Skip to content

release: Migrate artifacts publishing from legacy OSSRH to Central Portal #12156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 24, 2025
Merged

release: Migrate artifacts publishing from legacy OSSRH to Central Portal #12156

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
854dbda
release: revamping release to use Portal OSSRH Staging API
shivaspeaks Jun 16, 2025
94d0a94
release: revamping release process to use Portal OSSRH Staging API
shivaspeaks Jun 23, 2025
8164fdb
Merge branch 'master' of https://github.com/grpc/grpc-java into OSSRH…
shivaspeaks Jun 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ For [Bazel](https://bazel.build), you can either
https://search.maven.org/search?q=g:io.grpc%20AND%20v:1.73.0

Development snapshots are available in [Sonatypes's snapshot
repository](https://oss.sonatype.org/content/repositories/snapshots/).
repository](https://central.sonatype.com/repository/maven-snapshots/).

Generated Code
--------------
Expand Down
2 changes: 1 addition & 1 deletion RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ Tagging the Release
repository can then be `released`, which will begin the process of pushing
the new artifacts to Maven Central (the staging repository will be destroyed
in the process). You can see the complete process for releasing to Maven
Central on the [OSSRH site](https://central.sonatype.org/pages/releasing-the-deployment.html).
Central on the [OSSRH site](https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#deploying).

10. We have containers for each release to detect compatibility regressions with
old releases. Generate one for the new release by following the [GCR image
Expand Down
8 changes: 4 additions & 4 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -389,11 +389,11 @@ subprojects {
url = new File(rootProject.repositoryDir).toURI()
} else {
String stagingUrl
String baseUrl = "https://ossrh-staging-api.central.sonatype.com/service/local"
if (rootProject.hasProperty('repositoryId')) {
stagingUrl = 'https://oss.sonatype.org/service/local/staging/deployByRepositoryId/' +
rootProject.repositoryId
stagingUrl = "${baseUrl}/staging/deployByRepositoryId/" + rootProject.repositoryId
} else {
stagingUrl = 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
stagingUrl = "${baseUrl}/staging/deploy/maven2/"
}
credentials {
if (rootProject.hasProperty('ossrhUsername') && rootProject.hasProperty('ossrhPassword')) {
Expand All @@ -402,7 +402,7 @@ subprojects {
}
}
def releaseUrl = stagingUrl
def snapshotUrl = 'https://oss.sonatype.org/content/repositories/snapshots/'
def snapshotUrl = 'https://central.sonatype.com/repository/maven-snapshots/'
url = version.endsWith('SNAPSHOT') ? snapshotUrl : releaseUrl
}
}
Expand Down
17 changes: 16 additions & 1 deletion buildscripts/sonatype-upload.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ if [ -z "$USERNAME" -o -z "$PASSWORD" ]; then
exit 1
fi

STAGING_URL="https://oss.sonatype.org/service/local/staging"
STAGING_URL="https://ossrh-staging-api.central.sonatype.com/service/local/staging"

# We go through the effort of using deloyByRepositoryId/ because it is
# _substantially_ faster to upload files than deploy/maven2/. When using
Expand Down Expand Up @@ -108,3 +108,18 @@ XML="
</promoteRequest>"
curl --fail-with-body -X POST -d "$XML" -u "$USERPASS" -H "Content-Type: application/xml" \
"$STAGING_URL/profiles/$PROFILE_ID/finish"

# After closing the repository on the staging API, we must manually trigger
# its upload to the main Central Publisher Portal. We set publishing_type=automatic
# to have it release automatically upon passing validation.
echo "Triggering release of repository ${REPOID} to the Central Portal"

# The manual API endpoint requires a Bearer token, which is the base64 of user:pass.
BEARER_TOKEN=$(echo -n "$USERPASS" | base64)

curl --fail-with-body -X POST \
-H "Authorization: Bearer ${BEARER_TOKEN}" \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know the documentation said it is Bearer, but I'm suspicious it is actually Basic. You can see in the old API we passed -u to curl, which does HTTP basic (because servers rarely request HTTP digest these days). The same for Gradle; it looks configured for Basic. The base64 scheme it talks about is actually Basic, except they replaced the Authorization header prefix with Bearer.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found more on how we were using -u earlier, there it is explicitly shown the usage in the doc, on page 172. No mention of bearer in their the documentation. Why would they say in the new central portal! Thats unconventional by Sonatype.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm suspicious it was actually a typo or someone less familiar didn't realize the difference it was actually Basic. Bearer is very common, but for user:pass authentication should generally be Basic. They both start with B; someone might not realize the error.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah could be.
Even I found couple of typos at places in their migration documentations.

-H "Content-Type: application/json" \
"${MANUAL_API_URL}/upload/repository/${REPOID}?publishing_type=automatic"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MANUAL_API_URL is undefined


echo "Release triggered. Monitor progress at https://central.sonatype.com/publishing/deployments"