Sign release with GPG (#60)

QubitPi · Jan 13, 2024 · 3fc58d0 · 3fc58d0
1 parent c18e85c
commit 3fc58d0
Show file tree

Hide file tree

Showing 2 changed files with 65 additions and 13 deletions.
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
@@ -167,4 +167,6 @@ jobs:
               }
             ]
       - name: Publish to Maven Central
-        run: mvn --batch-mode deploy
+        run: mvn -B deploy -P ossrh
+        env:
+          GPG_KEYNAME: ${{ secrets.GPG_KEYNAME }}
diff --git a/pom.xml b/pom.xml
@@ -78,13 +78,16 @@
 
         <version.maven.war.plugin>3.2.2</version.maven.war.plugin>
         <version.maven.release.plugin>2.5.3</version.maven.release.plugin>
+        <version.maven.source.plugin>3.2.1</version.maven.source.plugin>
         <version.maven.javadoc.plugin>3.5.0</version.maven.javadoc.plugin>
         <version.maven.jar.plugin>3.1.1</version.maven.jar.plugin>
         <version.maven.surefire.plugin>3.0.0-M5</version.maven.surefire.plugin>
         <version.maven.compiler.plugin>3.7.0</version.maven.compiler.plugin>
         <version.maven.failsafe.plugin>3.0.0-M4</version.maven.failsafe.plugin>
         <version.maven.checkstyle.plugin>3.1.2</version.maven.checkstyle.plugin>
         <version.maven.surefire.report.plugin>${version.maven.surefire.plugin}</version.maven.surefire.report.plugin>
+        <version.nexus.staging.maven.plugin>1.6.13</version.nexus.staging.maven.plugin>
+        <version.maven.gpg.plugin>3.1.0</version.maven.gpg.plugin>
 
         <checkstyle.skip>false</checkstyle.skip>
         <checkstyle.config.location>checkstyle.xml</checkstyle.config.location>
@@ -598,18 +601,6 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-failsafe-plugin</artifactId>
             </plugin>
-
-            <plugin>
-                <groupId>org.sonatype.plugins</groupId>
-                <artifactId>nexus-staging-maven-plugin</artifactId>
-                <version>1.6.13</version>
-                <extensions>true</extensions>
-                <configuration>
-                    <serverId>ossrh</serverId>
-                    <nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
-                    <autoReleaseAfterClose>true</autoReleaseAfterClose>
-                </configuration>
-            </plugin>
         </plugins>
     </build>
 
@@ -666,4 +657,63 @@
             </plugin>
         </plugins>
     </reporting>
+
+    <profiles>
+        <profile>
+            <id>ossrh</id>
+            <activation>
+                <activeByDefault>false</activeByDefault>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-source-plugin</artifactId>
+                        <version>${version.maven.source.plugin}</version>
+                        <executions>
+                            <execution>
+                                <id>attach-sources</id>
+                                <goals>
+                                    <goal>jar-no-fork</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.sonatype.plugins</groupId>
+                        <artifactId>nexus-staging-maven-plugin</artifactId>
+                        <version>${version.nexus.staging.maven.plugin}</version>
+                        <extensions>true</extensions>
+                        <configuration>
+                            <serverId>ossrh</serverId>
+                            <nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
+                            <autoReleaseAfterClose>true</autoReleaseAfterClose>
+                        </configuration>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-gpg-plugin</artifactId>
+                        <version>${version.maven.gpg.plugin}</version>
+                        <executions>
+                            <execution>
+                                <id>sign-artifacts</id>
+                                <phase>verify</phase>
+                                <goals>
+                                    <goal>sign</goal>
+                                </goals>
+                                <configuration>
+                                    <keyname>${env.GPG_KEYNAME}</keyname>
+                                    <passphraseServerId>${env.GPG_KEYNAME}</passphraseServerId>
+                                    <gpgArguments>
+                                        <arg>--pinentry-mode</arg>
+                                        <arg>loopback</arg>
+                                    </gpgArguments>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
 </project>