SITES-49657 - Fix Maven Central credential wiring in the release workflow - #1088
Closed
LSantha wants to merge 1 commit into
Closed
SITES-49657 - Fix Maven Central credential wiring in the release workflow#1088LSantha wants to merge 1 commit into
LSantha wants to merge 1 commit into
Conversation
LSantha
changed the title
* map MAVEN_CENTRAL_USERNAME / MAVEN_CENTRAL_PASSWORD into the release job env, so the settings.xml placeholders for the Sonatype Central Portal server resolve instead of being sent literally, which made the central-publishing plugin fail with HTTP 401 * document the two secrets in the workflow header
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
.github/scripts/settings.xmlauthenticates the Sonatype Central Portalcentralserver with${env.MAVEN_CENTRAL_USERNAME}/${env.MAVEN_CENTRAL_PASSWORD}, but thereleasejob never mapped those two secrets into itsenv:block. Maven does not fail on an unresolvable${env.…}— it keeps the literal text, so the placeholder string itself was sent as the user token andcentral-publishing-maven-pluginfailed withHTTP 401 Unauthorizedoncore-cif-components-reactor. That aborted the 2.18.6 deploy before any Maven artifact reached Central.Change
MAVEN_CENTRAL_USERNAMEandMAVEN_CENTRAL_PASSWORDinto theenv:of thereleasejob'sReleasestepBoth secrets already exist in the repository; only the mapping was missing. Nothing outside the tag-triggered release workflow changes.
Testing
Not exercisable from a PR — the workflow only triggers on a release tag. Verified by inspection that the two variable names match the
${env.…}references in.github/scripts/settings.xml, and that theReleasestep'senv:block now carries all six variables that step needs. The change is exercised on the next release tag.Not covered
The
deploy-queriesjob fails for a separate reason: theDEPLOY_QUERIES_SSH_KEYsecret does not exist in the repository. It needs a deploy key with push access toadobe/commerce-cif-graphql-integration-reference, created by a repo admin — it cannot be fixed in YAML.SITES-49657