[RUN-4638] Migrate publishing from Maven Central to PackageCloud (#60)

* Migrate publishing from Maven Central to PackageCloud

Part of RUN-4570: Maven Central publishing limits resolution, applying
the same design validated on rundeck-plugins/sshj-plugin (RUN-4638).

- Remove nexusPublish plugin/nexusPublishing block (Sonatype-specific,
  dead once release.yml stops calling publishToSonatype).
- Point the existing PackageCloud maven repo at the configurable
  PKGCLD_REPO_URL (trimmed, guarded so plain builds/CI without the var
  don't fail at configuration time) instead of the hardcoded
  rundeckpro-test URL.
- Drop GPG signing: PackageCloud's Maven endpoint rejects the checksum
  Gradle auto-generates for .asc signature files (422 Unprocessable
  Entity), and neither the OSS rundeck WAR nor rundeckpro-enterprise
  carry .asc signatures on PackageCloud either - only RPM/DEB packages
  are signed there natively.
- release.yml: replace the Sonatype publish step with PackageCloud.

* Fail fast in release.yml if PackageCloud env vars are missing

Addresses GitHub Copilot review feedback on the PackageCloud migration
PRs: without this, a missing PKGCLD_REPO_URL makes the publish task
not exist at all (confusing "task not found"), and a missing
PKGCLD_WRITE_TOKEN with the URL present produces a "Bearer null"
Authorization header that PackageCloud rejects with a non-obvious
401/422. Validate both upfront in the one step that actually needs
them, instead of leaving the Gradle-side guard (which exists to keep
unrelated CI like gradle.yml working without these vars) to surface
the failure indirectly.

* Fall back to rundeck-plugins PackageCloud URL, simplify token check

Addresses the remaining GitHub Copilot review feedback: default
pkgcldRepoUrl to the real, canonical rundeck-plugins PackageCloud URL
instead of relying on PKGCLD_REPO_URL always being set. This removes
the need for the "only register if URL present" guard entirely, since
uri() never receives null - registering a Maven repository doesn't
make any network call until something actually resolves/publishes
through it, so there's no cost to always registering it.

With the URL guaranteed non-null, release.yml's fail-fast check only
needs to validate PKGCLD_WRITE_TOKEN (which still has no safe public
default, since it's a secret).

* Sign and upload GPG signatures to PackageCloud manually

Validated end-to-end on rundeck-plugins/sshj-plugin (merged): signing
via sign(publishing.publications) makes Gradle auto-generate a
checksum for every publication artifact including the .asc files
themselves, and PackageCloud's Maven endpoint 422s on the
checksum-of-a-signature-file. Sidestep this entirely by signing the
already-built artifacts with the gpg CLI directly and uploading just
the .asc files via curl, bypassing Gradle's publish/checksum machinery
for this part. Reuses the existing SIGNING_KEY_B64/SIGNING_PASSWORD
secrets (now pointing at a renewed, non-expired key).

Author: Jesus-Osuna-M

.github/workflows/release.yml

@@ -9,6 +9,8 @@ jobs:
   build:
     name: Publish Release
     runs-on: ubuntu-latest
+    env:
+      PKGCLD_REPO_URL: ${{ vars.PKGCLD_REPO_URL }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -33,10 +35,38 @@ jobs:
             build/libs/http-step-${{ steps.get_version.outputs.VERSION }}.jar
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Publish to Maven Central
-        run: ./gradlew -PsigningKey=${SIGNING_KEY_B64} -PsigningPassword=${SIGNING_PASSWORD} -PsonatypeUsername=${SONATYPE_USERNAME} -PsonatypePassword=${SONATYPE_PASSWORD} publishToSonatype closeAndReleaseSonatypeStagingRepository
+      - name: Publish to PackageCloud
+        run: |
+          if [ -z "$PKGCLD_WRITE_TOKEN" ]; then
+            echo "::error::PKGCLD_WRITE_TOKEN must be set to publish to PackageCloud"
+            exit 1
+          fi
+          ./gradlew publishAllPublicationsToPackageCloudRepository
+        env:
+          PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }}
+      - name: Sign and upload GPG signatures to PackageCloud
+        run: |
+          set -e
+          VERSION="${{ steps.get_version.outputs.VERSION }}"
+          BASE_URL="${PKGCLD_REPO_URL:-https://packagecloud.io/pagerduty/rundeck-plugins/maven2}/org/rundeck/plugins/http-step/${VERSION}"
+
+          echo "$SIGNING_KEY_B64" | base64 -d | gpg --batch --yes --import
+          KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}')
+
+          sign_and_upload() {
+            local FILE="$1"
+            local REMOTE_NAME="$2"
+            gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSWORD" --default-key "$KEY_ID" --detach-sign --armor "$FILE"
+            curl -sf -H "Authorization: Bearer ${PKGCLD_WRITE_TOKEN}" \
+              -X PUT --data-binary "@${FILE}.asc" \
+              "${BASE_URL}/${REMOTE_NAME}.asc"
+          }
+
+          sign_and_upload "build/libs/http-step-${VERSION}.jar" "http-step-${VERSION}.jar"
+          sign_and_upload "build/libs/http-step-${VERSION}-sources.jar" "http-step-${VERSION}-sources.jar"
+          sign_and_upload "build/libs/http-step-${VERSION}-javadoc.jar" "http-step-${VERSION}-javadoc.jar"
+          sign_and_upload "build/publications/http-step/pom-default.xml" "http-step-${VERSION}.pom"
         env:
-          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
-          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
           SIGNING_KEY_B64: ${{ secrets.SIGNING_KEY_B64 }}
           SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+          PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }}

build.gradle

@@ -1,7 +1,6 @@
 plugins {
     id 'pl.allegro.tech.build.axion-release' version '1.21.2'
     id 'java'
-    id 'io.github.gradle-nexus.publish-plugin' version '2.0.0'
 }
 
 java {
@@ -142,14 +141,4 @@ jar {
     }
 }
 
-nexusPublishing {
-    packageGroup = 'org.rundeck.plugins'
-    repositories {
-        sonatype {
-            nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
-            snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
-        }
-    }
-}
-
 apply from: "${rootDir}/gradle/publishing.gradle"

gradle/publishing.gradle

@@ -5,18 +5,10 @@
  * publishDescription = 'description' (optional)
  * githubSlug = Github slug e.g. 'rundeck/rundeck-cli'
  * developers = [ [id:'id', name:'name', email: 'email' ] ] list of developers
- *
- * Define project properties to sign and publish when invoking publish task:
- *
- *     ./gradlew \
- *     -PsigningKey="base64 encoded gpg key" \
- *     -PsigningPassword="password for key" \
- *     -PsonatypeUsername="sonatype token user" \
- *     -PsonatypePassword="sonatype token password" \
- *     publishToSonatype closeAndReleaseSonatypeStagingRepository
  */
 apply plugin: 'maven-publish'
-apply plugin: 'signing'
+
+def pkgcldRepoUrl = (System.getenv("PKGCLD_REPO_URL") ?: "https://packagecloud.io/pagerduty/rundeck-plugins/maven2").trim()
 
 publishing {
     publications {
@@ -56,31 +48,16 @@ publishing {
         }
     }
     repositories {
-        def pkgcldWriteToken = System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken")
-        if (pkgcldWriteToken) {
-            maven {
-                name = "PackageCloudTest"
-                url = uri("https://packagecloud.io/pagerduty/rundeckpro-test/maven2")
-                authentication {
-                    header(HttpHeaderAuthentication)
-                }
-                credentials(HttpHeaderCredentials) {
-                    name = "Authorization"
-                    value = "Bearer " + pkgcldWriteToken
-                }
+        maven {
+            name = "PackageCloud"
+            url = uri(pkgcldRepoUrl)
+            authentication {
+                header(HttpHeaderAuthentication)
+            }
+            credentials(HttpHeaderCredentials) {
+                name = "Authorization"
+                value = "Bearer " + (System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken"))
             }
         }
     }
-}
-def base64Decode = { String prop ->
-    project.findProperty(prop) ?
-            new String(Base64.getDecoder().decode(project.findProperty(prop).toString())).trim() :
-            null
-}
-
-if (project.hasProperty('signingKey') && project.hasProperty('signingPassword')) {
-    signing {
-        useInMemoryPgpKeys(base64Decode("signingKey"), project.signingPassword)
-        sign(publishing.publications)
-    }
 }