Skip to content

@W-21191311 Enable publishing to new Sonatype portal #162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
douglasdew merged 2 commits into from
Feb 16, 2026
Merged

@W-21191311 Enable publishing to new Sonatype portal #162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a67134c
Enable publishing to new Sonatype portal
douglasdew Feb 13, 2026
c3793ba
Also update secrets in maven-publish.yml
douglasdew Feb 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/maven-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,10 @@ jobs:
- name: Release to Apache Maven Central
run: mvn deploy -B -P sign-artifacts,db-tests,presto,skip-presto-tests -s $GITHUB_WORKSPACE/settings.xml
env:
SONATYPE_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER }}
SONATYPE_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER }} # SONATYPE_USERNAME
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN }} # SONATYPE_PASSWORD
MAVEN_CENTRAL_USER: ${{ secrets.MAVEN_CENTRAL_USER }}
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
SONATYPE_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER_2 }}
SONATYPE_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_2 }}
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER_2 }} # SONATYPE_USERNAME
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_2 }} # SONATYPE_PASSWORD
MAVEN_CENTRAL_USER: ${{ secrets.MAVEN_CENTRAL_USER_2 }}
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN_2 }}
MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
21 changes: 15 additions & 6 deletions .github/workflows/maven-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,18 +53,18 @@ jobs:
mvn -V -gs $GITHUB_WORKSPACE/generated-settings/settings.xml -B -P sign-artifacts,db-tests,presto,skip-presto-tests -e release:clean release:prepare &&
echo "::set-output name=RELEASED_VERSION::$(grep scm.tag= release.properties | cut -d'=' -f2 | cut -c2-)"
env:
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER }}
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER_2 }}
Copy link
Copy Markdown
Collaborator

@sahil-here sahil-here Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you also update these variable names in settings.xml and maven-publish.yml

Copy link
Copy Markdown
Collaborator Author

@douglasdew douglasdew Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sahil-here The values used in settings.xml are from the environment rather than from secrets and are set by maven-release.yml and maven-publish.yml. So, there's no need to make changes to settings.xml.

Also, some of the values which are used by settings.xml are set by maven-publish.yml but not by maven-release.yml. So, at first it seems that we need to update maven-publish.yml, as you requested. However, it seemed to me from our FE release process doc (https://salesforce.quip.com/xrT0AlfumtsI#UNXAAABdyzn) that we don't use maven-publish.yml. If we don't use maven-publish.yml, and if settings.xml depends upon maven-publish.yml, then it seems to me that neither maven-publish.yml nor settings.xml are being used. I was going to ask about that during Friday standup.

If we are actually using those files then I agree that I need to update maven-publish.yml. If we are not using those files then perhaps we should delete those files.

Please correct any misunderstandings I might have.

Copy link
Copy Markdown
Collaborator

@bairenlong-sfdc bairenlong-sfdc Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think the maven-publish.yml is being used, the GPG keys expired 2 years ago.

Copy link
Copy Markdown
Collaborator

@sahil-here sahil-here Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good!

Copy link
Copy Markdown
Collaborator

@sahil-here sahil-here Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure about settings.xml.
I checked and looks like maven-publish.yml does not have any history of workflows, not sure if there could still be something that might be running it, but it is not showing up alteast in this repo.

Copy link
Copy Markdown
Collaborator Author

@douglasdew douglasdew Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sahil-here I updated the secrets for maven-publish.yml.

MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_2 }}
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN_2 }}
MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE_2 }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Perform Release
run: >
mvn -gs $GITHUB_WORKSPACE/generated-settings/settings.xml -B -P sign-artifacts,db-tests,releases,presto,skip-presto-tests -e release:perform
env:
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER }}
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USER_2 }}
MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_TOKEN_2 }}
MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN_2 }}
MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE_2 }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Create Release Entry
Expand All @@ -75,3 +75,12 @@ jobs:
body: ${{ github.event.inputs.release-body }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Encode credentials to Base64
Copy link
Copy Markdown
Collaborator

@bairenlong-sfdc bairenlong-sfdc Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this section new? required?

Copy link
Copy Markdown
Collaborator Author

@douglasdew douglasdew Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the Sonatype doc, that new section is required: https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#configuring-the-repository. They even emphasize with "must".

Copy link
Copy Markdown
Collaborator

@bairenlong-sfdc bairenlong-sfdc Feb 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section?
**Documentation of Manual API Endpoints⚓︎
To authenticate your requests to the Manual API Endpoints, you will need to provide an Authorization header the same way that it is done for the Publisher API. Specifically, it expects a Bearer token that is the base64 encoded string of your token username and token password separated by ...

Copy link
Copy Markdown
Collaborator Author

@douglasdew douglasdew Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"After all of the artifacts have been uploaded, your CI process should make a request to POST /manual/upload/defaultRepository/ where is the namespace that you see in https://central.sonatype.com/publishing/namespaces when you log in with the account that was used to generate the token. This must be done from the same IP that was used when uploading the files, so adding it to the end of your CI process is the most likely way for this to work reliably."

run: |
ENCODED_CREDENTIALS=$(echo -n "${{ secrets.MAVEN_CENTRAL_USER_2 }}:${{ secrets.MAVEN_CENTRAL_TOKEN_2 }}" | base64)
echo "::set-output name=ENCODED_CREDENTIALS::$ENCODED_CREDENTIALS"
id: encode_credentials_step
- name: Ensure visibility in Central Publisher Portal
run: |
curl -H "Authorization: Bearer ${{ steps.encode_credentials_step.outputs.ENCODED_CREDENTIALS }}" -i -X POST https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/com.salesforce.formula

Copy link
Copy Markdown
Collaborator

@bairenlong-sfdc bairenlong-sfdc Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What exactly is this for? looks like it is used to upload files manually.

Copy link
Copy Markdown
Collaborator Author

@douglasdew douglasdew Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's the POST request which is described in the Sonatype procedure which I linked. That request ensures visibility in the portal.

8 changes: 4 additions & 4 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,7 @@
<extensions>true</extensions>
<configuration>
<serverId>sonatype-nexus-staging</serverId>
<nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
<nexusUrl>https://ossrh-staging-api.central.sonatype.com/</nexusUrl>
<autoReleaseAfterClose>true</autoReleaseAfterClose>
</configuration>
</plugin>
Expand Down Expand Up @@ -463,11 +463,11 @@
<distributionManagement>
<repository>
<id>sonatype-nexus-staging</id>
<url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
<url>https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/</url>
</repository>
<snapshotRepository>
<id>sonatype-nexus-staging</id>
<url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
<url>https://ossrh-staging-api.central.sonatype.com/content/repositories/snapshots</url>
</snapshotRepository>
</distributionManagement>
<build>
Expand Down Expand Up @@ -517,7 +517,7 @@
</executions>
<configuration>
<serverId>sonatype-nexus-staging</serverId>
<nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
<nexusUrl>https://ossrh-staging-api.central.sonatype.com/</nexusUrl>
<autoReleaseAfterClose>true</autoReleaseAfterClose>
<stagingProgressTimeoutMinutes>15</stagingProgressTimeoutMinutes>
</configuration>
Expand Down