Setup a new release process to be used after the deprecation of OSSRH

CC: https://central.sonatype.org/news/20250326_ossrh_sunset/

Author: brunoocasali

.github/workflows/ossrh-publish.yml

@@ -0,0 +1,27 @@
+name: Publish to Maven Central
+
+on:
+  push:
+    tags: ["v*"]   # Trigger on version tag pushes (adjust as needed)
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - name: Publish to Sonatype Central
+        env:
+          # Pass Sonatype portal token credentials to Gradle
+          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          MAVEN_CENTRAL_SIGNING_KEY: ${{ secrets.MAVEN_CENTRAL_SIGNING_KEY }}
+          MAVEN_CENTRAL_SIGNING_PASSWORD: ${{ secrets.MAVEN_CENTRAL_SIGNING_PASSWORD }}
+        run: ./gradlew clean publishToSonatype closeAndReleaseSonatypeStagingRepository

.github/workflows/publish.yml

@@ -199,29 +199,22 @@ gpg --gen-key --batch genkey
 gpg --keyserver hkp://keyserver.ubuntu.com --send-keys <last-8-digits-of-your-key-hash>
 ```
 
-5. Export the gpg key in a secring.gpg file
+5. Export the gpg key in a signing-key.asc armored file
 
 ```bash
-gpg --keyring secring.gpg --export-secret-keys > ~/.gnupg/secring.gpg
-```
-
-6. Encode the secring in base64 and store it (Used by the ossrh-publish workflow)
-
-```bash
-base64 ~/.gnupg/secring.gpg > secring.gpg.b64
+gpg --armor --export-secret-keys $KEY_ID > signing-key.asc
 ```
 
 #### Sign your files and upload to Maven Repository manually <!-- omit in TOC -->
 
 1. Set the environment variables listed below with the required credentials:
 
 ```bash
-export OSSRH_USERNAME=<maven-username>
-export OSSRH_PASSWORD=<maven-password>
+export MAVEN_CENTRAL_USERNAME=<maven-username>
+export MAVEN_CENTRAL_PASSWORD=<maven-password>
 
 export SIGNINT_KEY_ID=<id-associated-to-the-gpg-key>
 export SIGNING_PASSWORD=<passphrase-associated-to-the-gpg-key>
-export SIGNING_SECRET_KEY_RING_FILE=<path-to-gpg-key-encoded-in-base64>
 ```
 
 2. Decode the gpg key
@@ -235,13 +228,13 @@ base64 -d $SIGNING_SECRET_KEY_RING_FILE > secring.gpg
 ```bash
 # May need sudo privilege and JDK8
 ./gradlew build
-./gradlew publish -Psigning.keyId=$SIGNING_KEY_ID -Psigning.password=$SIGNING_PASSWORD -Psigning.secretKeyRingFile=$(echo secring.gpg)
+TODO
 ```
 
-4. Login to [Sonatype Nexus](https://oss.sonatype.org).
-5. Navigate to `Staging repositories`.
-6. Close your repository by clicking on the `Close` button. Checks will be made by nexus. It might take time. If any error occurs, it will be visible in the `Activity` tab.
-7. Once the check have succeeded, you should be able to click on the `Release` button. The release will be now processed and might take a long time to appear in [Maven Central](https://search.maven.org/artifact/com.meilisearch.sdk/meilisearch-java).
+4. Login to [Sonatype Nexus](https://central.sonatype.com/).
+5. Navigate to `Deployments`.
+6. Checks will be made by Sonatype. It might take time. If any error occurs, it will be visible in the `Deployments` tab (last one).
+7. Once the check have succeeded, the release will be now processed and it will appear in [Maven Central](https://central.sonatype.com/artifact/com.meilisearch.sdk/meilisearch-java/versions).
 
 <hr>
 

CONTRIBUTING.md

@@ -12,7 +12,7 @@ plugins {
 	id 'maven-publish'
 	id 'signing'
 	id 'jacoco'
-	id 'io.github.gradle-nexus.publish-plugin' version "2.0.0"
+	id "io.github.gradle-nexus.publish-plugin" version "2.0.0"
 	id "com.diffplug.spotless" version "6.13.0"
 }
 
@@ -159,33 +159,25 @@ publishing {
 			}
 		}
 	}
-	repositories {
-		maven {
-			url "https://oss.sonatype.org/service/local/staging/deploy/maven2"
-			credentials {
-				username System.getenv('OSSRH_USERNAME')
-				password System.getenv('OSSRH_PASSWORD')
-			}
-		}
-	}
 }
 
 nexusPublishing {
-	packageGroup = "com.meilisearch"
-
 	repositories {
 		sonatype {
-			nexusUrl.set(uri("https://oss.sonatype.org/service/local/"))
-
-			username = System.getenv('OSSRH_USERNAME')
-			password = System.getenv('OSSRH_PASSWORD')
-			stagingProfileId = System.getenv('SONATYPE_STAGING_PROFILE_ID')
+			// Point to new Central Portal staging API (replaces oss.sonatype.org)
+			nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
+			snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
+			// Credentials: use Central Portal token (username/password)
+			username.set(System.getenv("MAVEN_CENTRAL_USERNAME"))  // portal token user
+			password.set(System.getenv("MAVEN_CENTRAL_PASSWORD"))  // portal token password
+			// packageGroup or stagingProfileId not needed if using nexus-publish-plugin
 		}
 	}
 }
 
 signing {
-	sign publishing.publications.mavenJava
+	useInMemoryPgpKeys(System.getenv("MAVEN_CENTRAL_SIGNING_KEY"), System.getenv("MAVEN_CENTRAL_SIGNING_PASSWORD"))
+	sign(publishing.publications["mavenJava"])
 }
 
 javadoc {

build.gradle

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.1-bin.zip
 networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists