Repository navigation
Publish solely to the Code Genome Project - #1184
Merged
Merged
Conversation
Replaces Sonatype/OSSRH as the deploy target for both snapshots and releases with the Code Genome Project's flat Maven repository, written to through its backing S3 bucket.
Resolves the ci.yml and publish.yml conflicts with #1190, which taught the release and snapshot workflows to reach the Code Genome Project while still publishing to Sonatype. This branch drops Sonatype as a target altogether, so codegenome is the only server setup-java writes and the second setup-java call plus the --settings/--global-settings pair are no longer needed. The main-side additions that stand on their own are kept: CODEGENOME credentials on the version-bump steps in both workflows, and bump-snapshots.yml switching to the codegenome server.
Main meanwhile grew its own Code Genome Project publishing in #1191, but as a dual publish: Sonatype stays the deploy target and a codegenome-publish profile, activated by AWS credentials, points distributionManagement at the CGP bucket for a second deploy step in each workflow. This branch publishes solely to CGP, so the resolution keeps that single-target shape and drops the duplication it makes redundant: - pom.xml keeps CGP in the top-level distributionManagement, so the codegenome-publish profile that overrode it with the same coordinates is gone. - The s3 wagon is declared once, in main's .mvn/extensions.xml, rather than also in the pom's build extensions. - ci.yml and publish.yml drop the extra publish-*-codegenome steps, along with the Sonatype credentials and the --settings/--global-settings pair. Adopted from main: the CODEGENOME_USERNAME/CODEGENOME_TOKEN secret rename from #1197, the narrowed rollback condition keyed on steps.publish-release.outcome, and the README's CGP documentation from #1193, which covers what this branch's smaller README edit did and more.
timtebeek
marked this pull request as ready for review
August 26, 2026 10:38
distributionManagement is deployed verbatim in the published pom, so the s3:// URL is the only Code Genome Project address a consumer reading it sees. Name the read-only HTTP service the URL they actually resolve from, and mark the bucket as the write side.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft, because it retires the Maven Central publication path and cannot be verified without a real publish — the questions below want an answer before this merges.
What changed
pom.xmldistributionManagement(bothrepositoryandsnapshotRepository) points ats3://codegenome-artifacts/maven. CGP serves releases and snapshots from one flat repository, so both entries are the same URL; the idcodegenome-s3is deliberately distinct from thecodegenomeread repository added in Allow resolving dependencies from the Code Genome Project #1183, since the two authenticate differently (settings.xml server vs. the AWS environment).net.pennix:maven-wagon-s3v2build extension. The HTTP service is read-only, so deploys go to the bucket directly, and Maven has no built-ins3://transport. Credentials and region come from the standard AWS SDK v2 provider chain — the wagon does not read Maven<server>credentials.nexus-staging-maven-pluginfrom thereleaseprofile; with<extensions>true</extensions>it hijackeddeployto stage into Nexus. The stockmaven-deploy-pluginnow runs, which merges remotemaven-metadata.xmlthe way CGP's ADR 13 expects of a publisher.ci.yml/publish.yml— onesetup-javacall instead of two: it writes thecodegenomeserver plus the GPG key into the default~/.m2/settings.xml, so the--settingsflags are gone andrelease:perform's forked Maven picks the credentials up without extra plumbing. Publish steps getCGP_AWS_ACCESS_KEY_ID/CGP_AWS_SECRET_ACCESS_KEYandAWS_REGION: us-west-2(the wagon defaults to us-east-1 otherwise). GPG signing is kept; the passphrase moves to the conventionalMAVEN_GPG_PASSPHRASEname, still fed fromOSSRH_SIGNING_PASSWORD.README.md— the snapshot instructions pointed at Sonatype snapshots, which will no longer receive anything.Verified locally
./mvnw validateresolves the extension, and adeploy-fileagainst a bogus bucket reaches S3 and fails with a 403 on the fake key rather than "no transporter for s3://", so the wagon is wired throughdistributionManagementcorrectly. The actual upload can only be exercised with real credentials.Worth a decision before merge
RewriteCgpPublishPlugin) publishes to CGP in addition to Sonatype. This does what the title says and drops Sonatype — deliberate, but it diverges from the Gradle repos, and it means the plugin stops appearing on Maven Central.net.pennix:maven-wagon-s3v2is a single-maintainer artifact, last released 2023, pulling AWS SDK 2.17.212. It is the only maintained SDK-v2 S3 wagon I found. The alternative ismvn deployto a staging directory plusaws s3 sync, but that would make us responsible for merging artifact-levelmaven-metadata.xmlourselves.bump-snapshots.ymland the twoversions:update-propertiessteps inpublish.ymldo not setCODEGENOME_USERNAME, so thecodegenomeprofile stays inactive there and they will stop seeing neworg.openrewriteversions once Central is retired. Happy to fix here or in a separate PR.