Merge pull request #197 from smallrye/ci/smallrye-new-secrets-scheme

Switch to the new Smallrye secrets scheme
smallrye · May 29, 2024 · a6c84b7 · a6c84b7
2 parents 3ee48ce + ae515f1
commit a6c84b7
Show file tree

Hide file tree

Showing 6 changed files with 20 additions and 23 deletions.
diff --git a/.github/encrypted/maven-settings.xml.gpg b/.github/encrypted/maven-settings.xml.gpg
diff --git a/.github/encrypted/smallrye-sign.asc.gpg b/.github/encrypted/smallrye-sign.asc.gpg
diff --git a/.github/scripts/decrypt-secrets.sh b/.github/scripts/decrypt-secrets.sh
diff --git a/.github/scripts/deploy.sh b/.github/scripts/deploy.sh
@@ -7,10 +7,6 @@ echo "Set up Git"
 git config --global user.name "SmallRye CI"
 git config --global user.email "[email protected]"
 
-echo "Import key"
-
-gpg --fast-import --no-tty --batch --yes smallrye-sign.asc
-
 echo "Fetch code"
 
 git fetch origin --tags
@@ -19,5 +15,5 @@ git checkout main
 
 echo "Deploy"
 
-./mvnw -B clean deploy -DskipTests -Prelease -s maven-settings.xml
+./mvnw -B clean deploy -DskipTests -Prelease
 
diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml
@@ -42,12 +42,18 @@ jobs:
           distribution: temurin
           java-version: 11
           cache: maven
+          server-id: 'oss.sonatype'
+          server-username: 'MAVEN_DEPLOY_USERNAME'
+          server-password: 'MAVEN_DEPLOY_TOKEN'
+          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          gpg-passphrase: 'MAVEN_GPG_PASSPHRASE'
       - name: Deploy
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SECRET_PASSPHRASE: ${{ secrets.SECRET_PASSPHRASE }}
+          MAVEN_DEPLOY_USERNAME: ${{ secrets.MAVEN_DEPLOY_USERNAME }}
+          MAVEN_DEPLOY_TOKEN: ${{ secrets.MAVEN_DEPLOY_TOKEN }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
         run: |
-          .github/scripts/decrypt-secrets.sh
           .github/scripts/deploy.sh
 
   compatibility:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -32,20 +32,26 @@ jobs:
           distribution: temurin
           java-version: 11
           cache: maven
+          server-id: 'oss.sonatype'
+          server-username: 'MAVEN_DEPLOY_USERNAME'
+          server-password: 'MAVEN_DEPLOY_TOKEN'
+          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          gpg-passphrase: 'MAVEN_GPG_PASSPHRASE'
 
       - name: maven release ${{steps.metadata.outputs.current-version}}
+        env:
+          MAVEN_DEPLOY_USERNAME: ${{ secrets.MAVEN_DEPLOY_USERNAME }}
+          MAVEN_DEPLOY_TOKEN: ${{ secrets.MAVEN_DEPLOY_TOKEN }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
         run: |
           java -version
-          gpg --quiet --batch --yes --decrypt --passphrase="${{secrets.SECRET_PASSPHRASE}}" --output smallrye-sign.asc .github/encrypted/smallrye-sign.asc.gpg
-          gpg --quiet --batch --yes --decrypt --passphrase="${{secrets.SECRET_PASSPHRASE}}" --output maven-settings.xml .github/encrypted/maven-settings.xml.gpg
-          gpg --fast-import --no-tty --batch --yes smallrye-sign.asc
           git config --global user.name "SmallRye CI"
           git config --global user.email "[email protected]"
           git checkout -b release
-          ./mvnw -B release:prepare -Prelease -DreleaseVersion=${{steps.metadata.outputs.current-version}} -DdevelopmentVersion=${{steps.metadata.outputs.next-version}} -s maven-settings.xml
+          ./mvnw -B release:prepare -Prelease -DreleaseVersion=${{steps.metadata.outputs.current-version}} -DdevelopmentVersion=${{steps.metadata.outputs.next-version}}
           git checkout ${{github.base_ref}}
           git rebase release
-          ./mvnw -B release:perform -Prelease -s maven-settings.xml
+          ./mvnw -B release:perform -Prelease
           git push
           git push --tags