Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GHA Snapshot publishing #912

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
40 changes: 40 additions & 0 deletions .github/workflows/publish.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name: Publishing

on:
# Only publish when 'All tests' has finished on master branch
workflow_run:
workflows: [ All tests ]
branches: [ master ]
types: [ completed ]

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
cancel-in-progress: true

jobs:
publish_snapshot:
runs-on: ubuntu-latest
timeout-minutes: 30
if: ${{ github.event.workflow_run.conclusion == 'success' }} # only publish if the tests passed

steps:
- uses: actions/checkout@v3

- uses: actions/setup-java@v3
with:
distribution: adopt
java-version: 11

- name: Setup Gradle
uses: gradle/gradle-build-action@v2

- name: Publish snapshot to Sonatype
env:
ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.GRADLE_SIGNING_KEY_ID }}
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GRADLE_SIGNING_PASSWORD }}
ORG_GRADLE_PROJECT_signingSecretKeyRingFile: ${{ secrets.GRADLE_SIGNING_SECRET_KEY_RING_FILE }}
ORG_GRADLE_PROJECT_ossrhUsername: ${{ secrets.OSS_SONATYPE_USERNAME }}
ORG_GRADLE_PROJECT_ossrhPassword: ${{ secrets.OSS_SONATYPE_PASSWORD }}
run: ./gradlew publishToSonatypeStaging --no-parallel
# don't run in parallel - Sonatype doesn't like it
Original file line number Diff line number Diff line change
Expand Up @@ -12,20 +12,14 @@ plugins {
val sonatypeRepositoryCredentials: Provider<Action<PasswordCredentials>> =
providers.credentialsAction("ossrh")

val sonatypeRepositoryReleaseUrl: Provider<String> = provider {
if (version.toString().endsWith("SNAPSHOT")) {
"https://oss.sonatype.org/content/repositories/snapshots/"
} else {
"https://oss.sonatype.org/service/local/staging/deploy/maven2/"
}
}
val isSnapshotVersion: Provider<Boolean> = provider { version.toString().endsWith("SNAPSHOT") }

val signingKeyId: Provider<String> =
providers.gradleProperty("signing.keyId")
providers.gradleProperty("signingKeyId")
val signingPassword: Provider<String> =
providers.gradleProperty("signing.password")
providers.gradleProperty("signingPassword")
val signingSecretKeyRingFile: Provider<String> =
providers.gradleProperty("signing.secretKeyRingFile")
providers.gradleProperty("signingSecretKeyRingFile")
val ossrhUsername: Provider<String> =
providers.gradleProperty("ossrhUsername")
val ossrhPassword: Provider<String> =
Expand All @@ -47,21 +41,35 @@ val mavenName: String by project.extra
val mavenDescription: String by project.extra
val localrepo: String by project

publishing {
extensions.getByType<PublishingExtension>().apply {
//publishing {
repositories {
// publish to local dir, for testing
maven(rootProject.layout.projectDirectory.dir(localrepo)) {
name = "LocalRepo"
}

/*maven {
url = uri(sonatypeRepositoryReleaseUrl)
credentials {
username = ossrhUsername.get()
password = ossrhPassword.get()
if (ossrhUsername.isPresent && ossrhPassword.isPresent) {
maven("https://oss.sonatype.org/content/repositories/snapshots/") {
name = "SonartypeStaging"
credentials {
username = ossrhUsername.get()
password = ossrhPassword.get()
}
}

if (!isSnapshotVersion.get()) {
maven("https://oss.sonatype.org/service/local/staging/deploy/maven2/") {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please check this guide https://central.sonatype.org/publish/publish-gradle/.
I have doubts that this is right URL.
I will try to deal with required secrets and set them in GH settings:

  • secrets.GRADLE_SIGNING_KEY_ID
  • secrets.GRADLE_SIGNING_PASSWORD
  • secrets.GRADLE_SIGNING_SECRET_KEY_RING_FILE
  • secrets.OSS_SONATYPE_USERNAME
  • secrets.OSS_SONATYPE_PASSWORD

Copy link
Contributor Author

@aSemy aSemy Jan 15, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @oleksiyp!

Would you consider granting @Raibaz co-ownership? Then he could also manage the secrets.

I have doubts that this is right URL.

MockK was published before 2021 so still uses the 'legacy host', but the docs mostly use the new URLs.

Note: As of February 2021, all new projects began being provisioned on https://s01.oss.sonatype.org/. If your project is not provisioned on https://s01.oss.sonatype.org/, you will want to reference the legacy host https://oss.sonatype.org/.

The current MockK config uses the same URL and it works okay

val sonatypeRepositoryReleaseUrl: Provider<String> = provider {
if (version.toString().endsWith("SNAPSHOT")) {
"https://oss.sonatype.org/content/repositories/snapshots/"
} else {
"https://oss.sonatype.org/service/local/staging/deploy/maven2/"
}
}

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure you will need other secrets... and not sure you need them for something else... security is always compromise of comfort. So no 😄 but remember that I am still alive and happy to help 😄

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Afterall if @Raibaz feels that more access is required happy to understand the reasoning and cooperate.

There is a bigger issue where to spend $4k on https://opencollective.com/mockk. Previously I thought it was too small an amount to spend paying contributors... but now it is not that obvious

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm perfectly fine with the access I have now, I don't think I need more :)

After all, this should be a one-shot operation and we should be ok with secrets now, I don't think I'll need access to change them anytime soon.

name = "SonatypeProduction"
credentials {
username = ossrhUsername.get()
password = ossrhPassword.get()
}
}
}
}*/
}
}

// Configure for Android libraries
publications {
if (project.extensions.findByName("android") != null) {
Expand All @@ -72,6 +80,7 @@ publishing {
}
}
}

publications.withType<MavenPublication>().configureEach {
createMockKPom {
name.set(provider { mavenName })
Expand All @@ -83,7 +92,6 @@ publishing {
if (signingKeyId.isPresent && signingSecretKeyRingFile.isPresent && signingPassword.isPresent) {
signing.sign(this)
}

}
}

Expand Down