[RUN-4638] Migrate publishing from Maven Central to PackageCloud#42
Merged
Conversation
Part of RUN-4570: Maven Central publishing limits resolution, applying the same design validated on rundeck-plugins/sshj-plugin (PR #136) and the other already-migrated rundeck-plugins repos. - Remove nexusPublish plugin/nexusPublishing block (repo already had id 'java' declared, so no lifecycle tasks were lost). - Point the PackageCloud maven repo at the configurable PKGCLD_REPO_URL with a fallback to the real rundeck-plugins repo, dropping the now-unnecessary guard. - Drop Gradle-side GPG signing (sign(publishing.publications)) - PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for .asc signature files. Sign and upload via gpg CLI + curl instead, in release.yml. - release.yml: replace the Sonatype publish step with PackageCloud + the GPG sign/upload step.
There was a problem hiding this comment.
Pull request overview
This PR migrates the http-notification plugin’s release publishing flow from Sonatype/Maven Central to PackageCloud, aligning with the publishing approach used in other rundeck-plugins repositories.
Changes:
- Removed Maven Central (nexus publish) configuration from Gradle and the version catalog.
- Updated Gradle publishing to target PackageCloud with configurable
PKGCLD_REPO_URL. - Updated the GitHub Actions release workflow to publish to PackageCloud and upload GPG
.ascsignatures viagpg+curl.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
gradle/publishing.gradle |
Switches publishing repository configuration to PackageCloud and removes Gradle-side signing. |
gradle/libs.versions.toml |
Removes the io.github.gradle-nexus.publish-plugin plugin version/catalog entry. |
build.gradle |
Removes application of the nexus publish plugin and Sonatype publishing config. |
.github/workflows/release.yml |
Replaces Maven Central publishing with PackageCloud publishing and a signature upload step. |
| apply plugin: 'maven-publish' | ||
| apply plugin: 'signing' | ||
|
|
||
| def pkgcldRepoUrl = (System.getenv("PKGCLD_REPO_URL") ?: "https://packagecloud.io/pagerduty/rundeck-plugins/maven2").trim() |
Comment on lines
+57
to
60
| credentials(HttpHeaderCredentials) { | ||
| name = "Authorization" | ||
| value = "Bearer " + (System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken")) | ||
| } |
Comment on lines
+49
to
+51
| set -e | ||
| VERSION="${{ steps.get_version.outputs.VERSION }}" | ||
| BASE_URL="${PKGCLD_REPO_URL:-https://packagecloud.io/pagerduty/rundeck-plugins/maven2}/org/rundeck/plugins/http-notification/${VERSION}" |
Comment on lines
+54
to
+55
| KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}') | ||
|
|
Comment on lines
+60
to
+62
| curl -sf -H "Authorization: Bearer ${PKGCLD_WRITE_TOKEN}" \ | ||
| -X PUT --data-binary "@${FILE}.asc" \ | ||
| "${BASE_URL}/${REMOTE_NAME}.asc" |
carlosrfranco
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira ticket
RUN-4638 (subtask of RUN-4570)
Description
Migrate
http-notificationpublishing from Maven Central (Sonatype) to PackageCloud, applying the same design already validated on rundeck-plugins/sshj-plugin#136 and the other already-migratedrundeck-pluginsrepos. Part of the RUN-4570 Maven Central publishing limits resolution — plugins account for the bulk of the file/release count on Maven Central, but no external project depends on them as Maven dependencies.nexusPublish/nexusPublishing(version-catalog form: removed thelibs.plugins.nexusPublishalias and its now-orphanedgradle/libs.versions.tomlentries too).PKGCLD_REPO_URLenv var (with a fallback to the realrundeck-pluginsrepo), dropping the now-unnecessary guard.sign(publishing.publications)): PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for.ascsignature files (422 Unprocessable Entity). Sign and upload viagpgCLI +curlinstead, directly inrelease.yml— the same mechanism validated end-to-end onsshj-plugin.release.yml: replaced the "Publish to Maven Central" step with "Publish to PackageCloud" + a "Sign and upload GPG signatures" step.Testing instructions
.ascsignature land underorg/rundeck/plugins/http-notification/<version>/on PackageCloud../gradlew buildstill succeeds withoutPKGCLD_REPO_URLset.