ci(release): publish signed KMP artifact matrix to Maven Central - #20
Merged
octaviospain merged 2 commits intoJul 21, 2026
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
🚧 Files skipped from review as they are similar to previous changes (10)
📝 WalkthroughWalkthroughThe PR adds signed Kotlin Multiplatform publication to Maven Central, moves release execution to macOS, wires CI credentials and signing, generates release notes and an SBOM, documents the release process, and updates Gradle dependency verification metadata. ChangesMaven release pipeline
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Gradle
participant MavenCentral
participant GitHubRelease
GitHubActions->>Gradle: run publishAndReleaseToMavenCentral
GitHubActions->>Gradle: provide Central Portal credentials and GPG key
Gradle->>MavenCentral: upload signed KMP artifact matrix
GitHubActions->>GitHubRelease: attach release notes and SBOM
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 52-64: Update the “Publish signed artifact matrix to Maven
Central” step’s Gradle command to set mavenCentralDeploymentValidation to
PUBLISHED, ensuring publishAndReleaseToMavenCentral waits until artifacts are
downloadable before the GitHub release proceeds.
In `@gradle/verification-metadata.xml`:
- Line 9: The org.apache.groovy trust rule is broader than the IDE-only
dependency set. In gradle/verification-metadata.xml at line 9, replace the
group-wide trust with entries for only the exact Groovy modules/files IntelliJ
resolves, and update CONTRIBUTING.md lines 352-358 to document the same scoped
artifacts and rationale.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ab7b26c4-83d1-4028-9ba6-88d42e9037f3
📒 Files selected for processing (8)
.github/workflows/release.ymlCONTRIBUTING.mdbuild-logic/convention/build.gradle.ktsbuild-logic/convention/src/main/kotlin/cloudevents.kmp-library.gradle.ktsbuild-logic/convention/src/main/kotlin/cloudevents.publishing.gradle.ktscore/build.gradle.ktsgradle/libs.versions.tomlgradle/verification-metadata.xml
octaviospain
force-pushed
the
12-maven-publishing-pipeline
branch
2 times, most recently
from
July 21, 2026 12:38
9c0cbed to
af07699
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 104-113: Update the “Commit and push the changelog” step to detect
both modified and untracked CHANGELOG.md files before committing. Replace the
git diff-only condition with a git status --porcelain check scoped to
CHANGELOG.md, while preserving the existing git add, commit, and push flow.
- Line 113: Update the release workflow step containing the git push command so
github.ref_name is passed through an environment variable and referenced via the
shell’s environment expansion, rather than interpolated directly in run:.
Preserve the existing HEAD push target and configure the variable at the step
level.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 550388c5-f459-4bf7-a5c8-27792f9ba567
📒 Files selected for processing (10)
.github/workflows/release.yml.gitignoreCONTRIBUTING.mdbuild-logic/convention/build.gradle.ktsbuild-logic/convention/src/main/kotlin/cloudevents.kmp-library.gradle.ktsbuild-logic/convention/src/main/kotlin/cloudevents.publishing.gradle.ktscliff.tomlcore/build.gradle.ktsgradle/libs.versions.tomlgradle/verification-metadata.xml
🚧 Files skipped from review as they are similar to previous changes (8)
- build-logic/convention/src/main/kotlin/cloudevents.publishing.gradle.kts
- build-logic/convention/src/main/kotlin/cloudevents.kmp-library.gradle.kts
- core/build.gradle.kts
- gradle/libs.versions.toml
- cliff.toml
- build-logic/convention/build.gradle.kts
- CONTRIBUTING.md
- gradle/verification-metadata.xml
Add a cloudevents.publishing convention plugin (vanniktech) that publishes the full KMP artifact matrix (root module plus one Maven module per target) to the Central Portal, with GPG signing and a complete POM (io.cloudevents:cloudevents-kotlin-core, Apache-2.0, SCM, developer, and organization metadata). The release job runs on macos-latest so one runner builds the whole matrix (JVM, JS, Wasm, Apple, Linux, mingw) into a single Central deployment. It tags, publishes and auto-releases, waiting for the deployment to be fully PUBLISHED rather than only VALIDATED before announcing, then generates the SBOM and cuts the GitHub release. Credentials come only from CI environment variables and are never committed. Regenerate gradle/verification-metadata.xml for the vanniktech and signing dependencies, and trust IDE-only artifacts (sources/javadoc jars, org.apache.groovy:groovy, gradle:gradle) so an IntelliJ sync no longer fails verification. Document the release path, required secrets, and the IDE trust rules in CONTRIBUTING. Closes cloudevents#12 Signed-off-by: Octavio Calleya Garcia <octavio@transgressoft.net>
Add a cliff.toml grouping the repository's Conventional Commits, and wire the git-cliff action into the release workflow: it regenerates the cumulative CHANGELOG.md and commits it back to the default branch after the release tag, and builds the GitHub release body from the tag's section. SBOM generation runs before the changelog steps so the working tree is clean when axion-release resolves the version, keeping the SBOM on the exact released version. The transient RELEASE_NOTES.md is git-ignored; CHANGELOG.md is the committed artifact. Detect the changelog with git status --porcelain so an untracked first-release CHANGELOG.md is still committed, and pass github.ref_name through an env var to avoid run-step template injection. Signed-off-by: Octavio Calleya Garcia <octavio@transgressoft.net>
octaviospain
force-pushed
the
12-maven-publishing-pipeline
branch
from
July 21, 2026 13:05
af07699 to
c3f386f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Wires the Maven Central (Central Portal) publishing pipeline so
io.cloudevents:cloudevents-kotlin-corecan be released. The pipeline is fully configured but only runs when a release is cut, so this PR changes no build outputs on its own.What changed
cloudevents.publishingconvention plugin (built oncom.vanniktech.maven.publish) that publishes the full Kotlin Multiplatform artifact matrix — the root module plus one Maven module per target — to the Central Portal, with GPG signing and a complete POM (groupio.cloudevents, artifactcloudevents-kotlin-core, Apache-2.0 license, SCM, developer, and organization metadata). Applied to thecoremodule.release.ymlnow runs onmacos-latest. Kotlin/Native Apple targets can only be built on macOS, and a single macOS runner builds the entire matrix (JVM + JS + Wasm + all Apple + both Linux + mingw), so the complete signed set lands in one Central deployment. The job tags the release, publishes and auto-releases to Central (waiting for the deployment to be fullyPUBLISHEDbefore announcing), then generates the SBOM and cuts the GitHub release. The previous Linux job stopped at tagging and would have silently omitted the Apple targets.cliff.tomland thegit-cliffaction turn the Conventional Commit history since the previous tag into grouped release notes (Features, Bug Fixes, Build & CI, …) that become the GitHub release body.ORG_GRADLE_PROJECT_*environment variables and are never committed.-sources.jar,-javadoc.jar, theorg.apache.groovy:groovydistribution module, and thegradle:gradlesource distribution) are trusted by name so an IntelliJ Gradle sync no longer fails verification for artifacts the command-line build never resolves.CONTRIBUTING.mdcovering the artifact matrix, local coordinate verification, the release process, and the required repository secrets.Published artifact matrix
io.cloudevents:cloudevents-kotlin-core…-core-jvm…-core-js…-core-wasm-js…-core-linuxx64,…-core-linuxarm64…-core-macosx64,…-core-macosarm64,…-core-iosarm64,…-core-iosx64,…-core-iossimulatorarm64…-core-mingwx64Each module carries its own jar/klib, sources jar, javadoc jar, POM, and module metadata, and every file is GPG-signed.
Maintainer action required before a release can publish
Publishing to the
io.cloudeventsnamespace needs repository secrets and namespace authorization that only the repo owners can provide:MAVEN_CENTRAL_USERNAME/MAVEN_CENTRAL_PASSWORDSIGNING_KEY/SIGNING_PASSWORDSIGNING_KEY_IDThe Central Portal account behind the token must be authorized to publish to the
io.cloudeventsnamespace.Testing
gradle publishToMavenLocalproduces correctly-coordinated artifacts (verified the JVM target and the root module: correct coordinates, complete POM, and valid Gradle module metadata listing every target variant).build.ymldependency-metadata cross-check re-resolves byte-identical, so the integrity gate stays green.Closes #12
Summary by CodeRabbit
Build & Release Pipeline
Documentation