diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 222c8176..8fd3abb2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,6 +9,8 @@ jobs: publish: runs-on: ubuntu-22.04 + env: + PKGCLD_REPO_URL: ${{ vars.PKGCLD_REPO_URL }} steps: - uses: actions/checkout@v7 with: @@ -47,13 +49,60 @@ jobs: ./rd-cli-lib/build/libs/rd-cli-lib-*.jar env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Publish to Maven Central - run: ./gradlew -PsigningKey=${SIGNING_KEY_B64} -PsigningPassword=${SIGNING_PASSWORD} -PsonatypeUsername=${SONATYPE_USERNAME} -PsonatypePassword=${SONATYPE_PASSWORD} publishToSonatype closeAndReleaseSonatypeStagingRepository + - name: Publish Maven artifacts to PackageCloud + run: | + if [ -z "$PKGCLD_WRITE_TOKEN" ]; then + echo "::error::PKGCLD_WRITE_TOKEN must be set to publish to PackageCloud" + exit 1 + fi + ./gradlew publishAllPublicationsToPackageCloudRepository + env: + PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }} + - name: Sign and upload GPG signatures to PackageCloud + run: | + set -e + VERSION="${GITHUB_REF_NAME#v}" + BASE_URL="${PKGCLD_REPO_URL:-https://packagecloud.io/pagerduty/rundeck/maven2}" + + echo "$SIGNING_KEY_B64" | base64 -d | gpg --batch --yes --import + KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}') + + sign_and_upload() { + local FILE="$1" + local REMOTE_URL="$2" + gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSWORD" --default-key "$KEY_ID" --detach-sign --armor "$FILE" + curl -sf -H "Authorization: Bearer ${PKGCLD_WRITE_TOKEN}" \ + -X PUT --data-binary "@${FILE}.asc" \ + "${REMOTE_URL}" + } + + # rd-api-client: local build/libs filenames already match the published artifactId + RD_API_CLIENT_URL="${BASE_URL}/org/rundeck/api/rd-api-client/${VERSION}" + sign_and_upload "rd-api-client/build/libs/rd-api-client-${VERSION}.jar" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}.jar.asc" + sign_and_upload "rd-api-client/build/libs/rd-api-client-${VERSION}-sources.jar" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}-sources.jar.asc" + sign_and_upload "rd-api-client/build/libs/rd-api-client-${VERSION}-javadoc.jar" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}-javadoc.jar.asc" + sign_and_upload "rd-api-client/build/publications/rd-api-client/pom-default.xml" "${RD_API_CLIENT_URL}/rd-api-client-${VERSION}.pom.asc" + + # rd-cli-lib: local build/libs filenames already match the published artifactId + RD_CLI_LIB_URL="${BASE_URL}/org/rundeck/cli/rd-cli-lib/${VERSION}" + sign_and_upload "rd-cli-lib/build/libs/rd-cli-lib-${VERSION}.jar" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}.jar.asc" + sign_and_upload "rd-cli-lib/build/libs/rd-cli-lib-${VERSION}-sources.jar" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}-sources.jar.asc" + sign_and_upload "rd-cli-lib/build/libs/rd-cli-lib-${VERSION}-javadoc.jar" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}-javadoc.jar.asc" + sign_and_upload "rd-cli-lib/build/publications/rd-cli-lib/pom-default.xml" "${RD_CLI_LIB_URL}/rd-cli-lib-${VERSION}.pom.asc" + + # rd-cli-tool: archivesBaseName is 'rundeck-cli', so LOCAL filenames differ from the + # published Maven artifactId 'rd-cli-tool' -- sign the local files, upload under the + # published coordinate name. + RD_CLI_TOOL_URL="${BASE_URL}/org/rundeck/rd/rd-cli-tool/${VERSION}" + sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}.jar.asc" + sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}-sources.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}-sources.jar.asc" + sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}-javadoc.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}-javadoc.jar.asc" + sign_and_upload "rd-cli-tool/build/libs/rundeck-cli-${VERSION}-all.jar" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}-all.jar.asc" + sign_and_upload "rd-cli-tool/build/publications/rd-cli-tool/pom-default.xml" "${RD_CLI_TOOL_URL}/rd-cli-tool-${VERSION}.pom.asc" env: - SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} - SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} SIGNING_KEY_B64: ${{ secrets.SIGNING_KEY_B64 }} SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }} + PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }} - name: Install Ruby uses: ruby/setup-ruby@v1 with: @@ -61,7 +110,7 @@ jobs: - name: Install packagecloud.io CLI run: | gem install package_cloud - - name: Publish to Packagecloud + - name: Publish OS packages (deb/rpm) to PackageCloud run: | package_cloud push pagerduty/rundeck/any/any rd-cli-tool/build/distributions/rundeck-cli_*-1_all.deb package_cloud push pagerduty/rundeckpro/any/any rd-cli-tool/build/distributions/rundeck-cli_*-1_all.deb diff --git a/build.gradle b/build.gradle index 63d51401..ce254498 100644 --- a/build.gradle +++ b/build.gradle @@ -17,7 +17,6 @@ plugins { id 'base' alias(libs.plugins.axion) - alias(libs.plugins.nexusPublish) } import java.util.regex.Matcher import pl.allegro.tech.build.axion.release.domain.VersionConfig @@ -218,13 +217,3 @@ tasks.register('changeLog'){ } -nexusPublishing { - packageGroup = 'org.rundeck' - repositories { - sonatype{ - stagingProfileId = '67d196ce5bae' - nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/")) - snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/")) - } - } -} diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 2cb49b27..244e3efc 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -8,7 +8,6 @@ junit = "4.13.2" groovy = "4.0.32" spock = "2.3-groovy-4.0" axion = "1.21.2" -nexusPublish = "1.3.0" shadow = "8.1.1" ospackage = "11.11.2" buildInfo = "0.9" @@ -65,7 +64,6 @@ rundeckAuthz = ["rundeckAuthzCore", "rundeckAuthzApi", "rundeckAuthzYaml"] [plugins] axion = { id = "pl.allegro.tech.build.axion-release", version.ref = "axion" } -nexusPublish = { id = "io.github.gradle-nexus.publish-plugin", version.ref = "nexusPublish" } shadow = { id = "com.github.johnrengelman.shadow", version.ref = "shadow" } ospackage = { id = "com.netflix.nebula.ospackage", version.ref = "ospackage" } buildInfo = { id = "org.dvaske.gradle.git-build-info", version.ref = "buildInfo" } diff --git a/gradle/publishing.gradle b/gradle/publishing.gradle index 00782a25..ee78be5c 100644 --- a/gradle/publishing.gradle +++ b/gradle/publishing.gradle @@ -7,17 +7,12 @@ * githubSlug = Github slug e.g. 'rundeck/rundeck-cli' * developers = [ [id:'id', name:'name', email: 'email' ] ] list of developers * - * Define project properties to sign and publish when invoking publish task: - * - * ./gradlew \ - * -PsigningKey="base64 encoded gpg key" \ - * -PsigningPassword="password for key" \ - * -PsonatypeUsername="sonatype token user" \ - * -PsonatypePassword="sonatype token password" \ - * publishToSonatype closeAndReleaseSonatypeStagingRepository + * Publishes to PackageCloud via PKGCLD_REPO_URL / PKGCLD_WRITE_TOKEN env vars. + * Signing happens separately in the release workflow via gpg/curl, not here. */ apply plugin: 'maven-publish' -apply plugin: 'signing' + +def pkgcldRepoUrl = (System.getenv("PKGCLD_REPO_URL") ?: "https://packagecloud.io/pagerduty/rundeck/maven2").trim() publishing { publications { @@ -60,16 +55,17 @@ publishing { } } -} -def base64Decode = { String prop -> - project.findProperty(prop) ? - new String(Base64.getDecoder().decode(project.findProperty(prop).toString())).trim() : - null -} - -if (project.hasProperty('signingKey') && project.hasProperty('signingPassword')) { - signing { - useInMemoryPgpKeys(base64Decode("signingKey"), project.signingPassword) - sign(publishing.publications) + repositories { + maven { + name = "PackageCloud" + url = uri(pkgcldRepoUrl) + authentication { + header(HttpHeaderAuthentication) + } + credentials(HttpHeaderCredentials) { + name = "Authorization" + value = "Bearer " + (System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken")) + } + } } }