Migrate CD to maven central (#891)

Author: TingDaoK

android/build.gradle

@@ -20,9 +20,9 @@ if (project.hasProperty("sonatypeUsername") && project.hasProperty("sonatypePass
     apply plugin: 'io.github.gradle-nexus.publish-plugin'
     nexusPublishing {
         repositories {
-            create("awsNexus") {
-                nexusUrl.set(uri("https://aws.oss.sonatype.org/service/local/"))
-                snapshotRepositoryUrl.set(uri("https://aws.oss.sonatype.org/content/repositories/snapshots/"))
+            sonatype {
+                nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
+                snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
                 username.set(project.property("sonatypeUsername") as String)
                 password.set(project.property("sonatypePassword") as String)
             }

android/crt/build.gradle

@@ -199,8 +199,8 @@ afterEvaluate {
 
         repositories {
             maven {
-                def snapshotRepo = "https://aws.oss.sonatype.org/content/repositories/snapshots"
-                def releaseRepo = "https://aws.oss.sonatype.org/"
+                def snapshotRepo = "https://central.sonatype.com/repository/maven-snapshots/"
+                def releaseRepo = "https://ossrh-staging-api.central.sonatype.com/"
                 url = version.endsWith('SNAPSHOT') ? snapshotRepo : releaseRepo
             }
         }

build.gradle.kts

@@ -124,8 +124,8 @@ publishing {
     }
     repositories {
         maven {
-            val releasesRepo = uri("https://aws.oss.sonatype.org/")
-            val snapshotRepo = uri("https://aws.oss.sonatype.org/content/repositories/snapshots")
+            val releasesRepo = uri("https://ossrh-staging-api.central.sonatype.com/")
+            val snapshotRepo = uri("https://central.sonatype.com/repository/maven-snapshots/")
             url = if (version.toString().endsWith("SNAPSHOT")) snapshotRepo else releasesRepo
         }
     }

…uild/cd/deploy-platform-specific-jars.sh …uild/cd/bundle-platform-specific-jars.shcodebuild/cd/deploy-platform-specific-jars.sh renamed to codebuild/cd/bundle-platform-specific-jars.sh codebuild/cd/deploy-platform-specific-jars.sh renamed to codebuild/cd/bundle-platform-specific-jars.sh

@@ -2,16 +2,9 @@
 
 set -ex
 
-if [[ $DEPLOY_VERSION = *-SNAPSHOT ]]; then
-  # snapshot doesn't need to gpg sign the file to deploy
-  DEPLOY_FILE_GOAL=deploy:deploy-file
-  DEPLOY_REPOSITORY_URL=https://aws.oss.sonatype.org/content/repositories/snapshots
-else
-  # Need to sign the file to deploy to staging repo
-  # pin to 3.1.0, somehow the latest 3.2.0 breaks the file deploy with 401.
-  DEPLOY_FILE_GOAL=org.apache.maven.plugins:maven-gpg-plugin:3.1.0:sign-and-deploy-file
-  DEPLOY_REPOSITORY_URL=https://aws.oss.sonatype.org:443/service/local/staging/deployByRepositoryId/${STAGING_REPO_ID}
-fi
+DEPLOY_FILE_GOAL=org.apache.maven.plugins:maven-gpg-plugin:sign-and-deploy-file
+DEPLOY_DIR_URL=file://${BUNDLE_DIR}
+
 
 CLASSIFIERS_ARRAY=("linux-armv6" "linux-armv7" "linux-aarch_64" "linux-x86_32" "linux-x86_64" "osx-aarch_64" "osx-x86_64" "windows-x86_32" "windows-x86_64" "linux-x86_64-musl" "linux-armv7-musl" "linux-aarch_64-musl" "fips-where-available")
 
@@ -28,12 +21,11 @@ TYPES=${TYPES::-1}
 
 
 mvn -B -X $DEPLOY_FILE_GOAL \
-    -Dgpg.passphrase=$GPG_PASSPHRASE \
     -DgroupId=software.amazon.awssdk.crt -DartifactId=aws-crt -Dpackaging=jar \
     -Dversion=$DEPLOY_VERSION \
     -Dfile=./target/aws-crt-$DEPLOY_VERSION.jar \
     -Dfiles=$FILES \
     -Dclassifiers=$CLASSIFIERS \
     -Dtypes=$TYPES \
     -DpomFile=pom.xml \
-    -DrepositoryId=ossrh -Durl=$DEPLOY_REPOSITORY_URL
+    -Durl=$DEPLOY_DIR_URL

codebuild/cd/deploy-and-test-snapshot.yml

@@ -0,0 +1,55 @@
+version: 0.2
+# this buildspec assumes the ubuntu image
+# This job is responsible for deploying and test a snapshot version of the aws-crt-java library
+phases:
+  install:
+    commands:
+      - sudo add-apt-repository ppa:openjdk-r/ppa
+      - sudo apt-get update -y
+      - sudo apt-get install openjdk-11-jdk-headless maven wget unzip -y -f
+  pre_build:
+    commands:
+      - cd $CODEBUILD_SRC_DIR/aws-crt-java
+      - export PKG_VERSION=$(git describe --tags | cut -f2 -dv)
+      - echo $PKG_VERSION
+      - mkdir -p target/cmake-build/lib
+      # mv all the platform-specific jars to target/
+      - aws s3 cp --recursive s3://aws-crt-java-pipeline/v${PKG_VERSION}/jar $CODEBUILD_SRC_DIR/aws-crt-java/target/
+      # cp all the shared libs to cmake-build/lib/
+      - aws s3 cp --recursive s3://aws-crt-java-pipeline/v${PKG_VERSION}/lib $CODEBUILD_SRC_DIR/aws-crt-java/target/cmake-build/lib
+      # log the downloaded files
+      - ls -alR $CODEBUILD_SRC_DIR/aws-crt-java/target
+      # install settings.xml to ~/.m2/settings.xml
+      - mkdir -p $HOME/.m2
+      - aws s3 cp s3://code-sharing-aws-crt/aws-crt-java.settings.token.xml $HOME/.m2/settings.xml
+      # import gpg key
+      - aws s3 cp s3://code-sharing-aws-crt/aws-sdk-common-runtime.key.asc /tmp/aws-sdk-common-runtime.key.asc
+      # for https://github.com/keybase/keybase-issues/issues/2798
+      - export GPG_TTY=$(tty)
+      - gpg --batch --import /tmp/aws-sdk-common-runtime.key.asc
+      # refer to https://maven.apache.org/plugins/maven-gpg-plugin/usage.html
+      - export MAVEN_GPG_PASSPHRASE=$(aws --query "SecretString" secretsmanager get-secret-value --secret-id aws-sdk-common-runtime.key.asc/password  --region us-east-1 | cut -f2 -d":" | sed -e 's/[\\\"\}]//g')
+      - export ST_USERNAME=$(aws --query "SecretString" secretsmanager get-secret-value --secret-id Sonatype/JIRA/token --region us-east-1 | cut -f2 -d":" | cut -f1 -d"," | sed -e 's/[\\\"\}]//g')
+      - export ST_PASSWORD=$(aws --query "SecretString" secretsmanager get-secret-value --secret-id Sonatype/JIRA/token --region us-east-1 | cut -f3 -d":" | sed -e 's/[\\\"\}]//g')
+      # Use the username and password from secret manager to update the settings
+      - sed -i 's|token-username|'"$ST_USERNAME"'|g' $HOME/.m2/settings.xml
+      - sed -i 's|token-password|'"$ST_PASSWORD"'|g' $HOME/.m2/settings.xml
+
+  build:
+    commands:
+      # --- DEPLOY SNAPSHOT ---
+      - cd $CODEBUILD_SRC_DIR/aws-crt-java
+      # update the version to match the git tag, make a snapshot version we can test
+      - export DEPLOY_VERSION=${PKG_VERSION}-SNAPSHOT
+      - mvn -B versions:set -DnewVersion=${DEPLOY_VERSION}
+      # do a full build/deploy, but skip shared libs and tests, since the shared libs were artifacts above
+      - mvn -B deploy -Prelease -Dshared-lib.skip=true -Dmaven.test.skip=true
+
+  post_build:
+    commands:
+      # --- TEST SNAPSHOT ---
+      - mvn -B dependency:get -DrepoUrl=https://central.sonatype.com/repository/maven-snapshots/ -Dartifact=software.amazon.awssdk.crt:aws-crt:${DEPLOY_VERSION} -Dtransitive=false
+
+cache:
+  paths:
+    - "/root/.m2/**/*"

codebuild/cd/deploy-snapshot-android.sh

@@ -1,7 +1,4 @@
 version: 0.2
-#this buildspec assumes the aws-common-runtime/ubuntu-16.04 image
-# This job is responsible for artifacting the JAR which will have all of the other shared libs stuffed
-# into it once all platforms are built and artifacted
 phases:
   install:
     commands:

codebuild/cd/deploy-snapshot.yml

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -ex
+set -o pipefail # Make sure one process in pipe fail gets bubble up
+
+git submodule update --init
+cd ./android
+
+# Check if promote release mode is enabled
+PROMOTE_RELEASE="${PROMOTE_RELEASE:-false}"
+
+GPG_KEY=$(cat /tmp/aws-sdk-common-runtime.key.asc)
+# Publish and release
+# As May30th, 2025, the Sonatype OSSRH has been deprecated and replaced with Central Publisher and the new API does't support `findSonatypeStagingRepository`.
+# the release will need to be invoked within the same call.
+# https://github.com/gradle-nexus/publish-plugin/issues/379
+
+if [ "$PROMOTE_RELEASE" = "true" ]; then
+    # close and release the staging repository to promote release
+    ../gradlew -PsigningKey=$"$GPG_KEY" -PsigningPassword=$MAVEN_GPG_PASSPHRASE -PsonatypeUsername=$ST_USERNAME -PsonatypePassword=$ST_PASSWORD publishToSonatype closeAndReleaseSonatypeStagingRepository
+else
+    # close the staging repository without promoting release. NOTES: you need to manually clean up the staging repository in Maven Central.
+    ../gradlew -PsigningKey=$"$GPG_KEY" -PsigningPassword=$MAVEN_GPG_PASSPHRASE -PsonatypeUsername=$ST_USERNAME -PsonatypePassword=$ST_PASSWORD publishToSonatype closeSonatypeStagingRepository
+fi