Skip to content

Commit c94f0e0

Browse files
simbo1905simbo1905
committed
wip: isolate signing/publishing under -P release; fix workflow to use it
1 parent 99f8b86 commit c94f0e0

4 files changed

Lines changed: 56 additions & 40 deletions

File tree

‎.github/workflows/release-on-tag.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,15 @@ jobs:
4040
tag_name: ${{ github.ref_name }}
4141
generate_release_notes: true
4242

43-
- name: Build and Deploy to Central
43+
- name: Build and Deploy to Central (release profile)
4444
env:
4545
CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
4646
CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
4747
run: |
48-
mvn -B -ntp -Dgpg.passphrase="${{ secrets.GPG_PASSPHRASE }}" clean deploy
48+
mvn -B -ntp \
49+
-Dgpg.passphrase="${{ secrets.GPG_PASSPHRASE }}" \
50+
-Dgpg.keyname="${{ secrets.GPG_KEYNAME }}" \
51+
-P release clean deploy
4952
5053
- name: Configure Git identity
5154
run: |

‎AGENTS.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ Automated Release (preferred)
8484
- Push a tag named `release/X.Y.Z` (semver, no leading `v`).
8585
- The workflow `.github/workflows/release-on-tag.yml` will:
8686
- Create a GitHub Release for that tag with autogenerated notes.
87-
- Build and deploy artifacts to Maven Central (Central Publishing plugin). Uses `-Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}` for signing.
87+
- Build and deploy artifacts to Maven Central with `-P release` (Central Publishing plugin). Uses `-Dgpg.passphrase=${{ secrets.GPG_PASSPHRASE }}` and `-Dgpg.keyname=${{ secrets.GPG_KEYNAME }}` for signing.
8888
- Create a branch `release-bot-YYYYMMDD-HHMMSS` at the tagged commit and open a PR back to `main` (no version bumps).
8989

9090
Manual Release (local)
@@ -107,7 +107,7 @@ Notes
107107

108108
Secrets Helper
109109
- Use `./scripts/setup-release-secrets.zsh` to set GitHub Actions secrets (`CENTRAL_USERNAME`, `CENTRAL_PASSWORD`, `GPG_PRIVATE_KEY`, `GPG_PASSPHRASE`).
110-
- The script can auto-detect a signing key if neither `GPG_KEY_ID` nor `GPG_PRIVATE_KEY` is provided.
110+
- The script can auto-detect a signing key if neither `GPG_KEY_ID` nor `GPG_PRIVATE_KEY` is provided, and sets `GPG_KEYNAME` (fingerprint) for CI.
111111
- List keys explicitly with: `gpg --list-secret-keys --keyid-format=long`.
112112

113113
## Python Usage (Herodoc, 3.2-safe)

‎RELEASE-GIST.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,15 @@ jobs:
3535
with:
3636
tag_name: ${{ github.ref_name }}
3737
generate_release_notes: true
38-
- name: Build and Deploy to Central
38+
- name: Build and Deploy to Central (release profile)
3939
env:
4040
CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
4141
CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
42-
run: mvn -B -ntp -Dgpg.passphrase="${{ secrets.GPG_PASSPHRASE }}" clean deploy
42+
run: |
43+
mvn -B -ntp \
44+
-Dgpg.passphrase="${{ secrets.GPG_PASSPHRASE }}" \
45+
-Dgpg.keyname="${{ secrets.GPG_KEYNAME }}" \
46+
-P release clean deploy
4347
- name: Configure Git identity
4448
run: |
4549
git config user.name "github-actions[bot]"
@@ -61,6 +65,7 @@ jobs:
6165
6266
- CENTRAL_USERNAME, CENTRAL_PASSWORD (Central Portal token)
6367
- GPG_PRIVATE_KEY (ASCII-armored secret key), GPG_PASSPHRASE
68+
- GPG_KEYNAME (fingerprint of the signing key; set by helper script)
6469
6570
zsh helper (uses gh, gpg) — auto-detects a signing key if not provided:
6671

‎pom.xml‎

Lines changed: 42 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,6 @@
5656
<maven-jar-plugin.version>3.4.2</maven-jar-plugin.version>
5757
<maven-install-plugin.version>3.1.2</maven-install-plugin.version>
5858
<download-maven-plugin.version>1.7.1</download-maven-plugin.version>
59-
<!-- Ensure GPG is enabled by default for releases -->
60-
<gpg.skip>false</gpg.skip>
6159
</properties>
6260

6361

@@ -157,38 +155,7 @@
157155
</execution>
158156
</executions>
159157
</plugin>
160-
<plugin>
161-
<groupId>org.apache.maven.plugins</groupId>
162-
<artifactId>maven-gpg-plugin</artifactId>
163-
<version>3.1.0</version>
164-
<executions>
165-
<execution>
166-
<id>sign-artifacts</id>
167-
<phase>verify</phase>
168-
<goals>
169-
<goal>sign</goal>
170-
</goals>
171-
</execution>
172-
</executions>
173-
<configuration>
174-
<skip>${gpg.skip}</skip>
175-
<gpgArguments>
176-
<arg>--pinentry-mode</arg>
177-
<arg>loopback</arg>
178-
</gpgArguments>
179-
</configuration>
180-
</plugin>
181-
<plugin>
182-
<groupId>org.sonatype.central</groupId>
183-
<artifactId>central-publishing-maven-plugin</artifactId>
184-
<version>0.6.0</version>
185-
<extensions>true</extensions>
186-
<configuration>
187-
<publishingServerId>central</publishingServerId>
188-
<autoPublish>true</autoPublish>
189-
<waitUntil>published</waitUntil>
190-
</configuration>
191-
</plugin>
158+
192159
</plugins>
193160
</build>
194161

@@ -200,4 +167,45 @@
200167
</snapshotRepository>
201168
</distributionManagement>
202169

170+
<profiles>
171+
<profile>
172+
<id>release</id>
173+
<build>
174+
<plugins>
175+
<plugin>
176+
<groupId>org.apache.maven.plugins</groupId>
177+
<artifactId>maven-gpg-plugin</artifactId>
178+
<version>3.1.0</version>
179+
<executions>
180+
<execution>
181+
<id>sign-artifacts</id>
182+
<phase>verify</phase>
183+
<goals>
184+
<goal>sign</goal>
185+
</goals>
186+
</execution>
187+
</executions>
188+
<configuration>
189+
<gpgArguments>
190+
<arg>--pinentry-mode</arg>
191+
<arg>loopback</arg>
192+
</gpgArguments>
193+
</configuration>
194+
</plugin>
195+
<plugin>
196+
<groupId>org.sonatype.central</groupId>
197+
<artifactId>central-publishing-maven-plugin</artifactId>
198+
<version>0.6.0</version>
199+
<extensions>true</extensions>
200+
<configuration>
201+
<publishingServerId>central</publishingServerId>
202+
<autoPublish>true</autoPublish>
203+
<waitUntil>published</waitUntil>
204+
</configuration>
205+
</plugin>
206+
</plugins>
207+
</build>
208+
</profile>
209+
</profiles>
210+
203211
</project>

0 commit comments

Comments
 (0)