fix(release): publish to Central Portal instead of dead OSSRH endpoint - #55
Merged
Merged
Conversation
s01.oss.sonatype.org (OSSRH) shut down 2025-06-30. This repo's publish config still targeted it, silently, so publishAllPublicationsToSonatype Repository (never actually wired into release.yml either) would have failed even if someone tried it. This is almost certainly why nothing past 1.0.0-beta15 has reached Maven Central - beta16/beta17 both went out as signed GitHub release zips only. - lumen/build.gradle.kts: repo URL -> the Central Portal's OSSRH- compatibility staging API (ossrh-staging-api.central.sonatype.com). Credentials there are a Central Portal "user token", not a Sonatype account login - documented inline. Dropped the dead snapshot URL branch; the compat endpoint doesn't support SNAPSHOT publishing. - release.yml: added the actual publish-to-Sonatype step (previously missing entirely - the workflow only ever published to a LOCAL staging dir, zipped for the GitHub release), plus the mandatory manual-transfer POST maven-publish needs to make the upload visible in the Portal (it only PUTs files with no deployment context). Both steps are gated on OSSRH_USERNAME/OSSRH_PASSWORD being set, so this is a no-op until those secrets exist - doesn't break anything if the namespace migration below hasn't happened yet. Needs a one-time manual step before this can actually publish: the io.github.aldefy namespace has to be migrated from OSSRH to the Central Portal (https://central.sonatype.com -> find the namespace -> Migrate Namespace), then a Portal user token generated and added as the OSSRH_USERNAME/OSSRH_PASSWORD repo secrets. That's account-owner-only; nothing in this PR can do it. Same dead-endpoint pattern found in aldefy/compose-rebound's gradle/publish-convention.gradle.kts - same fix needed there, not included in this PR.
actionlint caught it, and the actual failed run confirmed it: GitHub Actions rejects `secrets.X` inside a step's `if:` expression outright (workflow-parse-time error, so the job never even starts). Switched to the documented pattern - reference the step's own `env:` (which does see secrets) in `if:` instead, since a step's env IS visible to its own if condition. This is what actually caused the "Release" run just now to fail with zero real jobs - not a build/logic error, a workflow schema error that never let :lumen:build start. Verified with `actionlint` (was clean before I added the secrets check; now clean again with the env-based version). Ran `actionlint` on every workflow file in the repo, no other issues found.
This was referenced Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the actual reason nothing past
1.0.0-beta15has reached Maven Central:s01.oss.sonatype.org(OSSRH) shut down 2025-06-30, and this repo's publish config still pointed at it. Separately,release.ymlnever had a step that published there in the first place — it only ever wrote to a local staging directory, zipped for the GitHub release.lumen/build.gradle.kts: repo URL → the Central Portal's OSSRH-compatibility staging API (ossrh-staging-api.central.sonatype.com). Credentials there are a Central Portal user token, not a Sonatype account login.release.yml: adds the missingpublishAllPublicationsToSonatypeRepositorystep, plus the mandatory manual-transferPOSTthe OSSRH-compat API needs afterward (plainmaven-publishonlyPUTs files with no deployment context, so nothing shows up in the Portal without this call). Both steps are gated onOSSRH_USERNAME/OSSRH_PASSWORDexisting, so this is a no-op — doesn't break anything — until the manual step below is done.Required before this can actually publish (repo-owner only, I can't do this)
io.github.aldefynamespace, click Migrate Namespace.OSSRH_USERNAME/OSSRH_PASSWORDsecrets (Settings → Secrets and variables → Actions). These are Lumen-repo-specific secrets — they don't carry over from or to any other repo.Note
aldefy/compose-reboundhas the identical dead-endpoint pattern ingradle/publish-convention.gradle.kts. The namespace migration above is account-level and covers both repos' group IDs (io.github.aldefy/io.github.aldefy.rebound), but the workflow fix and theOSSRH_USERNAME/OSSRH_PASSWORDsecrets are per-repo — Rebound needs its own PR and its own copy of those secrets, not included here.Test plan
./gradlew :lumen:compileKotlinMetadata— compiles clean