Restrict publish worflow to production env, remove auto snapshot publishing

.github/workflows/publish.yml

@@ -9,6 +9,7 @@ jobs:
   publish:
     name: Publish to Maven Central
     runs-on: ubuntu-latest
+    environment: production
 
     steps:
       - name: Checkout code

.gitignore

@@ -8,4 +8,5 @@
 .externalNativeBuild
 .cxx
 local.properties
+signing.local
 firebase-debug.log

build.gradle.kts

@@ -1,4 +1,12 @@
 // Top-level build file where you can add configuration options common to all sub-projects/modules.
+
+val signingProperties = java.util.Properties().apply {
+    file("signing.local").takeIf { it.exists() }?.inputStream()?.use { load(it) }
+}
+
+fun getSigningProperty(key: String): String? =
+    providers.environmentVariable(key).orNull ?: signingProperties.getProperty(key)
+
 plugins {
     alias(libs.plugins.android.application) apply false
     alias(libs.plugins.android.library) apply false
@@ -15,8 +23,8 @@ nexusPublishing {
         sonatype {
             nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
             snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
-            username.set(providers.environmentVariable("SONATYPE_USERNAME"))
-            password.set(providers.environmentVariable("SONATYPE_PASSWORD"))
+            username.set(getSigningProperty("SONATYPE_USERNAME"))
+            password.set(getSigningProperty("SONATYPE_PASSWORD"))
         }
     }
 }
@@ -29,8 +37,8 @@ allprojects {
                     name = "snapshot"
                     url = uri("https://central.sonatype.com/repository/maven-snapshots/")
                     credentials {
-                        username = providers.environmentVariable("SONATYPE_USERNAME").orNull ?: ""
-                        password = providers.environmentVariable("SONATYPE_PASSWORD").orNull ?: ""
+                        username = getSigningProperty("SONATYPE_USERNAME") ?: ""
+                        password = getSigningProperty("SONATYPE_PASSWORD") ?: ""
                     }
                 }
             }

gradle/publishing.gradle.kts

@@ -1,12 +1,26 @@
 import org.gradle.api.publish.PublishingExtension
 import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.plugins.signing.SigningExtension
+
+val signingProperties = java.util.Properties().apply {
+    rootProject.file("signing.local").takeIf { it.exists() }?.inputStream()?.use { load(it) }
+}
+
+fun getSigningProperty(key: String): String? =
+    System.getenv(key) ?: signingProperties.getProperty(key)
+
+fun getSigningPropertyWithNewlines(key: String): String? =
+    System.getenv(key) ?: signingProperties.getProperty(key)?.replace("\\n", "\n")
+
+extra["signingProperties"] = signingProperties
+extra["getSigningProperty"] = ::getSigningProperty
 
 plugins.withId("maven-publish") {
     afterEvaluate {
         extensions.configure<PublishingExtension> {
             publications.withType<MavenPublication>().configureEach {
                 groupId = "com.mercari"
-                version = System.getenv("VERSION") ?: project.property("navEntryScopeVersion") as String
+                version = getSigningProperty("VERSION") ?: project.property("navEntryScopeVersion") as String
 
                 pom {
                     url.set("https://github.com/mercari/nav-entry-scope-android")
@@ -38,4 +52,17 @@ plugins.withId("maven-publish") {
             }
         }
     }
+
+    plugins.withId("signing") {
+        val publishing = extensions.getByType<PublishingExtension>()
+        val signing = extensions.getByType<SigningExtension>()
+
+        val signingKey = getSigningPropertyWithNewlines("SIGNING_KEY")
+        val signingPassword = getSigningProperty("SIGNING_PASSWORD")
+
+        if (signingKey != null && signingPassword != null) {
+            signing.useInMemoryPgpKeys(signingKey, signingPassword)
+            signing.sign(publishing.publications)
+        }
+    }
 }

nav-entry-scope/lib/build.gradle.kts

@@ -83,5 +83,4 @@ afterEvaluate {
     }
 }
 
-apply(from = rootProject.file("gradle/publishing.gradle.kts"))
-apply(from = rootProject.file("gradle/signing.gradle.kts"))
+apply(from = rootProject.file("gradle/publishing.gradle.kts"))

nav-entry-scope/processor/build.gradle.kts

@@ -44,5 +44,4 @@ publishing {
     }
 }
 
-apply(from = rootProject.file("gradle/publishing.gradle.kts"))
-apply(from = rootProject.file("gradle/signing.gradle.kts"))
+apply(from = rootProject.file("gradle/publishing.gradle.kts"))