[RUN-4638] Migrate publishing from Maven Central to PackageCloud#52
Merged
Conversation
Part of RUN-4570: Maven Central publishing limits resolution, applying the same design validated on rundeck-plugins/sshj-plugin (PR #136), rundeck-plugins/http-step (PR #60), and rundeck-plugins/ansible-plugin (PR #456). - Remove nexusPublish plugin/nexusPublishing block (Sonatype-specific, dead once release.yml stops calling publishToSonatype). - Point the PackageCloud maven repo at the configurable PKGCLD_REPO_URL (trimmed, guarded so plain builds/CI without the var don't fail at configuration time) instead of the hardcoded rundeckpro-test URL left over from an earlier manual test. - Drop GPG signing: PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for .asc signature files (422 Unprocessable Entity), and neither the OSS rundeck WAR nor rundeckpro-enterprise carry .asc signatures on PackageCloud either - only RPM/DEB packages are signed there natively. - release.yml: replace the Sonatype publish step with PackageCloud.
Contributor
There was a problem hiding this comment.
Pull request overview
Migrates this plugin’s release publishing flow from Sonatype/Maven Central to PackageCloud, aligning with the org-wide approach used in other rundeck-plugins repositories and removing Sonatype-specific publishing/signing configuration.
Changes:
- Removed Gradle Nexus Publish (Sonatype) plugin/config and GPG signing from the build/publishing setup.
- Updated Gradle publishing to target a PackageCloud Maven repo via a configurable
PKGCLD_REPO_URL. - Updated the release GitHub Actions workflow to publish to PackageCloud instead of Maven Central.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
gradle/publishing.gradle |
Drops signing and switches publishing repo configuration to PackageCloud using PKGCLD_REPO_URL. |
gradle/libs.versions.toml |
Removes the Nexus Publish plugin version/alias from the version catalog. |
build.gradle |
Removes Nexus Publish plugin application and its Sonatype configuration block. |
.github/workflows/release.yml |
Switches the release workflow publish step from Sonatype to PackageCloud and wires in PKGCLD_REPO_URL. |
Comment on lines
+40
to
+43
| - name: Publish to PackageCloud | ||
| run: ./gradlew publishAllPublicationsToPackageCloudRepository | ||
| env: | ||
| SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} | ||
| SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} | ||
| SIGNING_KEY_B64: ${{ secrets.SIGNING_KEY_B64 }} | ||
| SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }} | ||
| PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }} |
Addresses GitHub Copilot review feedback on the PackageCloud migration PRs: without this, a missing PKGCLD_REPO_URL makes the publish task not exist at all (confusing "task not found"), and a missing PKGCLD_WRITE_TOKEN with the URL present produces a "Bearer null" Authorization header that PackageCloud rejects with a non-obvious 401/422. Validate both upfront in the one step that actually needs them, instead of leaving the Gradle-side guard (which exists to keep unrelated CI like gradle.yml working without these vars) to surface the failure indirectly.
Addresses the remaining GitHub Copilot review feedback: default pkgcldRepoUrl to the real, canonical rundeck-plugins PackageCloud URL instead of relying on PKGCLD_REPO_URL always being set. This removes the need for the "only register if URL present" guard entirely, since uri() never receives null - registering a Maven repository doesn't make any network call until something actually resolves/publishes through it, so there's no cost to always registering it. With the URL guaranteed non-null, release.yml's fail-fast check only needs to validate PKGCLD_WRITE_TOKEN (which still has no safe public default, since it's a secret).
Validated end-to-end on rundeck-plugins/sshj-plugin (merged): signing via sign(publishing.publications) makes Gradle auto-generate a checksum for every publication artifact including the .asc files themselves, and PackageCloud's Maven endpoint 422s on the checksum-of-a-signature-file. Sidestep this entirely by signing the already-built artifacts with the gpg CLI directly and uploading just the .asc files via curl, bypassing Gradle's publish/checksum machinery for this part. Reuses the existing SIGNING_KEY_B64/SIGNING_PASSWORD secrets (now pointing at a renewed, non-expired key).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira ticket
RUN-4638 (subtask of RUN-4570)
Description
Migrate
attribute-match-node-enhancerpublishing from Maven Central (Sonatype) to PackageCloud, applying the same design already validated on rundeck-plugins/sshj-plugin#136, rundeck-plugins/http-step#60, and rundeck-plugins/ansible-plugin#456. Part of the RUN-4570 Maven Central publishing limits resolution — plugins account for the bulk of the file/release count on Maven Central, but no external project depends on them as Maven dependencies.nexusPublish/nexusPublishing(Sonatype-specific, dead oncerelease.ymlstops callingpublishToSonatype).PKGCLD_REPO_URLenv var (trimmed, and guarded so plain builds/CI without the var don't fail at Gradle configuration time), replacing the hardcodedrundeckpro-testURL left over from an earlier test..ascsignature files (422 Unprocessable Entity on*.jar.asc.sha1), and neither the OSSrundeckWAR norrundeckpro-enterpriseWAR carry.ascsignatures on PackageCloud either — only RPM/DEB packages are signed there, natively, via the separately-publishedBUILD-GPG-KEY.release.yml: replaced the "Publish to Maven Central" step with "Publish to PackageCloud".Testing instructions
sshj-plugin1.0.4: jar/pom/sources/javadoc all publish successfully to PackageCloud).org/rundeck/plugins/attribute-match-node-enhancer/<version>/at whatever repoPKGCLD_REPO_URLpoints to../gradlew buildstill succeeds withoutPKGCLD_REPO_URLset (e.g. ingradle.ymlCI) — the PackageCloud repo registration is guarded and should not affect plain builds.