Skip to content

Commit 6f1591d

Browse files
mrudatsprintfusionauth-platform-team
mrudatsprint
and
fusionauth-platform-team
authored
chore: Moving from OSSRH to the Maven Central Portal to publish the SDK library release. (#276)
* chore(main): release 1.0.0-rc * chore(release): v1.0.0 * Compare to the release. * chore(main): release 1.0.0-rc * feat: Move from OSSRH to the Maven Central Portal to publish the SDK library. * feat: retrieve secrets from AWS and not GitHub * Specify a know version. * Use the aws secrets action. * Missing permission for running aws-actions/configure-aws-credentials@v4 * Remove role-chaining as it may be preventing setting the aws credentials. * debugging assuming role with OIDC. * Change role to authenticate with AWS. * Use the aws cli to get the secret vs a specific github action. * Debugging the creation of the deployment bundle. * debugging the location of the deployment. * Attempting to locate the deployment. * Publish to the Central Portal using a username/password * Rename as OSSRH is not being used. * Security cleanup per co-pilot. * Fix syntax error. * Rename in order to re-test publish. * Rename as OSSRH is not being used. --------- Co-authored-by: fusionauth-platform-team <158609934+fusionauth-platform-team@users.noreply.github.com>
1 parent 70a7f85 commit 6f1591d

4 files changed

Lines changed: 126 additions & 134 deletions

File tree

‎.github/workflows/release-publish-ossrh.yml‎

Lines changed: 0 additions & 114 deletions
This file was deleted.

‎.github/workflows/release-publish.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow performs a Maven Release to Central Portal
7+
#
8+
9+
name: Maven Release Central Portal
10+
11+
on:
12+
# Allows you to run this workflow manually from the Actions tab
13+
workflow_dispatch:
14+
15+
# This workflow is part of the release group and will not run concurrently with other workflows in the same group
16+
concurrency:
17+
group: release
18+
19+
env:
20+
AWS_REGION: us-west-2
21+
22+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
23+
jobs:
24+
# The e2e-test job first verifies the release with multiple fusionauth versions
25+
e2e-test:
26+
uses: ./.github/workflows/e2e-test-fusionauth-matrix-android-latest.yml
27+
28+
# The publish job builds and publishes the release to Central Portal
29+
publish:
30+
name: Maven Release
31+
32+
permissions:
33+
# required for all workflows
34+
security-events: write
35+
# only required for workflows in private repositories
36+
actions: read
37+
contents: read
38+
id-token: write
39+
40+
# The type of runner that the job will run on
41+
runs-on: ubuntu-latest
42+
43+
# Requires e2e-test job
44+
needs: [ e2e-test ]
45+
46+
# Steps represent a sequence of tasks that will be executed as part of the job
47+
steps:
48+
# Sets up JDK as a prerequisite to run Gradle
49+
- name: Setup Java
50+
uses: actions/setup-java@v5
51+
with:
52+
java-version: '17'
53+
distribution: 'zulu'
54+
55+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
56+
- name: Checkout repository
57+
uses: actions/checkout@v6
58+
59+
- name: set aws credentials
60+
uses: aws-actions/configure-aws-credentials@v4
61+
with:
62+
role-to-assume: arn:aws:iam::752443094709:role/gha-fusionauth-android-sdk
63+
role-session-name: aws-auth-action
64+
aws-region: ${{ env.AWS_REGION }}
65+
66+
- name: get secrets into the env
67+
run: |
68+
while IFS=$'\t' read -r key value; do
69+
echo "::add-mask::${value}"
70+
echo "${key}=${value}" >> $GITHUB_ENV
71+
done < <(aws secretsmanager get-secret-value \
72+
--region us-west-2 \
73+
--secret-id platform/maven \
74+
--query SecretString \
75+
--output text | \
76+
jq -r 'to_entries[] | [.key, .value] | @tsv')
77+
78+
# Sets up Gradle as a prerequisite to run Maven Release
79+
- name: Setup Gradle
80+
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
81+
with:
82+
gradle-home-cache-cleanup: true
83+
84+
# Performs a Local Maven Release
85+
- name: Run Maven Local Release
86+
env:
87+
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
88+
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
89+
run: ./gradlew publishReleasePublicationToMavenLocal
90+
91+
# Build and sign the publication bundle
92+
- name: Build Publication Bundle
93+
env:
94+
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
95+
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
96+
run: ./gradlew publishReleasePublicationToMavenLocalRepository
97+
98+
# Create deployment bundle for Central Portal
99+
- name: Create Deployment Bundle
100+
run: |
101+
cd library/build/maven-local-repository
102+
zip -r ../deployment-bundle.zip .
103+
104+
# Publish to Central Portal
105+
- name: Publish to Central Portal
106+
run: |
107+
HTTP_STATUS=$(curl --request POST \
108+
--silent \
109+
--output response.json \
110+
--write-out "%{http_code}" \
111+
--user '${{ env.CENTRAL_USERNAME }}:${{ env.CENTRAL_PASSWORD }}' \
112+
--form bundle=@library/build/deployment-bundle.zip \
113+
https://central.sonatype.com/api/v1/publisher/upload?publishingType=AUTOMATIC)
114+
115+
echo "Response from Central Portal:"
116+
cat response.json
117+
echo
118+
119+
# Check if the upload was successful based on HTTP status code
120+
if [ "$HTTP_STATUS" -lt 200 ] || [ "$HTTP_STATUS" -ge 300 ]; then
121+
echo "Error: Upload failed with HTTP status ${HTTP_STATUS}"
122+
fi

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ jobs:
137137
GH_TOKEN: ${{ github.token }}
138138
RELEASE_TAG: ${{ needs.prerelease-prep.outputs.tag_name }}
139139
run: |
140-
gh workflow run release-publish-ossrh.yml --ref refs/tags/$RELEASE_TAG
140+
gh workflow run release-publish.yml --ref refs/tags/$RELEASE_TAG
141141
142142
# This job runs post-release steps
143143
post-release:

‎library/build.gradle.kts‎

Lines changed: 3 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -111,26 +111,10 @@ publishing {
111111

112112
// Here we define some repositories that we can publish our outputs to.
113113
repositories {
114-
// Specifying that this is a custom maven repository.
115114
maven {
116-
// This is the name of the repo that is used as the value of ${target}
117-
// from above.
118-
name = "OSSRH"
119-
120-
// Self-explanatory.
121-
setUrl {
122-
val repositoryId =
123-
System.getenv("SONATYPE_REPOSITORY_ID") ?: error("Missing env variable: SONATYPE_REPOSITORY_ID")
124-
"https://oss.sonatype.org/service/local/staging/deployByRepositoryId/${repositoryId}/"
125-
}
126-
127-
// These need to be defined in ~/.gradle/gradle.properties:
128-
// ossrhUsername=<your sonatype jira username>
129-
// ossrhPassword=<your sonatype jira password>
130-
credentials {
131-
username = project.findProperty("ossrhUsername") as String?
132-
password = project.findProperty("ossrhPassword") as String?
133-
}
115+
// publish to a local directory first
116+
name = "MavenLocal"
117+
url = uri("${buildDir}/maven-local-repository")
134118
}
135119
}
136120
}

0 commit comments

Comments
 (0)