[RUN-4638] Migrate publishing from Maven Central to PackageCloud - #24
Merged
Conversation
Part of RUN-4570: Maven Central publishing limits resolution, applying
the same design validated on rundeck-plugins/sshj-plugin (PR #136) and
the other already-migrated rundeck-plugins repos.
- Remove nexusPublish plugin/nexusPublishing block. Add `id 'base'`
explicitly, since io.github.gradle-nexus.publish-plugin was silently
providing the base/build/assemble/check lifecycle tasks this repo
never declared on its own - removing it without adding 'base' back
broke `./gradlew build` entirely ("Task with name 'build' not
found").
- Point the PackageCloud maven repo at the configurable PKGCLD_REPO_URL
with a fallback to the real rundeck-plugins repo, and drop the
now-unnecessary guard.
- Drop Gradle-side GPG signing (sign(publishing.publications)) -
PackageCloud's Maven endpoint rejects the checksum Gradle
auto-generates for .asc signature files. Sign and upload via gpg CLI
+ curl instead, in release.yml.
- release.yml: replace the Sonatype publish step with PackageCloud +
the GPG sign/upload step.
There was a problem hiding this comment.
Pull request overview
Migrates this plugin’s release/publishing pipeline from Sonatype/Maven Central to PackageCloud, aligning with the org’s newer publishing approach and removing Gradle-side GPG signing.
Changes:
- Remove
io.github.gradle-nexus.publish-plugin/nexusPublishingconfiguration and explicitly apply Gradle’sbaseplugin to keep lifecycle tasks (e.g.,build) present. - Update Gradle publishing to target PackageCloud via
PKGCLD_REPO_URLandPKGCLD_WRITE_TOKEN. - Replace the Maven Central publish step in
release.ymlwith PackageCloud publishing plus a CLI-based GPG signature upload step.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
gradle/publishing.gradle |
Switch publishing repository configuration to PackageCloud and remove Gradle-side signing. |
build.gradle |
Remove Nexus publishing plugin and explicitly add base to preserve lifecycle tasks. |
.github/workflows/release.yml |
Update release workflow to publish to PackageCloud and upload .asc signatures via gpg+curl. |
| apply plugin: 'maven-publish' | ||
| apply plugin: 'signing' | ||
|
|
||
| def pkgcldRepoUrl = (System.getenv("PKGCLD_REPO_URL") ?: "https://packagecloud.io/pagerduty/rundeck-plugins/maven2").trim() |
Comment on lines
+53
to
63
| maven { | ||
| name = "PackageCloud" | ||
| url = uri(pkgcldRepoUrl) | ||
| authentication { | ||
| header(HttpHeaderAuthentication) | ||
| } | ||
| credentials(HttpHeaderCredentials) { | ||
| name = "Authorization" | ||
| value = "Bearer " + (System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken")) | ||
| } | ||
| } |
Comment on lines
+57
to
+63
| set -e | ||
| VERSION="${{ steps.get_version.outputs.VERSION }}" | ||
| BASE_URL="${PKGCLD_REPO_URL:-https://packagecloud.io/pagerduty/rundeck-plugins/maven2}/org/rundeck/plugins/aws-s3-steps/${VERSION}" | ||
|
|
||
| echo "$SIGNING_KEY_B64" | base64 -d | gpg --batch --yes --import | ||
| KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}') | ||
|
|
carlosrfranco
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira ticket
RUN-4638 (subtask of RUN-4570)
Description
Migrate
aws-s3-stepspublishing from Maven Central (Sonatype) to PackageCloud, applying the same design already validated on rundeck-plugins/sshj-plugin#136 and the other already-migratedrundeck-pluginsrepos. Part of the RUN-4570 Maven Central publishing limits resolution — plugins account for the bulk of the file/release count on Maven Central, but no external project depends on them as Maven dependencies.nexusPublish/nexusPublishing. Addedid 'base'explicitly to theplugins {}block —io.github.gradle-nexus.publish-pluginwas silently providing thebase/build/assemble/checklifecycle tasks this repo never declared on its own; removing it without addingbaseback broke./gradlew buildentirely with "Task with name 'build' not found".PKGCLD_REPO_URLenv var (with a fallback to the realrundeck-pluginsrepo), dropping the now-unnecessary guard.sign(publishing.publications)): PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for.ascsignature files (422 Unprocessable Entity). Sign and upload viagpgCLI +curlinstead, directly inrelease.yml— the same mechanism validated end-to-end onsshj-plugin.release.yml: replaced the "Publish to Maven Central" step with "Publish to PackageCloud" + a "Sign and upload GPG signatures" step.Testing instructions
./gradlew buildstill succeeds (this is what the missingid 'base'would have broken)..ascsignature land underorg/rundeck/plugins/aws-s3-steps/<version>/on PackageCloud.