plugin</artifactId>
400393
<version>3.0.0-M1</version>
401394
<configuration>
402395
<skip>true</skip>
403396
</configuration>
404397
</plugin>
398+
405399
<plugin>
406-
<groupId>org.sonatype.plugins</groupId>
407-
<artifactId>nexus-staging-maven-plugin</artifactId>
408-
<version>1.6.13</version>
400+
<groupId>org.sonatype.central</groupId>
401+
<artifactId>central-publishing-maven-plugin</artifactId>
402+
<version>0.8.0</version>
409403
<extensions>true</extensions>
410-
<executions>
411-
<execution>
412-
<id>default-deploy</id>
413-
<phase>deploy</phase>
414-
<goals>
415-
<goal>deploy</goal>
416-
</goals>
417-
</execution>
418-
</executions>
419404
<configuration>
420-
<serverId>ossrh</serverId>
421-
<nexusUrl>https://s01.oss.sonatype.org</nexusUrl>
422-
<autoReleaseAfterClose>true</autoReleaseAfterClose>
405+
<!-- Auto-publishing is disabled by default to prevent accidental deployments. -->
406+
<!-- When testing, it is therefore safe to run `mvn deploy` from your local machine, -->
407+
<!-- as publishing will require manual action. -->
408+
<!-- In CI we override this option to true and waitUtil=published. -->
409+
<autoPublish>${central-publishing.autoPublish}</autoPublish>
410+
<waitUntil>${central-publishing.waitUntil}</waitUntil>
423411
</configuration>
424412
</plugin>
413+
425414
<plugin>
426415
<artifactId>maven-site-plugin</artifactId>
427416
<version>3.9.1</version>
@@ -458,8 +447,8 @@
458447
<artifactId>maven-gpg-plugin</artifactId>
459448
</plugin>
460449
<plugin>
461-
<groupId>org.sonatype.plugins</groupId>
462-
<artifactId>nexus-staging-maven-plugin</artifactId>
450+
<groupId>org.sonatype.central</groupId>
451+
<artifactId>central-publishing-maven-plugin</artifactId>
463452
</plugin>
464453
</plugins>
465454
</build>

decrypt_secret.sh renamed to tools/decrypt_secret.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#!/usr/bin/env bash
22
set -euo pipefail
33

4+
# Options:
45
# --batch to prevent interactive command
56
# --yes to assume "yes" for questions
67
gpg --quiet --batch --yes --decrypt --passphrase="$GPG_PASSPHRASE" --output secrets.tar secrets.tar.gpg

‎tools/encrypt_secret.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# This script generates a GPG-ecrypted tarball with our signing GPG key
5+
# and Maven Central Repository credentials.
6+
#
7+
# Make sure that key.gpg, settings.xml, and passphrase.env exist in the current directory.
8+
# Delete these files after the script has run. Only commit secrets.tar.gpg!
9+
10+
rm -f secrets.tar &&
11+
tar --no-xattrs -czf secrets.tar key.gpg settings.xml passphrase.env
12+
13+
rm -f secrets.tar.gpg &&
14+
gpg --batch --symmetric \
15+
--passphrase "$GPG_PASSPHRASE" \
16+
--output secrets.tar.gpg \
17+
secrets.tar
18+
19+
rm -f secrets.tar
20+
21+
echo "Tarball secrets.tar.gpg generated successfully."
22+
echo "Remember to delete the plaintext files. Only commit secrets.tar.gpg to source control!"
23+
echo
24+
echo " \$ git add secrets.tar.gpg && git commit -m 'ci: update secrets.tar.gpg'"
25+
echo " \$ rm key.gpg settings.xml passphrase.env"
26+
echo
27+

0 commit comments

Comments
 (0)