Skip to content

Extract Gradle Plugin Portal publish into a separate dispatchable workflow #231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kirich1409 merged 1 commit into from
Jun 1, 2026
Merged

Extract Gradle Plugin Portal publish into a separate dispatchable workflow #231

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 66 additions & 0 deletions .github/workflows/publish-plugin-portal.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
name: Publish Plugin to Gradle Plugin Portal

on:
push:
tags:
- "v[0-9]+.[0-9]+.[0-9]+"
- "v[0-9]+.[0-9]+.[0-9]+-*"
Comment on lines +5 to +7
# No branches: branch pushes produce SNAPSHOTs; Portal rejects them.
workflow_dispatch:
inputs:
ref:
description: "Git ref to check out (e.g. v1.0.0). Must point to the exact release tag."
required: true
version:
description: "Plugin version to publish (e.g. 1.0.0, without leading v)."
required: true

permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false
Comment on lines +21 to +23

jobs:
publish-plugin-portal:
name: Publish plugin to Gradle Plugin Portal
runs-on: ubuntu-latest
environment: Main

steps:
- uses: actions/checkout@v6
with:
# On tag push: check out the triggering tag.
# On workflow_dispatch: check out the explicit ref input so develop-HEAD
# (1.1.0-SNAPSHOT) is never published in place of the release tag.
ref: ${{ inputs.ref || github.ref }}

- uses: ./.github/actions/setup-build-env

- name: Determine version
id: version
env:
INPUT_VERSION: ${{ inputs.version }}
run: |
if [[ -n "${INPUT_VERSION}" ]]; then
# Manual dispatch: use the explicitly supplied version.
VERSION="${INPUT_VERSION}"
else
Comment on lines +46 to +49
# Tag push: strip the leading "v" from the tag (e.g. v1.0.0 -> 1.0.0).
VERSION="${GITHUB_REF_NAME#v}"
fi
echo "VERSION_NAME=${VERSION}" | tee -a "$GITHUB_OUTPUT"

- name: Publish plugin to Gradle Plugin Portal
# publishPlugins uploads directly — no manual promotion step unlike Maven Central.
# GPG signing env is required: com.gradle.plugin-publish creates maven publications
# for plugin markers and the signing plugin signs them as part of publishPlugins.
env:
GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_SIGNING_KEY }}
ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.GPG_KEY_ID }}
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_KEY_PASSWORD }}
ORG_GRADLE_PROJECT_VERSION_NAME: ${{ steps.version.outputs.VERSION_NAME }}
run: ./gradlew --no-daemon :featured-gradle-plugin:publishPlugins --no-configuration-cache
Comment on lines +9 to +66
Copy link
Copy Markdown

@qodo-code-review qodo-code-review Bot Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Ref/version not validated 🐞 Bug ≡ Correctness

For workflow_dispatch, the workflow checks out inputs.ref but always publishes the explicitly
provided inputs.version as ORG_GRADLE_PROJECT_VERSION_NAME without verifying they match. This
can publish a version number that doesn’t correspond to the source being built, creating incorrect
artifacts in the Gradle Plugin Portal.
Agent Prompt 
## Issue description
`workflow_dispatch` accepts both `ref` and `version`, but the workflow never verifies that the checked-out ref corresponds to the version being published.

## Issue Context
The checkout step uses `ref: ${{ inputs.ref || github.ref }}` while `Determine version` uses `inputs.version` when present, and `Publish` exports `ORG_GRADLE_PROJECT_VERSION_NAME` from that computed version.

## Fix Focus Areas
- .github/workflows/publish-plugin-portal.yml[31-66]

## Suggested fix
Add a validation step for `workflow_dispatch` before publishing, e.g.:
- Require `inputs.ref` to be a tag of the form `v${inputs.version}` (string compare).
- Optionally verify it is an exact tag checkout: `git describe --tags --exact-match`.
- Alternatively, remove `version` input entirely and derive version strictly from `inputs.ref` (strip leading `v`) to eliminate mismatch risk.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Loading