Sign artifacts in build instead of in bintray. (#1778)

Author: Anuraag Agrawal

.github/workflows/nightly.yaml

@@ -151,6 +151,8 @@ jobs:
           S3_BUILD_CACHE_SECRET_KEY: ${{ secrets.S3_BUILD_CACHE_SECRET_KEY }}
           BINTRAY_USER: ${{ secrets.BINTRAY_USER }}
           BINTRAY_API_KEY: ${{ secrets.BINTRAY_API_KEY }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
         run: ./gradlew snapshot --stacktrace
 
   issue:

.github/workflows/patch-release-build.yml

@@ -74,3 +74,5 @@ jobs:
           BINTRAY_API_KEY: ${{ secrets.BINTRAY_API_KEY }}
           GRGIT_USER: ${{ github.actor }}
           GRGIT_PASS: ${{ secrets.GITHUB_TOKEN }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}

.github/workflows/release-build.yml

@@ -26,4 +26,6 @@ jobs:
           BINTRAY_USER: ${{ secrets.BINTRAY_USER }}
           BINTRAY_API_KEY: ${{ secrets.BINTRAY_API_KEY }}
           GRGIT_USER: ${{ github.actor }}
-          GRGIT_PASS: ${{ secrets.GITHUB_TOKEN }}
+          GRGIT_PASS: ${{ secrets.GITHUB_TOKEN }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}

gradle/publish.gradle

@@ -1,4 +1,5 @@
 apply plugin: 'maven-publish'
+apply plugin: 'signing'
 apply plugin: 'com.jfrog.artifactory'
 apply plugin: 'com.jfrog.bintray'
 
@@ -103,10 +104,6 @@ bintray {
       name = project.version
       released = new Date()
 
-      gpg {
-        sign = true
-      }
-
       mavenCentralSync {
         user = System.getenv("SONATYPE_USER")
         password = System.getenv("SONATYPE_KEY")
@@ -133,3 +130,12 @@ artifactoryPublish {
   enabled = version.toString().contains('SNAPSHOT')
   publications('maven')
 }
+
+tasks.withType(Sign).configureEach {
+  onlyIf { System.getenv("CI") != null }
+}
+
+signing {
+  useInMemoryPgpKeys(System.getenv("GPG_PRIVATE_KEY"), System.getenv("GPG_PASSWORD"))
+  sign publishing.publications.maven
+}