From 6f7e549e67bb25f0cca7dba675c7453a724938b8 Mon Sep 17 00:00:00 2001 From: karel-rehor Date: Thu, 17 Sep 2026 15:04:45 +0200 Subject: [PATCH 01/17] ci: github action for automated releasing to stage (#445) * ci: start maven-release.yml workflow * chore: remove branches tag on release trigger * chore: add here doc for generating release.properties * chore: fix typo * chore: update pom.xml and deploy-settings.xml for fork. * chore: add simple volume check to workflow * chore: add release command to model release step * chore: reintroduce verify step to maven0release.yml workflow * docs: start RELEASE.md * docs: document gpg2 key generation in RELEASE.md. * chore: reintroduce checks in scripts/on-release.sh * docs: update temporary notes in CHANGELOG.md * chore: fix file permissions for on-release.sh * docs: temporary change to release date - for testing workflow. * docs: temporary update toe README.md to test workflow. * chore: set correct scm version an update RELEASE.md * chore: add scm/tag value check to on-release.sh * chore: fix dropped variable in on-release.sh * chore: temporarily change scm tag to test workflow failure. * chore: revert scm tag in pom.xml after workflow test proven correct. * chore: start workflow step Prepare next cycle. * chore: get correct TAG_NAME envar in workflow script. * chore: set next release cycle branch * chore: fix broken variable string in script. * chore: temporarily add debugging checks to workflow script. * chore: add automatic update to CHANGELOG.md in workflow. * chore: use correct envar in workflow script. * chore: fix formatting of next release CHANGELOG.md header * chore: setup automated git commands for next release cycle. * chore: setup github identity in release workflow prepare next cycle. * chore: fix push to origin in workstream Prepare next cycle. * chore: fix origin repository in workflow Prepare next release cycle. * chore: setup automatic PR for new release cycle. * chore: update permissions to allow creation of PR. * chore: remove automatic PR merge command - requires permission changes at org and project level to work. * chore: add site documentation update step. Update RELEASE.md * chore: add checks and updates to examples/pom.xml * chore: temporarily change examples dependency version to verify workflow. * chore: fix typo * chore: tidy maven-release.yml * chore: add check for remote next release branch. * docs: updated and proofed RELEASE.md * chore: clarify error message. * docs: add Maven Central step to releasing instructions. * chore: remove debug messages from on-release.sh * chore: remove debug messages from maven-release.yml * chore: troubleshoot document releasing step * chore: troubleshoot site publishing issue 02 * chore: troubleshoot site publishing - set to global. * chore: revert pubScmUrl - troubleshoot site publishing step. * chore: troubleshoot sit publishing 03 * chore: modify pubScmUrl to troubleshoot site publishing * chore: troubleshoot site publishing 05 * chore: revert troubleshoot changes * chore: troubleshoot site publishing 06 * chore: troubleshoot publish site documents. * chore: fix typo * chore: troubleshoot site document releasing 07 * chore: troubleshoot site documentation 08 * chore: troubleshoot publish sit documentation 09 * chore: troubleshoot publish sit documentation 10 * chore: troubleshoot publish sit documentation 11 * chore: troubleshoot publish sit documentation 12 * chore: troubleshoot publish sit documentation 13 * chore: troubleshoot publish sit documentation 14 * chore: troubleshoot publish sit documentation 15 * chore: troubleshoot publish sit documentation 16 * chore: troubleshoot publish sit documentation 17 * chore: troubleshoot publish sit documentation 18 * chore: remove debug commands from Publish documentation step. * chore: experim - try automatic PR creation. * chore: experim - try to create new PR 02 * chore: switch off automatic PR creation, requires special permissions. * chore: reactivate branch controls for prerelease. * chore: add env checks for matching scm values. * chore: fix path in script. * chore: remove debug of script ENV. * chore: remove commented nodes from pom.xml * docs: update RELEASE.md to match current workflow. * chore: remove unnecessary commands from workflow. * chore: prepare automated releasing branch for PR to upstream. * chore: remove experimental permissions from release workflow. * docs: update CHANGELOG.md * docs: lint fixes for RELEASE.md * docs: fix linting issues in RELEASE.md * docs: fixing lint issues in RELEASE.md 02 * docs: fix typos in RELEASE.md * chore: fixing lint issues in on-release.sh * chore: fix lint issues in maven-release.yml * chore: fix linter issue in maven-release.yml * chore: revise pom version values to match upstream HEAD. * docs: anonymize commands in RELEASE.md * chore: fix typo in on-releas.sh, add reminder to check RC_OR_BETA tagged releases. * chore: fix flaws in workflow and bash scripts. * chore: use more meaningful user.email in workflow. * chore: use current shell when calling on-release.sh in workflow * chore: fix RC or BETA release tag checks. * chore: update trigger, fix snapshot credentials, verify workfow envars. * chore: remove TODO and set RC_OR_BETA envar * chore: fix typos add TODOs for fixes in on-release.sh * chore: improve checks in on-release.sh * chore: better control sequencing, better checks in workflow. * chore: fine tune release workflow and script. * chore: remove snapshot checks, revert workflow check for next working snapshot branch. * chore: fine tune behavior for patch releases. * chore: update CHANGELOG.md, fix double negative and failure message. * chore: check gradle tag version in README.md * docs: clarify behavior of pre-release, beta/rc releases and patch releases in RELEASE.md. * chore: fix typo in ENVAR name and remove trim of release number. * chore: various updates to on-release.sh * chore: correct fix for on-release.sh * chore: script and doc tweaks. * chore: fix capitalization in user facing messages. * chore: fix capitalization in messages in workflow. * docs: add reminder about Gradle in RELEASE.md --- .github/workflows/maven-release.yml | 248 ++++++++++++++++++++++++++ CHANGELOG.md | 4 + RELEASE.md | 260 ++++++++++++++++++++++++++++ pom.xml | 29 ++-- scripts/on-release.sh | 244 ++++++++++++++++++++++++++ 5 files changed, 770 insertions(+), 15 deletions(-) create mode 100644 .github/workflows/maven-release.yml create mode 100644 RELEASE.md create mode 100755 scripts/on-release.sh diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml new file mode 100644 index 00000000..f0e89b9e --- /dev/null +++ b/.github/workflows/maven-release.yml @@ -0,0 +1,248 @@ +name: Maven Releasing + +on: + + release: + types: [published] + +jobs: + release: + permissions: + contents: write # may want to update version + runs-on: ubuntu-latest + env: + SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} + SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} + MAVEN_SETTINGS_EXPERIM: ${{ vars.MAVEN_SETTINGS_FILE }} + GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} + RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} + IS_PRERELEASE: ${{ github.event.release.prerelease }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_REPO: ${{ github.repository }} + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Setup JDK 21 + uses: actions/setup-java@v5 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} + - name: Add dependencies + run: | + sudo apt-get update + sudo apt-get -y install libxml2-utils + - name: Verify Env + run: | + if [[ -z "${{ secrets.GPG_PRIVATE_KEY }}" ]] + then + echo "ERROR GPG_PRIVATE_KEY is missing." + exit 1 + fi + # ensure scm properties match current project - don't want to modify other repository inadvertently + POM_SITE_URL=$(xmllint --xpath "//*[local-name()='distributionManagement']/*[local-name()='site']/*[local-name()='url']/text()" ./pom.xml) + POM_SCM_CONNECTION=$(xmllint --xpath "//*[local-name()='scm']/*[local-name()='connection']/text()" ./pom.xml) + POM_SCM_DEVELOPER_CONNECTION=$(xmllint --xpath "//*[local-name()='scm']/*[local-name()='developerConnection']/text()" ./pom.xml) + + if [[ "${POM_SITE_URL}" != "scm:git:https://github.com/${GITHUB_REPOSITORY}" ]] + then + echo "POM_SITE_URL ${POM_SITE_URL} does not match GITHUB_REPOSITORY ${GITHUB_REPOSITORY}" + exit 1 + else + echo "POM_SITE_URL OK ✓." + fi + + if [[ ! "${POM_SCM_CONNECTION}" =~ .*${GITHUB_REPOSITORY}\.git$ ]] + then + echo "POM_SCM_CONNECTION ${POM_SCM_CONNECTION} does not match GITHUB_REPOSITORY ${GITHUB_REPOSITORY}" + exit 1 + else + echo "POM_SCM_CONNECTION OK ✓." + fi + + if [[ ! "${POM_SCM_DEVELOPER_CONNECTION}" =~ .*${GITHUB_REPOSITORY}\.git$ ]] + then + echo "POM_SCM_DEVELOPER_CONNECTION ${POM_SCM_DEVELOPER_CONNECTION} does not match GITHUB_REPOSITORY ${GITHUB_REPOSITORY}" + exit 1 + else + echo "POM_SCM_DEVELOPER_CONNECTION OK ✓." + fi + + if [[ -n "$SONATYPE_USERNAME" ]] + then + echo "have SONATYPE_USERNAME" + else + echo "Release requires SONATYPE_USERNAME, which was not found. exiting" + exit 1 + fi + + if [[ -n "$SONATYPE_PASSWORD" ]] + then + echo "have SONATYPE_PASSWORD" + else + echo "Release requires SONATYPE_PASSWORD, which was not found. exiting" + exit 1 + fi + + if [[ -n "$GPG_PASSPHRASE_PRELIM" ]] + then + echo "have GPG_PASSPHRASE_PRELIM" + else + echo "Release requires GPG_PASSPHRASE, which was not found. exiting" + exit 1 + fi + + if [[ "$GPG_PASSPHRASE_PRELIM" == "EMPTY" ]] + then + echo "GPG_PASSPHRASE empty requested" + export GPG_PASSPHRASE="" + else + export GPG_PASSPHRASE="$GPG_PASSPHRASE_PRELIM" + fi + + echo "GPG_PASSPHRASE=${GPG_PASSPHRASE}" >> "$GITHUB_ENV" + + # Verify GPG2 environment + if ! command -v gpg2 &> /dev/null + then + echo "Failed to locate gpg2 on this host. GPG2 is required to continue." + exit 1 + fi + + gpg2 --version + GPG_EXECUTABLE=$(command -v gpg2) + export GPG_EXECUTABLE + echo "GPG_EXECUTABLE=${GPG_EXECUTABLE}" >> "$GITHUB_ENV" + + # Verify tag and next version + if ! echo "${RELEASE_TAG_NAME}" | grep -Ei '^v[0-9]+\.[0-9]+\.[0-9]+(-(rc|beta)[0-9]*)?$' + then + echo "RELEASE_TAG_NAME ${RELEASE_TAG_NAME} does not match expected pattern, e.g. (v1.9.0). Exiting." + exit 1 + fi + VERSION_CLEAN="${RELEASE_TAG_NAME:1}" + # shellcheck disable=SC2206 + PARTS=(${VERSION_CLEAN//./ }) + # TODO Check if PARTS[2] starts with 0 or [1-9] if not 0 then this is hot release and should not trigger publishing + if ! echo "${PARTS[2]}" | grep -q "^0.*" + then + echo "Detected hot fix release ${RELEASE_TAG_NAME}" + echo "IS_HOT_FIX=true" >> "${GITHUB_ENV}" + fi + NEW_MINOR=$((PARTS[1]+1)) + NEXT_RELEASE="${PARTS[0]}.${NEW_MINOR}.0" + echo "NEXT_RELEASE=${NEXT_RELEASE}" >> "${GITHUB_ENV}" + NEXT_RELEASE_BRANCH="ci/next-cycle-${NEXT_RELEASE}" + git config user.email "${GITHUB_ACTOR}@users.noreply.github.com" + git config user.name "${GITHUB_ACTOR}" + + if [[ "${IS_PRERELEASE}" != "true" && "${RELEASE_TAG_NAME,,}" =~ ^v[0-9]+\.[0-9]+\.0$ ]] + then + BRANCH_CHECK=$(git ls-remote --heads origin "refs/heads/${NEXT_RELEASE_BRANCH}") + if [ -n "${BRANCH_CHECK}" ] + then + echo "branch ${NEXT_RELEASE_BRANCH} already exists in project. Cannot recreate it automatically." + echo "If you wish to use this automatically created branch, please delete the existing branch and start the release again" + exit 1 + fi + else + echo "Skipping next release cycle branch check because this is either a pre-release or a patch fix." + fi + + echo "NEXT_RELEASE_BRANCH=${NEXT_RELEASE_BRANCH}" >> "$GITHUB_ENV" + + - name: Script + run: | + . ./scripts/on-release.sh + echo "RC_OR_BETA=${RC_OR_BETA}" >> "$GITHUB_ENV" + - name: Release + run: | + if [[ "${IS_PRERELEASE}" == "true" ]]; then + echo "This is a pre release and will not be deployed to Maven Central." + exit 0 + fi + if [[ "${RC_OR_BETA}" == "true" ]] + then + echo "This is an RC or BETA release and will not be deployed to Maven Central." + exit 0 + fi + cat << EOF > release.properties + scm.url=scm\:git\:https\://github.com/${GITHUB_REPOSITORY}.git + scm.tag=${RELEASE_TAG_NAME} + EOF + cat release.properties + mvn release:perform \ + -Dgoals=deploy \ + -s ./deploy-settings.xml \ + -Darguments="-DskipTests -DskipITs -DperformRelease=true" + - name: Prepare next cycle + run: | + if [[ "${IS_PRERELEASE}" == "true" ]]; then + echo "This is a prerelease so the next release cycle will not be prepared." + exit 0 + fi + if [[ "${RC_OR_BETA}" == "true" ]] + then + echo "This is an RC or BETA release so next release cycle will not be prepared." + exit 0 + fi + if [[ "${IS_HOT_FIX}" == "true" ]] + then + echo "This is a hot fix release ${RELEASE_TAG_NAME}, so next release cycle will not be prepared." + exit 0 + fi + + echo "Preparing next release cycle" + + git config user.email "${GITHUB_ACTOR}@users.noreply.github.com" + git config user.name "${GITHUB_ACTOR}" + echo "checking out next release branch ${NEXT_RELEASE_BRANCH}" + git checkout -b "${NEXT_RELEASE_BRANCH}" + mvn versions:set-scm-tag -DnewTag="HEAD" + mvn versions:set -DnextSnapshot=true -DnextSnapshotIndexToIncrement=1 + sed -i "1s/^/## ${NEXT_RELEASE} [unreleased]\n\n/" CHANGELOG.md + sed -i -e "s/${RELEASE_TAG_NAME:1}<\/version>/${NEXT_RELEASE}-SNAPSHOT<\/version>/" examples/pom.xml + git add pom.xml examples/pom.xml CHANGELOG.md + git commit -m "ci: setting up release cycle ${NEXT_RELEASE}" + git push --set-upstream origin "${NEXT_RELEASE_BRANCH}" + # The following requires special permissions on the organizational and project level to work. Switching off for now. + # gh pr create -B main -H ${NEXT_RELEASE_BRANCH} --title "Merge ${NEXT_RELEASE_BRANCH} into main" --body 'Created by GitHub action' + # The alternative is to create the PR by hand + echo "The branch ${NEXT_RELEASE_BRANCH} has been created. You can create and merge a PR manually from it to start the next release cycle." + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Publish documentation + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + if [[ "${IS_PRERELEASE}" == "true" ]]; then + echo "This is a pre release, so site documentation will not be updated to GitHub pages." + exit 0 + fi + if [[ "${RC_OR_BETA}" == "true" ]] + then + echo "This is an RC or BETA release, so site documentation will not be updated to GitHub pages." + exit 0 + fi + if [[ "${IS_HOT_FIX}" == "true" ]] + then + echo "This is a hot fix release ${RELEASE_TAG_NAME}, so site documentation will not be updated to GitHub pages." + exit 0 + fi + cat << EOF > scm-settings.xml + + + + github + x-access-token + ${GITHUB_TOKEN} + + + + EOF + git config --global user.email "${GITHUB_ACTOR}@noreply.github.com" + git config --global user.name "GitHub Action" + git checkout "${RELEASE_TAG_NAME}" + mvn clean site site:stage -DskipTests + mvn -s scm-settings.xml --batch-mode scm-publish:publish-scm -Dscmpublish.serverId=github diff --git a/CHANGELOG.md b/CHANGELOG.md index ce56bab6..8c21be99 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ ## 1.12.0 [unreleased] +### CI + +1. [#445](https://github.com/InfluxCommunity/influxdb3-java/pull/445): Sets up automated releasing to Maven Central + ## 1.11.0 [2026-08-27] ### Breaking Changes diff --git a/RELEASE.md b/RELEASE.md new file mode 100644 index 00000000..fae015e2 --- /dev/null +++ b/RELEASE.md @@ -0,0 +1,260 @@ +## Releasing + +This document contains a general description and tips for releasing Influxdb3-java using GitHub Actions with the ultimate goal of pushing the release to Maven Central. + +### Overview + +Releasing involves three general steps. + +1. Preparing the release in a new release branch +2. Triggering the automatic release by creating a new tag and release in GitHub. +3. Preparing the next release cycle by merging the next release branch created by the automated release script back into `main`. + +### Preparing the release + +1. from `main` create a new release branch, e.g. `git checkout -b chore/release-1.12.0` +1. In the new branch, update the version settings in `pom.xml` + + ```bash + $ mvn versions:set -DremoveSnapshot=true + ... + [INFO] Scanning for projects... + [INFO] + [INFO] --------------------< com.influxdb:influxdb3-java >--------------------- + [INFO] Building InfluxDB 3 Java Client 1.12.0 + [INFO] --------------------------------[ jar ]--------------------------------- + ... + $ mvn versions:set-scm-tag -DnewTag="v1.12.0" + ... + [INFO] --- versions-maven-plugin:2.21.0:set-scm-tag (default-cli) @ influxdb3-java --- + [INFO] Updating tag: HEAD -> v1.12.0 + [INFO] ------------------------------------------------------------------------ + [INFO] BUILD SUCCESS + [INFO] ------------------------------------------------------------------------ + ... + ``` + +1. In `README.md` update the `` tag value in the Maven dependency example and the `dependency:implementation` version in the Gradle dependency example. +1. In `CHANGELOG.md` verify all commit information for the current cycle is up-to-date, fix any discrepancies, then update the date for this release to the current date. +1. In `examples/pom.xml` update the version of the Influxdb3-java dependency to the version to be released. +1. Commit and push these changes to GitHub. + +### Initiating the release + +In GitHub `influxCommunity/influxdb3-java`... + +1. In the project home page open the _Releases_ section. +1. Click _Draft a new release_ +1. In the _Target_ dropdown check the new release branch. +1. In the _Tag_ dropdown click `Create new tag`, supply the tag matching the value added in the `set-scm-tag` command above. Note that the tag should be prefixed with the letter _v_. Click _Create_. +1. In the _Release title_ text control set the title to match the `` tag in `pom.xml`. +1. In the _Release notes_ text field copy changes added since the last release from `CHANGELOG.md`. +1. If this is a pre-release check the _pre-release_ radio button. +1. Click `Publish release`. + +- Note that for "pre-release" and "-rc*" or "-beta*" releases the release workflow will not automatically publish modules to Maven Central, will not automatically publish site documentation and will not automatically prepare the next release cycle. The _pre-release_ setting can be useful for debugging the workflow. +- Note that patch releases (e.g. `1.11.1`) will be uploaded to Maven Central, but will not automatically publish site documentation, nor will they automatically prepare the next release cycle. + +The creation of the new release will trigger the `maven-release.yml` workflow. It will: + +1. Verify required secrets and environment variables are set, and that SCM values in `pom.xml` match the repository from which the release is being triggered. +1. Check that the `pom.xml` version matches the release tag and that versioning references in documentation and examples are up-to-date and valid. +1. Check and sign the build. +1. Upload the archives and pom files to Maven Central. +1. Publish site documentation to [GitHub Pages](https://github.com/influxcommunity/influxdb3-java/tree/gh-pages) +1. prepare the `pom.xml` and `CHANGELOG.md` files for the next release cycle and push them to a new branch named `ci/next-cycle-`. + +### Publish release in Maven Central + +From the Maven Central account, review and publish the release to make it available to the public or drop it if the release workflow failed or if there are discrepancies in the files to be published. + +### Preparing the next release cycle + +A new branch `ci/next-cycle-` with an updated `pom.xml` file will have been created when the Maven Release action completes successfully. + +1. create a PR from the branch `ci/next-cycle-` to merge it into `main`. +2. review the PR and if everything has been generated correctly, squash and merge it. + +## The Release environment + +The release workflow is managed by `.github/workflows/maven-release.yml`. In order for the release workflow to succeed a number of environment secrets need to be set in the project. It may be necessary to update these in the future. + +- `GPG_PASSPHRASE` - password for the key used to sign archives and pom files to be uploaded to Maven Central. See _Generating a new GPG signing key_ below. +- `GPG_PRIVATE_KEY` - private key associated with public key pulled from a GPG repository and used to sign archives and pom files. +- `SONATYPE_PASSWORD` - password for the user account used to upload archives and pom files to Maven Central. +- `SONATYPE_USERNAME` - name of user account used to upload archives and pom files to Maven Central. + +### Addenda + +#### Generating a new GPG signing key + +1. Generate a random password for the key. + + e.g. On a Linux box... + + ```bash + $ head -c 6 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9+-' + jEtkLlyG + ``` + + Store this somewhere safe. + +1. Generate a key with a passphrase and no expiration. Note you will be required to enter the passphrase from above. + + ```bash + $ gpg --batch --quick-generate-key "your-user-name@users.noreply.github.com" default default never + gpg: revocation certificate stored as '/home//.gnupg/openpgp-revocs.d/REDACTED_KEY_ID.rev' + ``` + +1. Verify key. + + ```bash + $ gpg --list-keys + gpg: checking the trustdb + gpg: marginals needed: 3 completes needed: 1 trust model: pgp + gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u + /home//.gnupg/pubring.kbx + ----------------------------- + pub ed25519 2026-09-03 [SC] + REDACTED_KEY_ID + uid [ultimate] your-user-name@users.noreply.github.com + sub cv25519 2026-09-03 [E] + ``` + +1. Distribute the key. + + ```bash + $ gpg2 --keyserver keyserver.ubuntu.com --send-keys REDACTED_KEY_ID + gpg: sending key REDACTED to hkp://keyserver.ubuntu.com + ``` + +1. Verify key is on remote. Note, that it may take a few minutes to be registered. + + ```bash + $ gpg2 --keyserver keyserver.ubuntu.com --search-keys REDACTED_KEY_ID + gpg: data source: http://185.125.188.27:11371 + (1) your-user-name@users.noreply.github.com + 263 bit EDDSA key REDACTED, created: 2026-09-03 + Keys 1-1 of 1 for "REDACTED_KEY_ID". Enter number(s), N)ext, or Q)uit > 1 + gpg: key REDACTED: "your-user-name@users.noreply.github.com" not changed + gpg: Total number processed: 1 + gpg: unchanged: 1 + ``` + +1. Get the secret key associated with this key. It will need to be copied then pasted to the GitHub project secret GPG_PRIVATE_KEY. Note you will be prompted for the passphrase. + + ```bash + $ gpg2 --export-secret-keys --armor REDACTED_KEY_ID + -----BEGIN PGP PRIVATE KEY BLOCK----- + + ...REDACTED... + + -----END PGP PRIVATE KEY BLOCK----- + ``` + +#### Revoking a compromised GPG2 key + +1. verify that the key is on the local server. + + ```bash + $ gpg2 --list-keys + /home//.gnupg/pubring.kbx + ----------------------------- + pub ed25519 2026-07-27 [SC] [expires: 2029-07-26] + KEY_ID_REDACTED + uid [ultimate] your_user_name@users.noreply.github.com + sub REDACTED 2026-07-27 [E] + + ``` + + or... + + ```bash + $ gpg2 --list-keys KEY_ID_REDACTED + pub ed25519 2026-07-27 [SC] [expires: 2029-07-26] + KEY_ID_REDACTED + uid [ultimate] your-user-name@users.noreply.github.com + sub REDACTED 2026-07-27 [E] + ``` + +1. Verify that the key is on the remote server. + + ```bash + $ gpg2 --keyserver keyserver.ubuntu.com --search-keys KEY_ID_REDACTED + gpg: data source: http://185.125.188.27:11371 + (1) your-user-name@users.noreply.github.com + 263 bit EDDSA key REDACTED, created: 2026-07-27 + Keys 1-1 of 1 for "KEY_ID_REDACTED". Enter number(s), N)ext, or Q)uit > 1 + gpg: key REDACTED: "your-user-name@users.noreply.github.com" not changed + gpg: Total number processed: 1 + gpg: unchanged: 1 + ``` + +1. Create a revocation request locally. + + ```bash + $ gpg2 --output revoke-.asc --gen-revoke KEY_ID_REDACTED + ... + ``` + +1. Revoke the key locally. + + ```bash + $ gpg2 --import revoke-.asc + gpg: key REDACTED: "your-user-name@users.noreply.github.com" revocation certificate imported + gpg: Total number processed: 1 + gpg: new key revocations: 1 + gpg: marginals needed: 3 completes needed: 1 trust model: pgp + gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u + gpg: next trustdb check due at 2029-07-26 + ``` + +1. Verify revocation succeeded. + + ```bash + $ gpg2 --list-keys + /home//.gnupg/pubring.kbx + ----------------------------- + pub ed25519 2026-07-27 [SC] [revoked: 2026-09-03] + KEY_ID_REDACTED + uid [ revoked] your-user-name@users.noreply.github.com + ``` + +1. Push change of key state to remote server. + + ```bash + $ gpg2 --keyserver keyserver.ubuntu.com --send-keys KEY_ID_REDACTED + gpg: sending key REDACTED to hkp://keyserver.ubuntu.com + ``` + +1. Verify key state on remote server. + + ```bash + $ gpg2 --keyserver keyserver.ubuntu.com --search-keys KEY_ID_REDACTED + gpg: data source: http://185.125.188.27:11371 + gpg: key "KEY_ID_REDACTED" not found on keyserver + ``` + +1. Delete secret key locally. + + ```bash + $ gpg2 --delete-secret-key KEY_ID_REDACTED + ... + # Confirmation required + ``` + +1. Delete key locally + + ```bash + $ gpg2 --delete-key 01EAECEC736391172C6520F48B5778484117B952 + ... + # Confirmation required + ``` + +1. Verify key is deleted + + ```bash + $ gpg2 --list-keys + gpg: checking the trustdb + gpg: no ultimately trusted keys found + ``` diff --git a/pom.xml b/pom.xml index e68d9732..9a2098ce 100644 --- a/pom.xml +++ b/pom.xml @@ -64,8 +64,8 @@ - scm:git:git@github.com:InfluxCommunity/influxdb3-java.git - scm:git:git@github.com:InfluxCommunity/influxdb3-java.git + scm:git:https://github.com/InfluxCommunity/influxdb3-java.git + scm:git:https://github.com/InfluxCommunity/influxdb3-java.git https://github.com/InfluxCommunity/influxdb3-java/tree/main HEAD @@ -81,7 +81,7 @@ GitHubPages - https://InfluxCommunity.github.io/influxdb3-java/ + scm:git:https://github.com/InfluxCommunity/influxdb3-java @@ -408,6 +408,12 @@ + + org.apache.maven.plugins + maven-release-plugin + 3.3.1 + + org.apache.maven.plugins maven-checkstyle-plugin @@ -632,11 +638,8 @@ maven-scm-publish-plugin 3.3.0 - target/staging - scm:git:git@github.com:InfluxCommunity/influxdb3-java.git - ${project.basedir}/../influxdb3-scmpublish-checkout + ${project.build.directory}/scm-publish gh-pages - UTF-8 @@ -749,20 +752,16 @@ - org.sonatype.plugins - nexus-staging-maven-plugin - 1.7.0 + org.sonatype.central + central-publishing-maven-plugin + 0.9.0 true - ossrh - https://ossrh-staging-api.central.sonatype.com/ - true - 15 + ossrh - diff --git a/scripts/on-release.sh b/scripts/on-release.sh new file mode 100755 index 00000000..b7b6ba9b --- /dev/null +++ b/scripts/on-release.sh @@ -0,0 +1,244 @@ +#!/usr/bin/env bash +# +# The MIT License +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +# THE SOFTWARE. +# + +set -e + +echo "Starting ${0}" + +if [ -z "${GITHUB_ACTIONS}" ] +then + echo "This script can only be run in a GitHub action container." + echo "Local runs are not yet supported." + exit 1 +fi +SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +PROJECT_DIR="${SCRIPT_DIR}/.." +CHANGELOG_PATH="${PROJECT_DIR}/CHANGELOG.md" +README_PATH="${PROJECT_DIR}/README.md" +POM_XML_PATH="${PROJECT_DIR}/pom.xml" +EXAMPLE_POM_XML_PATH="${PROJECT_DIR}/examples/pom.xml" + +RELEASE_NUM="" +RC_OR_BETA=false + +FAILURE_BOILERPLATE="Please delete the tag ${RELEASE_TAG_NAME} and the related release, and start again." + +github_check(){ + + if [ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]; then + echo "WARNING: This script is targeted for 'release' not ${GITHUB_EVENT_NAME}." + echo "Continuing for debugging." + return + fi + + if [ "${GITHUB_EVENT_NAME}" == "push" ]; then + RELEASE_TAG_MATCH="^v[0-9]+(\.[0-9]+){2}(-(rc|beta)[0-9]+)?$" + echo "WARNING: this script is targeted for 'release' not ${GITHUB_EVENT_NAME}" + + if [[ "$GITHUB_REF_NAME" =~ $RELEASE_TAG_MATCH ]]; then + echo "Detected matching tag value in GITHUB_REF_NAME (${GITHUB_REF_NAME}). Continuing for debugging purposes." + RELEASE_TAG_NAME="${GITHUB_REF_NAME}" + return + else + printf 'GITHUB_REF_NAME=%s failed to match valid release tag pattern.\n' "${GITHUB_REF_NAME}" + exit 1 + fi + fi + + if [ "${GITHUB_EVENT_NAME}" != "release" ]; then + echo "This script can run only on 'release'. Detected GitHub event ${GITHUB_EVENT_NAME}." + exit 1 + fi + + if ! echo "${RELEASE_TAG_NAME}" | grep -Ei '^v[0-9]+\.[0-9]+\.[0-9]+(-(rc|beta)[0-9]*)?$' + then + echo "This script requires a valid release tag (e.g. v1.9.0), but RELEASE_TAG_NAME=${RELEASE_TAG_NAME} was found." + exit 1 + fi + + echo "Running ${GITHUB_EVENT_NAME} with tag ${RELEASE_TAG_NAME}." +} + +setup(){ + ADDITIONAL_INSTALLS="" + if ! [ -x "$(command -v xmllint)" ] + then + ADDITIONAL_INSTALLS="${ADDITIONAL_INSTALLS} libxml2-utils" + else + printf "have xmllint\n" + fi + + if [ -n "${ADDITIONAL_INSTALLS}" ] + then + printf "This script requires the following unavailable libraries: %s\n" "${ADDITIONAL_INSTALLS}" + printf "Please install them and then continue.\n" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + else + printf "Additional requirements already satisfied.\n" + fi +} + +set_release_number(){ + RELEASE_NUM=$(echo "${RELEASE_TAG_NAME}" | sed -r "s/^v//" | sed -r "s/-(rc|beta)[0-9]*//i" ) +} + +verify_rc_or_beta(){ + LOWER_TAG_NAME=$(echo "${RELEASE_TAG_NAME}" | tr '[:upper:]' '[:lower:]') + if echo "${LOWER_TAG_NAME}" | grep -q "rc\|beta" + then + RC_OR_BETA=true + fi +} + +verify_changelog() { + + CHANGELOG_RELEASE_HEADERS=$(sed -n '/^#.*[0-9].[0-9]*.[0-9].*/p' "${CHANGELOG_PATH}") + + mapfile -t HEADER_ARRAY <<< "$CHANGELOG_RELEASE_HEADERS" + + mapfile -td ' ' HEADER_LINE <<< "${HEADER_ARRAY[0]}" + + HEADER_TAG="${HEADER_LINE[1]}" + HEADER_DATE="${HEADER_LINE[2]:1:-2}" + + if [ "$HEADER_TAG" != "$RELEASE_NUM" ]; then + printf "ERROR: Latest HEADER_TAG in CHANGELOG.md (%s) does not match release number (%s) from git tag (%s)\n" \ + "$HEADER_TAG" \ + "$RELEASE_NUM" \ + "$RELEASE_TAG_NAME" + printf "Please update the latest HEADER_TAG in CHANGELOG.md\n" + printf "%s" "${FAILURE_BOILERPLATE}" + exit 1 + else + printf "CHANGELOG.md release number check: OK ✓\n" + fi + + if ! date --date="${HEADER_DATE}" + then + printf "ERROR invalid commit date (%s) in last CHANGELOG.md entry\n" "$HEADER_DATE" + printf "Please update the commit date in CHANGELOG.md\n" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + else + printf "CHANGELOG.md release date check: OK ✓\n" + fi +} + +verify_version(){ + printf "verifying version\n" + PROJECT_VERSION=$(xmllint --xpath "//*[local-name()='project']/*[local-name()='version']/text()" "${POM_XML_PATH}") + printf "Project version from pom.xml is %s\n" "${PROJECT_VERSION}" + + if [[ "${PROJECT_VERSION}" == *SNAPSHOT ]] + then + printf "Version in %s (%s) is a snapshot.\n" "${POM_XML_PATH}" "${PROJECT_VERSION}" + printf "This script does not release snapshots.\n" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + fi + + if [ "${PROJECT_VERSION}" != "${RELEASE_NUM}" ] + then + printf "PROJECT_VERSION %s in pom.xml does not match tag %s" "${PROJECT_VERSION}" "${RELEASE_TAG_NAME}" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + fi + + printf "pom.xml project version (%s) checks with release tag (%s): OK ✓\n" "${PROJECT_VERSION}" "${RELEASE_TAG_NAME}" + + SCM_TAG=$(xmllint --xpath "//*[local-name()='project']/*[local-name()='scm']/*[local-name()='tag']/text()" "${POM_XML_PATH}") + + if [ "${SCM_TAG}" != "${RELEASE_TAG_NAME}" ] + then + printf "SCM_TAG %s in pom.xml does not match tag %s" "${SCM_TAG}" "${RELEASE_TAG_NAME}" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + fi + +} + +verify_example_pom(){ + EXAMPLE_DEPENDENCY_VERSION=$(xmllint --xpath "//*[local-name()='dependencies']/*[local-name()='dependency']/*[local-name()='version']/text()" "${EXAMPLE_POM_XML_PATH}") + if [ "${RELEASE_NUM}" != "${EXAMPLE_DEPENDENCY_VERSION}" ] + then + printf "Example dependency version %s does not match the release number %s\n" "${EXAMPLE_DEPENDENCY_VERSION}" "${RELEASE_NUM}" + printf "Please update the project dependency version in %s\n" "${EXAMPLE_POM_XML_PATH}" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + fi +} + +verify_readme(){ + printf "Verifying README %s\n" "${README_PATH}" + README_NODE_RAW="$(sed -n "/.*<\/version>/p" "${README_PATH}")" + + if [ -z "${README_NODE_RAW}" ] + then + printf "Example in %s with tag not found.\n" "${README_PATH}" + printf "The %s file should include an example with the current release version.\n" "${README_PATH}" + printf "Exiting...\n" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + fi + + README_NODE="${README_NODE_RAW#"${README_NODE_RAW%%[![:space:]]*}"}" + README_VERSION="$(echo "${README_NODE}" | sed "s///" | sed "s/<\/version>//")" + + if [ "${RELEASE_NUM}" != "${README_VERSION}" ] + then + VERSION_LINE=$(grep -n ".*" "${README_PATH}" | awk -F '[:]' '{ print $1 }') + printf "Release tag (%s) does not match example in README.md (%s) on line %s.\n" "${RELEASE_NUM}" "${README_VERSION}" "${VERSION_LINE}" + printf "Please update README.md to the current release before continuing.\n" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + fi + + printf "Version in README.md (%s) OK ✓.\n" "${README_VERSION}" + + GRADLE_GROOVY_RELEASE="$(grep "implementation \"com.influxdb:influxdb3-java:" "${README_PATH}" | grep -o "[0-9]*\.[0-9]*\.[0-9]*")" + + if [ "${RELEASE_NUM}" != "${GRADLE_GROOVY_RELEASE}" ] + then + GROOVY_LINE=$(grep -n "implementation \"com.influxdb:influxdb3-java:" "${README_PATH}" | awk -F '[:]' '{ print $1 }') + printf "Release tag (%s) does not match gradle example in README.md (%s) on line %s.\n" "${RELEASE_NUM}" "${GRADLE_GROOVY_RELEASE}" "${GROOVY_LINE}" + printf "Please update README.md to the current release before continuing.\n" + printf "%s\n" "${FAILURE_BOILERPLATE}" + exit 1 + fi +} + +echo "Running in GitHub Actions container." + +setup + +github_check + +verify_rc_or_beta +export RC_OR_BETA +set_release_number + +verify_changelog +verify_example_pom +verify_readme +verify_version From 6b070df1e42546cb401b97c2d1d968b2ac9fcba4 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Fri, 18 Sep 2026 10:18:14 +0200 Subject: [PATCH 02/17] chore: replace ossrh references with maven central. --- deploy-settings.xml | 4 ++-- pom.xml | 9 +++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/deploy-settings.xml b/deploy-settings.xml index f3761fc5..0acec203 100644 --- a/deploy-settings.xml +++ b/deploy-settings.xml @@ -25,7 +25,7 @@ xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.1.0 http://maven.apache.org/xsd/settings-1.1.0.xsd"> - ossrh + central ${env.SONATYPE_USERNAME} ${env.SONATYPE_PASSWORD} @@ -33,7 +33,7 @@ - ossrh + central true diff --git a/pom.xml b/pom.xml index 9a2098ce..b6bab1e0 100644 --- a/pom.xml +++ b/pom.xml @@ -72,12 +72,13 @@ - ossrh + central https://central.sonatype.com/repository/maven-snapshots/ - ossrh - https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/ + central + Central Portal + https://central.sonatype.com/api/v1/publisher GitHubPages @@ -757,7 +758,7 @@ 0.9.0 true - ossrh + central From 6f4b4df439be41ad45a1ab67c1326f39f545bbb5 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Fri, 18 Sep 2026 10:41:49 +0200 Subject: [PATCH 03/17] chore: prioritize pom version checks in on-release.sh --- scripts/on-release.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/on-release.sh b/scripts/on-release.sh index b7b6ba9b..624e12fb 100755 --- a/scripts/on-release.sh +++ b/scripts/on-release.sh @@ -238,7 +238,7 @@ verify_rc_or_beta export RC_OR_BETA set_release_number +verify_version verify_changelog verify_example_pom verify_readme -verify_version From 471133facfe73b506f0c2f5c8e01ff298f78ab91 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Fri, 18 Sep 2026 10:56:04 +0200 Subject: [PATCH 04/17] chore: add CRLF to error message. --- scripts/on-release.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/on-release.sh b/scripts/on-release.sh index 624e12fb..fea72171 100755 --- a/scripts/on-release.sh +++ b/scripts/on-release.sh @@ -171,7 +171,7 @@ verify_version(){ if [ "${SCM_TAG}" != "${RELEASE_TAG_NAME}" ] then - printf "SCM_TAG %s in pom.xml does not match tag %s" "${SCM_TAG}" "${RELEASE_TAG_NAME}" + printf "SCM_TAG %s in pom.xml does not match tag %s\n" "${SCM_TAG}" "${RELEASE_TAG_NAME}" printf "%s\n" "${FAILURE_BOILERPLATE}" exit 1 fi From 66766869be4b2584add6140dd677b28ec7d306ea Mon Sep 17 00:00:00 2001 From: karel rehor Date: Fri, 18 Sep 2026 15:19:06 +0200 Subject: [PATCH 05/17] docs: fix PR number in CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c29d1657..1400c6e5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ### CI -1. [#445](https://github.com/InfluxCommunity/influxdb3-java/pull/445): Sets up automated releasing to Maven Central +1. [#446](https://github.com/InfluxCommunity/influxdb3-java/pull/446): Sets up automated releasing to Maven Central ### Documentation From efb0d7545e1f5929e77054efdde627e6958da259 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Fri, 18 Sep 2026 16:59:34 +0200 Subject: [PATCH 06/17] docs: fix phantom space in CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1400c6e5..5cca6984 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ ### CI 1. [#446](https://github.com/InfluxCommunity/influxdb3-java/pull/446): Sets up automated releasing to Maven Central - + ### Documentation 1. [#439](https://github.com/InfluxCommunity/influxdb3-java/pull/439): Fix unresolved variables in generated site documentation. From 7c643741e9b0973cdd1afa329cfd045a03e6a9b9 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 14:15:34 +0200 Subject: [PATCH 07/17] chore: workflow security fixes --- .github/workflows/maven-release.yml | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index f0e89b9e..bf551bcf 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -4,12 +4,15 @@ on: release: types: [published] + tags: + - "v*" jobs: release: permissions: contents: write # may want to update version runs-on: ubuntu-latest + environment: release env: SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} @@ -17,11 +20,12 @@ jobs: GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} IS_PRERELEASE: ${{ github.event.release.prerelease }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPO: ${{ github.repository }} steps: - name: Checkout uses: actions/checkout@v6 + with: + persist-credentials: false - name: Setup JDK 21 uses: actions/setup-java@v5 with: @@ -230,17 +234,6 @@ jobs: echo "This is a hot fix release ${RELEASE_TAG_NAME}, so site documentation will not be updated to GitHub pages." exit 0 fi - cat << EOF > scm-settings.xml - - - - github - x-access-token - ${GITHUB_TOKEN} - - - - EOF git config --global user.email "${GITHUB_ACTOR}@noreply.github.com" git config --global user.name "GitHub Action" git checkout "${RELEASE_TAG_NAME}" From 7b426112629bbbf3b54daf4f8812d9e6e960d9a2 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 14:16:34 +0200 Subject: [PATCH 08/17] chore: start scm-settings.xml --- scm-settings.xml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 scm-settings.xml diff --git a/scm-settings.xml b/scm-settings.xml new file mode 100644 index 00000000..271f8cb5 --- /dev/null +++ b/scm-settings.xml @@ -0,0 +1,9 @@ + + + + github + x-access-token + ${env.GITHUB_TOKEN} + + + \ No newline at end of file From 1577811708aeb892abe5ec62cc1802630c8c22cd Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 14:25:26 +0200 Subject: [PATCH 09/17] chore: protect gpg-passphrase in workflow. --- .github/workflows/maven-release.yml | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index bf551bcf..b26c48a1 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -14,10 +14,7 @@ jobs: runs-on: ubuntu-latest environment: release env: - SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} - SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} MAVEN_SETTINGS_EXPERIM: ${{ vars.MAVEN_SETTINGS_FILE }} - GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} IS_PRERELEASE: ${{ github.event.release.prerelease }} GITHUB_REPO: ${{ github.repository }} @@ -38,6 +35,10 @@ jobs: sudo apt-get update sudo apt-get -y install libxml2-utils - name: Verify Env + env: + GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} + SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} + SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} run: | if [[ -z "${{ secrets.GPG_PRIVATE_KEY }}" ]] then @@ -97,16 +98,6 @@ jobs: exit 1 fi - if [[ "$GPG_PASSPHRASE_PRELIM" == "EMPTY" ]] - then - echo "GPG_PASSPHRASE empty requested" - export GPG_PASSPHRASE="" - else - export GPG_PASSPHRASE="$GPG_PASSPHRASE_PRELIM" - fi - - echo "GPG_PASSPHRASE=${GPG_PASSPHRASE}" >> "$GITHUB_ENV" - # Verify GPG2 environment if ! command -v gpg2 &> /dev/null then @@ -161,6 +152,10 @@ jobs: . ./scripts/on-release.sh echo "RC_OR_BETA=${RC_OR_BETA}" >> "$GITHUB_ENV" - name: Release + env: + GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} + SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} + SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} run: | if [[ "${IS_PRERELEASE}" == "true" ]]; then echo "This is a pre release and will not be deployed to Maven Central." @@ -171,6 +166,13 @@ jobs: echo "This is an RC or BETA release and will not be deployed to Maven Central." exit 0 fi + if [[ "$GPG_PASSPHRASE_PRELIM" == "EMPTY" ]]; then + echo "GPG_PASSPHRASE empty requested" + GPG_PASSPHRASE="" + else + GPG_PASSPHRASE="$GPG_PASSPHRASE_PRELIM" + fi + export GPG_PASSPHRASE cat << EOF > release.properties scm.url=scm\:git\:https\://github.com/${GITHUB_REPOSITORY}.git scm.tag=${RELEASE_TAG_NAME} From aada4b6db302e2ba93a0dde0c1a1a97d35b16ae2 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 14:27:25 +0200 Subject: [PATCH 10/17] chore: add license to scm-settings.xml --- scm-settings.xml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/scm-settings.xml b/scm-settings.xml index 271f8cb5..85d7a510 100644 --- a/scm-settings.xml +++ b/scm-settings.xml @@ -1,3 +1,26 @@ + From 54563a803ecd8e2175129ef504492f23d62bd853 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 14:33:59 +0200 Subject: [PATCH 11/17] chore: switch repository secrets to environment secrets. --- .github/workflows/maven-release.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index b26c48a1..fcf4c4c9 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -29,18 +29,18 @@ jobs: java-version: '21' distribution: 'temurin' cache: maven - gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} + gpg-private-key: ${{ env.GPG_PRIVATE_KEY }} - name: Add dependencies run: | sudo apt-get update sudo apt-get -y install libxml2-utils - name: Verify Env env: - GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} - SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} - SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} + GPG_PASSPHRASE_PRELIM: ${{ env.GPG_PASSPHRASE }} + SONATYPE_USERNAME: ${{ env.SONATYPE_USERNAME }} + SONATYPE_PASSWORD: ${{ env.SONATYPE_PASSWORD }} run: | - if [[ -z "${{ secrets.GPG_PRIVATE_KEY }}" ]] + if [[ -z "${{ env.GPG_PRIVATE_KEY }}" ]] then echo "ERROR GPG_PRIVATE_KEY is missing." exit 1 @@ -153,9 +153,9 @@ jobs: echo "RC_OR_BETA=${RC_OR_BETA}" >> "$GITHUB_ENV" - name: Release env: - GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} - SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} - SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} + GPG_PASSPHRASE_PRELIM: ${{ env.GPG_PASSPHRASE }} + SONATYPE_USERNAME: ${{ env.SONATYPE_USERNAME }} + SONATYPE_PASSWORD: ${{ env.SONATYPE_PASSWORD }} run: | if [[ "${IS_PRERELEASE}" == "true" ]]; then echo "This is a pre release and will not be deployed to Maven Central." From 9c05e23275a84da6be521cb70c7bac96d1cf4461 Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 14:36:27 +0200 Subject: [PATCH 12/17] chore: remove tag filter for release event - not applicable to 'release'. --- .github/workflows/maven-release.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index fcf4c4c9..5ef1a145 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -4,8 +4,6 @@ on: release: types: [published] - tags: - - "v*" jobs: release: From 47afe9b7f0438f5cc29cadd900dc9497076ab56b Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 15:06:21 +0200 Subject: [PATCH 13/17] chore: revert workflow env back to secrets --- .github/workflows/maven-release.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index 5ef1a145..532d9d58 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -27,18 +27,18 @@ jobs: java-version: '21' distribution: 'temurin' cache: maven - gpg-private-key: ${{ env.GPG_PRIVATE_KEY }} + gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} - name: Add dependencies run: | sudo apt-get update sudo apt-get -y install libxml2-utils - name: Verify Env env: - GPG_PASSPHRASE_PRELIM: ${{ env.GPG_PASSPHRASE }} - SONATYPE_USERNAME: ${{ env.SONATYPE_USERNAME }} - SONATYPE_PASSWORD: ${{ env.SONATYPE_PASSWORD }} + GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} + SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} + SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} run: | - if [[ -z "${{ env.GPG_PRIVATE_KEY }}" ]] + if [[ -z "${{ secrets.GPG_PRIVATE_KEY }}" ]] then echo "ERROR GPG_PRIVATE_KEY is missing." exit 1 @@ -151,9 +151,9 @@ jobs: echo "RC_OR_BETA=${RC_OR_BETA}" >> "$GITHUB_ENV" - name: Release env: - GPG_PASSPHRASE_PRELIM: ${{ env.GPG_PASSPHRASE }} - SONATYPE_USERNAME: ${{ env.SONATYPE_USERNAME }} - SONATYPE_PASSWORD: ${{ env.SONATYPE_PASSWORD }} + GPG_PASSPHRASE_PRELIM: ${{ secrets.GPG_PASSPHRASE }} + SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} + SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} run: | if [[ "${IS_PRERELEASE}" == "true" ]]; then echo "This is a pre release and will not be deployed to Maven Central." From 994733abedd0d51852a18703fe2d6b410378196b Mon Sep 17 00:00:00 2001 From: karel rehor Date: Mon, 21 Sep 2026 15:43:58 +0200 Subject: [PATCH 14/17] chore: match envirionment in workflow to gerun releasing --- .github/workflows/maven-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index 532d9d58..997c7114 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -10,7 +10,7 @@ jobs: permissions: contents: write # may want to update version runs-on: ubuntu-latest - environment: release + environment: releasing env: MAVEN_SETTINGS_EXPERIM: ${{ vars.MAVEN_SETTINGS_FILE }} RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} From a91004542cf10a13b5c7b184a0b358eac75ba16d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 16:47:02 +0000 Subject: [PATCH 15/17] build(deps): bump com.google.protobuf:protobuf-java (#447) Bumps [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) from 4.36.1 to 4.36.2. - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) --- updated-dependencies: - dependency-name: com.google.protobuf:protobuf-java dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index b6bab1e0..ae5a0251 100644 --- a/pom.xml +++ b/pom.xml @@ -260,7 +260,7 @@ com.google.protobuf protobuf-java - 4.36.1 + 4.36.2 From 698050d24910f9f5b75f5674fecdffc365210487 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 16:49:19 +0000 Subject: [PATCH 16/17] build(deps): bump github/codeql-action from 4.38.0 to 4.38.1 (#448) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.38.0 to 4.38.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.38.0...v4.38.1) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 9356c2c0..dd561380 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -20,12 +20,12 @@ jobs: uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.0 + uses: github/codeql-action/init@v4.38.1 with: languages: java - name: Autobuild - uses: github/codeql-action/autobuild@v4.38.0 + uses: github/codeql-action/autobuild@v4.38.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.0 + uses: github/codeql-action/analyze@v4.38.1 From 76c6be9c46a7b6fcea0396d0d1ce06ba3a0d5f7a Mon Sep 17 00:00:00 2001 From: karel rehor Date: Tue, 22 Sep 2026 12:39:12 +0200 Subject: [PATCH 17/17] chore: fix changes to git operations after security fixes. --- .github/workflows/maven-release.yml | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index 997c7114..c13e0339 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -209,6 +209,7 @@ jobs: sed -i -e "s/${RELEASE_TAG_NAME:1}<\/version>/${NEXT_RELEASE}-SNAPSHOT<\/version>/" examples/pom.xml git add pom.xml examples/pom.xml CHANGELOG.md git commit -m "ci: setting up release cycle ${NEXT_RELEASE}" + gh auth setup-git git push --set-upstream origin "${NEXT_RELEASE_BRANCH}" # The following requires special permissions on the organizational and project level to work. Switching off for now. # gh pr create -B main -H ${NEXT_RELEASE_BRANCH} --title "Merge ${NEXT_RELEASE_BRANCH} into main" --body 'Created by GitHub action' @@ -216,6 +217,24 @@ jobs: echo "The branch ${NEXT_RELEASE_BRANCH} has been created. You can create and merge a PR manually from it to start the next release cycle." env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Prepare documentation + run: | + if [[ "${IS_PRERELEASE}" == "true" ]]; then + echo "This is a pre release, so site documentation will not be updated to GitHub pages." + exit 0 + fi + if [[ "${RC_OR_BETA}" == "true" ]] + then + echo "This is an RC or BETA release, so site documentation will not be updated to GitHub pages." + exit 0 + fi + if [[ "${IS_HOT_FIX}" == "true" ]] + then + echo "This is a hot fix release ${RELEASE_TAG_NAME}, so site documentation will not be updated to GitHub pages." + exit 0 + fi + git checkout "${RELEASE_TAG_NAME}" + mvn clean site site:stage -DskipTests - name: Publish documentation env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -236,6 +255,4 @@ jobs: fi git config --global user.email "${GITHUB_ACTOR}@noreply.github.com" git config --global user.name "GitHub Action" - git checkout "${RELEASE_TAG_NAME}" - mvn clean site site:stage -DskipTests mvn -s scm-settings.xml --batch-mode scm-publish:publish-scm -Dscmpublish.serverId=github