From 584180276fce9d197f45c5534fdfd4075f4e8f06 Mon Sep 17 00:00:00 2001
From: Fabrice Bibonne <fabrice.bibonne@courriel.eco>
Date: Wed, 28 Jan 2026 06:52:45 +0100
Subject: [PATCH] pom (deploy artifact signing with sigstore)

---
 .github/workflows/deploy-release.yml |  3 ++-
 README.md                            |  8 ++++++++
 pom.xml                              | 23 ++++++++++++++++-------
 3 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy-release.yml b/.github/workflows/deploy-release.yml
index ac65948..386a330 100644
--- a/.github/workflows/deploy-release.yml
+++ b/.github/workflows/deploy-release.yml
@@ -9,6 +9,7 @@ jobs:
       runs-on: ubuntu-latest
       permissions:
         contents: write
+        id-token: write
       steps:
         - uses: actions/checkout@v4
         - name: Set up JDK
@@ -36,7 +37,7 @@ jobs:
         - run: mv target/boot-properties-logger-starter-${{steps.version.outputs.prop}}.jar target/boot-properties-logger-starter.jar
         - name: Create Release
           id: create_release
-          uses: ncipollo/release-action@v1.16.0
+          uses: ncipollo/release-action@v1.20.0
           with:
             tag: v${{steps.version.outputs.prop}}
             commit: master
diff --git a/README.md b/README.md
index 1bde162..bf06414 100644
--- a/README.md
+++ b/README.md
@@ -195,3 +195,11 @@ methods. If you have no other choice (make sure you had a complete look to
 [the numerous ways to override properties in Spring Boot](https://docs.spring.io/spring-boot/reference/features/external-config.html) )
 that defining `@DynamicPropertySource` methods to override properties in a test and you want to check the value of the 
 overrided property, consider logging it yourself or write an assertion in your test
+
+## Maintainers notes
+
+- to update pom.xml if one can't get dependabot, find updates with :
+    ```
+    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-property-updates
+    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-parent-updates
+    ```
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 060a0a1..c4c043c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -12,14 +12,9 @@
 
     <groupId>io.github.fbibonne</groupId>
     <artifactId>boot-properties-logger-starter</artifactId>
-    <version>2.0.0</version>
+    <version>${sigstore-maven-plugin.version}</version>
     <packaging>jar</packaging>
 
-    <!-- If you can't get dependabot, find updates with :
-    ```
-    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-property-updates
-    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-parent-updates
-    ``` -->
     <properties>
         <jspecify.version>1.0.0</jspecify.version>
         <maven.compiler.source>17</maven.compiler.source>
@@ -29,6 +24,7 @@
         <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
         <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
         <central-publishing-maven-plugin.version>0.10.0</central-publishing-maven-plugin.version>
+        <sigstore-maven-plugin.version>2.0.0</sigstore-maven-plugin.version>
     </properties>
 
     <name>Spring Boot Properties Logger</name>
@@ -163,6 +159,20 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>dev.sigstore</groupId>
+                <artifactId>sigstore-maven-plugin</artifactId>
+                <version>${sigstore-maven-plugin.version}</version>
+                <executions>
+                    <execution>
+                        <id>sign</id>
+                        <phase>install</phase>
+                        <goals>
+                            <goal>sign</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.sonatype.central</groupId>
                 <artifactId>central-publishing-maven-plugin</artifactId>
@@ -171,7 +181,6 @@
                 <configuration>
                     <publishingServerId>central</publishingServerId>
                     <deploymentName>Properties-Logger</deploymentName>
-                    <autoPublish>true</autoPublish>
                 </configuration>
             </plugin>
         </plugins>