chore: migrate publishing from OSSRH to Central Portal #359
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,8 @@ on: | |
| pull_request: | ||
| branches: | ||
| - master | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| test: | ||
| name: Run tests and publish test coverage | ||
|
|
@@ -22,41 +23,114 @@ jobs: | |
| with: | ||
| java-version: 8 | ||
| distribution: 'adopt' | ||
|
|
||
| - name: Install dependencies | ||
| run: mvn install -DskipTests=true -Dmaven.javadoc.skip=true -B -V -Dgpg.skip | ||
|
|
||
| - name: Run tests and collect coverage | ||
| run: mvn -B test | ||
|
|
||
| - name: Upload coverage to Codecov | ||
| uses: codecov/codecov-action@v3 | ||
| with: | ||
| fail_ci_if_error: false | ||
| verbose: true | ||
|
|
||
| publish-dry-run: | ||
| name: Publish dry run (validate artifacts) | ||
| needs: test | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Java JDK | ||
| uses: actions/setup-java@v2 | ||
| with: | ||
| java-version: 8 | ||
| distribution: 'adopt' | ||
|
|
||
| - name: Build package with sources and javadoc | ||
| run: mvn clean package -B -Dgpg.skip | ||
|
|
||
| - name: Verify artifacts exist | ||
| run: | | ||
| echo "=== Checking generated artifacts ===" | ||
| ls -la target/*.jar | ||
| echo "" | ||
| VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout) | ||
| echo "=== Verifying JAR ===" | ||
| test -f "target/razorpay-java-${VERSION}.jar" && echo "✓ Main JAR found" || (echo "✗ Main JAR missing" && exit 1) | ||
| echo "=== Verifying Sources JAR ===" | ||
| test -f "target/razorpay-java-${VERSION}-sources.jar" && echo "✓ Sources JAR found" || (echo "✗ Sources JAR missing" && exit 1) | ||
| echo "=== Verifying Javadoc JAR ===" | ||
| test -f "target/razorpay-java-${VERSION}-javadoc.jar" && echo "✓ Javadoc JAR found" || (echo "✗ Javadoc JAR missing" && exit 1) | ||
|
|
||
| - name: Validate pom.xml metadata | ||
| run: | | ||
| echo "=== Validating pom.xml for Central Portal requirements ===" | ||
| mvn help:evaluate -Dexpression=project.groupId -q -DforceStdout | grep -q "com.razorpay" && echo "✓ groupId present" || (echo "✗ groupId missing" && exit 1) | ||
| mvn help:evaluate -Dexpression=project.artifactId -q -DforceStdout | grep -q "razorpay-java" && echo "✓ artifactId present" || (echo "✗ artifactId missing" && exit 1) | ||
| mvn help:evaluate -Dexpression=project.version -q -DforceStdout | grep -qv "SNAPSHOT" && echo "✓ version is release (non-SNAPSHOT)" || (echo "✗ version is SNAPSHOT" && exit 1) | ||
| mvn help:evaluate -Dexpression=project.name -q -DforceStdout | grep -q "." && echo "✓ name present" || (echo "✗ name missing" && exit 1) | ||
| mvn help:evaluate -Dexpression=project.description -q -DforceStdout | grep -q "." && echo "✓ description present" || (echo "✗ description missing" && exit 1) | ||
| mvn help:evaluate -Dexpression=project.url -q -DforceStdout | grep -q "http" && echo "✓ url present" || (echo "✗ url missing" && exit 1) | ||
| echo "" | ||
| echo "=== All Central Portal validations passed ===" | ||
|
|
||
| - name: Validate Central Portal credentials | ||
| env: | ||
| CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }} | ||
| CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }} | ||
| run: | | ||
| echo "=== Validating Central Portal credentials ===" | ||
| if [ -z "$CENTRAL_USERNAME" ] || [ -z "$CENTRAL_TOKEN" ]; then | ||
| echo "✗ CENTRAL_USERNAME or CENTRAL_TOKEN secrets are not set" | ||
| exit 1 | ||
| fi | ||
| HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -u "${CENTRAL_USERNAME}:${CENTRAL_TOKEN}" \ | ||
| "https://central.sonatype.com/api/v1/publisher/published?namespace=com.razorpay&name=razorpay-java") | ||
| if [ "$HTTP_STATUS" -eq 200 ]; then | ||
| echo "✓ Central Portal credentials are valid (HTTP $HTTP_STATUS)" | ||
| elif [ "$HTTP_STATUS" -eq 401 ]; then | ||
| echo "✗ Central Portal credentials are invalid (HTTP 401 Unauthorized)" | ||
| exit 1 | ||
| elif [ "$HTTP_STATUS" -eq 403 ]; then | ||
| echo "✗ Central Portal credentials lack permission (HTTP 403 Forbidden)" | ||
| exit 1 | ||
| else | ||
| echo "⚠ Unexpected response from Central Portal (HTTP $HTTP_STATUS) — credentials may still be valid" | ||
| fi | ||
|
|
||
| publish: | ||
| if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' | ||
| needs: publish-dry-run | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Maven Central Repository | ||
| uses: actions/setup-java@v2 | ||
|
There was a problem hiding this comment.
🧁 Fixed in commit b2ace4a 🧁 |
||
| with: | ||
| java-version: 8 | ||
| distribution: 'adopt' | ||
| server-id: central | ||
| server-username: MAVEN_USERNAME | ||
| server-password: MAVEN_PASSWORD | ||
| gpg-private-key: ${{ secrets.OSSRH_GPG_SECRET_KEY }} | ||
| gpg-passphrase: MAVEN_GPG_PASSPHRASE | ||
|
|
||
| - name: Configure GPG | ||
| run: | | ||
| echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf | ||
| gpg-connect-agent reloadagent /bye | ||
| gpg --list-secret-keys | ||
|
|
||
| - name: Build with Maven | ||
| run: mvn clean package -B | ||
|
|
||
| - name: Publish package | ||
| run: mvn deploy | ||
| env: | ||
| MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }} | ||
| MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }} | ||
| MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.🧼 Fixed in commit b2ace4a 🧼