|
| 1 | +# Maven Central Release Setup |
| 2 | + |
| 3 | +This document describes how to configure GitHub Actions to automatically publish releases to Maven Central. |
| 4 | + |
| 5 | +## Prerequisites |
| 6 | + |
| 7 | +1. A Maven Central account (via [central.sonatype.org](https://central.sonatype.org)) |
| 8 | +2. A GPG key pair for signing artifacts |
| 9 | + |
| 10 | +## Required GitHub Secrets |
| 11 | + |
| 12 | +Configure the following secrets in your GitHub repository settings (Settings → Secrets and variables → Actions): |
| 13 | + |
| 14 | +### 1. `MAVEN_CENTRAL_USERNAME` |
| 15 | +Your Maven Central username/token username. |
| 16 | + |
| 17 | +For Central Portal (recommended): |
| 18 | +- Go to https://central.sonatype.com/account |
| 19 | +- Generate a new token |
| 20 | +- Use the token username |
| 21 | + |
| 22 | +### 2. `MAVEN_CENTRAL_TOKEN` |
| 23 | +Your Maven Central password/token password. |
| 24 | + |
| 25 | +For Central Portal: |
| 26 | +- Use the token password from the same token generation step above |
| 27 | + |
| 28 | +### 3. `GPG_PRIVATE_KEY` |
| 29 | +Your GPG private key used for signing artifacts. |
| 30 | + |
| 31 | +To export your GPG private key: |
| 32 | +```bash |
| 33 | +# List your keys |
| 34 | +gpg --list-secret-keys --keyid-format=long |
| 35 | + |
| 36 | +# Export the key (replace KEY_ID with your key ID) |
| 37 | +gpg --armor --export-secret-keys KEY_ID |
| 38 | +``` |
| 39 | + |
| 40 | +Copy the entire output including the `-----BEGIN PGP PRIVATE KEY BLOCK-----` and `-----END PGP PRIVATE KEY BLOCK-----` lines. |
| 41 | + |
| 42 | +### 4. `GPG_PASSPHRASE` |
| 43 | +The passphrase for your GPG private key. |
| 44 | + |
| 45 | +## Generating a GPG Key (if you don't have one) |
| 46 | + |
| 47 | +```bash |
| 48 | +# Generate a new key |
| 49 | +gpg --gen-key |
| 50 | + |
| 51 | +# Follow the prompts: |
| 52 | +# - Use your real name |
| 53 | +# - Use your email |
| 54 | +# - Choose a strong passphrase |
| 55 | + |
| 56 | +# List your keys to verify |
| 57 | +gpg --list-secret-keys --keyid-format=long |
| 58 | + |
| 59 | +# Upload your public key to a key server |
| 60 | +gpg --keyserver keyserver.ubuntu.com --send-keys KEY_ID |
| 61 | +gpg --keyserver keys.openpgp.org --send-keys KEY_ID |
| 62 | +``` |
| 63 | + |
| 64 | +## Triggering a Release |
| 65 | + |
| 66 | +There are two ways to trigger a release: |
| 67 | + |
| 68 | +### 1. Tag-based Release (Recommended) |
| 69 | +```bash |
| 70 | +# Create and push a version tag |
| 71 | +git tag v3.0.0 |
| 72 | +git push origin v3.0.0 |
| 73 | +``` |
| 74 | + |
| 75 | +The workflow will automatically: |
| 76 | +- Build the project |
| 77 | +- Sign the artifacts |
| 78 | +- Deploy to Maven Central |
| 79 | +- Create a GitHub release |
| 80 | + |
| 81 | +### 2. Manual Release |
| 82 | +Go to Actions → Release to Maven Central → Run workflow and enter the version number. |
| 83 | + |
| 84 | +## Verifying the Release |
| 85 | + |
| 86 | +1. Check the GitHub Actions workflow run for any errors |
| 87 | +2. Verify the artifacts on [Maven Central](https://central.sonatype.com/) |
| 88 | +3. Check the [Maven Central Repository](https://repo1.maven.org/maven2/com/vgerbot/propify/) (may take a few hours to sync) |
| 89 | + |
| 90 | +## Troubleshooting |
| 91 | + |
| 92 | +### GPG Signing Issues |
| 93 | +- Ensure the GPG key is properly formatted with newlines |
| 94 | +- Verify the passphrase is correct |
| 95 | +- Check that the key hasn't expired: `gpg --list-keys` |
| 96 | + |
| 97 | +### Maven Central Authentication Issues |
| 98 | +- Verify your credentials are correct |
| 99 | +- Ensure your token hasn't expired |
| 100 | +- Check that you have the necessary permissions for the groupId `com.vgerbot` |
| 101 | + |
| 102 | +### Deployment Failures |
| 103 | +- Review the GitHub Actions logs |
| 104 | +- Ensure all required metadata is present in the POM (name, description, url, licenses, developers, scm) |
| 105 | +- Verify that source and javadoc JARs are being generated |
| 106 | + |
| 107 | +## Maven Central Requirements |
| 108 | + |
| 109 | +To successfully publish to Maven Central, your artifacts must include: |
| 110 | +- ✅ Project metadata (name, description, URL) - Already configured |
| 111 | +- ✅ License information - Already configured |
| 112 | +- ✅ Developer information - Already configured |
| 113 | +- ✅ SCM information - Already configured |
| 114 | +- ✅ Source JAR - Configured via maven-source-plugin |
| 115 | +- ✅ Javadoc JAR - Configured via maven-javadoc-plugin |
| 116 | +- ✅ GPG signatures - Configured via maven-gpg-plugin in release profile |
| 117 | + |
| 118 | +All requirements are already satisfied in your `propify/pom.xml`. |
0 commit comments