Repository navigation
ci(java): add the Maven Central release workflow - #18
Conversation
- pom.xml: add the developer and scm metadata Maven Central requires, and a release profile that signs every artifact and publishes through the Central Portal. Normal builds never sign. - java_dev.py: add verify (tag matches a non-SNAPSHOT pom version with a CHANGELOG entry) and smoke (polls Maven Central for the published files). - java-release.yml: on a java-v* release, test every supported Java version, then sign and publish from the maven environment and smoke-test Maven Central.
verify now also requires java/examples/pom.xml and java/integration-tests/pom.xml to depend on the release version, since the examples are not built by the release workflow. The developers block uses the same fields as other AWS libraries on Maven Central.
| server-id: central | ||
| server-username: CENTRAL_TOKEN_USERNAME | ||
| server-password: CENTRAL_TOKEN_PASSWORD | ||
| gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} |
There was a problem hiding this comment.
setup-java@v4.7.1 defaults gpg-passphrase to the environment variable GPG_PASSPHRASE and writes that name into Maven settings. The publish step only defines MAVEN_GPG_PASSPHRASE, so a passphrase-protected key cannot be unlocked.
There was a problem hiding this comment.
With bestPractices=true, maven-gpg-plugin 3.2.8 reads the passphrase from the MAVEN_GPG_PASSPHRASE environment variable directly and ignores the gpg.passphrase server in settings.xml, so this worked locally as written. But to ensure the two agree, will add setup-java to get gpg-passphrase: MAVEN_GPG_PASSPHRASE. thank you!
| base = ( | ||
| f"{CENTRAL}/{group.replace('.', '/')}/{artifact}/{version}/{artifact}-{version}" | ||
| ) | ||
| files = [".pom", ".jar", "-sources.jar", "-javadoc.jar", ".jar.asc"] |
There was a problem hiding this comment.
Consider also requiring .pom.asc, -sources.jar.asc, and -javadoc.jar.asc so the post-publish verification covers the complete release.
There was a problem hiding this comment.
ack, the smoke test now requires the .asc for all four artifacts, thank you!
- setup-java's gpg-passphrase names MAVEN_GPG_PASSPHRASE explicitly, so the settings.xml it writes and maven-gpg-plugin read the same variable. - The smoke test requires the signature of every artifact, not just the jar.
| # Tag must match the pom version, which must not be a SNAPSHOT, and the | ||
| # CHANGELOG must have an entry. | ||
| - name: Verify the tag matches the pom version | ||
| run: python3 scripts/java_dev.py verify "$GITHUB_REF_NAME" |
There was a problem hiding this comment.
This validation runs only after a reviewer approves the maven environment because it is inside publish. A mistyped tag or missed version bump therefore runs the full matrix and requests approval before failing. Please move this step into versions, which already checks out the repository and has Python 3, so invalid releases fail before the matrix and environment gate.
There was a problem hiding this comment.
ack, will add guard as follow ups
|
|
||
| - name: Build and test | ||
| run: mvn --batch-mode --no-transfer-progress install | ||
|
|
There was a problem hiding this comment.
The release matrix skips the documentation examples. java.yml runs mvn --file examples/pom.xml verify after install, and verify now requires examples/pom.xml to use the release version. Please add the same step here between Build and test and the integration tests so the release artifact is checked against the examples before publishing.
edlng
left a comment
edlng
left a comment
There was a problem hiding this comment.
comments non-blocking though!
3 participants
Adds the release pipeline for the Java package, following the Central Portal's Maven publishing guide.
What a
java-v*release doesjava.supported.versionsin the pom).mavenenvironment, after approval: verifies the tag matches the pom version, then runsmvn -P release deploy, which signs every artifact, uploads them to the Central Portal, waits for validation and publishes them. Then smoke-tests that the files are served by Maven Central.Changes
java/pom.xml:<developers>and<scm>metadata that Central requires, and areleaseprofile withmaven-gpg-pluginandcentral-publishing-maven-plugin(autoPublish,waitUntil=published). Normal builds are unchanged and never sign.scripts/java_dev.py:verify(tag ==java-v+ pom version, not a SNAPSHOT,## [version]present injava/CHANGELOG.md) andsmoke(polls Maven Central for the pom, jar, sources, javadoc and signature)..github/workflows/java-release.yml: the workflow above. Fork guard on the repository owner; secrets are scoped to themavenenvironment.Verified locally
verifyrejects a SNAPSHOT version and a mismatched tag;list-supported-versionsis unchanged.The upload itself cannot be exercised until the namespace is approved on the Portal.
Before the first release
software.amazon.elasticache.0.1.0-SNAPSHOTto the release version in the poms and add the CHANGELOG entry.