[#2027] Use env-vars for passing secrets used during release

hibernate · Dec 12, 2024 · 5df6c58 · 5df6c58
1 parent 62bb1eb
commit 5df6c58
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 48 deletions.
diff --git a/build.gradle b/build.gradle
@@ -12,15 +12,6 @@ group = "org.hibernate.reactive"
 // leverage the ProjectVersion which comes from the `local.versions` plugin
 version = project.projectVersion.fullName
 
-ext {
-    if ( !project.hasProperty( 'hibernatePublishUsername' ) ) {
-        hibernatePublishUsername = null
-    }
-    if ( !project.hasProperty( 'hibernatePublishPassword' ) ) {
-        hibernatePublishPassword = null
-    }
-}
-
 // Versions which need to be aligned across modules; this also
 // allows overriding the build using a parameter, which can be
 // useful to monitor compatibility for upcoming versions on CI:
@@ -39,15 +30,10 @@ ext {
     logger.lifecycle "Vert.x SQL Client Version: " + project.vertxSqlClientVersion
 }
 
-// To release, see task ciRelease in release/build.gradle
-// To publish on Sonatype (Maven Central):
-// ./gradlew publishToSonatype closeAndReleaseStagingRepository -PhibernatePublishUsername="<YOUR USERNAME>" -PhibernatePublishPassword="<YOUR PASSWORD>"
+// Publishing to Sonatype (Maven Central):
 nexusPublishing {
     repositories {
-        sonatype {
-            username = project.hibernatePublishUsername
-            password = project.hibernatePublishPassword
-        }
+        sonatype()
     }
 }
 

diff --git a/ci/release/Jenkinsfile b/ci/release/Jenkinsfile
@@ -165,24 +165,18 @@ pipeline {
 							configFile(fileId: 'release.config.ssh', targetLocation: "${env.HOME}/.ssh/config"),
 							configFile(fileId: 'release.config.ssh.knownhosts', targetLocation: "${env.HOME}/.ssh/known_hosts")
 					]) {
-						withCredentials([
-							usernamePassword(credentialsId: 'ossrh.sonatype.org', passwordVariable: 'OSSRH_PASSWORD', usernameVariable: 'OSSRH_USER'),
-							usernamePassword(credentialsId: 'gradle-plugin-portal-api-key', passwordVariable: 'PLUGIN_PORTAL_PASSWORD', usernameVariable: 'PLUGIN_PORTAL_USERNAME'),
-							file(credentialsId: 'release.gpg.private-key', variable: 'SIGNING_GPG_PRIVATE_KEY_PATH'),
-							string(credentialsId: 'release.gpg.passphrase', variable: 'SIGNING_GPG_PASSPHRASE')
-						]) {
-							sshagent(['ed25519.Hibernate-CI.github.com', 'hibernate.filemgmt.jboss.org', 'hibernate-ci.frs.sourceforge.net']) {
-								// set release version
-								// update changelog from JIRA
-								// tags the version
-								// changes the version to the provided development version
-								withEnv([
-										"BRANCH=${env.GIT_BRANCH}",
-										// Increase the amount of memory for this part since asciidoctor doc rendering consumes a lot of metaspace
-										"GRADLE_OPTS=-Dorg.gradle.jvmargs='-Dlog4j2.disableJmx -Xmx4g -XX:MaxMetaspaceSize=768m -XX:+HeapDumpOnOutOfMemoryError -Duser.language=en -Duser.country=US -Duser.timezone=UTC -Dfile.encoding=UTF-8'"
-								]) {
-									sh ".release/scripts/prepare-release.sh ${env.PROJECT} ${env.RELEASE_VERSION} ${env.DEVELOPMENT_VERSION}"
-								}
+
+					sshagent(['ed25519.Hibernate-CI.github.com', 'hibernate.filemgmt.jboss.org', 'hibernate-ci.frs.sourceforge.net']) {
+							// set release version
+							// update changelog from JIRA
+							// tags the version
+							// changes the version to the provided development version
+							withEnv([
+									"BRANCH=${env.GIT_BRANCH}",
+									// Increase the amount of memory for this part since asciidoctor doc rendering consumes a lot of metaspace
+									"GRADLE_OPTS=-Dorg.gradle.jvmargs='-Dlog4j2.disableJmx -Xmx4g -XX:MaxMetaspaceSize=768m -XX:+HeapDumpOnOutOfMemoryError -Duser.language=en -Duser.country=US -Duser.timezone=UTC -Dfile.encoding=UTF-8'"
+							]) {
+								sh ".release/scripts/prepare-release.sh ${env.PROJECT} ${env.RELEASE_VERSION} ${env.DEVELOPMENT_VERSION}"
 							}
 						}
 					}
@@ -199,10 +193,10 @@ pipeline {
 							configFile(fileId: 'release.config.ssh.knownhosts', targetLocation: "${env.HOME}/.ssh/known_hosts")
 					]) {
 						withCredentials([
-							usernamePassword(credentialsId: 'ossrh.sonatype.org', passwordVariable: 'OSSRH_PASSWORD', usernameVariable: 'OSSRH_USER'),
-							usernamePassword(credentialsId: 'gradle-plugin-portal-api-key', passwordVariable: 'PLUGIN_PORTAL_PASSWORD', usernameVariable: 'PLUGIN_PORTAL_USERNAME'),
-							file(credentialsId: 'release.gpg.private-key', variable: 'RELEASE_GPG_PRIVATE_KEY_PATH'),
-							string(credentialsId: 'release.gpg.passphrase', variable: 'RELEASE_GPG_PASSPHRASE')
+							// https://github.com/gradle-nexus/publish-plugin#publishing-to-maven-central-via-sonatype-ossrh
+							usernamePassword(credentialsId: 'ossrh.sonatype.org', passwordVariable: 'ORG_GRADLE_PROJECT_sonatypePassword', usernameVariable: 'ORG_GRADLE_PROJECT_sonatypeUsername'),
+							file(credentialsId: 'release.gpg.private-key', variable: 'SIGNING_GPG_PRIVATE_KEY_PATH'),
+							string(credentialsId: 'release.gpg.passphrase', variable: 'SIGNING_GPG_PASSPHRASE')
 							gitUsernamePassword(credentialsId: 'username-and-token.Hibernate-CI.github.com', gitToolName: 'Default')
 						]) {
 							sshagent(['ed25519.Hibernate-CI.github.com', 'hibernate.filemgmt.jboss.org', 'hibernate-ci.frs.sourceforge.net']) {

diff --git a/ci/snapshot-publish.Jenkinsfile b/ci/snapshot-publish.Jenkinsfile
@@ -31,15 +31,12 @@ pipeline {
 		stage('Publish') {
 			steps {
 				withCredentials([
-					usernamePassword(credentialsId: 'ossrh.sonatype.org', usernameVariable: 'hibernatePublishUsername', passwordVariable: 'hibernatePublishPassword'),
+					// https://github.com/gradle-nexus/publish-plugin#publishing-to-maven-central-via-sonatype-ossrh
+					usernamePassword(credentialsId: 'ossrh.sonatype.org', usernameVariable: 'ORG_GRADLE_PROJECT_sonatypeUsername', passwordVariable: 'ORG_GRADLE_PROJECT_sonatypePassword'),
 					file(credentialsId: 'release.gpg.private-key', variable: 'SIGNING_GPG_PRIVATE_KEY_PATH'),
 					string(credentialsId: 'release.gpg.passphrase', variable: 'SIGNING_GPG_PASSPHRASE')
 				]) {
-					sh '''./gradlew clean publish \
-						-PhibernatePublishUsername=$hibernatePublishUsername \
-						-PhibernatePublishPassword=$hibernatePublishPassword \
-						--no-scan \
-					'''
+					sh "./gradlew clean publish --no-scan"
 				}
 			}
         }

diff --git a/publish.gradle b/publish.gradle
@@ -36,7 +36,7 @@ javadoc {
 
 publishing {
     publications {
-        publishedArtifacts(MavenPublication) {
+        register( "publishedArtifacts", MavenPublication) {
             from components.java
 
             pom {
@@ -94,19 +94,21 @@ gradle.taskGraph.whenReady { TaskExecutionGraph graph ->
     List<Sign> signingTasks = []
 
     graph.allTasks.each {task ->
-        logger.lifecycle( "Checking task : $task" )
         if ( task instanceof Sign ) {
-            logger.lifecycle( "    - Task is Sign" )
             signingTasks.add( task )
             wasSigningRequested = true
         }
         else if ( task instanceof PublishToMavenRepository ) {
-            logger.lifecycle( "    - Task is PublishToMavenRepository" )
             wasPublishingRequested = true
         }
     }
 
     if ( wasPublishingRequested ) {
+        def ossrhUser = System.getenv().get( "ORG_GRADLE_PROJECT_sonatypeUsername" )
+        def ossrhPass = System.getenv().get( "ORG_GRADLE_PROJECT_sonatypePassword" )
+        if ( ossrhUser == null || ossrhPass == null ) {
+            throw new RuntimeException( "Cannot perform publishing to OSSRH without credentials." )
+        }
         logger.lifecycle "Publishing groupId: '" + project.group + "', version: '" + project.version + "'"
     }