Skip to content

feat: publish to Sonatype OSSRH#102

Merged
jacques-n merged 12 commits intosubstrait-io:mainfrom
davisusanibar:feature/release_to_sonatype
Nov 25, 2022
Merged

feat: publish to Sonatype OSSRH#102
jacques-n merged 12 commits intosubstrait-io:mainfrom
davisusanibar:feature/release_to_sonatype

Conversation

@davisusanibar
Copy link
Copy Markdown
Contributor

@davisusanibar davisusanibar commented Nov 10, 2022

This PR contains:

  • Feature to implement release to Sonatype OSSRH
  • Review ci/release/README.md file to create variables needed for deployment to Sonatype OSSRH

Second part to solve #43 , please at first time review/merge #100 that is needed to this PR

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Consider that after this PR is merged, then immediately the first deployment to Sonatype OSSRH will start and the first version v1.0.0 will be created.

@jacques-n
Copy link
Copy Markdown
Collaborator

Hey @davisusanibar, can you rebase?

@jacques-n
Copy link
Copy Markdown
Collaborator

jacques-n commented Nov 10, 2022

Hey @davisusanibar , a couple things here. The doc at least looks like it is double releasing (to github and ossrh). Let's not do that. Additionally, we should automate the movement from stage to release. Some info here about this: https://issues.sonatype.org/browse/OSSRH-48410

Will look at the detail soon...

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Hey @davisusanibar , a couple things here. The doc at least looks like it is double releasing (to github and ossrh). Let's not do that. Additionally, we should automate the movement from stage to release. Some info here about this: https://issues.sonatype.org/browse/OSSRH-48410

Will look at the detail soon...

  • Semantic-release create a release with CHANGELOG notes and also adding source code. At the same moment we are adding Isthmus native images to the release to any user could download and use the native library, please let me know if this is ok.

  • Related to automate the release to maven central process:
    Currently we are opening the staging environment and close that to be able to consume by end user: publishToSonatype closeSonatypeStagingRepository, and yes we could do all the steps opening the staging environment, close and release with publishToSonatype closeAndReleaseSonatypeStagingRepository.

I could recommend initially to send only to staging, after we test if the library is working and all is ok we could send another PR to publish automatically.

Please let me know how do we could proceed?

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Hey @davisusanibar , a couple things here. The doc at least looks like it is double releasing (to github and ossrh). Let's not do that. Additionally, we should automate the movement from stage to release. Some info here about this: https://issues.sonatype.org/browse/OSSRH-48410
Will look at the detail soon...

  • Semantic-release create a release with CHANGELOG notes and also adding source code. At the same moment we are adding Isthmus native images to the release to any user could download and use the native library, please let me know if this is ok.
  • Related to automate the release to maven central process:
    Currently we are opening the staging environment and close that to be able to consume by end user: publishToSonatype closeSonatypeStagingRepository, and yes we could do all the steps opening the staging environment, close and release with publishToSonatype closeAndReleaseSonatypeStagingRepository.

I could recommend initially to send only to staging, after we test if the library is working and all is ok we could send another PR to publish automatically.

Please let me know how do we could proceed?

Ohh I just see your point, ... that sound really interesting, ...let me check about how do we could automate , thanks!

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Hi @jacques-n I have a doubt about automate the movement from stage to release, please could you help me to clarify that?

Consider:

  1. Every push to master create a release process as detailed:

a.) Create the release on staging
REST POST: https://s01.oss.sonatype.org/service/local/staging/profiles/<account_id_profile>/start
Gradle Task: publishToSonatype

Request:
{
	"data": {
		"description": "io.substrait:substrait:1.2.4"
	}
}

Response:
{
	"data": {
		"stagedRepositoryId": "io.substrait-1041",
		"description": "io.substrait:substrait:1.2.4"
	}
}

Problem arise with "1041", it is a sequential number that cannot be pre-calculated in the next steps.

b.) Close the release (send the artifacts to https://s01.oss.sonatype.org/content/repositories/staging):
REST POST: https://s01.oss.sonatype.org/service/local/staging/bulk/close
Gradle Task: closeSonatypeStagingRepository

Request:
{
	"data": {
		"stagedRepositoryIds": ["io.substrait-1041"],
		"description": "io.substrait:substrait:1.2.4",
		"autoDropAfterRelease": true
	}
}

c.) Release the artifacts to maven central (to: https://s01.oss.sonatype.org/content/repositories/releases/):
REST POST: https://s01.oss.sonatype.org/service/local/staging/bulk/promote
Gradle Task: closeAndReleaseSonatypeStagingRepository

Request
{
	"data": {
		"stagedRepositoryIds": ["io.substrait-1041"],
		"description": "io.substrait:substrait:1.2.4",
		"autoDropAfterRelease": true
	}
}

In case is needed to Create / Close / Release in different step there is needed to persist information per steps OR call all the task as one.

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Hi @jacques-n I have a doubt about automate the movement from stage to release, please could you help me to clarify that?

Consider:

  1. Every push to master create a release process as detailed:

a.) Create the release on staging REST POST: https://s01.oss.sonatype.org/service/local/staging/profiles/<account_id_profile>/start Gradle Task: publishToSonatype

Request:
{
	"data": {
		"description": "io.substrait:substrait:1.2.4"
	}
}

Response:
{
	"data": {
		"stagedRepositoryId": "io.substrait-1041",
		"description": "io.substrait:substrait:1.2.4"
	}
}

Problem arise with "1041", it is a sequential number that cannot be pre-calculated in the next steps.

b.) Close the release (send the artifacts to https://s01.oss.sonatype.org/content/repositories/staging): REST POST: https://s01.oss.sonatype.org/service/local/staging/bulk/close Gradle Task: closeSonatypeStagingRepository

Request:
{
	"data": {
		"stagedRepositoryIds": ["io.substrait-1041"],
		"description": "io.substrait:substrait:1.2.4",
		"autoDropAfterRelease": true
	}
}

c.) Release the artifacts to maven central (to: https://s01.oss.sonatype.org/content/repositories/releases/): REST POST: https://s01.oss.sonatype.org/service/local/staging/bulk/promote Gradle Task: closeAndReleaseSonatypeStagingRepository

Request
{
	"data": {
		"stagedRepositoryIds": ["io.substrait-1041"],
		"description": "io.substrait:substrait:1.2.4",
		"autoDropAfterRelease": true
	}
}

In case is needed to Create / Close / Release in different step there is needed to persist information per steps OR call all the task as one.

One way about how do we could release to maven central automatically will be to create a rule/job that the maximum time to verify/test artifacts on Staging is 05 days, after that a Job automatically will run a promote to maven central.

POST: https://s01.oss.sonatype.org/service/local/staging/profile_repositories

<stagingRepositories>
    <data>
        <stagingProfileRepository>
            <profileId>XXXXXXXX</profileId>
            <profileName>io.substrait</profileName>
            <profileType>repository</profileType>
            <repositoryId>io.substrait-1041</repositoryId>
            <type>closed</type>
            <policy>release</policy>
            <userId>dsusanibara</userId>
            <userAgent>gradle-nexus-publish-plugin/1.1.0</userAgent>
            <ipAddress>x.y.z.w</ipAddress>
            <repositoryURI>https://s01.oss.sonatype.org/content/repositories/io.substrait-1041</repositoryURI>
            <created>2022-11-10T11:46:31.407Z</created>
            <createdDate>Thu Nov 10 11:46:31 UTC 2022</createdDate>
            <createdTimestamp>1668080791407</createdTimestamp>
            <updated>2022-11-10T11:48:23.774Z</updated>
            <updatedDate>Thu Nov 10 11:48:23 UTC 2022</updatedDate>
            <updatedTimestamp>1668080903774</updatedTimestamp>
            <description>io.substrait:substrait:1.2.4</description>
            <provider>maven2</provider>
            <releaseRepositoryId>releases</releaseRepositoryId>
            <releaseRepositoryName>Releases</releaseRepositoryName>
            <notifications>0</notifications>
            <transitioning>false</transitioning>
        </stagingProfileRepository>
        ...
        ...
    </data>
</stagingRepositories>

@davisusanibar
Copy link
Copy Markdown
Contributor Author

The doc at least looks like it is double releasing (to github and ossrh). Let's not do that.

@jacques-n Please also confirm if uploaded native images to Github release is ok or need to be deleted

image

With this we could download binaries from Github release and use that:

$ ./isthmus-macOS-2.0.0  -c "CREATE TABLE Persons ( firstName VARCHAR, lastName VARCHAR, zip INT )" "SELECT lastName, firstName FROM Persons WHERE zip = 90210"
{
  "extensionUris": [{
    "extensionUriAnchor": 1,
    "uri": "/functions_comparison.yaml"
  }],

Copy link
Copy Markdown
Member

@westonpace westonpace left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not really an expert on Java releases but I gave it an attempt. I have a few questions that are probably just my inexperience :)

Comment thread .github/workflows/pr.yml Outdated
Comment on lines +50 to +82
- uses: actions/checkout@v2
with:
submodules: recursive
- uses: DeLaGuardo/setup-graalvm@5.0
with:
graalvm: '22.0.0.2'
java: 'java17'
- name: Setup Gradle
uses: gradle/gradle-build-action@v2
- name: Report Java Version
run: java -version
- name: Install GraalVM native image
run: gu install native-image
- name: Build with Gradle
run: gradle nativeImage
- name: Smoke Test
run: ./isthmus/src/test/script/smoke.sh
./isthmus/src/test/script/tpch_smoke.sh
- name: Rename the artifact to OS-unique name
shell: bash
run: |
value=`mv isthmus/build/graal/isthmus isthmus/build/graal/isthmus-${{ matrix.os }}`
- name: Publish artifact
uses: actions/upload-artifact@master
with:
name: isthmus-${{ matrix.os }}
path: isthmus/build/graal/isthmus-${{ matrix.os }}
- uses: actions/checkout@v2
with:
submodules: recursive
- uses: DeLaGuardo/setup-graalvm@5.0
with:
graalvm: '22.0.0.2'
java: 'java17'
- name: Setup Gradle
uses: gradle/gradle-build-action@v2
- name: Report Java Version
run: java -version
- name: Install GraalVM native image
run: gu install native-image
- name: Build with Gradle
run: gradle nativeImage
- name: Smoke Test
run: ./isthmus/src/test/script/smoke.sh
./isthmus/src/test/script/tpch_smoke.sh
- name: Rename the artifact to OS-unique name
shell: bash
run: |
value=`mv isthmus/build/graal/isthmus isthmus/build/graal/isthmus-${{ matrix.os }}`
- name: Publish artifact
uses: actions/upload-artifact@master
with:
name: isthmus-${{ matrix.os }}
path: isthmus/build/graal/isthmus-${{ matrix.os }}
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we avoid whitespace-only changes? It makes review trickier.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok

Comment on lines +7 to +10
- next
- next-major
- beta
- alpha
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need all these? Maybe just include the ones we actually use? Or main and next to show what could be done?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is only configuration. It will be good to have this already in place, and ONLY create this branch on the project when it is needed or there are reason for.

Comment thread ci/release/README.md Outdated
Comment thread ci/release/README.md Outdated
Comment thread ci/release/README.md
Comment thread ci/release/README.md Outdated
Comment thread ci/release/README.md Outdated

We are using Sonatype OSSRH and there are repositories for `snapshots` / `staging` / `release`:
- If your library finalize with `1.4.3-XXXXX-SNAPSHOT` -> it is going to be deployed to Snapshots repository
- If your library finalize with `1.4.3-XXXXX-SNAPSHOT.YYYY` -> it is going to be deployed to Staging/Releases repository
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does it mean for a library to finalize? Does this mean the destination repository is based on the name of the artifacts? Or is the the value of the version field?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let me update that. The destination repository is based on the name of the artifacts. It will be:

We are using Sonatype OSSRH, the destination repository (snapshots / staging / release) is based on the name of the artifacts:

  • For library name artifacts as 1.4.3-XXXXX-SNAPSHOT -> it is going to be deployed to Snapshots repository
  • For library name artifacts as 1.4.3-XXXXX-SNAPSHOT.YYYY -> it is going to be deployed to Staging/Releases repository
  • For library name artifacts as 1.4.3-XXXXX -> it is going to be deployed to Staging/Releases repository
  • For library name artifacts as 1.4.3 -> it is going to be deployed to Staging/Releases repository

Comment thread ci/release/README.md Outdated
Comment on lines +138 to +140
#### 2. How many days do I have to approve the artifacts on the Staging repository?

Please review [OSSRH-24751](https://issues.sonatype.org/browse/OSSRH-24751)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if a release is not approved in the time limit?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is not an option to recover that version. A initial proposal is to run a Job that after 5 days on staging environment automatically deploy that to release maven central, more detal at #102 (comment)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider: OSSRH-86341

  • Open staging repositories are dropped after 3 days of inactivity.
  • Closed staging repositories are dropped after 21 days of inactivity.
  • Released staging repositories are dropped within an hour or two of release.

Comment thread core/build.gradle.kts Outdated
"Create a well-defined, cross-language specification for data compute operations"
)
url.set("https://github.com/substrait-io/substrait-java")
properties.set(mapOf("country" to "PE", "dsusanibar.type.of" to "Java"))
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is this info used for?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, that was for my internal test, let me delete that.

Comment thread gradle.properties
#signing
SIGNING_KEY_ID = 193EAE47
SIGNING_PASSWORD = password
SIGNING_KEY = ALDqwcArqwfsdqweqwrwr
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is this value? Is it a dummy value? Or is it a secret?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is dummy value, real value is going to read at build time from Github secrets values.

davisusanibar and others added 2 commits November 18, 2022 09:23
@davisusanibar davisusanibar force-pushed the feature/release_to_sonatype branch from 2ecc7c2 to 57947e7 Compare November 18, 2022 15:51
@davisusanibar
Copy link
Copy Markdown
Contributor Author

Hi @westonpace please if you could take a second chance to review it.

@davisusanibar davisusanibar changed the title [CI]: Feature to implement release to Sonatype OSSRH feat: publish to Sonatype OSSRH Nov 18, 2022
@westonpace
Copy link
Copy Markdown
Member

One way about how do we could release to maven central automatically will be to create a rule/job that the maximum time to verify/test artifacts on Staging is 05 days, after that a Job automatically will run a promote to maven central.

This sounds good to me.

Semantic-release create a release with CHANGELOG notes and also adding source code. At the same moment we are adding Isthmus native images to the release to any user could download and use the native library, please let me know if this is ok.

Let me make sure I understand. The substrait-java .jar file (for programmatic use) will be deployed to maven central. The isthmus binary executable (for scripting / command-line use) will be deployed to github

That sounds reasonable to me.

@davisusanibar
Copy link
Copy Markdown
Contributor Author

One way about how do we could release to maven central automatically will be to create a rule/job that the maximum time to verify/test artifacts on Staging is 05 days, after that a Job automatically will run a promote to maven central.

This sounds good to me.

Please if we could handle this as an additional PR to we could continue with the scope of this PR. I mean the proposal is that initially deploy the artifacts into Staging automatically and deploy manually to maven central, then, when this end-to-end is working we could automate that without problems.

If that won't be possible please let me know to I could send that feature into this PR

Semantic-release create a release with CHANGELOG notes and also adding source code. At the same moment we are adding Isthmus native images to the release to any user could download and use the native library, please let me know if this is ok.

Let me make sure I understand. The substrait-java .jar file (for programmatic use) will be deployed to maven central. The isthmus binary executable (for scripting / command-line use) will be deployed to github

That sounds reasonable to me.

It will be:

Sonatype OSSRH:

Github asset:

  • Only Isthmus binary executable (for scripting / command-line use)

@westonpace
Copy link
Copy Markdown
Member

An additional PR for automated releases sounds fine to me.

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Hi team, please let me know when we could have a time to test the promote to Sonatype Staging Environment.

Also please share the Key (ie: 103EEE97) sending to Ubuntu server at step gpg --keyserver keyserver.ubuntu.com --send-keys 103EEE97

@westonpace
Copy link
Copy Markdown
Member

Also please share the Key (ie: 103EEE97) sending to Ubuntu server at step gpg --keyserver keyserver.ubuntu.com --send-keys 103EEE97

Do you perhaps mean for us to run --recv-key?

(base) pace@pace-desktop:~$ gpg --keyserver keyserver.ubuntu.com --recv-key 0x103EEE97
gpg: key 9B445A3D103EEE97: public key "david dali susanibar arce (Key to sign Java artifacts) <dsusanibara@uni.pe>" imported
gpg: Total number processed: 1
gpg:               imported: 1

@westonpace
Copy link
Copy Markdown
Member

@jacques-n I think there is probably a more fundamental issue here around signing releases that you might have more experience / opinions on.

The ASF policy mandates that all source releases be signed by the release manager (and optionally as many PMC members as want to participate) and all released artifacts be signed by a committer (preferably a PMC member).

That seems a little extreme and not easily automated. If we wanted to automate it, then it requires putting all signers' keys into some centralized secret storage and so you end up with a single point of failure anyways. In that case, we might as well have a single "substrait" key that is stored in some kind of credentials vault (a github secret might be enough for now).

@davisusanibar
Copy link
Copy Markdown
Contributor Author

An additional PR for automated releases sounds fine to me.

Just send PR #104 for automation.

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Also please share the Key (ie: 103EEE97) sending to Ubuntu server at step gpg --keyserver keyserver.ubuntu.com --send-keys 103EEE97

Do you perhaps mean for us to run --recv-key?

(base) pace@pace-desktop:~$ gpg --keyserver keyserver.ubuntu.com --recv-key 0x103EEE97
gpg: key 9B445A3D103EEE97: public key "david dali susanibar arce (Key to sign Java artifacts) <dsusanibara@uni.pe>" imported
gpg: Total number processed: 1
gpg:               imported: 1

Request was related about: (1) create public/private key, (2) send public key to ubuntu server, (3) share with me the ID generated on step 1 to update documentation with that value.

@westonpace
Copy link
Copy Markdown
Member

I'm not certain I understand. If I don't sign the release with my private key then I'm not sure sharing my public key will be useful.

@davisusanibar
Copy link
Copy Markdown
Contributor Author

I'm not certain I understand. If I don't sign the release with my private key then I'm not sure sharing my public key will be useful.

In this case we are using Gradle Signing Plugin. It's configured on the project to read environment variables and use that as needed.

This is the signing task Task :signMaven-publishPublication involved on the release process:

...
> Task :initializeSonatypeStagingRepository
> Task :signMaven-publishPublication
> Task :publishMaven-publishPublicationToSonatypeRepository
> Task :publishToSonatype
> Task :closeSonatypeStagingRepository

For this reason we need to create public/private keys and then upload private key information into the Github project Secrets and also send public key to public server keys.

@westonpace
Copy link
Copy Markdown
Member

Closing the loop, since some of this conversation happened externally. I have created secrets for this repository named SIGNING_KEY, SIGNING_KEY_ID, and SIGNING_PASSWORD. The public certificate has been uploaded to keyserver.ubuntu.com and the ID is BF2002D7C82E92DEA00BCFD2F4A1E652C8BA52B3. This key will expire in six months.

@davisusanibar
Copy link
Copy Markdown
Contributor Author

Just to mention that is needed to decide what will be our first version to promote: v0.x.y or v1.0.0.

To be aligned with Sustrait version that recommend version with format 0.x.y is needed to create a dummy tag (ie: v0.0.0) then semantic release process will increment that version number (ie: v0.1.0).

Semantic release consider tags created by main branch, and increment that version number for next releases, if there aren't any tags then semantic release will create v1.0.0 tag and release 1.0.0 version.

@jacques-n / @westonpace

@westonpace
Copy link
Copy Markdown
Member

@davisusanibar Can we use the instructions here which use a token instead of a username / password?

@davisusanibar
Copy link
Copy Markdown
Contributor Author

@davisusanibar Can we use the instructions here which use a token instead of a username / password?

Yes, we are not using our user/password to login into UI dashboard, instead we are using tokens (at the end it's also a combination of a name and password codes but not linked to a end user)

@westonpace
Copy link
Copy Markdown
Member

I have created the necessary secrets at the repository level (no promises they are all correct 😆 but let me know if it looks like any are not working when you try):

Screenshot 2022-11-23 at 13-39-19 Build software better together

@westonpace
Copy link
Copy Markdown
Member

To be aligned with Sustrait version that recommend version with format 0.x.y is needed to create a dummy tag (ie: v0.0.0) then semantic release process will increment that version number (ie: v0.1.0).

I agree that we should start with v0.1.0 but move quickly to v1.0.0 (e.g. don't need to wait for spec@1.0.0)

@davisusanibar
Copy link
Copy Markdown
Contributor Author

I have created the necessary secrets at the repository level (no promises they are all correct 😆 but let me know if it looks like any are not working when you try):

Screenshot 2022-11-23 at 13-39-19 Build software better together

This looks good.

How do you see to have an option to test Github Credentials? This PR #107 help on that. Could be an option to merge that before, then run workflow manually and when all credentials are validate we could continue to merge this PR, if not let's continue with this PR merge and let's see.

@davisusanibar
Copy link
Copy Markdown
Contributor Author

To be aligned with Sustrait version that recommend version with format 0.x.y is needed to create a dummy tag (ie: v0.0.0) then semantic release process will increment that version number (ie: v0.1.0).

I agree that we should start with v0.1.0 but move quickly to v1.0.0 (e.g. don't need to wait for spec@1.0.0)

Ok. To start with v0.1.0 please help me to create a initial tag v.0.0.0 before to merge (Why? If not, semantic release will create a tag for us but this will have v1.0.0 format).

@jacques-n jacques-n merged commit 7b195b0 into substrait-io:main Nov 25, 2022
baibaichen pushed a commit to baibaichen/substrait-java that referenced this pull request Feb 6, 2023
* refine doc on Velox backend

* revert pom change
ajegou pushed a commit to ajegou/substrait-java that referenced this pull request Mar 29, 2024
Enable publishing to Sonatype OSSRH

Co-authored-by: Weston Pace <weston.pace@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants