[RUN-4638] Migrate publishing from Maven Central to PackageCloud#71
Merged
Conversation
Maven Central's free publishing limits are being hit org-wide (RUN-4570); plugins account for most of the file/release count and nothing depends on them as Maven dependencies, so rundeck-plugins repos are moving to PagerDuty's PackageCloud instead. Same design already validated on sshj-plugin, http-step, and other rundeck-plugins repos. Signing moves out of Gradle's signing plugin into a manual gpg+curl step in the release workflow: Gradle auto-generates a checksum for every publication artifact including .asc signature files, and PackageCloud's Maven endpoint 422s on the checksum-of-a-signature-file, aborting the publish task. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Migrates this plugin’s release publishing pipeline from Maven Central/Sonatype to PackageCloud, aligning with the approach used in other rundeck-plugins repositories to reduce Maven Central usage while keeping the build functional without PackageCloud-specific configuration.
Changes:
- Removed Gradle Nexus/Sonatype publishing configuration and Gradle-side GPG signing.
- Added configurable PackageCloud Maven repository targeting via
PKGCLD_REPO_URL(with a default fallback). - Updated
release.ymlto publish to PackageCloud and upload.ascsignatures viagpg+curl.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
gradle/publishing.gradle |
Drops Gradle signing configuration from the shared publishing setup. |
gradle/libs.versions.toml |
Removes the Nexus publish plugin version and catalog entry. |
build.gradle |
Removes Nexus publishing plugin usage; configures PackageCloud repository and auth. |
.github/workflows/release.yml |
Switches release publishing from Sonatype to PackageCloud and adds signature upload. |
| PKGCLD_WRITE_TOKEN: ${{ secrets.PKGCLD_WRITE_TOKEN }} | ||
| - name: Sign and upload GPG signatures to PackageCloud | ||
| run: | | ||
| set -e |
fdevans
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira ticket
RUN-4638 (subtask of RUN-4570)
Description
Migrate
git-pluginpublishing from Maven Central (Sonatype) to PackageCloud, applying the same design already validated on rundeck-plugins/sshj-plugin#136 and the other already-migratedrundeck-pluginsrepos. Part of the RUN-4570 Maven Central publishing limits resolution — plugins account for the bulk of the file/release count on Maven Central, but no external project depends on them as Maven dependencies.nexusPublish/nexusPublishing(version-catalog form: dropped thealias(libs.plugins.nexusPublish)plugin and itsnexusPublishentries ingradle/libs.versions.toml).PKGCLD_REPO_URLenv var (with a fallback to the realrundeck-pluginsrepo), replacing the half-migratedPackageCloudTestblock that pointed atrundeckpro-test(tacked ontobuild.gradledirectly, same pattern seen onrundeck-ec2-nodes-plugin/rundeck-azure-plugin).sign(publishing.publications)): PackageCloud's Maven endpoint rejects the checksum Gradle auto-generates for.ascsignature files (422 Unprocessable Entity). Sign and upload viagpgCLI +curlinstead, directly inrelease.yml— the same mechanism validated end-to-end onsshj-plugin.release.yml: replaced the "Publish to Maven Central" step with "Publish to PackageCloud" + a "Sign and upload GPG signatures" step.Testing instructions
.ascsignatures land underorg/rundeck/plugins/git-plugin/<version>/on PackageCloud../gradlew buildstill succeeds withoutPKGCLD_REPO_URLset.