Skip to content

Configure maven central publishing #1042

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 12, 2025
+46 −13
Merged

Configure maven central publishing #1042

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 21 additions & 6 deletions .github/workflows/release-sigstore-java-from-tag.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,14 +57,29 @@ jobs:
- name: Setup Gradle
uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1

- name: Authenticate to Google Cloud
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v0.8.1
with:
workload_identity_provider: projects/306323169285/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider
service_account: [email protected]

- uses: google-github-actions/get-secretmanager-secrets@a8440875e1c2892062aef9061228d4f1af8f919b # v2.2.3
id: secrets
with:
secrets: |-
signing_key:sigstore-secrets/sigstore-java-pgp-priv-key
signing_password:sigstore-secrets/sigstore-java-pgp-priv-key-password
sonatype_username:sigstore-secrets/sigstore-sonatype-central-portal-username
sonatype_password:sigstore-secrets/sigstore-sonatype-central-portal-password
- name: Build, Sign and Release to Maven Central
run: |
./gradlew clean :sigstore-java:publishMavenJavaPublicationToSonatypeRepository :sigstore-maven-plugin:publishMavenJavaPublicationToSonatypeRepository -Prelease
env:
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.PGP_PRIVATE_KEY }}
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.PGP_PASSPHRASE }}
ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USERNAME }}
ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_PASSWORD }}
ORG_GRADLE_PROJECT_signingKey: ${{ steps.secrets.outputs.signing_key }}
ORG_GRADLE_PROJECT_signingPassword: ${{ steps.secrets.outputs.signing_password }}
CENTRAL_PORTAL_USERNAME: ${{ steps.secrets.outputs.sonatype_username }}
CENTRAL_PORTAL_PASSWORD: ${{ steps.secrets.outputs.sonatype_password }}
run: |
./gradlew clean :publishAggregationToCentralPortal -Prelease
create-release-on-github:
runs-on: ubuntu-latest
Expand Down
1 change: 1 addition & 0 deletions build-logic/publishing/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,5 @@ dependencies {
implementation("dev.sigstore.build-logic:gradle-plugin")
implementation("dev.sigstore:sigstore-gradle-sign-plugin:1.3.0")
implementation("com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin:1.3.1")
implementation("com.gradleup.nmcp:com.gradleup.nmcp.gradle.plugin:1.0.2")
}
8 changes: 1 addition & 7 deletions build-logic/publishing/src/main/kotlin/build-logic.publish-to-central.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
plugins {
id("java-library")
id("maven-publish")
id("com.gradleup.nmcp")
id("build-logic.publish-to-tmp-maven-repo")
}

Expand Down Expand Up @@ -59,11 +60,4 @@ publishing {
}
}
}
repositories {
maven {
name = "sonatype"
url = uri("https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/")
credentials(PasswordCredentials::class)
}
}
}
15 changes: 15 additions & 0 deletions build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
plugins {
id("build-logic.root-build")
id("com.gradleup.nmcp.aggregation") version "1.0.2"
// The Kotlin Gradle plugin was loaded multiple times in different subprojects, which is not supported and may break the build.
`embedded-kotlin` apply false
}
Expand All @@ -15,3 +16,17 @@ val parameters by tasks.registering {
description = "Displays build parameters (i.e. -P flags) that can be used to customize the build"
dependsOn(gradle.includedBuild("build-logic").task(":build-parameters:parameters"))
}

nmcpAggregation {
centralPortal {
username = providers.environmentVariable("CENTRAL_PORTAL_USERNAME")
password = providers.environmentVariable("CENTRAL_PORTAL_PASSWORD")
publishingType = "USER_MANAGED"
publicationName = "sigstore protobuf-specs $version"
}
}

dependencies {
nmcpAggregation(project(":sigstore-java"))
nmcpAggregation(project(":sigstore-maven-plugin"))
Comment on lines +30 to +31
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add gradle plugin artifacts as well

Copy link
Member Author

@loosebazooka loosebazooka Aug 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is creating some issue where it's trying to apply the plugin on itself? We can try to add it in after, but for now, I'd like to get this in so we can publish these (and still publish the plugins to the portal)

An exception occurred applying plugin request [id: 'build-logic.java-published-library']
> Failed to apply plugin 'dev.sigstore.sign'.
   > Plugin with id 'dev.sigstore.sign-base' not found.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What are the changes and how do you reproduce the error of "Failed to apply plugin 'dev.sigstore.sign'"?

diff --git a/build.gradle.kts b/build.gradle.kts
index bb9cfe5..fa3933a 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -29,4 +29,6 @@ nmcpAggregation {
 dependencies {
     nmcpAggregation(project(":sigstore-java"))
     nmcpAggregation(project(":sigstore-maven-plugin"))
+    nmcpAggregation(project(":sigstore-gradle:sigstore-gradle-sign-base-plugin"))
+    nmcpAggregation(project(":sigstore-gradle:sigstore-gradle-sign-plugin"))
 }
% CENTRAL_PORTAL_USERNAME=u CENTRAL_PORTAL_PASSWORD=p ./gradlew publishAggregationToCentralPortal -m
:sigstore-java:cleanupDirectory SKIPPED
:sigstore-java:generateBuildInfo SKIPPED
:sigstore-java:protobufDummy SKIPPED
:sigstore-java:extractProto SKIPPED
:sigstore-java:processResources SKIPPED
...
[Incubating] Problems report is available at: file:////sigstore-java/build/reports/problems/problems-report.html

Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

For more on this, please refer to https://docs.gradle.org/8.14.1/userguide/command_line_interface.html#sec:command_line_warnings in the Gradle documentation.

BUILD SUCCESSFUL in 1

Copy link
Member Author

@loosebazooka loosebazooka Aug 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hrmm interesting, maybe it doesn't add signing?

diff --git a/build.gradle.kts b/build.gradle.kts
index bb9cfe5..fa3933a 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -29,4 +29,6 @@ nmcpAggregation {
 dependencies {
     nmcpAggregation(project(":sigstore-java"))
     nmcpAggregation(project(":sigstore-java"))
     nmcpAggregation(project(":sigstore-maven-plugin"))
+    nmcpAggregation(project(":sigstore-gradle:sigstore-gradle-sign-base-plugin"))
+    nmcpAggregation(project(":sigstore-gradle:sigstore-gradle-sign-plugin"))
 }
diff --git a/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts b/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts
index 8ef4908..0642901 100644
--- a/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts
+++ b/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts
@@ -1,5 +1,6 @@
 plugins {
     id("build-logic.kotlin-dsl-published-gradle-plugin")
+    id("build-logic.java-published-library")
     id("build-logic.test-junit5")
 }

diff --git a/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts b/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts
index 2b5133c..fe0322a 100644
--- a/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts
+++ b/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts
@@ -1,5 +1,6 @@
 plugins {
     id("build-logic.kotlin-dsl-published-gradle-plugin")
+    id("build-logic.java-published-library")
     id("build-logic.test-junit5")
 }

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts already has id("build-logic.kotlin-dsl-published-gradle-plugin") which internally has id("build-logic.publish-to-central").
So the addition of id("build-logic.java-published-library") should not be needed for sigstore-gradle/*/build.gradle.kts

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

while signing, etc is all configured in java-published-library

Apparently, we'd better move signing to publish-to-central or a separate file.
I might try signing the plugin itself.

However, I did use com.github.vlsi.state-vote-release plugin to release com.github.vlsi.state-vote-release, so the limitation of "plugin can't be used" sounds strange.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I think you brought that up when we discussed it last time. I can't remember the details I think it might be lost in slack history unfortunately. If you find a solution I would love to include it. I was just unable to find one that worked.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I might try once again and add a code comment

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

any update here? I would like to unblock this.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, sorry, I did not intend to block the pr

}
8 changes: 8 additions & 0 deletions sigstore-java/src/main/java/dev/sigstore/oidc/client/WebOidcClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
import dev.sigstore.http.HttpParams;
import dev.sigstore.trustroot.Service;
import java.io.IOException;
import java.net.URI;
import java.util.Arrays;
import java.util.Locale;
import java.util.Map;
Expand Down Expand Up @@ -96,6 +97,13 @@ public Builder setIssuer(Service issuer) {
return this;
}

/** Deprecated compat issuer selector, remove in next version. */
@Deprecated
public Builder setIssuer(String issuer) {
this.issuer = Service.of(URI.create(issuer), 1);
return this;
}

/**
* Alternative to default browser behavior, only use if you truly need to open with some sort of
* custom browser, like in test or headless environments.
Expand Down
Loading