[RUN-4638] Migrate publishing from Maven Central to PackageCloud#136
Merged
Conversation
Replace Sonatype Maven Central publication with PackageCloud (packagecloud.io/pagerduty/rundeckpro-test) in the release workflow. This plugin is bundled into the Rundeck distribution and does not need to be on Maven Central. Internal builds already resolve from PackageCloud. Part of RUN-4570: Maven Central publishing limits resolution. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Pull request overview
Migrates this plugin’s release workflow publishing target from Maven Central (Sonatype) to PackageCloud, aligning with the broader initiative to reduce Maven Central publishing volume for internal-only plugins.
Changes:
- Replaced the Sonatype publish/release Gradle invocation with a PackageCloud publish task.
- Switched workflow secrets from Sonatype/GPG credentials to
PKGCLD_WRITE_TOKEN.
- Rename repository from PackageCloudTest to PackageCloud - Default URL points to pagerduty/rundeckpro (production) - URL is configurable via PKGCLD_REPO_URL env var for flexibility Co-authored-by: Cursor <cursoragent@cursor.com>
Commit dfb3e39 dropped the closing paren and default URL fallback, which broke Groovy parsing of the publishing block (verified locally with the groovy CLI). Restore the closing paren and fallback URL.
nexusPublish/nexusPublishing was only used for the Sonatype staging repo flow and is now dead since release.yml publishes to PackageCloud. GPG signing is unrelated to Sonatype though (Gradle's signing plugin signs all configured MavenPublications, not just Sonatype's), so keep it and pass the same signing key/password to the PackageCloud publish step to produce .jar.asc/.pom.asc alongside the artifacts, consistent with how RPM/DEB packages in this org are already signed before upload.
build.gradle reads PKGCLD_REPO_URL eagerly at configuration time, so it must be present for every ./gradlew invocation in the job (build, currentVersion), not just the publish step. Setting it only on the "Publish to PackageCloud" step's env left earlier steps with a null value, crashing with "Cannot convert 'null' to URI."
.github/workflows/gradle.yml (Java CI) runs ./gradlew build on every push and never sets PKGCLD_REPO_URL, since it has nothing to do with publishing. Since the publishing.repositories block is evaluated eagerly at configuration time regardless of which task runs, it crashed every plain build with "Cannot convert 'null' to URI." Guard the repo registration so it's skipped unless the URL is actually configured.
The GitHub org variable value has a trailing newline/whitespace (common when pasted into the Actions UI), which java.net.URI rejects outright: "Cannot convert '...maven2\n ' to a URI." Trim it once and reuse the trimmed value for both the guard check and the URL itself.
PackageCloud's Maven support rejects the checksum Gradle auto-generates for the .asc signature file (422 Unprocessable Entity on sshj-plugin-*.jar.asc.sha1), aborting the whole publish task. Gradle has no public option to skip checksums for specific artifacts. Verified this isn't a regression: neither the OSS rundeck WAR nor the rundeckpro-enterprise WAR carry .asc signatures on PackageCloud either - only the RPM/DEB packages are signed there (natively, via the BUILD-GPG-KEY published on docs.rundeck.com), which was never wired through this Gradle/Maven publish path to begin with.
This was referenced Jul 18, 2026
Merged
Merged
[RUN-4638] Migrate publishing from Maven Central to PackageCloud
rundeck-plugins/py-winrm-plugin#128
Merged
Addresses GitHub Copilot review feedback on the PackageCloud migration PRs: without this, a missing PKGCLD_REPO_URL makes the publish task not exist at all (confusing "task not found"), and a missing PKGCLD_WRITE_TOKEN with the URL present produces a "Bearer null" Authorization header that PackageCloud rejects with a non-obvious 401/422. Validate both upfront in the one step that actually needs them, instead of leaving the Gradle-side guard (which exists to keep unrelated CI like gradle.yml working without these vars) to surface the failure indirectly.
Addresses the remaining GitHub Copilot review feedback: default pkgcldRepoUrl to the real, canonical rundeck-plugins PackageCloud URL instead of relying on PKGCLD_REPO_URL always being set. This removes the need for the "only register if URL present" guard entirely, since uri() never receives null - registering a Maven repository doesn't make any network call until something actually resolves/publishes through it, so there's no cost to always registering it. With the URL guaranteed non-null, release.yml's fail-fast check only needs to validate PKGCLD_WRITE_TOKEN (which still has no safe public default, since it's a secret).
Gradle's signing plugin can't be used directly for this: attaching signatures via sign(publishing.publications) makes Gradle auto-generate a checksum for every artifact in the publication, including the .asc files themselves, and PackageCloud's Maven endpoint rejects the checksum-of-a-signature-file with 422 Unprocessable Entity (confirmed earlier - jar.asc uploads fine, jar.asc.sha1 does not). Sidestep this by signing the already-built artifacts with the gpg CLI directly and uploading just the .asc files via curl, bypassing Gradle's publish/checksum machinery entirely for this part. Reuses the existing SIGNING_KEY_B64/SIGNING_PASSWORD secrets from the old Sonatype flow.
gpg imported the secret key fine but had no default signing identity configured, so --detach-sign failed with "no default secret key: No secret key" in batch/non-interactive mode. Extract the imported key's ID and pass it explicitly.
Comment on lines
+40
to
+46
| - name: Publish to PackageCloud | ||
| run: | | ||
| if [ -z "$PKGCLD_WRITE_TOKEN" ]; then | ||
| echo "::error::PKGCLD_WRITE_TOKEN must be set to publish to PackageCloud" | ||
| exit 1 | ||
| fi | ||
| ./gradlew publishAllPublicationsToPackageCloudRepository |
Comment on lines
+49
to
+55
| - name: Sign and upload GPG signatures to PackageCloud | ||
| run: | | ||
| set -e | ||
| VERSION="${{ steps.get_version.outputs.VERSION }}" | ||
| BASE_URL="${PKGCLD_REPO_URL:-https://packagecloud.io/pagerduty/rundeck-plugins/maven2}/org/rundeck/plugins/sshj-plugin/${VERSION}" | ||
|
|
||
| echo "$SIGNING_KEY_B64" | base64 -d | gpg --batch --yes --import |
This was referenced Jul 21, 2026
Merged
[RUN-4638] Migrate publishing from Maven Central to PackageCloud
rundeck-plugins/puppet-apply-step#8
Merged
Merged
[RUN-4638] Migrate publishing from Maven Central to PackageCloud
rundeck-plugins/yaml-text-source#12
Merged
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira Ticket
RUN-4638 (subtask of RUN-4570)
Summary
Migrate sshj-plugin publishing from Maven Central (Sonatype) to PackageCloud as a pilot for migrating all 29 plugin repos. This is part of the Maven Central publishing limits resolution — plugins account for 67% of the file count and 85% of the release count on Maven Central, but no external project depends on them as Maven dependencies.
Change
Replace the "Publish to Maven Central" step in the release workflow with "Publish to PackageCloud":
Before:
publishToSonatype closeAndReleaseSonatypeStagingRepository(4 secrets: Sonatype user/pass, GPG key/pass)After:
publishAllPublicationsToPackageCloudRepository(1 secret: PKGCLD_WRITE_TOKEN)Why this is safe
org.rundeck.plugins:sshj-pluginas a Maven dependencyrundeck/build.gradleandrundeckpro/build.gradlealready havepackagecloud.io/pagerduty/rundeckpro-test/maven2configured as a Gradle repositorybuild.gradlein this repo already has the PackageCloud publishing repository configuredPrerequisites
PKGCLD_WRITE_TOKENsecret exists in therundeck-pluginsGitHub orgTest Plan
packagecloud.io/pagerduty/rundeck-plugins./gradlew build -x checkin rundeck/rundeckpro resolves the plugin from PackageCloudMade with Cursor