Conversation
OSSRH is dead, use replacement
📝 WalkthroughWalkthroughThis update transitions the Maven project from Sonatype OSSRH to Maven Central for artifact publishing, updating related credentials, plugins, and configuration. It also adjusts GitHub Actions workflows for release and website publishing, and revises the README to clarify GPG setup for releases. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR migrates the Maven deployment configuration from the deprecated OSSRH (OSS Repository Hosting) to the new Maven Central publishing system. The change addresses the fact that OSSRH is no longer available and replaces it with the modern central-publishing-maven-plugin.
- Removes the old OSSRH distribution management configuration and replaces the nexus-staging plugin with central-publishing plugin
- Updates GitHub Actions workflows to use new Maven Central credentials instead of OSSRH credentials
- Adds a GitHub Actions profile for GPG signing configuration and updates documentation for local releases
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pom.xml | Removes OSSRH distribution management, replaces nexus-staging plugin with central-publishing plugin, adds GitHub Actions profile |
| README.md | Updates local release instructions to use gpg-agent instead of disabling bc signer |
| .github/workflows/website.yml | Adds ref specification and always condition for tag deletion |
| .github/workflows/release.yml | Updates environment variables from OSSRH to Maven Central credentials |
| .github/maven-settings.xml | Updates server configuration from OSSRH to Maven Central |
Comments suppressed due to low confidence (1)
pom.xml:744
- The version 0.8.0 for central-publishing-maven-plugin may not exist. As of my knowledge cutoff in January 2025, this plugin was relatively new. Please verify this version exists in Maven Central before deploying.
<central-publishing-maven-plugin.version>0.8.0</central-publishing-maven-plugin.version>
| <joda.osgi.packages>org.joda.convert.*</joda.osgi.packages> | ||
| <joda.osgi.require.capability>osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=${maven.compiler.release}))"</joda.osgi.require.capability> | ||
| <joda.nexus.auto.release>true</joda.nexus.auto.release> | ||
| <joda.publish.auto>true</joda.publish.auto><!-- false/true --> |
There was a problem hiding this comment.
[nitpick] The inline comment format is inconsistent with the project's comment style. Consider using a separate line comment or removing the comment since the property name is self-explanatory.
| <joda.publish.auto>true</joda.publish.auto><!-- false/true --> | |
| <joda.publish.auto>true</joda.publish.auto> |
| <joda.osgi.require.capability>osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=${maven.compiler.release}))"</joda.osgi.require.capability> | ||
| <joda.nexus.auto.release>true</joda.nexus.auto.release> | ||
| <joda.publish.auto>true</joda.publish.auto><!-- false/true --> | ||
| <joda.publish.wait>published</joda.publish.wait><!-- validated/published --> |
There was a problem hiding this comment.
[nitpick] The inline comment format is inconsistent with the project's comment style. Consider using a separate line comment or removing the comment since the property name is self-explanatory.
| <joda.publish.wait>published</joda.publish.wait><!-- validated/published --> | |
| <joda.publish.wait>published</joda.publish.wait> |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
README.md (1)
104-105: Clarify signer expectations for local releasesThe line now only asks the user to ensure
gpg-agentis running, yet thegithub-actionMaven profile introduced inpom.xmlexplicitly sets-Dgpg.signer=bc.
Readers performing a local release might be confused as to whether they still need Bouncy Castle, or if the default GnuPG setup is sufficient.Consider adding a short note explaining that the
bcsigner is automatically activated only on CI and that the default GPG installation is expected locally.
This keeps the README self-contained and avoids surprises during manual releases..github/workflows/website.yml (1)
19-21: Checkout with${{ github.ref }}is redundant but harmless
actions/checkoutalready checks out the commit that triggered the workflow. Passingref: ${{ github.ref }}has no functional impact and can quietly break forks that do not have permission to read the same ref name (e.g. PRs from forks with deleted tags).If you do not have a specific reason to pin the ref, consider dropping the
ref:attribute to keep the workflow minimal and fork-friendly.pom.xml (1)
744-746: Plugin version 0.8.0 is new – track for breaking changes
central-publishing-maven-pluginis still moving quickly. Keep an eye on release notes in case 0.8.x introduces breaking changes that affect your workflow (especially aroundautoPublishsemantics).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (5)
.github/maven-settings.xml(1 hunks).github/workflows/release.yml(1 hunks).github/workflows/website.yml(2 hunks)README.md(1 hunks)pom.xml(4 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (5)
.github/workflows/website.yml (1)
74-78: Good call making tag clean-up unconditionalWrapping the “Delete website tag” step in
if: always()guarantees that temporary tags are removed even when earlier steps fail.
This prevents stale tags from accumulating..github/workflows/release.yml (1)
53-56: Verify new secret names before mergingThe workflow now expects
MAVEN_CENTRAL_USERNAMEandMAVEN_CENTRAL_PASSWORD.
Ensure these secrets are already defined in the repository (or organisation) settings; otherwise the release job will fail at deploy time with unauthorised errors..github/maven-settings.xml (1)
7-10: Server id change looks correct – double-check matching plugin config
<id>central</id>matches thepublishingServerIdused by the newcentral-publishing-maven-plugininpom.xml, so Maven will pick up the credentials correctly.Nothing further to do here.
pom.xml (2)
655-666: Validate central-publishing plugin coordinates and parameters
The published coordinates are
org.sonatype.central:central-publishing-maven-plugin.
At the time of writing the canonical groupId iscom.sonatype.maven.plugins. Please verify the artifact exists for version${central-publishing-maven-plugin.version}.Parameters
deploymentName,autoPublishandwaitUntillook correct, but make sure they match the plugin’s schema for version 0.8.0 (some earlier versions usedstagingProfileId/timeoutMinutesinstead).A quick manual
mvn help:effective-pomon a local checkout will confirm the plugin is resolved.
715-717: Expose publish toggles as documented propertiesNice touch introducing
joda.publish.autoandjoda.publish.wait– this makes it trivial to override behaviour from the command line, e.g.:mvn deploy -Djoda.publish.auto=false
| <!-- Set environment when running on GitHub Actions --> | ||
| <profile> | ||
| <id>github-action</id> | ||
| <activation> | ||
| <property> | ||
| <name>env.GITHUB_ACTIONS</name> | ||
| <value>true</value> | ||
| </property> | ||
| </activation> | ||
| <properties> | ||
| <gpg.signer>bc</gpg.signer> | ||
| </properties> | ||
| </profile> |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Consider omitting bc signer unless strictly required
The github-action profile forces -Dgpg.signer=bc.
If the runner uses the default GnuPG (which is already installed on ubuntu-latest), adding the Bouncy Castle dependency is unnecessary and may even fail if the bcprov JAR is not present.
Unless Bouncy Castle is a hard requirement (e.g. for legacy RSA-1024 keys), you could drop this property and rely on stock GPG:
- <properties>
- <gpg.signer>bc</gpg.signer>
- </properties>
+ <!-- No extra signer needed; default GPG works on GH-Actions -->📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <!-- Set environment when running on GitHub Actions --> | |
| <profile> | |
| <id>github-action</id> | |
| <activation> | |
| <property> | |
| <name>env.GITHUB_ACTIONS</name> | |
| <value>true</value> | |
| </property> | |
| </activation> | |
| <properties> | |
| <gpg.signer>bc</gpg.signer> | |
| </properties> | |
| </profile> | |
| <!-- Set environment when running on GitHub Actions --> | |
| <profile> | |
| <id>github-action</id> | |
| <activation> | |
| <property> | |
| <name>env.GITHUB_ACTIONS</name> | |
| <value>true</value> | |
| </property> | |
| </activation> | |
| <!-- No extra signer needed; default GPG works on GH-Actions --> | |
| </profile> |
🤖 Prompt for AI Agents
In pom.xml around lines 596 to 608, the github-action profile sets the
gpg.signer property to "bc", which forces use of the Bouncy Castle signer. This
may cause failures if the bcprov JAR is not present and is unnecessary if the
default GnuPG is sufficient. To fix this, remove the <gpg.signer>bc</gpg.signer>
property from the github-action profile unless Bouncy Castle is strictly
required for your signing keys.
OSSRH is dead, use replacement
Summary by CodeRabbit