Skip to content

Commit d216732

Browse files
cdimasciocarmine
and
carmine
authoredSep 1, 2024··
update CONTRIBUTING.md to include signed artifact github upload (#73)
* Delete .github/workflows/codeql.yml * remove codeql workflow - its configured through settings * fix javadoc * remove codeql workflow - its configured through settings * fix javadoc * update CONTRIBUTING.md --------- Co-authored-by: carmine <carmine@everco.ai>
1 parent 8c0b9c5 commit d216732

File tree

1 file changed

+63
-17
lines changed

1 file changed

+63
-17
lines changed
 

‎CONTRIBUTING.md

+63-17
Original file line numberDiff line numberDiff line change
@@ -41,32 +41,42 @@ Run the following to ensure the package step succeeds.
4141
mvn clean test jacoco:report package
4242
```
4343

44-
### Publish to MavenCentral
45-
46-
Contributors are not responsible for deploying to mavencentral.
44+
## Release Process
4745

48-
**Maven Central**
49-
50-
- Publish with Maven - https://central.sonatype.org/publish/publish-maven/
51-
- GPG Setup - https://central.sonatype.org/publish/requirements/gpg/
52-
- https://oss.sonatype.org/#profile;User%20Token
53-
- get oss.sonatype token
54-
55-
To publish a gpg key:
46+
### Build
5647

48+
Build sources and javadoc
5749
```shell
58-
gpg --send-keys 5BE1414D5EAF81B48F2E77E1999F818C080AF9C1
59-
````
50+
mvn clean test jacoco:report package
51+
```
6052

61-
where `5BE1414D5EAF81B48F2E77E1999F818C080AF9C1` is the public key
53+
Generate signed artifacts locally
54+
```shell
55+
mvn verify -P release-sign-artifacts -DperformRelease=true
56+
```
6257

58+
### Publish to Maven Central
6359

60+
Deploy
6461
```shell
6562
mvn clean test jacoco:report package deploy -DperformRelease=true
6663
```
64+
When first publishing to staging repos, you most close and release from OSS Sonatype. To do this
65+
- navigate to https://oss.sonatype.org/#stagingRepositories
66+
- select repository
67+
- press the `close` button
68+
- press the `release` button
69+
70+
#### Artifacts upload
71+
- Upload change log
72+
```shell
73+
gh release create v3.0.1 -F CHANGELOG.md
74+
```
6775

68-
Navigate to https://oss.sonatype.org/#stagingRepositories, select repository, then press the `close` button, then `release`
69-
76+
- Attach 'signed' artifacts (needed for OpenSSF Security Score)
77+
```shell
78+
gh release upload target/*.jar.asc --clobber
79+
```
7080
### Publish to Github Packages
7181

7282
_Note: This step can only be run by maintainers._
@@ -88,13 +98,49 @@ Add `distributionManagement` to `pom.xml`
8898
mvn deploy -Dregistry=https://maven.pkg.github.com/cdimascio -Dtoken=XXXX
8999
# or
90100
mvn clean test jacoco:report package deploy -Dregistry=https://maven.pkg.github.com/cdimascio -Dtoken=XXXX
101+
```
102+
103+
## Notes
104+
105+
106+
### Publish to MavenCentral
91107

108+
Contributors are not responsible for deploying to mavencentral.
109+
110+
**Maven Central**
111+
112+
- Publish with Maven - https://central.sonatype.org/publish/publish-maven/
113+
- GPG Setup - https://central.sonatype.org/publish/requirements/gpg/
114+
- https://oss.sonatype.org/#profile;User%20Token
115+
- get oss.sonatype token
116+
117+
To publish a gpg key:
118+
119+
```shell
120+
gpg --send-keys 5BE1414D5EAF81B48F2E77E1999F818C080AF9C1
121+
````
122+
123+
where `5BE1414D5EAF81B48F2E77E1999F818C080AF9C1` is the public key
124+
125+
126+
```shell
127+
mvn clean test jacoco:report package deploy -DperformRelease=true
128+
```
129+
130+
Generate signed artifacts locally without deploying
131+
132+
```shell
133+
mvn verify -P release-sign-artifacts -DperformRelease=true
92134
```
93135

136+
Navigate to https://oss.sonatype.org/#stagingRepositories, select repository, then press the `close` button, then `release`
137+
138+
94139
https://docs.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-apache-maven-for-use-with-github-packages
95140

96141

97-
OpenSSF Security Scorecard
142+
### OpenSSF Security Scorecard
98143
- Get Analysis Result: https://api.securityscorecards.dev/#/results/getResult
99144
- Step Security - Secure Your Repo Analysis + auto PR - https://app.stepsecurity.io/securerepo
100145
- Step Security - For Repo - https://app.stepsecurity.io/github/cdimascio/actions/dashboard
146+

0 commit comments

Comments
 (0)
Please sign in to comment.