ci: retire Pages snapshot push; use SONATYPE_* for Central - #12
Open
Pinont wants to merge 2 commits into
Open
Conversation
publish-public-repo cannot git-push Pinont/singularity-maven: the only GitHub secret that existed for that path is empty, and SONATYPE_USERNAME / SONATYPE_PASSWORD are Maven Central Portal credentials (not a git token). Snapshots already go to GitHub Packages via build.yml. maven.pinont.me stays a frozen archive. Gut pages-repo.yml to a dispatch-only no-op (no push trigger, so it no longer fails on every main / rework/v2 push). Point release.yml Central upload at SONATYPE_USERNAME / SONATYPE_PASSWORD. Co-authored-by: Nonnipat Tangrojjanakhajorn <contact@pinont.me>
release.yml ran on every merge to main. pom is 2.0.0-SNAPSHOT and tag 2.0.0 already exists, so merging this CI-only PR would derive 2.0.0-Hotfix-1. Gate both release and publish-central on the release label in addition to merged==true. Co-authored-by: Nonnipat Tangrojjanakhajorn <contact@pinont.me>
There was a problem hiding this comment.
🟡 Changes recommended
The release label gate currently uses substring matching and could trigger releases for similarly named labels (e.g., pre-release), risking unintended publishing.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR adjusts CI/CD workflows to stop attempting GitHub Pages-based snapshot publishing and to tighten/modernize Maven Central publishing credentials and release gating for SingularityLib.
Changes:
- Retires
publish-public-repoby removing the push-triggered Pages snapshot deploy logic and leaving a dispatch-only informational job. - Updates
release.ymlto useSONATYPE_USERNAME/SONATYPE_PASSWORDfor Central upload. - Gates both the release and Central publish jobs behind a PR
releaselabel to prevent unintended releases on routine merges.
File summaries
| File | Description |
|---|---|
| .github/workflows/release.yml | Adds a release-label gate for release/Central jobs and switches Central credentials to SONATYPE_*. |
| .github/workflows/pages-repo.yml | Removes snapshot git-push workflow logic; keeps a dispatch-only job that documents the retirement/policy. |
Review details
Suppressed comments (1)
.github/workflows/release.yml:177
- Same substring-based label check here:
contains(join(...), 'release')can match labels likepre-releaseand unintentionally run the Central publish path. Prefercontains(labels.*.name, 'release')for an exact label match.
if: github.event.pull_request.merged == true && contains(join(github.event.pull_request.labels.*.name, ','), 'release')
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if: github.event.pull_request.merged == true | ||
| # Only tagged product releases. Merging a CI/docs PR to main without the | ||
| # `release` label must not derive a hotfix tag or publish. | ||
| if: github.event.pull_request.merged == true && contains(join(github.event.pull_request.labels.*.name, ','), 'release') |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Nont confirmed there is no usable GitHub Actions secret for pushing to
Pinont/singularity-maven.SONATYPE_USERNAME/SONATYPE_PASSWORDare Maven Central Portal user/token only — they cannot authenticate a git push, and Central does not accept SNAPSHOT uploads.#11 already merged onto
mainand still git-pushesgh-pageswith an empty token, sopublish-public-repowill keep failing on every push tomain/rework/v2. Snapshots already live on GitHub Packages (io.github.pinont.singularitylib:2.0.0-SNAPSHOT, deployed bybuild.ymlwithGITHUB_TOKEN).maven.pinont.meis a stale Pages archive.release.ymljobpublish-centralstill readssecrets.MAVEN_CENTRAL_USERNAME/secrets.MAVEN_CENTRAL_PASSWORDonmain. It also runs on every merged PR tomain. pom is2.0.0-SNAPSHOTand tag2.0.0already exists, so merging this CI-only PR without a guard would derive2.0.0-Hotfix-1and try to publish.What
pages-repo.yml: dispatch-only no-op. Comment records the policy (GitHub Packages for snapshots, frozen Pages archive, Central viarelease.yml). Noon: push, no git clone/push, no invented git token.release.ymlCentral upload now usessecrets.SONATYPE_USERNAME/secrets.SONATYPE_PASSWORD. No other secrets renamed.releaseandpublish-centraljobs only run when the merged PR has thereleaselabel:merged == true && contains(join(labels.*.name, ','), 'release').Future Central/GitHub releases need that label on the PR. This PR must not have it.
Out of scope
releaselabel.maven.pinont.me) left as-is.Verify
git grep -n MAVEN_REPO_TOKENis empty on this branch.release.ymlCentral curl usesSONATYPE_USERNAME/SONATYPE_PASSWORD.publish-public-repois dispatch-only and never git-pushes.releaselabel skips bothreleaseandpublish-central.