Skip to content

Commit a594a20

Browse files
AdamKorczIan Lewislaurentsimon
authored
chore: Make maven publisher an action (#2482)
Closes #2369 --------- Signed-off-by: AdamKorcz <[email protected]> Signed-off-by: AdamKorcz <[email protected]> Signed-off-by: laurentsimon <[email protected]> Co-authored-by: Ian Lewis <[email protected]> Co-authored-by: laurentsimon <[email protected]>
1 parent c683687 commit a594a20

File tree

7 files changed

+372
-142
lines changed

7 files changed

+372
-142
lines changed

‎.github/workflows/publish_maven.yml

-124
This file was deleted.

‎actions/maven/publish/README.md

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Publishing SLSA3+ provenance to Maven Central
2+
3+
This document explains how to publish SLSA3+ artifacts and provenance to Maven central.
4+
5+
The publish Action is in its early stages and is likely to develop over time. Future breaking changes may occur.
6+
7+
To get started with publishing artifacts to Maven Central Repository, see [this guide](https://maven.apache.org/repository/guide-central-repository-upload.html).
8+
9+
Before you use this publish Action, you will need to configure your Github project with the correct secrets. See [this guide](https://docs.github.com/en/actions/publishing-packages/publishing-java-packages-with-maven) for more.
10+
11+
## Using the Maven Publish action
12+
13+
To use the Maven action you need to add the step in your release workflow that invokes it.
14+
15+
Before using the Maven publish action, you should have a workflow that invokes the [Maven builder](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/maven/README.md). It will look something like this:
16+
17+
```yaml
18+
name: Release Maven project
19+
on:
20+
- workflow_dispatch
21+
22+
permissions: read-all
23+
24+
jobs:
25+
build:
26+
permissions:
27+
id-token: write
28+
contents: read
29+
actions: read
30+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
31+
with:
32+
rekor-log-public: true
33+
```
34+
35+
To use the Publish action, you need to add another job:
36+
37+
```yaml
38+
publish:
39+
runs-on: ubuntu-latest
40+
needs: build
41+
permissions:
42+
id-token: write
43+
contents: read
44+
actions: read
45+
steps:
46+
- name: publish
47+
id: publish
48+
uses: slsa-framework/slsa-github-generator/actions/maven/[email protected]
49+
with:
50+
provenance-download-name: "${{ needs.build.outputs.provenance-download-name }}"
51+
provenance-download-sha256: "${{ needs.build.outputs.provenance-download-sha256 }}"
52+
target-download-sha256: "${{ needs.build.outputs.target-download-sha256 }}"
53+
maven-username: ${{ secrets.OSSRH_USERNAME }}
54+
maven-password: ${{ secrets.OSSRH_PASSWORD }}
55+
gpg-key-pass: ${{ secrets.GPG_PASSPHRASE }}
56+
gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
57+
```
58+
59+
Set the values of "maven-username", "maven-password", "gpg-key-pass" and " gpg-private-key" for your account. The parameters to `provenance-download-name`, `provenance-download-sha256` and `target-download-sha256` should not be changed.
60+
61+
Once you trigger this workflow, your artifacts and provenance files will be added to a staging repository in Maven Central. You need to close the staging repository and then release:
62+
63+
Closing the staging repository:
64+
65+
![closing the staging repository](/actions/gradle/publish/images/gradle-publisher-staging-repository.png)
66+
67+
Releasing:
68+
69+
![releasing the Gradle artefacts](/actions/gradle/publish/images/gradle-publisher-release-closed-repository.png)

‎actions/maven/publish/action.yml

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# Copyright 2023 SLSA Authors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
16+
inputs:
17+
provenance-download-name:
18+
description: "The artifact name for the package provenance."
19+
required: true
20+
type: string
21+
provenance-download-sha256:
22+
description: "The sha256 of the package provenance artifact."
23+
required: true
24+
type: string
25+
target-download-sha256:
26+
description: "The sha256 of the target directory."
27+
required: true
28+
type: string
29+
maven-username:
30+
description: "Maven username"
31+
required: true
32+
maven-password:
33+
description: "Maven password"
34+
required: true
35+
gpg-key-pass:
36+
description: "gpg-key-pass"
37+
required: true
38+
gpg-private-key:
39+
description: "gpg-key-pass"
40+
required: true
41+
runs:
42+
using: "composite"
43+
steps:
44+
- name: Checkout the project repository
45+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@main # needed because we run javadoc and sources.
46+
- name: Set up Java for publishing to Maven Central Repository
47+
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3
48+
env:
49+
MAVEN_USERNAME: ${{ inputs.maven-username }}
50+
MAVEN_PASSWORD: ${{ inputs.maven-password }}
51+
GPG_KEY_PASS: ${{ inputs.gpg-key-pass }}
52+
with:
53+
java-version: '11'
54+
distribution: 'temurin'
55+
server-id: ossrh
56+
server-username: MAVEN_USERNAME
57+
server-password: MAVEN_PASSWORD
58+
gpg-private-key: ${{ inputs.gpg-private-key }}
59+
gpg-passphrase: GPG_KEY_PASS
60+
61+
- name: Download the slsa attestation
62+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main
63+
with:
64+
name: "${{ inputs.provenance-download-name }}"
65+
path: slsa-attestations
66+
sha256: "${{ inputs.provenance-download-sha256 }}"
67+
68+
- name: Download the target dir
69+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main
70+
with:
71+
name: target
72+
path: ./
73+
sha256: "${{ inputs.target-download-sha256 }}"
74+
75+
- name: Checkout the framework repository
76+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
77+
with:
78+
repository: slsa-framework/slsa-github-generator
79+
ref: v1.8.0
80+
path: __BUILDER_CHECKOUT_DIR__
81+
82+
- name: Publish to the Maven Central Repository
83+
shell: bash
84+
env:
85+
MAVEN_USERNAME: "${{ inputs.maven-username }}"
86+
MAVEN_PASSWORD: "${{ inputs.maven-password }}"
87+
GPG_KEY_PASS: "${{ inputs.gpg-key-pass }}"
88+
SLSA_DIR: "${{ inputs.provenance-download-name }}"
89+
PROVENANCE_FILES: "${{ inputs.provenance-download-name }}"
90+
run: |
91+
cd __BUILDER_CHECKOUT_DIR__/actions/maven/publish/slsa-hashing-plugin && mvn clean install && cd -
92+
mvn javadoc:jar source:jar
93+
# Retrieve project version
94+
export version=$(mvn org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout)
95+
export artifactid=$(mvn org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.artifactId -q -DforceStdout)
96+
# Reset the environment variables add in the base provenance
97+
export files="slsa-attestations/${PROVENANCE_FILES}/${artifactid}-${version}.jar.build.slsa"
98+
export types=slsa
99+
export classifiers=jar.build
100+
# Find all necessary built jar files and attach them to the environment variable deploy
101+
while read -r name; do
102+
target=$(echo "${name}" | rev | cut -d- -f1 | rev)
103+
files=$files,$name
104+
types=$types,${target##*.}
105+
classifiers=$classifiers,${target%.*}
106+
done <<<"$(find ./ -name "$artifactid-$version-*.jar")"
107+
# Find all generated provenance files and attach them the the environment variable for deploy
108+
while read -r name; do
109+
target=$(echo "${name}" | rev | cut -d- -f1 | rev)
110+
files=$files,$name
111+
types=$types",slsa"
112+
classifiers=$classifiers,${target::-9}
113+
done <<<"$(find ./ -name "$artifactid-$version-*.jar.build.slsa")"
114+
# Sign and deploy the files to the ossrh remote repository
115+
mvn validate jar:jar -Dfile=target/"${artifactid}"-"${version}".jar -Durl=https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/ -DrepositoryId=ossrh -Dfiles="${files}" -Dtypes="${types}" -Dclassifiers="${classifiers}" -DpomFile=pom.xml gpg:sign-and-deploy-file

‎actions/maven/publish/slsa-hashing-plugin/pom.xml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0"
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
4+
5+
<modelVersion>4.0.0</modelVersion>
6+
<groupId>io.github.slsa-framework.slsa-github-generator</groupId>
7+
<artifactId>hash-maven-plugin</artifactId>
8+
<packaging>maven-plugin</packaging>
9+
<version>0.0.1</version>
10+
11+
<name>Jarfile Hashing Maven Mojo</name>
12+
<url>http://maven.apache.org</url>
13+
14+
<properties>
15+
<maven.compiler.target>1.8</maven.compiler.target>
16+
<maven.compiler.source>1.8</maven.compiler.source>
17+
</properties>
18+
19+
<dependencies>
20+
<dependency>
21+
<groupId>org.apache.maven</groupId>
22+
<artifactId>maven-plugin-api</artifactId>
23+
<version>3.6.3</version>
24+
</dependency>
25+
<dependency>
26+
<groupId>org.apache.maven.plugin-tools</groupId>
27+
<artifactId>maven-plugin-annotations</artifactId>
28+
<version>3.6.0</version>
29+
<scope>provided</scope>
30+
</dependency>
31+
<dependency>
32+
<groupId>org.apache.maven</groupId>
33+
<artifactId>maven-project</artifactId>
34+
<version>2.2.1</version>
35+
</dependency>
36+
<dependency>
37+
<groupId>org.json</groupId>
38+
<artifactId>json</artifactId>
39+
<version>20230227</version>
40+
</dependency>
41+
</dependencies>
42+
</project>

0 commit comments

Comments
 (0)