GHA Snapshot publishing #912

aSemy · 2022-08-29T18:04:30Z

Publish a snapshot version to Sonatype on every successful build on master branch.

Fixes #910

This requires setting GitHub secrets - see .github/workflows/publish.yml

~~I'm marking this as a draft as I'm not sure if the GHA is defined correctly, particularly the Gradle variables - the periods might need to be removed from signing.keyId etc.~~ I've renamed the variables:

signing.keyId -> signingKeyId
signing.password -> signingPassword
signing.secretKeyRingFile -> signingSecretKeyRingFile

Raibaz · 2022-08-29T20:19:29Z

Thanks!

A couple of notes: according to this doc, i guess you're right and periods need to be removed.

Also, apparently I cannot set the secrets in the repo, so I'm afraid we need to summon @oleksiyp

aSemy · 2022-08-30T08:54:08Z

The Gradle secrets ${{ secrets.GRADLE_SIGNING_KEY_ID }} can't have periods, but what about the environment variables they're assigned to? ORG_GRADLE_PROJECT_signing.key? For simplicity I'll rename the environment variables to match.

luongvo · 2023-01-12T04:08:37Z

@Raibaz Could you please resume reviewing this soon? 👋

Raibaz · 2023-01-15T21:35:19Z

PR LGTM, but I can't set the secrets :(

oleksiyp · 2023-01-15T22:03:36Z

Do you need my help?

oleksiyp · 2023-01-15T22:16:39Z

buildSrc/src/main/kotlin/buildsrc/convention/mockk-publishing.gradle.kts

+            }
+
+            if (!isSnapshotVersion.get()) {
+                maven("https://oss.sonatype.org/service/local/staging/deploy/maven2/") {


Please check this guide https://central.sonatype.org/publish/publish-gradle/.
I have doubts that this is right URL.
I will try to deal with required secrets and set them in GH settings:

secrets.GRADLE_SIGNING_KEY_ID

secrets.GRADLE_SIGNING_PASSWORD

secrets.GRADLE_SIGNING_SECRET_KEY_RING_FILE

secrets.OSS_SONATYPE_USERNAME

secrets.OSS_SONATYPE_PASSWORD

Thanks @oleksiyp!

Would you consider granting @Raibaz co-ownership? Then he could also manage the secrets.

I have doubts that this is right URL.

MockK was published before 2021 so still uses the 'legacy host', but the docs mostly use the new URLs.

Note: As of February 2021, all new projects began being provisioned on https://s01.oss.sonatype.org/. If your project is not provisioned on https://s01.oss.sonatype.org/, you will want to reference the legacy host https://oss.sonatype.org/.

The current MockK config uses the same URL and it works okay

mockk/buildSrc/src/main/kotlin/buildsrc/convention/mockk-publishing.gradle.kts

Lines 15 to 21 in 1419517

val sonatypeRepositoryReleaseUrl: Provider<String> = provider {

if (version.toString().endsWith("SNAPSHOT")) {

"https://oss.sonatype.org/content/repositories/snapshots/"

} else {

"https://oss.sonatype.org/service/local/staging/deploy/maven2/"

}

}

Not sure you will need other secrets... and not sure you need them for something else... security is always compromise of comfort. So no 😄 but remember that I am still alive and happy to help 😄

Afterall if @Raibaz feels that more access is required happy to understand the reasoning and cooperate.

There is a bigger issue where to spend $4k on https://opencollective.com/mockk. Previously I thought it was too small an amount to spend paying contributors... but now it is not that obvious

I'm perfectly fine with the access I have now, I don't think I need more :)

After all, this should be a one-shot operation and we should be ok with secrets now, I don't think I'll need access to change them anytime soon.

oleksiyp · 2023-01-15T22:54:17Z

@Raibaz @aSemy

I added a few secrets

Please note there is no way to delimit release access and snapshot access... so this is my creds. I ask you to be careful with build scripts PR review so that nobody does "echo $KEY" stuff. I believe it should be protected somehow, but I never tried to use such a hack in GH actions. In Jenkins such a hack is easy peasy, to be honest

Also, @aSemy, note that local run suppose you have a file with keyring, while I cannot import binary files into GH action secret field.
So you will need to adopt "import to gpg" somehow

- name: Configure GPG Key
  run: |
    echo -n "$GPG_SIGNING_KEY" | base64 --decode | gpg --import
  env:
    GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}

https://stackoverflow.com/questions/61096521/how-to-use-gpg-key-in-github-actions

Especially for that purpose name secret is a "signing key", and not a "signing key ring file".
You may count that the private signing key unencrypted in PEM format is stored there.
The same reason "password" is not set, coz anyway you would need first to import to gpg.

Also, note I am going to go to Paris tomorrow and will not have access to the laptop where the original key is stored. GH does not allow to read values as well, so hope what I set is enough.

Feel free to ask any questions.

aSemy · 2023-01-16T12:51:36Z

thanks @oleksiyp, I will take a look! I think there's a way of 'mounting' a GitHub Secret as a file...

There are a number of protections for GitHub Secrets, but there's a couple more that could be done

prevent PRs from creating/approving PRs
Require that any PR that edits a GitHub Workflow must be reviewed and approved by CODEOWNERS

These require configuration at the project and/or org level, so it's up to you to implement them @oleksiyp :)

Raibaz · 2023-01-18T08:54:46Z

Thanks a lot @oleksiyp!

I think once we put in place the two protections that @aSemy suggested we should be fine.

Raibaz · 2023-04-12T12:11:33Z

@aSemy do you happen to have any updates on this?

aSemy · 2023-04-13T08:46:55Z

@Raibaz Thanks for the reminder, I'll pick this up again, hopefully by the end of the week. Since I last looked at this I set up automatic publishing for one of my libraries, so I've got a better idea of how things work now.

aSemy · 2023-04-16T21:55:09Z

@Raibaz as far as I can tell, this PR should be ready to go. Because I don't have access to the secrets or Sonatype Nexus I can't tell if it will work though, and I also won't be able to debug it. I think it's best if you or @oleksiyp pick it up, since you'll be able to more easily see what's going on. It might take some more tweaking. If there's any problems, then let me know and I can try and help out.

.github/workflows/publish.yml

Co-authored-by: Róbert Papp <[email protected]>

aSemy marked this pull request as ready for review September 4, 2022 10:31

aSemy mentioned this pull request Dec 6, 2022

Code cleanup #976

Merged

Raibaz approved these changes Jan 15, 2023

View reviewed changes

oleksiyp reviewed Jan 15, 2023

View reviewed changes

aSemy added 6 commits April 16, 2023 23:45

initial implementation of GHA Snapshot publishing

cfb64d1

remove period from Gradle signing properties

8e10f3c

adjust comment

e5b377d

update workflow to use official Gradle GHA

cf5f76f

disable parallel publishing (Sonatype doesn't like it)

66605f3

rename step to match command

4853205

aSemy force-pushed the feat/gha_snapshot_publishing branch from 7b8db93 to 4853205 Compare April 16, 2023 21:46

TWiStErRob reviewed Oct 25, 2024

View reviewed changes

.github/workflows/publish.yml Outdated Show resolved Hide resolved

Update .github/workflows/publish.yml

eab2aa7

Co-authored-by: Róbert Papp <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GHA Snapshot publishing #912

GHA Snapshot publishing #912

aSemy commented Aug 29, 2022 •

edited

Loading

Raibaz commented Aug 29, 2022

aSemy commented Aug 30, 2022

luongvo commented Jan 12, 2023

Raibaz commented Jan 15, 2023

oleksiyp commented Jan 15, 2023

oleksiyp Jan 15, 2023

aSemy Jan 15, 2023 •

edited

Loading

oleksiyp Jan 15, 2023

oleksiyp Jan 15, 2023

Raibaz Jan 18, 2023

oleksiyp commented Jan 15, 2023 •

edited

Loading

aSemy commented Jan 16, 2023

Raibaz commented Jan 18, 2023

Raibaz commented Apr 12, 2023

aSemy commented Apr 13, 2023

aSemy commented Apr 16, 2023

	val sonatypeRepositoryReleaseUrl: Provider<String> = provider {
	if (version.toString().endsWith("SNAPSHOT")) {
	"https://oss.sonatype.org/content/repositories/snapshots/"
	} else {
	"https://oss.sonatype.org/service/local/staging/deploy/maven2/"
	}
	}

GHA Snapshot publishing #912

Are you sure you want to change the base?

GHA Snapshot publishing #912

Conversation

aSemy commented Aug 29, 2022 • edited Loading

Raibaz commented Aug 29, 2022

aSemy commented Aug 30, 2022

luongvo commented Jan 12, 2023

Raibaz commented Jan 15, 2023

oleksiyp commented Jan 15, 2023

oleksiyp Jan 15, 2023

Choose a reason for hiding this comment

aSemy Jan 15, 2023 • edited Loading

Choose a reason for hiding this comment

oleksiyp Jan 15, 2023

Choose a reason for hiding this comment

oleksiyp Jan 15, 2023

Choose a reason for hiding this comment

Raibaz Jan 18, 2023

Choose a reason for hiding this comment

oleksiyp commented Jan 15, 2023 • edited Loading

aSemy commented Jan 16, 2023

Raibaz commented Jan 18, 2023

Raibaz commented Apr 12, 2023

aSemy commented Apr 13, 2023

aSemy commented Apr 16, 2023

aSemy commented Aug 29, 2022 •

edited

Loading

aSemy Jan 15, 2023 •

edited

Loading

oleksiyp commented Jan 15, 2023 •

edited

Loading