Automate Maven deployment

@cmarchand

Maven deployment depends on individual skills and has been a bit cumbersome. I'm thinking to automate it.

I searched GitHub Marketplace for a possible simple solution and action-maven-publish appears to satisfy the requirement described in Wiki. Its source code looks simple and transparent.

@cmarchand
What do you think?

@cmarchand

@cmarchand
Regarding this part of Wiki:

For example, use https://oss.sonatype.org, create an account there to get a login and password.

First, declare the authentication in your ~/.m2/settings.xml :
<settings>
 <servers>
  <server>
   <id>ossrh</id>
   <username>your_username</username>
   <password>your_password</password>
  </server>
 </server>
</settings>

Based on this answer, I presume the following procedure would work:

I create an account at https://issues.sonatype.org/secure/Signup!default.jspa for this automation purposes only
You grant (or, perhaps, ask someone in sonatype.org to grant) the created account the permission to deploy to io.xspec/xspec

What do you think?

@AirQuick

This would be a great feature to add in order to speed up the release cycle and make it less dependent on specific individual being available.

I did the initial setup of passwords and GPG keys on my machine in order to deploy previous releases and I think I could reuse the existing credentials using GitHub secrets which are supported by action-maven-publish.

Something useful to bear this in mind when using GitHub secrets:

Secrets are environment variables that are encrypted and only exposed to selected actions. Anyone with collaborator access to this repository can use these secrets in a workflow.

Secrets are not passed to workflows that are triggered by a pull request from a fork.

I would be happy to work on this following the above requirements and I have some time in May to dedicate to this issue. But I'm happy to leave it to @AirQuick and @cmarchand if you want to work on it - it's an interesting task!

@cirulls

Thanks @cirulls
First things first... I don't know how io.xspec coordinates at Sonatype have been operated till today.
Is this the io.xspec coordinates' authoritative account at Sonatype JIRA? Do @cirulls and @cmarchand share that one account?

Something useful to bear this in mind when using GitHub secrets:

And this. So we should use samuelmeuli/action-maven-publish@201a45a3f311b2ee888f252ba9f4194257545709 while developing this automation.
Once we confirm the developed automation works, we should perform this procedure:

fork the https://github.com/samuelmeuli/action-maven-publish repository under https://github.com/xspec
disable GitHub Actions for the forked https://github.com/xspec/action-maven-publish repository
use xspec/action-maven-publish@v1 instead of samuelmeuli/action-maven-publish@..., from that time onward
review any upstream changes, before merging them into https://github.com/xspec/action-maven-publish

@cirulls

@cirulls or @cmarchand
Can you leave "Confirmed" comment to this Jira ticket, so that I can work or back you up on any deployment issues even when both of you are inactive?

@cirulls

Yes, with @cirulls , we share the same account, the one you link above. I can send you account login / password if required by private mail. Send me your private mail address to one of my privates mail addresses defined in my account.
This Jira account is able to publish in groupId io.xspec, and descendants... I think my Jira accounts owns xspec-io account, or has sufficient privileges on, but I'm not sure.
For the GPG, you have to use your own certificate.

I will not work on automation tasks, I let you do this. You are much more advanced than I am.

So, "Confirmed".

@cmarchand

Thanks for the clarification, @cmarchand
Rather than sharing the credential, I would like to just add my account. Can you write "I confirm that this user should receive access" comment directly to this Jira ticket? https://issues.sonatype.org/browse/OSSRH-57324

Working on this branch: https://github.com/xspec/xspec/commits/auto-deploy-maven
Right now all the secrets are just dummy.

@cmarchand

GPG secrets have been set and are working: https://github.com/xspec/xspec/runs/657082433#step:4:1451

Now we need to:

have either @cmarchand or @cirulls write "Confirmed" in this Jira ticket: https://issues.sonatype.org/browse/OSSRH-57324
settle the slightly new version scheme (Version scheme #940)

Done.

@AirQuick

@AirQuick: it's looking good, you are much more advanced in this than me. I'll be happy to review the PR or configuration when it's ready.

@cirulls

Thanks @cirulls
Fortunately someone is actively working on an official GitHub Action to add GPG sign support. So I will use samuelmeuli/action-maven-publish@201a45a3f311b2ee888f252ba9f4194257545709 for the meantime and later migrate to the official GitHub Action.

I'm setting up a dedicated account for the automated deployment. Directly the account gets approved, I'll remove skipRemoteStaging to see if the artifacts are uploaded correctly to OSSRH. After that, I'll change the target branch to master and reinstate autoReleaseAfterClose. At this stage, I'll ask your review.

@cmarchand

Now the automated deployment is working in the auto-deploy-maven branch. Two 2.0-SNAPSHOTs have been deployed so far. The last action log is here.

If we merge the auto-deploy-maven branch to the master branch, each commit to the master branch will deploy another 2.0-SNAPSHOT. As far as I know, stale SNAPSHOTs will be deleted automatically.

@cmarchand and @cirulls,
Does it look fine so far?

@AirQuick

@AirQuick: I'll have a look later on today and give you some feedback.

@AirQuick

@AirQuick: it looks good to me. I checked the deployed snapshots on Sonatype and the action logs. Good stuff that stale snapshots are automatically deleted, that's going to be really useful when pushing to master. When GPG support will be available in GitHub Actions, I would be good to use that.

Do you want to merge it now to see how it works on master or prefer to wait for the new version scheme (#940)?

Opened #959

Navigation Menu

Repository navigation

Automate Maven deployment #932

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Automate Maven deployment #932

Description

Activity

AirQuick commented on Apr 28, 2020

cirulls commented on May 1, 2020

AirQuick commented on May 1, 2020

AirQuick commented on May 2, 2020

AirQuick commented on May 5, 2020

cmarchand commented on May 7, 2020

AirQuick commented on May 7, 2020

AirQuick commented on May 8, 2020

AirQuick commented on May 8, 2020

cmarchand commented on May 8, 2020

cirulls commented on May 11, 2020

AirQuick commented on May 11, 2020

AirQuick commented on May 11, 2020

cirulls commented on May 12, 2020

cirulls commented on May 13, 2020

AirQuick commented on May 14, 2020

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions