This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-jcasbin.git
The following commit(s) were added to refs/heads/master by this push:
new 0b07568 build: publish Maven artifacts through ASF Nexus staging
(#537)
0b07568 is described below
commit 0b07568f765ed9cdbfb0f7d5a6ac956c321b8777
Author: Emery <[email protected]>
AuthorDate: Thu Oct 15 02:12:46 2026 +0800
build: publish Maven artifacts through ASF Nexus staging (#537)
---
.github/workflows/maven-ci.yml | 3 +
.github/workflows/maven-publish.yml | 89 ----------------------
.github/workflows/release.yml | 15 +---
RELEASING.md | 145 +++++++++++++++---------------------
pom.xml | 74 +++++++++---------
5 files changed, 102 insertions(+), 224 deletions(-)
diff --git a/.github/workflows/maven-ci.yml b/.github/workflows/maven-ci.yml
index ef2277f..ea00f58 100644
--- a/.github/workflows/maven-ci.yml
+++ b/.github/workflows/maven-ci.yml
@@ -41,6 +41,9 @@ jobs:
distribution: temurin
java-version: 8
+ - name: Check unsigned Apache release profile
+ run: mvn -B -ntp clean verify -Papache-release -Dgpg.skip=true
-DskipTests=true
+
- name: Build with Maven
run: mvn -B -ntp clean verify cobertura:cobertura -Dgpg.skip=true
diff --git a/.github/workflows/maven-publish.yml
b/.github/workflows/maven-publish.yml
deleted file mode 100644
index c99c5e3..0000000
--- a/.github/workflows/maven-publish.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-name: Publish Maven
-
-on:
- workflow_call:
- inputs:
- maven_version:
- required: true
- type: string
- workflow_dispatch:
- inputs:
- maven_version:
- description: Maven release version to publish, for example 1.2.3
- required: true
- type: string
-
-permissions:
- contents: read
-
-jobs:
- publish-maven:
- name: Publish Maven
- if: ${{ github.repository == 'apache/casbin-jcasbin' }}
- runs-on: ubuntu-latest
- concurrency:
- group: maven-${{ github.ref }}
- cancel-in-progress: false
- steps:
- - name: Checkout
- uses: actions/checkout@v4
- with:
- fetch-depth: 0
-
- - name: Verify the requested release version
- env:
- MAVEN_VERSION: ${{ inputs.maven_version }}
- run: |
- set -euo pipefail
- python3 - <<'PY'
- import os
- import re
- requested = os.environ['MAVEN_VERSION']
- if not re.fullmatch(r'[0-9]+\.[0-9]+\.[0-9]+', requested):
- raise SystemExit('Expected a final Maven release version X.Y.Z')
- if os.environ['GITHUB_REF'] != f'refs/tags/v{requested}':
- raise SystemExit('Publish only from the matching final release
tag after the vote')
- PY
-
- - name: Verify promoted ASF release before loading signing credentials
- env:
- MAVEN_VERSION: ${{ inputs.maven_version }}
- run: python3 .github/scripts/verify_release.py "${MAVEN_VERSION}"
--output verified-release
-
- - name: Set up JDK 1.8
- uses: actions/setup-java@v4
- with:
- distribution: temurin
- java-version: 8
- server-id: ossrh
- server-username: OSSRH_JIRA_USERNAME
- server-password: OSSRH_JIRA_PASSWORD
- gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
- gpg-passphrase: GPG_PASSPHRASE
-
- - name: Publish Maven
- run: |
- mvn -B -ntp deploy -DskipTests "-Drevision=${MAVEN_VERSION}"
- env:
- MAVEN_VERSION: ${{ inputs.maven_version }}
- GPG_KEY_NAME: ${{ secrets.GPG_KEY_NAME }}
- GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
- OSSRH_JIRA_USERNAME: ${{ secrets.OSSRH_JIRA_USERNAME }}
- OSSRH_JIRA_PASSWORD: ${{ secrets.OSSRH_JIRA_PASSWORD }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f6b78e..cb10fe3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,8 @@ name: Release
# Releases are cut manually by pushing a git tag:
# v1.4.0-rc1 -> GitHub pre-release only (source package for the Apache vote)
-# v1.4.0 -> GitHub release + publish to Maven Central
+# v1.4.0 -> GitHub release using promoted ASF source originals
+# Maven promotion is a separate release-manager action on the reviewed Nexus
repository.
#
# The release manager downloads the source package from the release, signs it
# locally, and uses it for voting. This workflow does not sign anything.
@@ -219,13 +220,5 @@ jobs:
gh release create "${TAG}" dist/* --verify-tag \
--title "JCasbin ${TAG}" --notes-file RELEASE_NOTES.md
"${FLAGS[@]}"
- publish-maven:
- name: Publish Maven
- needs:
- - prepare
- - github-release
- if: ${{ needs.prepare.outputs.prerelease == 'false' }}
- uses: ./.github/workflows/maven-publish.yml
- with:
- maven_version: ${{ needs.prepare.outputs.maven_version }}
- secrets: inherit
+ # Maven promotion is performed separately on the reviewed closed Nexus
+ # repository after PPMC/IPMC approval. Do not rebuild Maven artifacts here.
diff --git a/RELEASING.md b/RELEASING.md
index 066edc8..7f70e0d 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -19,90 +19,61 @@ under the License.
# Releasing JCasbin
-Prepare dependency, licensing and workflow changes together in one
-release-preparation PR. Complete the scoped checks before requesting merge.
-Use [BUILDING.md](BUILDING.md) for the full Java 8/Maven build. Release-script
-tests run with `python3 -m unittest discover -s .github/scripts -p
'test_*.py'`.
-The release workflows require Python 3 and GnuPG, provided by Ubuntu runners.
-
-## Versioning
-
-The version is **not** committed to the source tree. `pom.xml` declares
-`<version>${revision}</version>` with the placeholder `0.0.0`, and the release
-version comes from the git tag: `vX.Y.Z-rcN` and `vX.Y.Z` both map to Maven
-version `X.Y.Z`. The Maven publish job passes `-Drevision=X.Y.Z`, and
-`flatten-maven-plugin` writes the resolved version into the POM that is
-deployed to Maven Central. Nothing in the repository needs to change between
-releases except the tag.
-
-## Before creating an RC tag
-
-The Maven coordinates are `org.apache.casbin:jcasbin` starting with 1.100.0.
-Java package names remain unchanged. Check the effective and flattened POMs,
-README coordinates and generated JAR metadata together. Confirm that the
-project's Central publishing account can administer the `org.apache.casbin`
-namespace before attempting publication; permission for `org.casbin` alone
-does not establish permission for the new namespace. See the migration note
-in README.md for downstream dependency handling.
-
-1. Check the latest releases/tags and choose the next `X.Y.Z`.
- Resolve relevant dependency updates and legal/source-archive findings in the
- preparation PR. The approved release scope determines which changes are
included.
-2. After merge, record the exact merged SHA and verify its build. Check the
- final source archive with Apache RAT and review LICENSE, NOTICE, DISCLAIMER,
- third-party material and any exclusions. New merged bytes need new evidence.
-3. Confirm that a maintainer can create the tag, the release manager can sign
- and write the Casbin ASF distribution directories, and the signing public
- key is in the official Casbin KEYS file.
-4. The Maven job uses existing repository secrets `GPG_PRIVATE_KEY`,
- `GPG_PASSPHRASE`, `GPG_KEY_NAME`, `OSSRH_JIRA_USERNAME` and
- `OSSRH_JIRA_PASSWORD`. The last two names are retained for compatibility:
- their values must be the Central Publisher Portal user-token username and
- password with publishing permission for `org.apache.casbin`, not old OSSRH
login
- credentials. Check configuration without disclosing secret values.
-
-## RC and community vote
-
-Create `vX.Y.Z-rcN` at the reviewed merged SHA. The tag workflow creates a
-GitHub prerelease containing:
-
-- `apache-casbin-jcasbin-X.Y.Z-incubating-src.tar.gz` and its `.sha512`;
-- `apache-casbin-jcasbin-X.Y.Z-incubating-src.zip` and its `.sha512`.
-
-Download and verify these exact archives; independently inspect/unpack/build
-them. Sign **both** archives, adding each `.asc`. Stage all six files under
-`https://dist.apache.org/repos/dist/dev/incubator/casbin/jcasbin-X.Y.Z-incubating-rcN/`.
-Verify the public downloads, signatures and checksums, then conduct the
-applicable Casbin/Incubator votes on these immutable files. Never overwrite a
-staged candidate. If candidate bytes must change, use a new RC number.
-
-GitHub refuses creation if that Release already exists. A failed or partial
-run needs its actual uploaded state inspected; do not delete and recreate a
-candidate already used for voting as a retry mechanism.
-
-## Promote and publish after approval
-
-1. Record the successful applicable vote results. Promote the same six files
- to the ASF release directory `incubator/casbin/jcasbin-X.Y.Z-incubating/`.
-2. Wait until all six files are available at
- `https://downloads.apache.org/incubator/casbin/jcasbin-X.Y.Z-incubating/`.
-3. Create the final `vX.Y.Z` tag at the same reviewed RC commit. This workflow
- downloads the promoted ASF originals, verifies SHA-512 and detached
- signatures against Casbin KEYS, and compares both archive file sets with
- the tagged Git source. It does not rebuild or replace those source archives.
-4. GitHub Release creation fails if the Release already exists. Maven Central
- publishing follows only after the final GitHub Release job succeeds.
- A Maven-only retry is available through **Publish Maven** on the matching
- final tag. It repeats the ASF-source verification before loading private
- signing credentials; never dispatch it from master or an RC tag. Check
- whether the Maven version already exists before retrying a failed publish.
-5. Verify the published distributions, update download links, send the release
- announcement as authorized, and retain the vote/artifact evidence.
-
-Missing ASF files, mismatched source, bad checksums or invalid signatures stop
-publication. Availability in ASF's release directory is an execution gate;
-the release manager remains responsible for the actual vote and promotion.
-These operations require no additional source PR after the preparation merges.
-
-References: [ASF release
policy](https://www.apache.org/legal/release-policy.html)
-and [Central Maven
publishing](https://central.sonatype.org/publish/publish-portal-maven/).
+Use Java 8 and Maven 3.9.x. Prepare the release changes in one PR, then
+verify its actual merged commit and CI. Java imports stay `org.casbin.jcasbin`;
+Maven coordinates are `org.apache.casbin:jcasbin:X.Y.Z`.
+
+## Release checklist
+
+1. Confirm the release manager's signing key is in the project KEYS file and
+ the ASF Nexus profile covers `org.apache.casbin`. Keep private Maven
settings
+ outside Git, using server ID `apache.releases.https`. The Apache parent POM
+ provides the staging and snapshot URLs; do not override them. Signing,
+ Nexus access and ASF dist access are separate permissions.
+2. Create an unused `vX.Y.Z-rcN` tag at the reviewed merged commit. Download
the
+ workflow's tar.gz and ZIP source packages and SHA-512 files. Check them
against
+ the tag and build a disposable extraction as described in BUILDING.md.
+ Keep the original archives: some tests rewrite example policies.
+3. Review the source and generated main/sources/Javadoc JARs, flattened POM,
+ legal files and documentation resources. Resolve any identified release
+ blockers. Javadoc licensing is being reviewed separately; this Maven route
+ change does not clear that question or require a newer documentation JDK.
+4. From a fresh extraction of the same source, build, sign and upload Maven
+ artifacts to ASF review staging with the standard release profile:
+
+ ```sh
+ mvn -B -ntp clean deploy -Papache-release -Drevision=X.Y.Z
+ ```
+
+ Use your private settings with `-s /path/to/settings.xml` if needed. Do not
+ skip tests or signing for a real release. The parent profile signs the main,
+ sources and Javadoc JARs and resolved POM. Source-release assembly/checksum
+ executions are disabled because the tagged source archives from step 2 are
+ the vote originals; do not create another source archive from test-modified
+ files. Sign those original tar.gz/ZIP files separately and stage them with
+ their signatures and SHA-512 files under a new ASF dev RC directory.
+5. Inspect the actual Nexus repository ID and artifacts, then close it for
+ review. Independently download all JARs/POM/signatures, verify KEYS,
+ signatures, hashes, GAV, legal material and correspondence with the source.
+ Record named source and binary review. Check remote state before retrying;
+ never overwrite a candidate or drop someone else's repository.
+6. Start fresh project/PPMC and IPMC votes with the exact source tag/commit,
+ ASF dev source URL, closed Maven repository URL, KEYS and verification
+ results. Link the dev ballot/result in the general request, and count the
+ two bodies separately. Cancelled RC votes cannot be reused.
+7. After both approvals, promote the voted source archives to ASF release
+ distribution and release the same closed Nexus repository. Promotion does
+ not rebuild Maven files. Verify public downloads and Maven resolution.
+ Push `vX.Y.Z` at the reviewed RC commit only after source promotion: its
+ workflow verifies and reuses the promoted ASF originals for GitHub Release,
+ with no Maven rebuild or deployment. Complete the download page and
announcement.
+
+For an unsigned local check of the release profile, use
+`mvn -B -ntp clean verify -Papache-release -Drevision=X.Y.Z -Dgpg.skip=true`.
+This is not a signing or staging test. Ordinary development still uses
+BUILDING.md and does not need the release profile.
+
+References: [Apache parent POM](https://maven.apache.org/pom/asf/),
+[ASF Maven guide](https://infra.apache.org/publishing-maven-artifacts.html),
+[ASF release policy](https://www.apache.org/legal/release-policy.html),
+[Incubation
policy](https://incubator.apache.org/policy/incubation.html#releases).
diff --git a/pom.xml b/pom.xml
index dd6f9cf..a166026 100644
--- a/pom.xml
+++ b/pom.xml
@@ -45,9 +45,10 @@ under the License.
</issueManagement>
<parent>
- <groupId>org.sonatype.oss</groupId>
- <artifactId>oss-parent</artifactId>
- <version>7</version>
+ <groupId>org.apache</groupId>
+ <artifactId>apache</artifactId>
+ <version>40</version>
+ <relativePath/>
</parent>
<licenses>
<license>
@@ -76,6 +77,7 @@ under the License.
<properties>
<revision>0.0.0</revision>
+ <javaVersion>8</javaVersion>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<slf4j.version>2.0.16</slf4j.version>
</properties>
@@ -96,6 +98,12 @@ under the License.
</resource>
</resources>
<plugins>
+ <plugin>
+ <!-- Keep the project's reviewed LICENSE/NOTICE instead of
generated templates. -->
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-remote-resources-plugin</artifactId>
+ <configuration><skip>true</skip></configuration>
+ </plugin>
<plugin>
<!-- Resolve ${revision} in the POM that gets
installed/deployed. -->
<groupId>org.codehaus.mojo</groupId>
@@ -143,27 +151,6 @@ under the License.
</execution>
</executions>
</plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-gpg-plugin</artifactId>
- <version>3.2.7</version>
- <executions>
- <execution>
- <id>sign-artifacts</id>
- <phase>verify</phase>
- <goals>
- <goal>sign</goal>
- </goals>
- </execution>
- </executions>
- <configuration>
- <!-- Prevent gpg from using pinentry programs -->
- <gpgArguments>
- <arg>--pinentry-mode</arg>
- <arg>loopback</arg>
- </gpgArguments>
- </configuration>
- </plugin>
<plugin>
<!-- Allow attaching Javadoc during releases -->
<groupId>org.apache.maven.plugins</groupId>
@@ -216,19 +203,6 @@ under the License.
</execution>
</executions>
</plugin>
- <plugin>
- <!-- Automatically close and deploy from OSSRH -->
- <groupId>org.sonatype.central</groupId>
- <artifactId>central-publishing-maven-plugin</artifactId>
- <version>0.6.0</version>
- <extensions>true</extensions>
- <configuration>
- <publishingServerId>ossrh</publishingServerId>
- <tokenAuth>true</tokenAuth>
- <!-- Release versions will be synced to Maven Central
automatically. -->
- <autoPublish>true</autoPublish>
- </configuration>
- </plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
@@ -319,4 +293,30 @@ under the License.
<version>2.18.9</version>
</dependency>
</dependencies>
+ <profiles>
+ <profile>
+ <id>apache-release</id>
+ <build>
+ <plugins>
+ <!-- Source archives and SHA-512 files come from the
reviewed RC tag. -->
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-assembly-plugin</artifactId>
+ <executions><execution>
+ <id>source-release-assembly</id>
+ <phase>none</phase>
+ </execution></executions>
+ </plugin>
+ <plugin>
+ <groupId>eu.maveniverse.maven.plugins</groupId>
+ <artifactId>checksum-plugin3</artifactId>
+ <executions><execution>
+ <id>source-release-checksum</id>
+ <phase>none</phase>
+ </execution></executions>
+ </plugin>
+ </plugins>
+ </build>
+ </profile>
+ </profiles>
</project>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
