Skip to content

Commit 8a4c959

Browse files
sebersolesebersole
committed
[hibernate#2027] Use env-vars for passing secrets used during release
1 parent 62bb1eb commit 8a4c959

File tree

4 files changed

+72
-58
lines changed

4 files changed

+72
-58
lines changed

‎build.gradle

+2-16
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,6 @@ group = "org.hibernate.reactive"
1212
// leverage the ProjectVersion which comes from the `local.versions` plugin
1313
version = project.projectVersion.fullName
1414

15-
ext {
16-
if ( !project.hasProperty( 'hibernatePublishUsername' ) ) {
17-
hibernatePublishUsername = null
18-
}
19-
if ( !project.hasProperty( 'hibernatePublishPassword' ) ) {
20-
hibernatePublishPassword = null
21-
}
22-
}
23-
2415
// Versions which need to be aligned across modules; this also
2516
// allows overriding the build using a parameter, which can be
2617
// useful to monitor compatibility for upcoming versions on CI:
@@ -39,15 +30,10 @@ ext {
3930
logger.lifecycle "Vert.x SQL Client Version: " + project.vertxSqlClientVersion
4031
}
4132

42-
// To release, see task ciRelease in release/build.gradle
43-
// To publish on Sonatype (Maven Central):
44-
// ./gradlew publishToSonatype closeAndReleaseStagingRepository -PhibernatePublishUsername="<YOUR USERNAME>" -PhibernatePublishPassword="<YOUR PASSWORD>"
33+
// Publishing to Sonatype (Maven Central):
4534
nexusPublishing {
4635
repositories {
47-
sonatype {
48-
username = project.hibernatePublishUsername
49-
password = project.hibernatePublishPassword
50-
}
36+
sonatype()
5137
}
5238
}
5339

‎ci/release/Jenkinsfile

+16-22
Original file line numberDiff line numberDiff line change
@@ -165,24 +165,18 @@ pipeline {
165165
configFile(fileId: 'release.config.ssh', targetLocation: "${env.HOME}/.ssh/config"),
166166
configFile(fileId: 'release.config.ssh.knownhosts', targetLocation: "${env.HOME}/.ssh/known_hosts")
167167
]) {
168-
withCredentials([
169-
usernamePassword(credentialsId: 'ossrh.sonatype.org', passwordVariable: 'OSSRH_PASSWORD', usernameVariable: 'OSSRH_USER'),
170-
usernamePassword(credentialsId: 'gradle-plugin-portal-api-key', passwordVariable: 'PLUGIN_PORTAL_PASSWORD', usernameVariable: 'PLUGIN_PORTAL_USERNAME'),
171-
file(credentialsId: 'release.gpg.private-key', variable: 'SIGNING_GPG_PRIVATE_KEY_PATH'),
172-
string(credentialsId: 'release.gpg.passphrase', variable: 'SIGNING_GPG_PASSPHRASE')
173-
]) {
174-
sshagent(['ed25519.Hibernate-CI.github.com', 'hibernate.filemgmt.jboss.org', 'hibernate-ci.frs.sourceforge.net']) {
175-
// set release version
176-
// update changelog from JIRA
177-
// tags the version
178-
// changes the version to the provided development version
179-
withEnv([
180-
"BRANCH=${env.GIT_BRANCH}",
181-
// Increase the amount of memory for this part since asciidoctor doc rendering consumes a lot of metaspace
182-
"GRADLE_OPTS=-Dorg.gradle.jvmargs='-Dlog4j2.disableJmx -Xmx4g -XX:MaxMetaspaceSize=768m -XX:+HeapDumpOnOutOfMemoryError -Duser.language=en -Duser.country=US -Duser.timezone=UTC -Dfile.encoding=UTF-8'"
183-
]) {
184-
sh ".release/scripts/prepare-release.sh ${env.PROJECT} ${env.RELEASE_VERSION} ${env.DEVELOPMENT_VERSION}"
185-
}
168+
169+
sshagent(['ed25519.Hibernate-CI.github.com', 'hibernate.filemgmt.jboss.org', 'hibernate-ci.frs.sourceforge.net']) {
170+
// set release version
171+
// update changelog from JIRA
172+
// tags the version
173+
// changes the version to the provided development version
174+
withEnv([
175+
"BRANCH=${env.GIT_BRANCH}",
176+
// Increase the amount of memory for this part since asciidoctor doc rendering consumes a lot of metaspace
177+
"GRADLE_OPTS=-Dorg.gradle.jvmargs='-Dlog4j2.disableJmx -Xmx4g -XX:MaxMetaspaceSize=768m -XX:+HeapDumpOnOutOfMemoryError -Duser.language=en -Duser.country=US -Duser.timezone=UTC -Dfile.encoding=UTF-8'"
178+
]) {
179+
sh ".release/scripts/prepare-release.sh ${env.PROJECT} ${env.RELEASE_VERSION} ${env.DEVELOPMENT_VERSION}"
186180
}
187181
}
188182
}
@@ -199,10 +193,10 @@ pipeline {
199193
configFile(fileId: 'release.config.ssh.knownhosts', targetLocation: "${env.HOME}/.ssh/known_hosts")
200194
]) {
201195
withCredentials([
202-
usernamePassword(credentialsId: 'ossrh.sonatype.org', passwordVariable: 'OSSRH_PASSWORD', usernameVariable: 'OSSRH_USER'),
203-
usernamePassword(credentialsId: 'gradle-plugin-portal-api-key', passwordVariable: 'PLUGIN_PORTAL_PASSWORD', usernameVariable: 'PLUGIN_PORTAL_USERNAME'),
204-
file(credentialsId: 'release.gpg.private-key', variable: 'RELEASE_GPG_PRIVATE_KEY_PATH'),
205-
string(credentialsId: 'release.gpg.passphrase', variable: 'RELEASE_GPG_PASSPHRASE')
196+
// https://github.com/gradle-nexus/publish-plugin#publishing-to-maven-central-via-sonatype-ossrh
197+
usernamePassword(credentialsId: 'ossrh.sonatype.org', passwordVariable: 'ORG_GRADLE_PROJECT_sonatypePassword', usernameVariable: 'ORG_GRADLE_PROJECT_sonatypeUsername'),
198+
file(credentialsId: 'release.gpg.private-key', variable: 'SIGNING_GPG_PRIVATE_KEY_PATH'),
199+
string(credentialsId: 'release.gpg.passphrase', variable: 'SIGNING_GPG_PASSPHRASE')
206200
gitUsernamePassword(credentialsId: 'username-and-token.Hibernate-CI.github.com', gitToolName: 'Default')
207201
]) {
208202
sshagent(['ed25519.Hibernate-CI.github.com', 'hibernate.filemgmt.jboss.org', 'hibernate-ci.frs.sourceforge.net']) {

‎ci/snapshot-publish.Jenkinsfile

+3-6
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,12 @@ pipeline {
3131
stage('Publish') {
3232
steps {
3333
withCredentials([
34-
usernamePassword(credentialsId: 'ossrh.sonatype.org', usernameVariable: 'hibernatePublishUsername', passwordVariable: 'hibernatePublishPassword'),
34+
// https://github.com/gradle-nexus/publish-plugin#publishing-to-maven-central-via-sonatype-ossrh
35+
usernamePassword(credentialsId: 'ossrh.sonatype.org', usernameVariable: 'ORG_GRADLE_PROJECT_sonatypeUsername', passwordVariable: 'ORG_GRADLE_PROJECT_sonatypePassword'),
3536
file(credentialsId: 'release.gpg.private-key', variable: 'SIGNING_GPG_PRIVATE_KEY_PATH'),
3637
string(credentialsId: 'release.gpg.passphrase', variable: 'SIGNING_GPG_PASSPHRASE')
3738
]) {
38-
sh '''./gradlew clean publish \
39-
-PhibernatePublishUsername=$hibernatePublishUsername \
40-
-PhibernatePublishPassword=$hibernatePublishPassword \
41-
--no-scan \
42-
'''
39+
sh "./gradlew clean publish --no-scan"
4340
}
4441
}
4542
}

‎publish.gradle

+51-14
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ apply plugin: 'signing'
55
// Java / publishing
66

77
java {
8-
// include javadoc and sources jar in the Java component
9-
// - classes jar included by default
8+
// Configure the Java "software component" to include javadoc and sources jars in addition to the classes jar.
9+
// Ultimately, this component is what makes up the publication for this project.
1010
withJavadocJar()
1111
withSourcesJar()
1212
}
@@ -36,7 +36,7 @@ javadoc {
3636

3737
publishing {
3838
publications {
39-
publishedArtifacts(MavenPublication) {
39+
register( "publishedArtifacts", MavenPublication) {
4040
from components.java
4141

4242
pom {
@@ -78,35 +78,39 @@ publishing {
7878
}
7979

8080

81-
// signing
81+
// Signing
8282

8383
var signingExtension = project.getExtensions().getByType(SigningExtension) as SigningExtension
8484

85-
// create a `signPublications` "grouping" task which will execute all Sign tasks
86-
def signPublicationsTask = tasks.register('signPublications')
85+
def signPublicationsTask = tasks.register('signPublications') {
86+
description "Grouping task which executes all Sign tasks"
87+
dependsOn tasks.withType( Sign )
88+
}
89+
8790
tasks.named( "publishPublishedArtifactsPublicationToSonatypeRepository" ) {
91+
// publishing depends on signing
8892
dependsOn signPublicationsTask
8993
}
9094

9195
gradle.taskGraph.whenReady { TaskExecutionGraph graph ->
9296
boolean wasSigningRequested = false
9397
boolean wasPublishingRequested = false
94-
List<Sign> signingTasks = []
9598

9699
graph.allTasks.each {task ->
97-
logger.lifecycle( "Checking task : $task" )
98100
if ( task instanceof Sign ) {
99-
logger.lifecycle( " - Task is Sign" )
100-
signingTasks.add( task )
101101
wasSigningRequested = true
102102
}
103103
else if ( task instanceof PublishToMavenRepository ) {
104-
logger.lifecycle( " - Task is PublishToMavenRepository" )
105104
wasPublishingRequested = true
106105
}
107106
}
108107

109108
if ( wasPublishingRequested ) {
109+
def publishUser = resolvePublishUser()
110+
def publishPass = resolvePublishPass()
111+
if ( publishUser == null || publishPass == null ) {
112+
throw new RuntimeException( "Cannot perform publishing to OSSRH without credentials." )
113+
}
110114
logger.lifecycle "Publishing groupId: '" + project.group + "', version: '" + project.version + "'"
111115
}
112116

@@ -119,14 +123,47 @@ gradle.taskGraph.whenReady { TaskExecutionGraph graph ->
119123
var signingPassword = resolveSigningPassphrase()
120124
signingExtension.useInMemoryPgpKeys( signingKey, signingPassword )
121125
signingExtension.sign publishing.publications.publishedArtifacts
122-
123-
signPublicationsTask.get().dependsOn( signingTasks )
124126
}
125127
else {
126128
// signing was not explicitly requested and we are not publishing to OSSRH,
127129
// - disable all Sign tasks
128-
signingTasks.each { enabled = false }
130+
tasks.withType( Sign ).each { enabled = false }
131+
}
132+
}
133+
134+
String resolvePublishUser() {
135+
var envVar = System.getenv().get( "ORG_GRADLE_PROJECT_sonatypeUsername" )
136+
if ( envVar != null ) {
137+
return envVar
138+
}
139+
140+
def projectProp = projectPropOrNull( "sonatypeUsername" )
141+
if ( projectProp != null ) {
142+
return projectProp
143+
}
144+
145+
return null
146+
}
147+
148+
String resolvePublishPass() {
149+
var envVar = System.getenv().get( "ORG_GRADLE_PROJECT_sonatypePassword" )
150+
if ( envVar != null ) {
151+
return envVar
152+
}
153+
154+
def projectProp = projectPropOrNull( "sonatypePassword" )
155+
if ( projectProp != null ) {
156+
return projectProp
157+
}
158+
159+
return null
160+
}
161+
162+
String projectPropOrNull(String name) {
163+
if ( project.hasProperty( name ) ) {
164+
return project.findProperty( name )
129165
}
166+
return null;
130167
}
131168

132169

0 commit comments

Comments
 (0)