[RUN-4638] Migrate publishing from Maven Central to PackageCloud#42
Open
Jesus-Osuna-M wants to merge 4 commits into
Open
[RUN-4638] Migrate publishing from Maven Central to PackageCloud#42Jesus-Osuna-M wants to merge 4 commits into
Jesus-Osuna-M wants to merge 4 commits into
Conversation
Part of RUN-4570: Maven Central publishing limits resolution, applying the same design validated on rundeck-plugins/sshj-plugin (PR #136), rundeck-plugins/http-step (PR #60), and rundeck-plugins/ansible-plugin (PR #456). - Remove nexusPublish plugin/nexusPublishing block (Sonatype-specific, dead once release.yml stops calling publishToSonatype). - Point the PackageCloud maven repo at the configurable PKGCLD_REPO_URL (trimmed, guarded so plain builds/CI without the var don't fail at configuration time) instead of the hardcoded rundeckpro-test URL left over from an earlier manual test. - Drop GPG signing: PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for .asc signature files (422 Unprocessable Entity), and neither the OSS rundeck WAR nor rundeckpro-enterprise carry .asc signatures on PackageCloud either - only RPM/DEB packages are signed there natively. - release.yml: replace the Sonatype publish step with PackageCloud.
There was a problem hiding this comment.
Pull request overview
Migrates openssh-node-execution release publishing away from Sonatype/Maven Central and over to PackageCloud, aligning this repo’s publishing/release flow with the approach used in other rundeck-plugins repos.
Changes:
- Removed the Gradle Nexus Publish plugin configuration used for Sonatype/Maven Central staging + release.
- Updated Gradle publishing to use a PackageCloud Maven repository configured via
PKGCLD_REPO_URL, and removed GPG signing. - Updated the GitHub Actions release workflow to publish to PackageCloud instead of Maven Central.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
gradle/publishing.gradle |
Switches publishing repository configuration to PackageCloud (URL via PKGCLD_REPO_URL) and removes signing logic. |
build.gradle |
Removes the nexus publish plugin and its nexusPublishing { ... } configuration. |
.github/workflows/release.yml |
Updates release workflow env and publish step to target PackageCloud instead of Sonatype/Maven Central. |
Comment on lines
65
to
68
| credentials(HttpHeaderCredentials) { | ||
| name = "Authorization" | ||
| value = "Bearer " + pkgcldWriteToken | ||
| value = "Bearer " + (System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken")) | ||
| } |
Addresses GitHub Copilot review feedback on the PackageCloud migration PRs: without this, a missing PKGCLD_REPO_URL makes the publish task not exist at all (confusing "task not found"), and a missing PKGCLD_WRITE_TOKEN with the URL present produces a "Bearer null" Authorization header that PackageCloud rejects with a non-obvious 401/422. Validate both upfront in the one step that actually needs them, instead of leaving the Gradle-side guard (which exists to keep unrelated CI like gradle.yml working without these vars) to surface the failure indirectly.
Addresses the remaining GitHub Copilot review feedback: default pkgcldRepoUrl to the real, canonical rundeck-plugins PackageCloud URL instead of relying on PKGCLD_REPO_URL always being set. This removes the need for the "only register if URL present" guard entirely, since uri() never receives null - registering a Maven repository doesn't make any network call until something actually resolves/publishes through it, so there's no cost to always registering it. With the URL guaranteed non-null, release.yml's fail-fast check only needs to validate PKGCLD_WRITE_TOKEN (which still has no safe public default, since it's a secret).
Validated end-to-end on rundeck-plugins/sshj-plugin (merged): signing via sign(publishing.publications) makes Gradle auto-generate a checksum for every publication artifact including the .asc files themselves, and PackageCloud's Maven endpoint 422s on the checksum-of-a-signature-file. Sidestep this entirely by signing the already-built artifacts with the gpg CLI directly and uploading just the .asc files via curl, bypassing Gradle's publish/checksum machinery for this part. Reuses the existing SIGNING_KEY_B64/SIGNING_PASSWORD secrets (now pointing at a renewed, non-expired key).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira ticket
RUN-4638 (subtask of RUN-4570)
Description
Migrate
openssh-node-executionpublishing from Maven Central (Sonatype) to PackageCloud, applying the same design already validated on rundeck-plugins/sshj-plugin#136, rundeck-plugins/http-step#60, and rundeck-plugins/ansible-plugin#456. Part of the RUN-4570 Maven Central publishing limits resolution — plugins account for the bulk of the file/release count on Maven Central, but no external project depends on them as Maven dependencies.nexusPublish/nexusPublishing(Sonatype-specific, dead oncerelease.ymlstops callingpublishToSonatype).PKGCLD_REPO_URLenv var (trimmed, and guarded so plain builds/CI without the var don't fail at Gradle configuration time), replacing the hardcodedrundeckpro-testURL left over from an earlier test..ascsignature files (422 Unprocessable Entity on*.jar.asc.sha1), and neither the OSSrundeckWAR norrundeckpro-enterpriseWAR carry.ascsignatures on PackageCloud either — only RPM/DEB packages are signed there, natively, via the separately-publishedBUILD-GPG-KEY.release.yml: replaced the "Publish to Maven Central" step with "Publish to PackageCloud".Testing instructions
sshj-plugin1.0.4: jar/pom/sources/javadoc all publish successfully to PackageCloud). Note this repo publishes a zip renamed to.jar(mavenZippublication) — the same flow applies.org/rundeck/plugins/openssh-node-execution/<version>/at whatever repoPKGCLD_REPO_URLpoints to../gradlew buildstill succeeds withoutPKGCLD_REPO_URLset (e.g. ingradle.ymlCI) — the PackageCloud repo registration is guarded and should not affect plain builds.