Skip to content

Publish releases to Maven Central from CI on a v* tag - #48

Merged
shannah merged 1 commit into
masterfrom
chore/maven-central-release
Nov 11, 2026
Merged

shannah merged 1 commit into
masterfrom
chore/maven-central-release

Conversation

@shannah

@shannah shannah commented Nov 11, 2026

Copy link
Copy Markdown
Owner

Nothing in CI published releases, and the pom.xml deployed to OSSRH (oss.sonatype.org), which Sonatype has retired. This sets up release publishing through the Central Portal, modelled on webliteca/swingwebview's maven-release.yml.

Changes

  • pom.xml
    • Removes the nexus-staging distributionManagement.
    • Adds a central-deploy profile with central-publishing-maven-plugin 0.7.0 (publishingServerId central, autoPublish).
    • The existing release profile (-Drelease=true) is unchanged. It still builds the universal Release libjcocoa and attaches sources, javadoc and GPG signatures (loopback pinentry, gpg.passphrase).
  • .github/workflows/release.yml, on a v* tag, on macos-15 (libjcocoa is built with xcodebuild):
    1. Sets the version from the tag (v1.3 → 1.3) with versions:set; nothing is committed back.
    2. Installs the pinned Maven 3.9.11 (sha512-verified), for the same reason swingwebview pins it.
    3. Writes settings.xml with the central server from MAVEN_CENTRAL_USERNAME / MAVEN_CENTRAL_PASSWORD.
    4. Imports GPG_PRIVATE_KEY, decoding the base64 with Python because macOS's base64 has no --ignore-garbage.
    5. Runs mvn clean verify -Drelease=true, so the tests run against the Release libjcocoa that ships.
    6. Checks that libjcocoa.dylib is arm64 + x86_64 and is in the jar.
    7. Runs mvn deploy -Drelease=true -Pcentral-deploy, then deletes the GPG key.
    • Dry run: running the workflow by hand with dry_run ticked (the default) does everything except the upload, from any branch. A manual run without it requires a v* tag.
  • README.md: a "Releasing" section.

Not tested yet

Publishing can't be exercised from a PR: GitHub only offers manual runs once the workflow is on master, and the secrets can't be checked from here. Suggested order:

  1. Merge.
  2. Actions → Release to Maven Central → Run workflow on master, with dry_run ticked. This checks the key import, signing and build.
  3. Tag v1.3 and push it.

Generated by Claude Code

The release profile deployed to OSSRH (oss.sonatype.org), which Sonatype
has retired, and nothing in CI published at all.

pom.xml: drop the nexus-staging distributionManagement and add a
central-deploy profile with central-publishing-maven-plugin 0.7.0
(publishingServerId central, autoPublish). The existing release profile
still builds the universal Release libjcocoa and attaches sources,
javadoc and GPG signatures.

release.yml, modelled on webliteca/swingwebview's maven-release.yml: on
a v* tag, on macos-15 (xcodebuild), set the version from the tag, run
the tests against the Release libjcocoa, check that it is universal and
in the jar, then deploy -Drelease=true -Pcentral-deploy with pinned
Maven 3.9.11. Uses the GPG_PRIVATE_KEY (base64), GPG_PASSPHRASE,
MAVEN_CENTRAL_USERNAME and MAVEN_CENTRAL_PASSWORD secrets. A manual run
with dry_run does everything but the upload, from any branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZMcbjtKBCyrRMgkgSipea
@shannah
shannah marked this pull request as ready for review November 11, 2026 19:47
@shannah
shannah merged commit de95e35 into master Nov 11, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants