fix(ci): Update publishing url to ossrh-staging-api#300
Merged
Conversation
Contributor
Reviewer's GuideUpdates Maven Central publishing to use the new ossrh-staging-api endpoint and adds an automatic publishing Gradle task, while simplifying and adjusting the GitHub release workflow to align with the new publishing flow and tagging/versioning strategy. Sequence diagram for CI release workflow and OSSRH staging API publishingsequenceDiagram
actor Developer
participant GitHubActions
participant GradleBuild
participant SonatypeOSSRH
Developer->>GitHubActions: Push to master / trigger release workflow
GitHubActions->>GitHubActions: Determine release_version and next_version
GitHubActions->>GitHubActions: Update build.gradle to release_version
GitHubActions->>GitHubActions: Commit [release-action] release version
GitHubActions->>GitHubActions: Create branch release-release_version and tag release_version
GitHubActions->>GradleBuild: Run ./gradlew sign publish publishToMavenCentral
GradleBuild->>SonatypeOSSRH: Publish artifacts to repository ossrh-staging-api
GradleBuild->>SonatypeOSSRH: HTTP POST /manual/upload/defaultRepository/namespace
Note right of GradleBuild: Gradle task publishToMavenCentral builds Authorization Bearer token from NEXUS_USERNAME and NEXUS_PASSWORD
SonatypeOSSRH-->>GradleBuild: HTTP response (success or error)
GradleBuild-->>GitHubActions: Build and publish result
GitHubActions->>GitHubActions: Checkout master
GitHubActions->>GitHubActions: Update build.gradle to next_version
GitHubActions->>GitHubActions: Commit [release-action] prepare for next development iteration
GitHubActions->>GitHubActions: Push master and tags to origin
GitHubActions-->>Developer: Release job status and logs
Flow diagram for updated GitHub release workflow and versioningflowchart TD
A["Start release workflow"] --> B["Compute release_version from build.gradle
(SNAPSHOT stripped)"]
B --> C["Get last_version and next_version
from tags and release_version"]
C --> D["Update build.gradle to release_version"]
D --> E["git add build.gradle"]
E --> F["git commit -m '[release-action] release version release_version'"]
F --> G["Create branch release-release_version"]
G --> H["git tag -a release_version -m 'Release release_version'"]
H --> I["Set up GPG key and Gradle properties"]
I --> J["Run ./gradlew sign publish publishToMavenCentral"]
J --> K["Gradle publishToMavenCentral task
POSTs to ossrh-staging-api"]
K --> L{"Publishing successful?"}
L -->|"No"| M["Fail workflow with GradleException"]
L -->|"Yes"| N["git checkout master"]
N --> O["Update build.gradle to next_version"]
O --> P["git add build.gradle"]
P --> Q["git commit -m '[release-action] prepare for next development iteration'"]
Q --> R["git push origin master --tags"]
R --> S["End release workflow"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- In the new
publishToMavenCentraltask, the Authorization header uses a Base64-encodedusername:passwordwith schemeBearer; if this endpoint expects HTTP Basic auth, the header should beAuthorization: Basic <base64-creds>instead to match standard Sonatype usage. - The
publishToMavenCentralURL connection does not set connect or read timeouts, so a hanging Sonatype endpoint could stall the Gradle build; consider configuring reasonable timeouts on theURLConnection. - The workflow creates a
release-${{ env.release_version }}branch but never pushes it, so the release branch exists only locally in CI; if you intend to keep release branches in the remote repo, add a push for that branch before the finalgit push origin master --tags.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In the new `publishToMavenCentral` task, the Authorization header uses a Base64-encoded `username:password` with scheme `Bearer`; if this endpoint expects HTTP Basic auth, the header should be `Authorization: Basic <base64-creds>` instead to match standard Sonatype usage.
- The `publishToMavenCentral` URL connection does not set connect or read timeouts, so a hanging Sonatype endpoint could stall the Gradle build; consider configuring reasonable timeouts on the `URLConnection`.
- The workflow creates a `release-${{ env.release_version }}` branch but never pushes it, so the release branch exists only locally in CI; if you intend to keep release branches in the remote repo, add a push for that branch before the final `git push origin master --tags`.
## Individual Comments
### Comment 1
<location path="build.gradle" line_range="221-227" />
<code_context>
+ def username = System.getenv('NEXUS_USERNAME')
+ def password = System.getenv('NEXUS_PASSWORD')
+ def namespace = System.getenv('NEXUS_NAMESPACE') ?: "io.prestodb"
+ def credentials = "${username}:${password}"
+ def token = credentials.bytes.encodeBase64().toString()
+
+ def url = "https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/${namespace}?publishing_type=automatic"
+ def connection = new URL(url).openConnection()
+ connection.setRequestMethod('POST')
+ connection.setRequestProperty('Authorization', "Bearer ${token}")
+ connection.setRequestProperty('Content-Type', 'application/json')
+ connection.setRequestProperty('Accept', 'application/json')
</code_context>
<issue_to_address>
**issue (bug_risk):** Authorization header likely should use Basic auth instead of Bearer for Sonatype staging API.
This endpoint usually requires HTTP Basic auth with `Authorization: Basic <base64(username:password)>`. You correctly base64‑encode `username:password`, but then send it as a Bearer token, which is likely to cause 401/403. Update this to `connection.setRequestProperty('Authorization', "Basic ${token}")` or confirm the expected auth scheme in the Sonatype docs.
</issue_to_address>
### Comment 2
<location path="build.gradle" line_range="218-230" />
<code_context>
+ def token = credentials.bytes.encodeBase64().toString()
+
+ def url = "https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/${namespace}?publishing_type=automatic"
+ def connection = new URL(url).openConnection()
+ connection.setRequestMethod('POST')
+ connection.setRequestProperty('Authorization', "Bearer ${token}")
+ connection.setRequestProperty('Content-Type', 'application/json')
+ connection.setRequestProperty('Accept', 'application/json')
+ connection.setDoOutput(true)
+
+ def responseCode = connection.getResponseCode()
</code_context>
<issue_to_address>
**suggestion (bug_risk):** HTTP connection lacks timeouts and minimal validation of required environment variables.
This manual HTTP call has no `connectTimeout`/`readTimeout` and also assumes `NEXUS_USERNAME`/`NEXUS_PASSWORD` are always set. If they’re missing, the call proceeds with `null:null`, and without timeouts a network issue could hang the build. Please add reasonable timeouts (e.g. 30s) and fail fast with a clear `GradleException` when required credentials are absent.
```suggestion
def username = System.getenv('NEXUS_USERNAME')
def password = System.getenv('NEXUS_PASSWORD')
if (!username || !password) {
throw new org.gradle.api.GradleException(
"NEXUS_USERNAME and NEXUS_PASSWORD environment variables must be set to publish to Maven Central."
)
}
def namespace = System.getenv('NEXUS_NAMESPACE') ?: "io.prestodb"
def credentials = "${username}:${password}"
def token = credentials.bytes.encodeBase64().toString()
def url = "https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/${namespace}?publishing_type=automatic"
def connection = new URL(url).openConnection()
connection.connectTimeout = 30_000
connection.readTimeout = 30_000
connection.setRequestMethod('POST')
connection.setRequestProperty('Authorization', "Bearer ${token}")
connection.setRequestProperty('Content-Type', 'application/json')
connection.setRequestProperty('Accept', 'application/json')
connection.setDoOutput(true)
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.