Skip to content

fix: sign Maven Central release artifacts#35

Merged
musketyr merged 2 commits into
masterfrom
fix/release-signatures
Jun 10, 2026
Merged

fix: sign Maven Central release artifacts#35
musketyr merged 2 commits into
masterfrom
fix/release-signatures

Conversation

@jean-de-bot

Copy link
Copy Markdown
Collaborator

Summary

  • fixes release signing so Maven publications actually emit .asc files
  • drops the unused signing key id from the release workflow and signs with the in-memory key directly
  • adds manual release dispatch with an explicit version so a failed Central validation can be retried from the fixed workflow

Verification

  • ./gradlew check --no-daemon --stacktrace
  • generated a temporary local PGP key and ran ./gradlew publishToMavenLocal -Prelease=true -Pversion=4.0.13 --no-daemon --stacktrace
  • verified every spreadsheet-builder-* 4.0.13 local Maven artifact has matching .asc signatures
  • ./gradlew publishAndReleaseToMavenCentral -Prelease=true -Pversion=4.0.13 --dry-run --no-daemon --stacktrace

@sonarqubecloud

Copy link
Copy Markdown

@jean-de-bot

Copy link
Copy Markdown
Collaborator Author

Updated per review: removed the manual workflow trigger. Release remains tag-only; after this PR merges, create a new version/tag to publish with the fixed signing wiring.

@musketyr musketyr merged commit 1593851 into master Jun 10, 2026
5 checks passed
@musketyr musketyr deleted the fix/release-signatures branch June 10, 2026 13:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants