Automate publishing of DefectDojo Java Client release to maven central

[Weltraumschaf]

• https://docs.gradle.org/current/userguide/github-actions.html
• https://github.com/gradle/gradle-build-action

[J12934]

Mhh? It's automated: https://github.com/secureCodeBox/defectdojo-client-java/blob/main/.github/workflows/publish.yml
Getting automatically published when a github release is created. @Weltraumschaf

[Weltraumschaf]

Build is automated, but there is no such release in Maven Central.

[J12934]

@Weltraumschaf should publish to maven central when the release doesn't contain snapshot
https://github.com/secureCodeBox/defectdojo-client-java/blob/main/build.gradle#L81

[Weltraumschaf]

Long time ago (~4 years) @rseedorff requested access to Maven Central. They said we should release some SNAPSHOT versions before they grant us access to the public repo. Now we should hook up this process.

[Weltraumschaf]

Found the Sonatype OSSRH issue:

Looks like everything is prepared to perform a release. @rseedorff do you have the GPG key to sign the jars? Do you have your Jira Account working and can login here?

[Weltraumschaf]

We also need to meet some requirements:

• Supply Javadoc and Sources
• Provide Files Checksums
• Sign Files with GPG/PGP
• Sufficient Metadata

Documentation how to do this with Gradle.

[Weltraumschaf]

I've raised an comment in the OSSRH issue and asked how to add more maintainers.

[Weltraumschaf]

@J12934 and me now have publish rights to our Sonatype staging repo. Now we can test a first release.

[Weltraumschaf]

Gradle documentaton from sonatype

[Zero3141]

Publishing requires that all files need to be signed with GPG/PGP. For that, we need the signing key together with its password in a ci run. We store these two Github's Encrypted secrets.

Signing key extraction (local)

First, we need to identify the LONG_ID of the private key:

gpg  --list-secret-keys

Then, we extract the private key:

gpg --armor --export-secret-keys <LONG_ID>

It should look like the following:

-----BEGIN PGP PRIVATE KEY BLOCK-----

...
-----END PGP PRIVATE KEY BLOCK-----

Github release workflow

The release workflow runs ./gradlew sign, which needs the following two environment variables being set: SIGNING_KEY and SIGNING_PASSWORD. In the workflow, they should be set from the preconfigured Github secrets SIGNING_KEY and SIGNING_PASSWORD.

[Weltraumschaf]

Real name: the secureCodeBox authors
E-Mail: securecodebox@iteratec.com
Comment:

1. Master Key
2. Signing Key

[Weltraumschaf]

Here we can see our published snapshots.

[Weltraumschaf]

GPG Signing: We had the plan to use a sub key derived from a secret master key to sign the artifacts, bit it seems that Maven can't deal with sub keys. So we decided to use one dedicated GPG key only for our Java artifacts we deploy to Maven Central.

[Zero3141]

Its recommended to set an expiration date of less than two years for our signing key. How do we keep track of this interval? @Weltraumschaf

[Weltraumschaf]

We add an appointment to the team calendar :-)

[Weltraumschaf]

We should really document all this stuff. I added your GPG notes as first part for a whole release documentation.

[Weltraumschaf]

We decided to change from Gradle to Maven bc full automatic release is not feasible int the we want it. We tried now for merely a week to get it work. With Maven it seems way more easier.

[Zero3141]

Problem: We enforce two status checks (DCO & Java Tests) to pass before merging. We already allowed the SCB Bot (who performs the push commit in which the version is bumped in the pom.xml) to push on the main branch. However, this setting mentions that Required status checks will still prevent these people, teams, and apps from merging if the checks fail..

It seems like that this issue is a general issue, see this discussion.

[Zero3141]

We have weakened the branch protection rules to decouple the release process from Issue 157.

[Weltraumschaf]

@Zero3141 Can we add to the action that it updates the version in the README.md?

• defectdojo-client-java/README.md

  Line 21 in 9a5811c

  <version>1.0.0.-beta2</version>

• defectdojo-client-java/README.md

  Line 28 in 9a5811c

  implementation group: 'io.securecodebox', name: 'defectdojo-client', version: '1.0.0.-beta2'