fix(release): atomic bundle upload to Maven Central (fixes incomplete beta18) - #57
Merged
Merged
Conversation
…atype push 1.0.0-beta18 confirmed the actual failure mode: the OSSRH-compat "manual/upload" endpoint stages each Gradle publish task as its own implicit deployment. A 7-publication KMP build uploads those 15-25s apart over ~2 minutes, and the single transfer/publish call afterward only picks up whatever's most recent - in beta18's case, just the 2 last-published iOS artifacts (lumen-iosx64, lumen-iossimulatorarm64). Android, JVM, wasmJs, and the KMP metadata module never made it, and can't be added now - Central doesn't allow republishing a version, so io.github.aldefy:lumen:1.0.0-beta18 is permanently incomplete on Maven Central. Do not depend on that version; use 1.0.0-beta19+ once verified. Root cause found by checking aldefy/composeproof's release.yml, which already publishes successfully in production: it never hits the OSSRH- compat endpoint at all. It zips the whole local-staging output into one bundle and POSTs it in a single multipart upload to Central's official Publisher API (central.sonatype.com/api/v1/publisher/upload), which is atomic - no per-publication staging, no timing window to lose artifacts in. This PR switches Lumen to the same pattern: - lumen/build.gradle.kts: removed the "sonatype" remote Maven repository entirely (both maven-publish and signing plugins/config are otherwise unchanged - this was never a plugin problem). Only localStaging remains. - release.yml: replaced the two Sonatype-specific steps (publish-to- Sonatype-repository, then a separate manual-transfer call) with one curl --form bundle upload of the zip that's already being created for the GitHub release asset. publishingType=AUTOMATIC releases immediately on successful validation - same parameter name/value confirmed working against composeproof's real release history, not guessed. SONATYPE_TOKEN doesn't need to be a new secret: Central's official API uses the identical base64(username:password) Bearer token as the OSSRH- compat one, so this reuses the existing OSSRH_USERNAME/OSSRH_PASSWORD secrets already set on this repo. Verified locally: publishAllPublicationsToLocalStagingRepository still produces all 7 expected publications (lumen, lumen-android, lumen-jvm, lumen-wasm-js, lumen-iosarm64, lumen-iossimulatorarm64, lumen-iosx64). actionlint clean, apiCheck passes.
Exists to verify the bundle-upload publish fix end to end on a real tag. No library code changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
1.0.0-beta18published to Maven Central incomplete — onlylumen-iosx64andlumen-iossimulatorarm64made it;lumen-android,lumen-jvm,lumen-wasm-js,lumen-iosarm64, and the rootlumen(KMP metadata) publication never did. Confirmed on the Central Portal UI (Component Coordinates showed exactly 2 artifacts) and oncentral.sonatype.com/artifact/io.github.aldefy/lumen/versions(beta18 never appeared).Root cause: the OSSRH-compatibility
manual/uploadendpoint (what #55/#56 used) stages each Gradlepublish*ToSonatypeRepositorytask as its own implicit deployment. A 7-publication KMP build uploads them 15–25s apart over ~2 minutes; the one manual-transfer call afterward only grabs whatever's most recent. Verified this is the actual mechanism by checkingaldefy/composeproof'srelease.yml, which already publishes successfully in production — it doesn't use this endpoint at all.Fix
Matches composeproof's proven pattern:
lumen/build.gradle.kts: removed thesonatyperemote Maven repository entirely. OnlylocalStagingremains —maven-publish/signingconfig is otherwise unchanged.release.yml: replaced the two Sonatype-specific steps with onecurl --form bundle=@lumen-<tag>-bundle.zipupload to Central's official Publisher API (central.sonatype.com/api/v1/publisher/upload), atomic by construction — no per-publication staging.publishingType=AUTOMATICreleases immediately on validation, confirmed against composeproof's real release history (not guessed).base64(username:password)already computed fromOSSRH_USERNAME/OSSRH_PASSWORD.Bumps to
1.0.0-beta19to verify end-to-end on a real tag.1.0.0-beta18is permanently brokenCentral doesn't allow re-publishing a version.
io.github.aldefy:lumen:1.0.0-beta18will exist forever with only the two iOS artifacts. Documented in the CHANGELOG as a known issue — don't depend on it.Test plan
actionlintclean./gradlew :lumen:apiCheck— passes./gradlew :lumen:publishAllPublicationsToLocalStagingRepository— confirmed all 7 expected publications present locally1.0.0-beta19after merge, confirm it appears complete (all 7 artifacts) at https://central.sonatype.com/artifact/io.github.aldefy/lumen/versions