Publish releases to a git-hosted Maven repository - #5
Merged
Merged
Conversation
Adds a release pipeline that deploys reqif4j into a generated `maven-repo` branch of this repository. The branch holds a plain Maven repository layout and is served over raw.githubusercontent.com, so consumers need neither a GitHub token nor a settings.xml entry. - pom.xml: distributionManagement pointing at a configurable output directory (`maven.repo.dir`), plus project url/licenses/scm metadata. A `release` profile attaches the sources and javadoc jars; keeping it out of the default build leaves `mvn verify` on CI unchanged. - .github/scripts/publish-maven-repo.sh: checks out the maven-repo branch as a worktree (creating it as an orphan branch on first run), deploys into it and commits the result. Existing versions and the merged maven-metadata.xml are preserved; release versions are immutable and a re-publish fails instead of overwriting. The pom version is only set for the build and restored afterwards, so no version bump lands on the source branch. - .github/workflows/release.yml: runs the script for `v*` tags and via manual dispatch. - ci.yml: skip the generated maven-repo branch, which carries no sources. - README: consumer instructions for Maven and Gradle, and how to publish. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUkGAHmCwySzzQG74U5C3H
Both were shown without explanation. The repository <id> is a free-form local name, unrelated to the artifactId that happens to share it, and <snapshots> is optional because Maven resolves snapshots from a self-declared repository by default — verified by resolving a SNAPSHOT with the element omitted and watching resolution fail only with <enabled>false</enabled>. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUkGAHmCwySzzQG74U5C3H
The Maven artifacts now go into the standalone public repository Tob1as864/maven-repo rather than a maven-repo branch of this repository. Maven's layout namespaces artifacts by groupId and artifactId, so that repository can hold several libraries side by side, and clones of this repository no longer carry the published binaries. - publish-maven-repo.sh: clone the target repository, deploy into it, commit and push. Handles a freshly created, still empty target repository, and only bootstraps a README when the target has none, so a hand-maintained index there is never clobbered. The immutability guard and the pom restore are unchanged. - release.yml: authenticate with an SSH deploy key from the secret MAVEN_REPO_DEPLOY_KEY, which grants write access to the Maven repository only; GITHUB_TOKEN now needs read permission only. Fails with an actionable message when the secret is missing. - ci.yml: revert the branch filter, there is no generated branch here anymore. - README: consumer URLs point at the new repository, plus one-time instructions for creating the deploy key. Snapshots are documented as an opt-out rather than a required element. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUkGAHmCwySzzQG74U5C3H
A wrong value in MAVEN_REPO_DEPLOY_KEY otherwise surfaces as an opaque SSH failure at push time, after the whole build has run. The workflow now checks the secret's first line up front and names the two likely mistakes: a PuTTY .ppk key, and a single line copied out of a key file rather than the whole file. The README states the expected format, points PuTTYgen users at Conversions -> Export OpenSSH key, and notes that a repository secret (not an environment secret) is what the workflow reads. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HUkGAHmCwySzzQG74U5C3H
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets up publishing of
de.uni_stuttgart.ils:reqif4jinto the separate public repositoryTob1as864/maven-repo, which holds a plain Maven repository layout and is served overraw.githubusercontent.com. Consumers need neither a GitHub token nor asettings.xmlentry.Maven's layout namespaces artifacts by groupId and artifactId, so that repository can hold further libraries side by side later on.
Changes
pom.xml—distributionManagementpointing at a configurable output directory (maven.repo.dir), plus projecturl,licensesandscmmetadata. Areleaseprofile attaches the sources and javadoc jars; keeping it out of the default build leavesmvn verifyunchanged..github/scripts/publish-maven-repo.sh— clones the target repository, deploys into it, commits and pushes. Handles a still empty target repository, and only bootstraps a README when the target has none, so a hand-maintained index there is never clobbered. Release versions are immutable: re-publishing an existing one fails instead of overwriting. The pom version is set for the build only and restored afterwards, so no version bump is committed here..github/workflows/release.yml— runs the script forv*tags (v1.2.0publishes1.2.0) and via manual dispatch. Authenticates with an SSH deploy key from the secretMAVEN_REPO_DEPLOY_KEY, which grants write access to the Maven repository only;GITHUB_TOKENneeds read permission only. Malformed or missing secrets are rejected up front with an actionable message rather than an opaque SSH failure after a full build.README.md— consumer instructions for Maven and Gradle, an explanation of the repository<id>and the<snapshots>element, and the one-time deploy key setup.Verification
Exercised end to end against a local target repository:
reqif4jmaven-metadata.xmlcorrectly merged across releases and snapshotsPUSH=falsedry run, and restoration of the pom version after a failed runmvn verifyunchanged: 154 tests pass, no javadoc overhead in the default buildSnapshot resolution was checked separately: the
<snapshots>element is documented as an opt-out, since Maven enables snapshots for a self-declared repository by default.Before merging
The repository
Tob1as864/maven-repohas to exist and be public —raw.githubusercontent.comrequires a token for private repositories. The deploy key setup is documented in the README section One-time setup of the publishing credentials.🤖 Generated with Claude Code
https://claude.ai/code/session_01HUkGAHmCwySzzQG74U5C3H
Generated by Claude Code