[RUN-4638] Migrate publishing from Maven Central to PackageCloud#90
Merged
Conversation
Maven Central's free publishing limits are being hit org-wide (RUN-4570);
plugins account for most of the file/release count and nothing depends on
them as Maven dependencies, so rundeck-plugins repos are moving to
PagerDuty's PackageCloud instead. Same design already validated on
sshj-plugin, http-step, and other rundeck-plugins repos.
Signing moves out of Gradle's signing plugin into a manual gpg+curl step in
the release workflow: Gradle auto-generates a checksum for every publication
artifact including .asc signature files, and PackageCloud's Maven endpoint
422s on the checksum-of-a-signature-file, aborting the publish task.
Also adds the 'base' plugin explicitly: this repo doesn't apply 'java', and
the removed nexus-publish plugin was the one transitively providing the
build/assemble/check lifecycle tasks that defaultTasks and tasks.named('build')
depend on here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Migrates the plugin release/publishing pipeline from Sonatype/Maven Central to PackageCloud, aligning this repo with the org’s already-migrated plugin repositories while preserving existing ./gradlew build behavior for a zip-based plugin artifact published with Maven .jar coordinates.
Changes:
- Remove
io.github.gradle-nexus.publish-plugin/nexusPublishingand add Gradlebaseto retain lifecycle tasks (build,assemble,check). - Update
maven-publishconfiguration to publish to a PackageCloud Maven repository, with the repo URL configurable viaPKGCLD_REPO_URL. - Update
release.ymlto publish to PackageCloud and upload detached ASCII-armored GPG signatures viagpg+curl.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
gradle/publishing.gradle |
Switch publishing repository configuration to PackageCloud + remove Gradle-side signing configuration. |
build.gradle |
Remove Nexus publish plugin usage and apply base to keep expected lifecycle tasks. |
.github/workflows/release.yml |
Replace Maven Central publishing with PackageCloud publishing plus a CLI-based signature upload step. |
Comment on lines
+59
to
62
| credentials(HttpHeaderCredentials) { | ||
| name = "Authorization" | ||
| value = "Bearer " + (System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken")) | ||
| } |
Comment on lines
+50
to
+52
| VERSION="${{ steps.get_version.outputs.VERSION }}" | ||
| BASE_URL="${PKGCLD_REPO_URL:-https://packagecloud.io/pagerduty/rundeck-plugins/maven2}/org/rundeck/plugins/docker/${VERSION}" | ||
|
|
carlosrfranco
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira ticket
RUN-4638 (subtask of RUN-4570)
Description
Migrate
dockerpublishing from Maven Central (Sonatype) to PackageCloud, applying the same design already validated on rundeck-plugins/sshj-plugin#136 and the other already-migratedrundeck-pluginsrepos. Part of the RUN-4570 Maven Central publishing limits resolution — plugins account for the bulk of the file/release count on Maven Central, but no external project depends on them as Maven dependencies.nexusPublish/nexusPublishing. Unlike other migrated repos, this one doesn't apply thejavaplugin, andnexus-publishwas the one transitively providing thebuild/assemble/checklifecycle tasks thatdefaultTasksandtasks.named('build')depend on here — addedid 'base'explicitly so removingnexus-publishdoesn't break./gradlew build.PKGCLD_REPO_URLenv var (with a fallback to the realrundeck-pluginsrepo), replacing the half-migratedPackageCloudTestblock that pointed atrundeckpro-test.sign(publishing.publications)): PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for.ascsignature files (422 Unprocessable Entity). Sign and upload viagpgCLI +curlinstead, directly inrelease.yml— the same mechanism validated end-to-end onsshj-plugin.release.yml: replaced the "Publish to Maven Central" step with "Publish to PackageCloud" + a "Sign and upload GPG signatures" step. Sincedockerpublishes a zip-based artifact (pluginZip) with its Maven extension overridden to.jar, the signing step signs the localdocker-<version>.zipand uploads the signature asdocker-<version>.jar.ascto match the published coordinates.Testing instructions
.ascsignature land underorg/rundeck/plugins/docker/<version>/on PackageCloud../gradlew buildstill succeeds withoutPKGCLD_REPO_URLset.