fix(release): use current Central Portal for package publishing (#64)

* fix(release): use current Central Portal for package publishing
* fix(release): split staging and release into two jobs, with approval on release
* fix(release): add version to gradle properties to tag staging package

Author: aevv

.github/workflows/release.yml

@@ -6,9 +6,19 @@ on:
       - master
       - main
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
-  changesets:
+  stage:
     runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.release.outputs.tag }}
     env:
       SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
       SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
@@ -50,28 +60,65 @@ jobs:
           version-script: npm run version
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Create new release if release PR is merged
+      - name: Tag and create GitHub release if release PR is merged
+        id: release
         if: steps.changesets.outputs.has-changesets == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           npx changeset git-tag && git push origin --tags
           COMMIT_TAG=$(git tag --points-at HEAD)
-          if [ -n "$COMMIT_TAG" ]; then
-            echo "A tag is attached to HEAD. Creating a new release..."
-            echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
-            CHANGELOG=$(awk '
-              BEGIN { recording=0; }
-              /^## / {
-                  if(recording) { exit; }
-                  recording=1;
-                  next;
-              }
-              recording {
-                  print;
-              }
-            ' CHANGELOG.md)
-            gh release create $COMMIT_TAG -t "$COMMIT_TAG" -n "$CHANGELOG"
-            ./generate_gradle_properties.bash ${{ github.workspace }}
-            ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository
-          else
+          if [ -z "$COMMIT_TAG" ]; then
             echo "No tag attached to HEAD. No new release needed."
-          fi
+            exit 0
+          fi
+          echo "A tag is attached to HEAD. Creating a new release..."
+          CHANGELOG=$(awk '
+            BEGIN { recording=0; }
+            /^## / {
+                if(recording) { exit; }
+                recording=1;
+                next;
+            }
+            recording {
+                print;
+            }
+          ' CHANGELOG.md)
+          gh release create "$COMMIT_TAG" -t "$COMMIT_TAG" -n "$CHANGELOG"
+          echo "tag=$COMMIT_TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Stage ${{ steps.release.outputs.tag }} to Sonatype
+        if: steps.release.outputs.tag != ''
+        run: |
+          ./generate_gradle_properties.bash ${{ github.workspace }}
+          ./gradlew publishToSonatype closeSonatypeStagingRepository
+
+  publish:
+    needs: stage
+    if: needs.stage.outputs.tag != ''
+    runs-on: ubuntu-latest
+    environment:
+      name: maven-central
+      url: https://central.sonatype.com/publishing/deployments
+    env:
+      SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+      GPG_KEY_FILE: ${{ secrets.GPG_KEY_FILE }}
+      GPG_KEY_PASSWORD: ${{ secrets.GPG_KEY_PASSWORD }}
+      GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
+    steps:
+      - name: Checkout release tag
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.stage.outputs.tag }}
+
+      - name: Setup java environment
+        uses: actions/setup-java@v6
+        with:
+          distribution: 'corretto'
+          java-version: '17'
+
+      - name: Release ${{ needs.stage.outputs.tag }} to Maven Central
+        run: |
+          ./generate_gradle_properties.bash ${{ github.workspace }}
+          ./gradlew findSonatypeStagingRepository releaseSonatypeStagingRepository

CHANGELOG.md

@@ -1,5 +1,11 @@
 # evervault-java
 
+## 4.3.1
+
+### Patch Changes
+
+- Update release process from deprecated OSSRH to Maven Central Portal.
+
 ## 4.3.0
 
 ### Minor Changes

build.gradle

@@ -9,6 +9,7 @@ plugins {
 }
 
 group 'com.evervault'
+version new groovy.json.JsonSlurper().parseText(file('package.json').text).version
 
 dependencyLocking {
     lockAllConfigurations()
@@ -25,8 +26,9 @@ def getRepositoryPassword() {
 nexusPublishing {
     repositories {
         sonatype {
-            nexusUrl.set(uri("https://s01.oss.sonatype.org/service/local/"))
-            snapshotRepositoryUrl.set(uri("https://s01.oss.sonatype.org/content/repositories/snapshots/"))
+            nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
+            snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
+            stagingProfileId.set("7050c947df3733")
             username = getRepositoryUsername()
             password = getRepositoryPassword()
         }

lib/build.gradle

@@ -6,7 +6,7 @@ plugins {
 }
 
 group 'com.evervault'
-version '4.3.0'
+version '4.3.1'
 
 repositories {
     mavenCentral()

package.json

@@ -1,7 +1,7 @@
 {
     "name": "evervault-java",
     "private": true,
-    "version": "4.3.0",
+    "version": "4.3.1",
     "scripts": {
         "version": "changeset version && PACKAGE_VERSION=$(node -p \"require('./package.json').version\") && sed -i \"s/version '.*'/version '$PACKAGE_VERSION'/g\" lib/build.gradle"
     },