@@ -41,32 +41,42 @@ Run the following to ensure the package step succeeds.
41
41
mvn clean test jacoco:report package
42
42
```
43
43
44
- ### Publish to MavenCentral
45
-
46
- Contributors are not responsible for deploying to mavencentral.
44
+ ## Release Process
47
45
48
- ** Maven Central**
49
-
50
- - Publish with Maven - https://central.sonatype.org/publish/publish-maven/
51
- - GPG Setup - https://central.sonatype.org/publish/requirements/gpg/
52
- - https://oss.sonatype.org/#profile;User%20Token
53
- - get oss.sonatype token
54
-
55
- To publish a gpg key:
46
+ ### Build
56
47
48
+ Build sources and javadoc
57
49
``` shell
58
- gpg --send-keys 5BE1414D5EAF81B48F2E77E1999F818C080AF9C1
59
- ````
50
+ mvn clean test jacoco:report package
51
+ ```
60
52
61
- where ` 5BE1414D5EAF81B48F2E77E1999F818C080AF9C1` is the public key
53
+ Generate signed artifacts locally
54
+ ``` shell
55
+ mvn verify -P release-sign-artifacts -DperformRelease=true
56
+ ```
62
57
58
+ ### Publish to Maven Central
63
59
60
+ Deploy
64
61
``` shell
65
62
mvn clean test jacoco:report package deploy -DperformRelease=true
66
63
```
64
+ When first publishing to staging repos, you most close and release from OSS Sonatype. To do this
65
+ - navigate to https://oss.sonatype.org/#stagingRepositories
66
+ - select repository
67
+ - press the ` close ` button
68
+ - press the ` release ` button
69
+
70
+ #### Artifacts upload
71
+ - Upload change log
72
+ ``` shell
73
+ gh release create v3.0.1 -F CHANGELOG.md
74
+ ```
67
75
68
- Navigate to https://oss.sonatype.org/# stagingRepositories, select repository, then press the `close` button, then `release`
69
-
76
+ - Attach 'signed' artifacts (needed for OpenSSF Security Score)
77
+ ``` shell
78
+ gh release upload target/* .jar.asc --clobber
79
+ ```
70
80
### Publish to Github Packages
71
81
72
82
_ Note: This step can only be run by maintainers._
@@ -88,13 +98,49 @@ Add `distributionManagement` to `pom.xml`
88
98
mvn deploy -Dregistry=https://maven.pkg.github.com/cdimascio -Dtoken=XXXX
89
99
# or
90
100
mvn clean test jacoco:report package deploy -Dregistry=https://maven.pkg.github.com/cdimascio -Dtoken=XXXX
101
+ ```
102
+
103
+ ## Notes
104
+
105
+
106
+ ### Publish to MavenCentral
91
107
108
+ Contributors are not responsible for deploying to mavencentral.
109
+
110
+ ** Maven Central**
111
+
112
+ - Publish with Maven - https://central.sonatype.org/publish/publish-maven/
113
+ - GPG Setup - https://central.sonatype.org/publish/requirements/gpg/
114
+ - https://oss.sonatype.org/#profile;User%20Token
115
+ - get oss.sonatype token
116
+
117
+ To publish a gpg key:
118
+
119
+ ``` shell
120
+ gpg --send-keys 5BE1414D5EAF81B48F2E77E1999F818C080AF9C1
121
+ ````
122
+
123
+ where ` 5BE1414D5EAF81B48F2E77E1999F818C080AF9C1` is the public key
124
+
125
+
126
+ ` ` ` shell
127
+ mvn clean test jacoco:report package deploy -DperformRelease=true
128
+ ` ` `
129
+
130
+ Generate signed artifacts locally without deploying
131
+
132
+ ` ` ` shell
133
+ mvn verify -P release-sign-artifacts -DperformRelease=true
92
134
` ` `
93
135
136
+ Navigate to https://oss.sonatype.org/# stagingRepositories, select repository, then press the `close` button, then `release`
137
+
138
+
94
139
https://docs.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-apache-maven-for-use-with-github-packages
95
140
96
141
97
- OpenSSF Security Scorecard
142
+ # ## OpenSSF Security Scorecard
98
143
- Get Analysis Result: https://api.securityscorecards.dev/# /results/getResult
99
144
- Step Security - Secure Your Repo Analysis + auto PR - https://app.stepsecurity.io/securerepo
100
145
- Step Security - For Repo - https://app.stepsecurity.io/github/cdimascio/actions/dashboard
146
+
0 commit comments