[RUN-4638] Migrate publishing from Maven Central to PackageCloud - #456
Merged
Conversation
Part of RUN-4570: Maven Central publishing limits resolution, applying the same design validated on rundeck-plugins/sshj-plugin (PR #136) and rundeck-plugins/http-step (PR #60). - Remove nexusPublish plugin/nexusPublishing block (Sonatype-specific, dead once release.yml stops calling publishToSonatype). - Point the PackageCloud maven repo at the configurable PKGCLD_REPO_URL (trimmed, guarded so plain builds/CI without the var don't fail at configuration time) instead of the hardcoded rundeckpro-test URL left over from an earlier manual test. - Drop GPG signing: PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for .asc signature files (422 Unprocessable Entity), and neither the OSS rundeck WAR nor rundeckpro-enterprise carry .asc signatures on PackageCloud either - only RPM/DEB packages are signed there natively. - release.yml: replace the Sonatype publish step with PackageCloud.
Contributor
There was a problem hiding this comment.
Pull request overview
Migrates the plugin’s release publishing pipeline from Sonatype/Maven Central to PackageCloud, aligning this repository with the org’s newer release/publishing approach and removing Sonatype-specific configuration.
Changes:
- Removed Gradle Nexus (Sonatype) publishing configuration from the build.
- Updated the Gradle publishing repo definition to use a configurable
PKGCLD_REPO_URLand PackageCloud auth token. - Updated the GitHub Actions release workflow to publish to PackageCloud instead of Maven Central (and dropped signing-related secrets/flags).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
gradle/publishing.gradle |
Switches publishing repository configuration to a PKGCLD_REPO_URL-driven PackageCloud target and removes signing logic. |
build.gradle |
Removes io.github.gradle-nexus.publish-plugin usage and Sonatype nexusPublishing configuration. |
.github/workflows/release.yml |
Updates the release workflow to publish via Gradle to PackageCloud and wires in PackageCloud configuration/secrets. |
This was referenced Jul 18, 2026
[RUN-4638] Migrate publishing from Maven Central to PackageCloud
rundeck-plugins/py-winrm-plugin#128
Merged
Addresses GitHub Copilot review feedback on the PackageCloud migration PRs: without this, a missing PKGCLD_REPO_URL makes the publish task not exist at all (confusing "task not found"), and a missing PKGCLD_WRITE_TOKEN with the URL present produces a "Bearer null" Authorization header that PackageCloud rejects with a non-obvious 401/422. Validate both upfront in the one step that actually needs them, instead of leaving the Gradle-side guard (which exists to keep unrelated CI like gradle.yml working without these vars) to surface the failure indirectly.
Addresses the remaining GitHub Copilot review feedback: default pkgcldRepoUrl to the real, canonical rundeck-plugins PackageCloud URL instead of relying on PKGCLD_REPO_URL always being set. This removes the need for the "only register if URL present" guard entirely, since uri() never receives null - registering a Maven repository doesn't make any network call until something actually resolves/publishes through it, so there's no cost to always registering it. With the URL guaranteed non-null, release.yml's fail-fast check only needs to validate PKGCLD_WRITE_TOKEN (which still has no safe public default, since it's a secret).
Validated end-to-end on rundeck-plugins/sshj-plugin (merged): signing via sign(publishing.publications) makes Gradle auto-generate a checksum for every publication artifact including the .asc files themselves, and PackageCloud's Maven endpoint 422s on the checksum-of-a-signature-file. Sidestep this entirely by signing the already-built artifacts with the gpg CLI directly and uploading just the .asc files via curl, bypassing Gradle's publish/checksum machinery for this part. Reuses the existing SIGNING_KEY_B64/SIGNING_PASSWORD secrets (now pointing at a renewed, non-expired key).
Jesus-Osuna-M
enabled auto-merge
July 21, 2026 13:39
carlosrfranco
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira ticket
RUN-4638 (subtask of RUN-4570)
Description
Migrate
ansible-pluginpublishing from Maven Central (Sonatype) to PackageCloud, applying the same design already validated on rundeck-plugins/sshj-plugin#136 and rundeck-plugins/http-step#60. Part of the RUN-4570 Maven Central publishing limits resolution — plugins account for the bulk of the file/release count on Maven Central, but no external project depends on them as Maven dependencies.nexusPublish/nexusPublishing(Sonatype-specific, dead oncerelease.ymlstops callingpublishToSonatype).PKGCLD_REPO_URLenv var (trimmed, and guarded so plain builds/CI without the var don't fail at Gradle configuration time), replacing the hardcodedrundeckpro-testURL left over from an earlier test..ascsignature files (422 Unprocessable Entity on*.jar.asc.sha1), and neither the OSSrundeckWAR norrundeckpro-enterpriseWAR carry.ascsignatures on PackageCloud either — only RPM/DEB packages are signed there, natively, via the separately-publishedBUILD-GPG-KEY.release.yml: replaced the "Publish to Maven Central" step with "Publish to PackageCloud".Testing instructions
sshj-plugin1.0.4: jar/pom/sources/javadoc all publish successfully to PackageCloud).org/rundeck/plugins/ansible-plugin/<version>/at whatever repoPKGCLD_REPO_URLpoints to../gradlew buildstill succeeds withoutPKGCLD_REPO_URLset (e.g. ingradle.ymlCI) — the PackageCloud repo registration is guarded and should not affect plain builds.