Skip to content

Commit e362a6a

Browse files
SubterraneSubterrane
committed
Migrate publishing to Central Portal API
The legacy OSSRH API (oss.sonatype.org) returns 403 Forbidden. Sonatype now requires the Central Portal Publisher API. Changes: - Use Central Portal upload endpoint instead of nexus-publish plugin - Build bundle ZIP with Maven directory structure - Sign artifacts with GPG and generate checksums - Poll for deployment completion - Update to JDK 17 and actions v4
1 parent 38a889f commit e362a6a

File tree

1 file changed

+102
-17
lines changed

1 file changed

+102
-17
lines changed

‎.github/workflows/publish-workflow.yml‎

Lines changed: 102 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,13 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Check out repo
13-
uses: actions/checkout@v2
13+
uses: actions/checkout@v4
1414

15-
- name: set up JDK 1.8
16-
uses: actions/setup-java@v1
15+
- name: Set up JDK 17
16+
uses: actions/setup-java@v4
1717
with:
18-
java-version: 1.8
18+
java-version: '17'
19+
distribution: 'temurin'
1920

2021
- name: Retrieve AWS Secrets - Common Android
2122
uses: say8425/aws-secrets-manager-actions@v2
@@ -25,28 +26,112 @@ jobs:
2526
AWS_DEFAULT_REGION: us-east-1
2627
SECRET_NAME: common/gh-actions/android
2728

28-
# Base64 decodes and pipes the GPG key content into the secret file
29-
- name: Prepare environment
29+
- name: Prepare GPG key
3030
env:
3131
GPG_KEY_CONTENTS: ${{ env.GPG_KEY_CONTENTS }}
32-
SIGNING_SECRET_KEY_RING_FILE: ${{ env.SIGNING_SECRET_KEY_RING_FILE }}
3332
run: |
34-
git fetch --unshallow
35-
sudo bash -c "echo '$GPG_KEY_CONTENTS' | base64 -d > '$SIGNING_SECRET_KEY_RING_FILE'"
33+
echo "$GPG_KEY_CONTENTS" | base64 -d > /tmp/secring.gpg
34+
gpg --batch --import /tmp/secring.gpg
3635
3736
- name: Build Release
3837
run: ./gradlew oneloginoidc:assembleRelease
3938

40-
- name: Source Jar and dokka
39+
- name: Build Source Jar and Javadoc
4140
run: ./gradlew androidSourcesJar javadocJar
4241

43-
# Runs upload, and then closes & releases the repository
44-
- name: Publish to MavenCentral
45-
run: ./gradlew publishReleasePublicationToSonatypeRepository --max-workers 1 closeAndReleaseSonatypeStagingRepository
42+
- name: Generate POM
43+
run: ./gradlew generatePomFileForReleasePublication
44+
45+
- name: Create bundle for Central Portal
4646
env:
47-
OSSRH_USERNAME: ${{ env.OSSRH_USERNAME }}
48-
OSSRH_PASSWORD: ${{ env.OSSRH_PASSWORD }}
4947
SIGNING_KEY_ID: ${{ env.SIGNING_KEY_ID }}
5048
SIGNING_PASSWORD: ${{ env.SIGNING_PASSWORD }}
51-
SIGNING_SECRET_KEY_RING_FILE: ${{ env.SIGNING_SECRET_KEY_RING_FILE }}
52-
SONATYPE_STAGING_PROFILE_ID: ${{ env.SONATYPE_STAGING_PROFILE_ID }}
49+
run: |
50+
# Get version from build.gradle
51+
VERSION=$(grep -oP 'versionName "\K[^"]+' oneloginoidc/build.gradle)
52+
GROUP_PATH="com/onelogin"
53+
ARTIFACT_ID="onelogin-oidc-android-sdk"
54+
BUNDLE_DIR="bundle/${GROUP_PATH}/${ARTIFACT_ID}/${VERSION}"
55+
56+
echo "Creating bundle for version ${VERSION}"
57+
mkdir -p "${BUNDLE_DIR}"
58+
59+
# Copy artifacts with correct names
60+
cp oneloginoidc/build/outputs/aar/oneloginoidc-release.aar "${BUNDLE_DIR}/${ARTIFACT_ID}-${VERSION}.aar"
61+
cp oneloginoidc/build/libs/oneloginoidc-sources.jar "${BUNDLE_DIR}/${ARTIFACT_ID}-${VERSION}-sources.jar"
62+
cp oneloginoidc/build/libs/oneloginoidc-javadoc.jar "${BUNDLE_DIR}/${ARTIFACT_ID}-${VERSION}-javadoc.jar"
63+
cp oneloginoidc/build/publications/release/pom-default.xml "${BUNDLE_DIR}/${ARTIFACT_ID}-${VERSION}.pom"
64+
65+
cd "${BUNDLE_DIR}"
66+
67+
# Sign all artifacts
68+
for file in *.aar *.jar *.pom; do
69+
echo "${SIGNING_PASSWORD}" | gpg --batch --yes --passphrase-fd 0 --pinentry-mode loopback \
70+
-u "${SIGNING_KEY_ID}" --armor --detach-sign "$file"
71+
done
72+
73+
# Generate checksums for all files (including signatures)
74+
for file in *.aar *.jar *.pom *.asc; do
75+
md5sum "$file" | cut -d' ' -f1 > "${file}.md5"
76+
sha1sum "$file" | cut -d' ' -f1 > "${file}.sha1"
77+
sha256sum "$file" | cut -d' ' -f1 > "${file}.sha256"
78+
sha512sum "$file" | cut -d' ' -f1 > "${file}.sha512"
79+
done
80+
81+
# List bundle contents
82+
echo "Bundle contents:"
83+
ls -la
84+
85+
# Create the bundle zip
86+
cd ../../../..
87+
zip -r bundle.zip bundle/
88+
echo "Bundle created: bundle.zip"
89+
90+
- name: Upload to Maven Central
91+
env:
92+
CENTRAL_TOKEN: ${{ secrets.CENTRAL_SONATYPE_TOKEN }}
93+
run: |
94+
echo "Uploading bundle to Maven Central..."
95+
96+
RESPONSE=$(curl -s -w "\n%{http_code}" \
97+
-X POST "https://central.sonatype.com/api/v1/publisher/upload?publishingType=AUTOMATIC" \
98+
-H "Authorization: Bearer ${CENTRAL_TOKEN}" \
99+
-F "bundle=@bundle.zip")
100+
101+
HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
102+
BODY=$(echo "$RESPONSE" | sed '$d')
103+
104+
echo "Response code: ${HTTP_CODE}"
105+
echo "Response body: ${BODY}"
106+
107+
if [ "$HTTP_CODE" != "201" ]; then
108+
echo "Upload failed with status ${HTTP_CODE}"
109+
exit 1
110+
fi
111+
112+
DEPLOYMENT_ID="${BODY}"
113+
echo "Deployment ID: ${DEPLOYMENT_ID}"
114+
115+
# Poll for status
116+
echo "Waiting for deployment to complete..."
117+
for i in {1..30}; do
118+
sleep 10
119+
STATUS_RESPONSE=$(curl -s \
120+
-H "Authorization: Bearer ${CENTRAL_TOKEN}" \
121+
"https://central.sonatype.com/api/v1/publisher/status?id=${DEPLOYMENT_ID}")
122+
123+
echo "Status check ${i}: ${STATUS_RESPONSE}"
124+
125+
STATE=$(echo "$STATUS_RESPONSE" | grep -oP '"deploymentState"\s*:\s*"\K[^"]+' || echo "UNKNOWN")
126+
127+
if [ "$STATE" = "PUBLISHED" ]; then
128+
echo "Successfully published to Maven Central!"
129+
exit 0
130+
elif [ "$STATE" = "FAILED" ]; then
131+
echo "Deployment failed!"
132+
exit 1
133+
fi
134+
done
135+
136+
echo "Timeout waiting for deployment. Final state: ${STATE}"
137+
echo "Check https://central.sonatype.com for deployment status"

0 commit comments

Comments
 (0)