README.md

ORSSH Gradle Artefact publishing

This project was created just to test artefact publishing into maven central repository. org.microproject base group ID is used in this example. In order to publish your own code, you will have to register your own group ID. Only standard gradle plugins are used, check build.gradle file setup.

• Java 11 or Java 8
• Gradle 6.8 or later.
• Only standard Gradle plugins.
• Publishing of SNAPSHOT and RELEASE artefacts.

1. Sonatype account setup

• Sonatype account setup is done only once per base group ID.
• Create account at https://issues.sonatype.org, Register groupId (org.microproject), get ossrhUsername and ossrhPassword - your own OSSRH credentials.
  • Getting started
  • Choose your coordinates
• Create new GPG key.

  gpg --gen-key
  gpg --export-secret-keys -o ~/.gnupg/secring.gpg
  gpg2 --list-keys  
  gpg2 --list-keys --keyid-format short
  

• Upload created GPG public key to public key servers, so others can verify.

  gpg2 --keyserver http://keyserver.ubuntu.com:11371 --send-keys <YourKeyId>
  gpg2 --keyserver http://keys.gnupg.net:11371 --send-keys <YourKeyId>
  gpg2 --keyserver http://pool.sks-keyservers.net:11371 --send-keys <YourKeyId>
  

  YourKeyId = last 8 characters from public key ID
• Create property file ~/.gradle/gradle.properties with content.

  signing.keyId=<YourKeyId>
  signing.password=<YourKeyPassword>
  signing.secretKeyRingFile=<PathToYourKeyRingFile>
  ossrhUsername=username
  ossrhPassword=********
  

  YourKeyPassword = password used for key generation
  PathToYourKeyRingFile = path to previously exported secring.gpg file

2. Project Compile & Test

Note that build.gradle is adapted so normal compilation and test works on any build system. Publishing to ORSSH works only on system setup properly as described above.

gradle clean build test

Project versioning

It is recommended to use semantic versioning. This is example project versioning and branching plan. Example: 1.0.0-SNAPSHOT < 1.0.0.

3. Publish

gradle publishToMavenLocal
gradle publish

Last step gradle publish, based on current artefact version publishes to snapshot or stage repository. Artefact version using -SNAPSHOT suffix is automatically published to snapshot repository.

3.1 SNAPSHOT artefacts

Artefacts published to oss.sonatype.org SNAPSHOT repository must have -SNAPSHOT version suffix. No further action required after gradle publish command.

• Published SNAPSHOT artefact example

3.2 Stage and Release artefacts

Artefacts published to oss.sonatype.org stage repository must NOT have -SNAPSHOT version suffix. Release is finished manually using sonatype nexus UI. Login using your OSSRH credentials. After gradle publish action, staging repository is in open state.

• Next step will close staging repository. Close action will verify published artefacts.
• After staging repository is closed successfully, there are 2 options: Release or Drop.
  
• In case Release is selected, staging repository is fully published to maven central. You have to wait until the release propagates into official maven repositories. It usually takes ~4h until your artefacts are visible in public maven repositories.
• In case Drop is selected, whole release is discarded.
• Published Release artefact example
• Published Release artefact search

4. Consuming SNAPSHOT Artefacts

Consuming SNAPSHOT Artefact in Maven

<project ...>
    ...
    <dependencies>
        <dependency>
            <groupId>one.microproject.test</groupId>
            <artifactId>test-artefact</artifactId>
            <version>1.0.4-SNAPSHOT</version>
        </dependency>
    </dependencies>
    <repositories>
        <repository>
            <id>sonatype-snapshot</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </repository>
    </repositories>
</project>

Consuming SNAPSHOT Artefact in Gradle

dependencies {
  implementation 'one.microproject.test:test-artefact:1.0.4-SNAPSHOT' 
}
repositories {
    maven {
        url "https://oss.sonatype.org/content/repositories/snapshots"
    }
}

5. Consuming Released Artefacts

Consuming Released Artefact in Maven

<project ...>
    ...
    <dependencies>
        <dependency>
            <groupId>one.microproject.test</groupId>
            <artifactId>test-artefact</artifactId>
            <version>1.0.7</version>
        </dependency>
    </dependencies>
</project>

Consuming Released Artefact in Gradle

dependencies {
  implementation 'one.microproject.test:test-artefact:1.0.7' 
}

References

• Publish into the Central repository
• Gradle Signing Plugin
• Gradle Maven Publish Plugin
• Working with PGP Signatures
• Sign and publish on Maven Central