From 27b7689512d0552d00479f07548220d5ac389e93 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:29:01 +0530 Subject: [PATCH 01/11] Create action.yml --- .../deploy-central-snapshot/action.yml | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 .github/actions/deploy-central-snapshot/action.yml diff --git a/.github/actions/deploy-central-snapshot/action.yml b/.github/actions/deploy-central-snapshot/action.yml new file mode 100644 index 00000000..f4c25f5b --- /dev/null +++ b/.github/actions/deploy-central-snapshot/action.yml @@ -0,0 +1,77 @@ +name: Deploy Snapshot to Central Portal +description: "Deploys a Maven SNAPSHOT package to Sonatype Central Portal Snapshots repository." + +inputs: + user: + description: "Sonatype Central Portal username (same as Maven Central)" + required: true + password: + description: "Sonatype Central Portal password (same as Maven Central)" + required: true + pgp-pub-key: + description: "The public pgp key ID (optional for snapshots but recommended)" + required: false + pgp-private-key: + description: "The private pgp key (optional for snapshots but recommended)" + required: false + pgp-passphrase: + description: "The passphrase for pgp (optional for snapshots but recommended)" + required: false + +runs: + using: composite + steps: + - name: "Setup Java" + uses: actions/setup-java@v4 + with: + distribution: 'sapmachine' + java-version: '21' + cache: maven + server-id: central + server-username: CENTRAL_USER + server-password: CENTRAL_PASSWORD + + - name: "Import GPG Key (if provided)" + if: inputs.pgp-private-key != '' + run: | + echo "${{ inputs.pgp-private-key }}" | gpg --batch --passphrase "$PASSPHRASE" --import + shell: bash + env: + PASSPHRASE: ${{ inputs.pgp-passphrase }} + + - name: "Verify SNAPSHOT version" + run: | + VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout) + echo "Current version: $VERSION" + if [[ ! "$VERSION" == *-SNAPSHOT ]]; then + echo "Error: Version $VERSION is not a SNAPSHOT version!" + echo "Central Portal Snapshots repository only accepts SNAPSHOT versions." + exit 1 + fi + echo "✅ Version $VERSION is a valid SNAPSHOT" + shell: bash + + - name: "Deploy Snapshot to Central Portal" + run: | + echo "🚀 Deploying SNAPSHOT to Sonatype Central Portal..." + if [ -n "$GPG_PASSPHRASE" ] && [ -n "$GPG_PUB_KEY" ]; then + mvn -B -ntp --show-version \ + -Dmaven.install.skip=true \ + -Dmaven.test.skip=true \ + -Dgpg.passphrase="$GPG_PASSPHRASE" \ + -Dgpg.keyname="$GPG_PUB_KEY" \ + clean deploy -P deploy-central-snapshot + else + mvn -B -ntp --show-version \ + -Dmaven.install.skip=true \ + -Dmaven.test.skip=true \ + -Dgpg.skip=true \ + clean deploy -P deploy-central-snapshot + fi + echo "✅ Snapshot deployed successfully!" + shell: bash + env: + CENTRAL_USER: ${{ inputs.user }} + CENTRAL_PASSWORD: ${{ inputs.password }} + GPG_PASSPHRASE: ${{ inputs.pgp-passphrase }} + GPG_PUB_KEY: ${{ inputs.pgp-pub-key }} From 7d3003e1621fca03e045376c01f40c6371243108 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:30:21 +0530 Subject: [PATCH 02/11] Create deploy-central-snapshot.yml --- .github/workflows/deploy-central-snapshot.yml | 136 ++++++++++++++++++ 1 file changed, 136 insertions(+) create mode 100644 .github/workflows/deploy-central-snapshot.yml diff --git a/.github/workflows/deploy-central-snapshot.yml b/.github/workflows/deploy-central-snapshot.yml new file mode 100644 index 00000000..dbf88f79 --- /dev/null +++ b/.github/workflows/deploy-central-snapshot.yml @@ -0,0 +1,136 @@ +name: Deploy Snapshot to Central Portal + +env: + JAVA_VERSION: '21' + +on: + # Manual trigger - select any branch from GitHub UI + workflow_dispatch: + inputs: + sign_artifacts: + description: 'Sign artifacts with GPG' + required: false + default: 'true' + type: choice + options: + - 'true' + - 'false' + + # Auto-trigger on push to this feature branch + push: + branches: + - snapshot_maven + +permissions: + contents: read + packages: read + +jobs: + verify-snapshot: + runs-on: ubuntu-latest + outputs: + is_snapshot: ${{ steps.check.outputs.is_snapshot }} + version: ${{ steps.check.outputs.version }} + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: ${{ env.JAVA_VERSION }} + cache: maven + + - name: Check version is SNAPSHOT + id: check + run: | + VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout) + echo "version=$VERSION" >> $GITHUB_OUTPUT + if [[ "$VERSION" == *-SNAPSHOT ]]; then + echo "is_snapshot=true" >> $GITHUB_OUTPUT + echo "✅ Version $VERSION is a SNAPSHOT" + else + echo "is_snapshot=false" >> $GITHUB_OUTPUT + echo "❌ Version $VERSION is NOT a SNAPSHOT - deployment will be skipped" + fi + + build: + runs-on: ubuntu-latest + needs: verify-snapshot + if: needs.verify-snapshot.outputs.is_snapshot == 'true' + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: ${{ env.JAVA_VERSION }} + cache: maven + + - name: Build + run: | + echo "🔨 Building SNAPSHOT version: ${{ needs.verify-snapshot.outputs.version }}" + mvn clean install -P unit-tests -DskipIntegrationTests + echo "✅ Build completed successfully!" + + - name: Upload build artifacts + uses: actions/upload-artifact@v6 + with: + name: snapshot-build + path: . + include-hidden-files: true + retention-days: 1 + + deploy: + name: Deploy Snapshot to Central Portal + runs-on: ubuntu-latest + needs: [verify-snapshot, build] + if: needs.verify-snapshot.outputs.is_snapshot == 'true' + environment: maven-central + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Download artifact + uses: actions/download-artifact@v7 + with: + name: snapshot-build + + - name: Deploy Snapshot (with GPG signing) + if: github.event.inputs.sign_artifacts != 'false' + uses: ./.github/actions/deploy-central-snapshot + with: + user: ${{ secrets.CENTRAL_REPOSITORY_USER }} + password: ${{ secrets.CENTRAL_REPOSITORY_PASS }} + pgp-pub-key: ${{ secrets.PGP_PUB_KEY }} + pgp-private-key: ${{ secrets.PGP_PRIVATE_KEY }} + pgp-passphrase: ${{ secrets.PGP_PASSPHRASE }} + + - name: Deploy Snapshot (without GPG signing) + if: github.event.inputs.sign_artifacts == 'false' + uses: ./.github/actions/deploy-central-snapshot + with: + user: ${{ secrets.CENTRAL_REPOSITORY_USER }} + password: ${{ secrets.CENTRAL_REPOSITORY_PASS }} + + - name: Summary + run: | + echo "## 🚀 Snapshot Deployed to Central Portal" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "**Version:** ${{ needs.verify-snapshot.outputs.version }}" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "**Repository:** https://central.sonatype.com/repository/maven-snapshots/" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "### Usage" >> $GITHUB_STEP_SUMMARY + echo '```xml' >> $GITHUB_STEP_SUMMARY + echo '' >> $GITHUB_STEP_SUMMARY + echo ' ' >> $GITHUB_STEP_SUMMARY + echo ' central-snapshots' >> $GITHUB_STEP_SUMMARY + echo ' https://central.sonatype.com/repository/maven-snapshots/' >> $GITHUB_STEP_SUMMARY + echo ' true' >> $GITHUB_STEP_SUMMARY + echo ' ' >> $GITHUB_STEP_SUMMARY + echo '' >> $GITHUB_STEP_SUMMARY + echo '```' >> $GITHUB_STEP_SUMMARY From 910dbf87419f07e8ca2fa623ac406267f6fabc15 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:52:32 +0530 Subject: [PATCH 03/11] Remove artifact upload/download from snapshot workflow The composite action runs clean deploy internally so the artifact shuttle between build and deploy jobs was redundant and causing download failures due to workspace conflicts after checkout. --- .github/workflows/deploy-central-snapshot.yml | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/.github/workflows/deploy-central-snapshot.yml b/.github/workflows/deploy-central-snapshot.yml index dbf88f79..087083f1 100644 --- a/.github/workflows/deploy-central-snapshot.yml +++ b/.github/workflows/deploy-central-snapshot.yml @@ -76,14 +76,6 @@ jobs: mvn clean install -P unit-tests -DskipIntegrationTests echo "✅ Build completed successfully!" - - name: Upload build artifacts - uses: actions/upload-artifact@v6 - with: - name: snapshot-build - path: . - include-hidden-files: true - retention-days: 1 - deploy: name: Deploy Snapshot to Central Portal runs-on: ubuntu-latest @@ -94,11 +86,6 @@ jobs: - name: Checkout uses: actions/checkout@v6 - - name: Download artifact - uses: actions/download-artifact@v7 - with: - name: snapshot-build - - name: Deploy Snapshot (with GPG signing) if: github.event.inputs.sign_artifacts != 'false' uses: ./.github/actions/deploy-central-snapshot From d20b4376cf7c8609137548ffcc4f2c3a97de1ee0 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:38:52 +0530 Subject: [PATCH 04/11] Update pom.xml Updated pom to use Central Portal snapshots --- pom.xml | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index b8e376a2..7672d63a 100644 --- a/pom.xml +++ b/pom.xml @@ -280,7 +280,7 @@ org.sonatype.central central-publishing-maven-plugin - 0.7.0 + 0.10.0 true @@ -346,6 +346,35 @@ + + deploy-central-snapshot + + + + central + Sonatype Central Portal Snapshots + https://central.sonatype.com/repository/maven-snapshots/ + + + + disabled-release + file:///dev/null + + + + + + org.sonatype.central + central-publishing-maven-plugin + + central + USER_MANAGED + true + + + + + From 290656e33b86964e79763fbac514eb70ec78eba7 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Tue, 21 Jul 2026 12:25:31 +0530 Subject: [PATCH 05/11] Add deploy-central-snapshot profile to sdm/pom.xml child module Child module had its own distributionManagement pointing to Artifactory. Without overriding it in the profile, Maven hits Artifactory for metadata during deploy and gets a 401. This profile redirects to Maven Central snapshots when -P deploy-central-snapshot is active. --- sdm/pom.xml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/sdm/pom.xml b/sdm/pom.xml index 90f0b4f8..fb5a2d34 100644 --- a/sdm/pom.xml +++ b/sdm/pom.xml @@ -98,6 +98,20 @@ + + deploy-central-snapshot + + + central + Sonatype Central Portal Snapshots + https://central.sonatype.com/repository/maven-snapshots/ + + + disabled-release + file:///dev/null + + + From 02063a911994dff194df3dd2fc5f378e2fac5b4b Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Wed, 29 Jul 2026 18:26:33 +0530 Subject: [PATCH 06/11] Updated the workflow --- .../actions/deploy-central-snapshot/action.yml | 15 ++++++++++++--- .github/workflows/deploy-central-snapshot.yml | 3 ++- pom.xml | 4 +--- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/actions/deploy-central-snapshot/action.yml b/.github/actions/deploy-central-snapshot/action.yml index f4c25f5b..0d9bbd75 100644 --- a/.github/actions/deploy-central-snapshot/action.yml +++ b/.github/actions/deploy-central-snapshot/action.yml @@ -32,11 +32,15 @@ runs: server-password: CENTRAL_PASSWORD - name: "Import GPG Key (if provided)" - if: inputs.pgp-private-key != '' + if: ${{ inputs.pgp-private-key != '' }} run: | - echo "${{ inputs.pgp-private-key }}" | gpg --batch --passphrase "$PASSPHRASE" --import - shell: bash + set +x + echo "::add-mask::$PGP_PRIVATE_KEY" + echo "::add-mask::$PASSPHRASE" + echo "$PGP_PRIVATE_KEY" | gpg --batch --passphrase "$PASSPHRASE" --import + shell: bash env: + PGP_PRIVATE_KEY: ${{ inputs.pgp-private-key }} PASSPHRASE: ${{ inputs.pgp-passphrase }} - name: "Verify SNAPSHOT version" @@ -53,6 +57,11 @@ runs: - name: "Deploy Snapshot to Central Portal" run: | + set +x + echo "::add-mask::$CENTRAL_USER" + echo "::add-mask::$CENTRAL_PASSWORD" + [ -n "$GPG_PASSPHRASE" ] && echo "::add-mask::$GPG_PASSPHRASE" + [ -n "$GPG_PUB_KEY" ] && echo "::add-mask::$GPG_PUB_KEY" echo "🚀 Deploying SNAPSHOT to Sonatype Central Portal..." if [ -n "$GPG_PASSPHRASE" ] && [ -n "$GPG_PUB_KEY" ]; then mvn -B -ntp --show-version \ diff --git a/.github/workflows/deploy-central-snapshot.yml b/.github/workflows/deploy-central-snapshot.yml index 087083f1..74db6526 100644 --- a/.github/workflows/deploy-central-snapshot.yml +++ b/.github/workflows/deploy-central-snapshot.yml @@ -80,7 +80,7 @@ jobs: name: Deploy Snapshot to Central Portal runs-on: ubuntu-latest needs: [verify-snapshot, build] - if: needs.verify-snapshot.outputs.is_snapshot == 'true' + if: needs.verify-snapshot.outputs.is_snapshot == 'true' && needs.build.result == 'success' environment: maven-central steps: - name: Checkout @@ -104,6 +104,7 @@ jobs: password: ${{ secrets.CENTRAL_REPOSITORY_PASS }} - name: Summary + if: success() run: | echo "## 🚀 Snapshot Deployed to Central Portal" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY diff --git a/pom.xml b/pom.xml index 7672d63a..c62ef8c2 100644 --- a/pom.xml +++ b/pom.xml @@ -367,9 +367,7 @@ org.sonatype.central central-publishing-maven-plugin - central - USER_MANAGED - true + true From 20c08b85d45051af048619bb634af604994231b2 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Wed, 29 Jul 2026 18:08:50 +0530 Subject: [PATCH 07/11] Removed run on push --- .github/workflows/deploy-central-snapshot.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/deploy-central-snapshot.yml b/.github/workflows/deploy-central-snapshot.yml index 74db6526..6b6c6b1d 100644 --- a/.github/workflows/deploy-central-snapshot.yml +++ b/.github/workflows/deploy-central-snapshot.yml @@ -16,10 +16,6 @@ on: - 'true' - 'false' - # Auto-trigger on push to this feature branch - push: - branches: - - snapshot_maven permissions: contents: read From bf6651247b4227eb91f96b59f5bbd2db9229bc38 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Thu, 30 Jul 2026 15:13:34 +0530 Subject: [PATCH 08/11] Fix snapshot deploy: disable central-publishing-plugin extension in deploy-central-snapshot profile With extensions=true in pluginManagement, central-publishing-maven-plugin replaces the entire deploy lifecycle, making maven-deploy-plugin unreachable. Setting extensions=false within this profile restores standard deploy behavior so maven-deploy-plugin can push directly to the Central Snapshots URL. --- pom.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/pom.xml b/pom.xml index c62ef8c2..c188cfe7 100644 --- a/pom.xml +++ b/pom.xml @@ -366,6 +366,7 @@ org.sonatype.central central-publishing-maven-plugin + false true From 60fb9fe0eca679c2d989c8e55f382fe53412e394 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Fri, 31 Jul 2026 16:26:18 +0530 Subject: [PATCH 09/11] Update action.yml --- .github/actions/newrelease/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/newrelease/action.yml b/.github/actions/newrelease/action.yml index 157842be..a987d567 100644 --- a/.github/actions/newrelease/action.yml +++ b/.github/actions/newrelease/action.yml @@ -28,7 +28,7 @@ runs: - name: Update version run: | VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,') - echo $VERSION > app/single-tenant/central-space/demoapp/version.txt + echo $VERSION > cap-notebook/version.txt mvn --no-transfer-progress versions:set-property -Dproperty=revision -DnewVersion=$VERSION #chmod +x ensure-license.sh #./ensure-license.sh From 20833cbd045c41492255948c2f6276d18178836c Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Fri, 31 Jul 2026 16:31:37 +0530 Subject: [PATCH 10/11] Update action.yml --- .github/actions/newrelease/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/newrelease/action.yml b/.github/actions/newrelease/action.yml index a987d567..04296d55 100644 --- a/.github/actions/newrelease/action.yml +++ b/.github/actions/newrelease/action.yml @@ -35,7 +35,7 @@ runs: git config --global user.name 'github-actions[bot]' git config --global user.email 'github-actions[bot]@users.noreply.github.com' git checkout -b develop - git add app/single-tenant/central-space/demoapp/version.txt + git add cap-notebook/version.txt git commit -am "Update version to $VERSION" git push --set-upstream origin develop shell: bash From 06b3b66843d0e344f33f015da6157531d309d259 Mon Sep 17 00:00:00 2001 From: vibhutikumar <160819926+vibhutikumar07@users.noreply.github.com> Date: Fri, 31 Jul 2026 16:36:49 +0530 Subject: [PATCH 11/11] Update main-build-and-deploy-oss.yml --- .github/workflows/main-build-and-deploy-oss.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main-build-and-deploy-oss.yml b/.github/workflows/main-build-and-deploy-oss.yml index ed47682d..74bfb732 100644 --- a/.github/workflows/main-build-and-deploy-oss.yml +++ b/.github/workflows/main-build-and-deploy-oss.yml @@ -14,7 +14,7 @@ permissions: jobs: update-version: - environment: maven-central + #environment: maven-central runs-on: ubuntu-latest #needs: blackduck steps: @@ -29,7 +29,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 with: - token: ${{ secrets.GH_TOKEN }} + token: ${{ secrets.GITHUB_TOKEN }} - name: Update version uses: ./.github/actions/newrelease