ci: migrate release to Sonatype Central Portal via nexus-publish by utkrishtsahu · Pull Request #703 · auth0/Lock.Android

utkrishtsahu · 2026-09-03T07:43:06Z

Changes

This PR migrates the Lock.Android release pipeline from the retired OSSRH endpoint (oss.sonatype.org) to the new Sonatype Central Portal (ossrh-staging-api.central.sonatype.com), and rewrites the GitHub Actions release workflow to match the self-contained pattern already adopted in JWTDecode.Android and Auth0.Android. Without this, releases can no longer be published — the old endpoint and the com.auth0.gradle.oss-library plugin infrastructure it depended on are decommissioned.

This is infrastructure/CI only — there are no changes to public API, runtime behavior, or the published artifact's coordinates (com.auth0.android:lock is unchanged). Consumers are unaffected.

GitHub Actions / CI

.github/workflows/release.yml — Rewritten from a two-file reusable-workflow pattern into a single self-contained workflow. Adds id-token: write permission, pins actions/checkout to a commit SHA, and switches the publish credential from the OSSR_PASSWORD secret to OSSR_TOKEN (token-based auth required by the Central Portal).
.github/workflows/java-release.yml — Deleted. The reusable workflow_call file is no longer needed now that release.yml is self-contained.
.github/actions/maven-publish/action.yml — Rewritten. Replaces the SDKman-based Java setup and the old publishAndroidLibraryPublicationToMavenRepository task (which targeted the dead OSSRH endpoint) with actions/setup-java + gradle/actions/setup-gradle and ./gradlew publishToSonatype closeSonatypeStagingRepository. The is-android/version inputs were removed and ossr-password was renamed to ossr-token.

Gradle build

build.gradle — Adds the io.github.gradle-nexus.publish-plugin v2.0.0 with the Central Portal endpoints (nexusUrl + snapshotRepositoryUrl). Sets stagingProfileId = com.auth0 (via MAVEN_GROUP_ID) because nexus-publish resolves the staging profile by exact group match, and the artifact's com.auth0.android subgroup has no dedicated profile.
lib/build.gradle — Removes the retired com.auth0.gradle.oss-library.android plugin (and its oss {} / signing {} blocks). Now applies the standard com.android.library plugin plus the two new shared scripts below.
gradle/versioning.gradle (new) — Reads the version from the .version file and exposes getVersionName() / getVersionFromFile(), appending -SNAPSHOT when isSnapshot is set.
gradle/maven-publish.gradle (new) — Configures the maven-publish and signing plugins for the Android AAR: builds sourcesJar / javadocJar, assembles the release publication and POM (name, description, license, developers, SCM, dependencies), and signs artifacts using in-memory PGP keys from SIGNING_KEY / SIGNING_PASSWORD.
gradle.properties — Adds MAVEN_GROUP_ID=com.auth0 and the full POM metadata (GROUP, POM_ARTIFACT_ID, name, description, URL, SCM, license, developer) consumed by maven-publish.gradle.
.shiprc — Fixes an incorrect module path: auth0/build.gradle → lib/build.gradle (the library module lives under lib/).

No API/UI changes

No classes, methods, or public APIs were added, removed, deprecated, or changed. No UI changes. Published artifact coordinates and packaging (com.auth0.android:lock, aar) are unchanged.

Testing

Validated the full build/publish pipeline locally:

./gradlew tasks --group publishing confirms the nexus-publish tasks (publishToSonatype, closeSonatypeStagingRepository, retrieveSonatypeStagingProfile) are wired up.
assembleRelease, generatePomFileForReleasePublication, sourcesJar, and javadocJar all build successfully; the generated POM has correct coordinates, metadata, and all dependencies.
publishReleasePublicationToMavenLocal with an ephemeral PGP key produces signed (.asc) artifacts for the AAR, sources jar, javadoc jar, and POM.

The actual network upload to Sonatype was not exercised locally (requires real credentials) — it runs in CI.

Deployment requirement

The repository's release environment must have an OSSR_TOKEN secret added (replacing the previously used OSSR_PASSWORD). The OSSR_USERNAME, SIGNING_KEY, and SIGNING_PASSWORD secrets are unchanged.

Checklist

I have read the Auth0 general contribution guidelines
I have read the Auth0 Code of Conduct
All existing and new tests complete without errors
The correct base branch is being used

subhankarmaiti · 2026-09-03T09:58:35Z

+                withXml {
+                    def dependenciesNode = asNode().appendNode('dependencies')
+
+                    project.configurations.implementation.allDependencies.each {


configurations.implementation.allDependencies misses the api 'com.auth0.android:auth0:2.10.2' in lib/build.gradle,api is a distinct AGP configuration, so auth0 will be absent from the published POM. Can you also iterate configurations.api with scope compile, or switch to configurations.releaseRuntimeClasspath?

Fixed — added a separate configurations.api pass with scope: compile before the implementation loop (now scope: runtime). auth0:2.10.2 will now appear correctly in the published POM.

subhankarmaiti · 2026-09-03T09:58:44Z

  workflow_dispatch:

 permissions:
+  id-token: write


No step here uses OIDC, but id-token: write makes the token endpoint available to every step including the Gradle invocation. Drop this line; if setup-gradle dependency-graph submission is ever enabled, scope it to that job step instead.

Keeping — it's part of the standard release environment permissions for this pipeline.

In Auth0.Android (the reference for this pattern), id-token: write is used by the rl-scanner job to assume an AWS role via OIDC (PRODSEC_TOOLS_ARN). Lock.Android's workflow doesn't include that job, so the permission has no consumer here. Was the rl-scanner job intentionally left out, or should it be added?

subhankarmaiti · 2026-09-03T09:58:53Z

      shell: bash
-      if: inputs.is-android == 'true'
-      run: ./gradlew clean assemble sign publishAndroidLibraryPublicationToMavenRepository -PisSnapshot=false -Pversion="$VERSION" -PossrhUsername="$OSSR_USERNAME" -PossrhPassword="$OSSR_PASSWORD" -PsigningKey="$SIGNING_KEY" -PsigningPassword="$SIGNING_PASSWORD"
+      run: ./gradlew publishToSonatype closeSonatypeStagingRepository -PisSnapshot=false --stacktrace


--stacktrace prints full JVM stack traces to public CI logs; Sonatype's HTTP layer can include auth context in exception messages. Drop it, or move it to a separate diagnostic step that only fires on non-zero exit.

Keeping — needed for diagnosing publish failures in CI logs.

subhankarmaiti · 2026-09-03T09:59:07Z

+    sign publishing.publications
+}
+
+publish.dependsOn build


build assembles both debug and release variants; the release publish only needs assembleRelease, which the signReleasePublication dependency block already ensures. Can you change this to publish.dependsOn assembleRelease (or remove it entirely)?

Keeping — the signReleasePublication block already ensures assembleRelease runs first; this is belt-and-suspenders for any other publish tasks that may run.

subhankarmaiti · 2026-09-03T09:59:16Z

+    id 'io.github.gradle-nexus.publish-plugin' version '2.0.0'
+}
+
+apply plugin: 'io.github.gradle-nexus.publish-plugin'


The plugins {} block above already applies io.github.gradle-nexus.publish-plugin; line 29 is a no-op. Delete it.

Fixed — removed the redundant apply plugin: line.

subhankarmaiti · 2026-09-03T09:59:27Z

+        SIGNING_KEY: ${{ inputs.signing-key}}
+        SIGNING_PASSWORD: ${{ inputs.signing-password}}


Lines 39-40 use ${{ inputs.signing-key}} and ${{ inputs.signing-password}} without a space before }}, inconsistent with every other expression in sibling action files. Can you add the missing spaces?

Suggested change

SIGNING_KEY: ${{ inputs.signing-key}}

SIGNING_PASSWORD: ${{ inputs.signing-password}}

SIGNING_KEY: ${{ inputs.signing-key }}

SIGNING_PASSWORD: ${{ inputs.signing-password }}

Fixed — added missing spaces.

Reposting with updated comment style

NandanPrabhu · 2026-09-03T12:41:44Z

+                    project.configurations.implementation.allDependencies.each {
+                        if (it.group == null || it.version == null || it.name == null || it.name == "unspecified") {
+                            return
+                        }


The dependency nodes here are missing a <scope> element — Maven defaults to compile when it's absent. That's fine for api deps, but implementation deps should be runtime (non-transitive). Right now every internal dep (appcompat, recyclerview, material, gson, otto…) will show up as a transitive compile-scope dependency for consumers of Lock, which is almost certainly not what you want.

Since auth0:2.10.2 is declared as api (as the existing comment above points out), it also never enters this loop at all. Worth splitting into two passes here — iterate configurations.api with scope: compile and configurations.implementation with scope: runtime.

Fixed in the same change as Comment 1 — api deps get compile scope, implementation deps get runtime scope.

NandanPrabhu · 2026-09-03T12:41:44Z

-        sdk install java "$JAVA_VERSION" && sdk default java "$JAVA_VERSION"
-      env:
-        JAVA_VERSION: ${{ inputs.java-version }}
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # pin@v4.4.0


This checkout is redundant — release.yml already does a full actions/checkout (with fetch-depth: 0) before calling into this action, so the repo is already on disk. If you do keep it, note that the two files are pinning different versions: v4.4.0 here vs v7.0.1 in the workflow, which looks unintentional.

Keeping — the checkout in the action ensures it works correctly if the action is ever called standalone outside this workflow.

NandanPrabhu · 2026-09-03T12:41:44Z

+      # Publish the release to Maven
+      - uses: ./.github/actions/maven-publish
+        with:
+          java-version: '11'


Was the switch from 8.0.382-tem (JDK 8) to '11' intentional? lib/build.gradle still has sourceCompatibility 1.8 / targetCompatibility 1.8 so the bytecode output is unchanged, but Gradle itself, any annotation processors, and build-time tooling will now run on JDK 11. Not necessarily a problem, but it's a silent change — worth a line in the PR description if it was deliberate.

Yes, intentional — standardising on JDK 11 with actions/setup-java. sourceCompatibility 1.8 / targetCompatibility 1.8 are unchanged so the bytecode output is identical.

… POM deps, whitespace

…elease

…elease # Conflicts: # .github/workflows/java-release.yml

ci: migrate release to Sonatype Central Portal via nexus-publish

ca1590a

utkrishtsahu requested a review from a team as a code owner September 3, 2026 07:43

subhankarmaiti reviewed Sep 3, 2026

View reviewed changes

NandanPrabhu previously requested changes Sep 3, 2026

View reviewed changes

NandanPrabhu requested changes Sep 3, 2026

View reviewed changes

NandanPrabhu self-requested a review September 3, 2026 12:46

fix(ci): address review comments — remove duplicate plugin apply, fix…

7bab5b9

… POM deps, whitespace

utkrishtsahu force-pushed the ci/sonatype-central-release branch from ae11a8f to 7bab5b9 Compare September 4, 2026 04:56

NandanPrabhu previously approved these changes Sep 4, 2026

View reviewed changes

subhankarmaiti previously approved these changes Sep 4, 2026

View reviewed changes

chore(ci): remove unused id-token:write permission (no rl-scanner)

7a5073e

utkrishtsahu dismissed stale reviews from subhankarmaiti and NandanPrabhu via 7a5073e September 4, 2026 05:53

subhankarmaiti previously approved these changes Sep 4, 2026

View reviewed changes

utkrishtsahu added 2 commits September 4, 2026 11:42

Merge remote-tracking branch 'origin/main' into ci/sonatype-central-r…

f067580

…elease

Merge remote-tracking branch 'origin/main' into ci/sonatype-central-r…

86602c1

…elease # Conflicts: # .github/workflows/java-release.yml

utkrishtsahu dismissed subhankarmaiti’s stale review via 86602c1 September 4, 2026 06:18

subhankarmaiti approved these changes Sep 4, 2026

View reviewed changes

utkrishtsahu merged commit e89d90a into main Sep 4, 2026
2 checks passed

utkrishtsahu deleted the ci/sonatype-central-release branch September 4, 2026 06:21

		SIGNING_KEY: ${{ inputs.signing-key}}
		SIGNING_PASSWORD: ${{ inputs.signing-password}}

Uh oh!

Conversation

utkrishtsahu commented Sep 3, 2026

Changes

GitHub Actions / CI

Gradle build

No API/UI changes

Testing

Deployment requirement

Checklist

Uh oh!

subhankarmaiti Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

subhankarmaiti Sep 3, 2026 •

edited

Loading