From ca1590abefa8072f52fb11459382cc6a37126e72 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Thu, 3 Sep 2026 13:10:45 +0530 Subject: [PATCH 1/3] ci: migrate release to Sonatype Central Portal via nexus-publish --- .github/actions/maven-publish/action.yml | 56 +++++------- .github/workflows/java-release.yml | 88 ------------------- .github/workflows/release.yml | 73 +++++++++++++--- .shiprc | 2 +- build.gradle | 18 ++++ gradle.properties | 24 +++++- gradle/maven-publish.gradle | 103 +++++++++++++++++++++++ gradle/versioning.gradle | 19 +++++ lib/build.gradle | 32 ++----- 9 files changed, 248 insertions(+), 167 deletions(-) delete mode 100644 .github/workflows/java-release.yml create mode 100644 gradle/maven-publish.gradle create mode 100644 gradle/versioning.gradle diff --git a/.github/actions/maven-publish/action.yml b/.github/actions/maven-publish/action.yml index 9bd2085e..6bdbf7a4 100644 --- a/.github/actions/maven-publish/action.yml +++ b/.github/actions/maven-publish/action.yml @@ -1,58 +1,40 @@ name: Publish release to Java inputs: + java-version: + required: true ossr-username: required: true - ossr-password: + ossr-token: required: true signing-key: required: true signing-password: required: true - java-version: - required: true - is-android: - required: true - version: - required: true + runs: using: composite steps: - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Java - shell: bash - run: | - curl -s "https://get.sdkman.io" | bash - source "/home/runner/.sdkman/bin/sdkman-init.sh" - sdk list java - sdk install java "$JAVA_VERSION" && sdk default java "$JAVA_VERSION" - env: - JAVA_VERSION: ${{ inputs.java-version }} + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # pin@v4.4.0 - - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # pin@1.1.0 + - name: Set up Java + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # pin@v4 + with: + distribution: 'temurin' + java-version: ${{ inputs.java-version }} + cache: 'gradle' - - name: Publish Java - shell: bash - if: inputs.is-android == 'false' - run: ./gradlew clean assemble sign publishMavenJavaPublicationToMavenRepository -PisSnapshot=false -Pversion="$VERSION" -PossrhUsername="$OSSR_USERNAME" -PossrhPassword="$OSSR_PASSWORD" -PsigningKey="$SIGNING_KEY" -PsigningPassword="$SIGNING_PASSWORD" - env: - VERSION: ${{ inputs.version }} - OSSR_USERNAME: ${{ inputs.ossr-username }} - OSSR_PASSWORD: ${{ inputs.ossr-password }} - SIGNING_KEY: ${{ inputs.signing-key }} - SIGNING_PASSWORD: ${{ inputs.signing-password }} + - name: Set up Gradle + uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # pin@v5 - - name: Publish Android + - name: Publish Android/Java Packages to Maven shell: bash - if: inputs.is-android == 'true' - run: ./gradlew clean assemble sign publishAndroidLibraryPublicationToMavenRepository -PisSnapshot=false -Pversion="$VERSION" -PossrhUsername="$OSSR_USERNAME" -PossrhPassword="$OSSR_PASSWORD" -PsigningKey="$SIGNING_KEY" -PsigningPassword="$SIGNING_PASSWORD" + run: ./gradlew publishToSonatype closeSonatypeStagingRepository -PisSnapshot=false --stacktrace env: - VERSION: ${{ inputs.version }} - OSSR_USERNAME: ${{ inputs.ossr-username }} - OSSR_PASSWORD: ${{ inputs.ossr-password }} - SIGNING_KEY: ${{ inputs.signing-key }} - SIGNING_PASSWORD: ${{ inputs.signing-password }} + MAVEN_USERNAME: ${{ inputs.ossr-username }} + MAVEN_PASSWORD: ${{ inputs.ossr-token }} + SIGNING_KEY: ${{ inputs.signing-key}} + SIGNING_PASSWORD: ${{ inputs.signing-password}} diff --git a/.github/workflows/java-release.yml b/.github/workflows/java-release.yml deleted file mode 100644 index 63ce0a9a..00000000 --- a/.github/workflows/java-release.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: Create Java and GitHub Release - -on: - workflow_call: - inputs: - java-version: - required: true - type: string - is-android: - required: true - type: string - secrets: - ossr-username: - required: true - ossr-password: - required: true - signing-key: - required: true - signing-password: - required: true - github-token: - required: true - -### TODO: Replace instances of './.github/actions/' w/ `auth0/dx-sdk-actions/` and append `@latest` after the common `dx-sdk-actions` repo is made public. -### TODO: Also remove `get-prerelease`, `get-version`, `release-create`, `tag-create` and `tag-exists` actions from this repo's .github/actions folder once the repo is public. - -jobs: - release: - if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) - runs-on: ubuntu-latest - environment: release - - steps: - # Checkout the code - - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - # Get the version from the branch name - - id: get_version - uses: ./.github/actions/get-version - - # Get the prerelease flag from the branch name - - id: get_prerelease - uses: ./.github/actions/get-prerelease - with: - version: ${{ steps.get_version.outputs.version }} - - # Get the release notes - - id: get_release_notes - uses: ./.github/actions/get-release-notes - with: - token: ${{ secrets.github-token }} - version: ${{ steps.get_version.outputs.version }} - repo_owner: ${{ github.repository_owner }} - repo_name: ${{ github.event.repository.name }} - - # Check if the tag already exists - - id: tag_exists - uses: ./.github/actions/tag-exists - with: - tag: ${{ steps.get_version.outputs.version }} - token: ${{ secrets.github-token }} - - # If the tag already exists, exit with an error - - if: steps.tag_exists.outputs.exists == 'true' - run: exit 1 - - # Publish the release to Maven - - uses: ./.github/actions/maven-publish - with: - java-version: ${{ inputs.java-version }} - is-android: ${{ inputs.is-android }} - version: ${{ steps.get_version.outputs.version }} - ossr-username: ${{ secrets.ossr-username }} - ossr-password: ${{ secrets.ossr-password }} - signing-key: ${{ secrets.signing-key }} - signing-password: ${{ secrets.signing-password }} - - # Create a release for the tag - - uses: ./.github/actions/release-create - with: - token: ${{ secrets.github-token }} - name: ${{ steps.get_version.outputs.version }} - body: ${{ steps.get_release_notes.outputs.release-notes }} - tag: ${{ steps.get_version.outputs.version }} - commit: ${{ github.sha }} - prerelease: ${{ steps.get_prerelease.outputs.prerelease }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b969eef4..34e4eb54 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,21 +7,66 @@ on: workflow_dispatch: permissions: + id-token: write contents: write -### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows/` and append `@latest` after the common `dx-sdk-actions` repo is made public. -### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `maven-publish`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public. -### TODO: Also remove `java-release` workflow from this repo's .github/workflows folder once the repo is public. - jobs: release: - uses: ./.github/workflows/java-release.yml - with: - java-version: 8.0.382-tem - is-android: true - secrets: - ossr-username: ${{ secrets.OSSR_USERNAME }} - ossr-password: ${{ secrets.OSSR_PASSWORD }} - signing-key: ${{ secrets.SIGNING_KEY }} - signing-password: ${{ secrets.SIGNING_PASSWORD }} - github-token: ${{ secrets.GITHUB_TOKEN }} + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) + runs-on: ubuntu-latest + environment: release + + steps: + # Checkout the code + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1 + with: + fetch-depth: 0 + + # Get the version from the branch name + - id: get_version + uses: ./.github/actions/get-version + + # Get the prerelease flag from the branch name + - id: get_prerelease + uses: ./.github/actions/get-prerelease + with: + version: ${{ steps.get_version.outputs.version }} + + # Get the release notes + - id: get_release_notes + uses: ./.github/actions/get-release-notes + with: + token: ${{ secrets.GITHUB_TOKEN }} + version: ${{ steps.get_version.outputs.version }} + repo_owner: ${{ github.repository_owner }} + repo_name: ${{ github.event.repository.name }} + + # Check if the tag already exists + - id: tag_exists + uses: ./.github/actions/tag-exists + with: + tag: ${{ steps.get_version.outputs.version }} + token: ${{ secrets.GITHUB_TOKEN }} + + # If the tag already exists, exit with an error + - if: steps.tag_exists.outputs.exists == 'true' + run: exit 1 + + # Publish the release to Maven + - uses: ./.github/actions/maven-publish + with: + java-version: '11' + ossr-username: ${{ secrets.OSSR_USERNAME }} + ossr-token: ${{ secrets.OSSR_TOKEN }} + signing-key: ${{ secrets.SIGNING_KEY }} + signing-password: ${{ secrets.SIGNING_PASSWORD }} + + # Create a release for the tag + - uses: ./.github/actions/release-create + with: + token: ${{ secrets.GITHUB_TOKEN }} + name: ${{ steps.get_version.outputs.version }} + body: ${{ steps.get_release_notes.outputs.release-notes }} + tag: ${{ steps.get_version.outputs.version }} + commit: ${{ github.sha }} + prerelease: ${{ steps.get_prerelease.outputs.prerelease }} diff --git a/.shiprc b/.shiprc index 158d710a..287226b2 100644 --- a/.shiprc +++ b/.shiprc @@ -1,6 +1,6 @@ { "files": { - "auth0/build.gradle": [], + "lib/build.gradle": [], ".version": [], "README.md": [] }, diff --git a/build.gradle b/build.gradle index 8a8404b5..b10e835d 100644 --- a/build.gradle +++ b/build.gradle @@ -22,6 +22,24 @@ buildscript { } } +plugins { + id 'io.github.gradle-nexus.publish-plugin' version '2.0.0' +} + +apply plugin: 'io.github.gradle-nexus.publish-plugin' + +nexusPublishing { + repositories { + sonatype { + nexusUrl.set(uri('https://ossrh-staging-api.central.sonatype.com/service/local/')) + snapshotRepositoryUrl.set(uri('https://central.sonatype.com/repository/maven-snapshots/')) + username.set(System.getenv("MAVEN_USERNAME")) + password.set(System.getenv("MAVEN_PASSWORD")) + stagingProfileId.set(MAVEN_GROUP_ID) + } + } +} + allprojects { group = 'com.auth0.android' diff --git a/gradle.properties b/gradle.properties index 2a8e7cc6..025c102a 100644 --- a/gradle.properties +++ b/gradle.properties @@ -17,4 +17,26 @@ # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects # org.gradle.parallel=true android.enableJetifier=false -android.useAndroidX=true \ No newline at end of file +android.useAndroidX=true + +# Maven publishing / POM metadata +MAVEN_GROUP_ID=com.auth0 +GROUP=com.auth0.android +POM_ARTIFACT_ID=lock + +POM_NAME=Lock.Android +POM_DESCRIPTION=The easiest way of securing your Android mobile apps with Auth0 & Lock +POM_PACKAGING=aar + +POM_URL=https://github.com/auth0/Lock.Android +POM_SCM_URL=https://github.com/auth0/Lock.Android +POM_SCM_CONNECTION=scm:git@github.com:auth0/Lock.Android.git +POM_SCM_DEV_CONNECTION=scm:git@github.com:auth0/Lock.Android.git + +POM_LICENCE_NAME=The MIT License (MIT) +POM_LICENCE_URL=https://raw.githubusercontent.com/auth0/Lock.Android/master/LICENSE.md +POM_LICENCE_DIST=repo + +POM_DEVELOPER_ID=auth0 +POM_DEVELOPER_NAME=Auth0 +POM_DEVELOPER_EMAIL=oss@auth0.com diff --git a/gradle/maven-publish.gradle b/gradle/maven-publish.gradle new file mode 100644 index 00000000..035fa94a --- /dev/null +++ b/gradle/maven-publish.gradle @@ -0,0 +1,103 @@ +apply plugin: 'maven-publish' +apply plugin: 'signing' + +apply from: rootProject.file('gradle/versioning.gradle') + +task sourcesJar(type: Jar) { + archiveClassifier = 'sources' + from android.sourceSets.main.java.srcDirs +} + +task javadoc(type: Javadoc) { + source = android.sourceSets.main.java.srcDirs + classpath += project.files(android.getBootClasspath().join(File.pathSeparator)) + android.libraryVariants.all { variant -> + if (variant.name == 'release') { + if (variant.hasProperty('javaCompileProvider')) { + owner.classpath += variant.javaCompileProvider.get().classpath + } else { + owner.classpath += variant.javaCompile.classpath + } + } + } + exclude '**/BuildConfig.java' + exclude '**/R.java' + failOnError false +} + +task javadocJar(type: Jar, dependsOn: javadoc) { + archiveClassifier = 'javadoc' + from javadoc.destinationDir +} + +publishing { + publications { + release(MavenPublication) { + groupId = GROUP + artifactId = POM_ARTIFACT_ID + version = getVersionName() + + artifact("$buildDir/outputs/aar/${project.getName()}-release.aar") + artifact sourcesJar + artifact javadocJar + + pom { + name = POM_NAME + packaging = POM_PACKAGING + description = POM_DESCRIPTION + url = POM_URL + + licenses { + license { + name = POM_LICENCE_NAME + url = POM_LICENCE_URL + distribution = POM_LICENCE_DIST + } + } + + developers { + developer { + id = POM_DEVELOPER_ID + name = POM_DEVELOPER_NAME + email = POM_DEVELOPER_EMAIL + } + } + + scm { + url = POM_SCM_URL + connection = POM_SCM_CONNECTION + developerConnection = POM_SCM_DEV_CONNECTION + } + + // Replace this with components.release after we update the Android Gradle Plugin version + withXml { + def dependenciesNode = asNode().appendNode('dependencies') + + project.configurations.implementation.allDependencies.each { + if (it.group == null || it.version == null || it.name == null || it.name == "unspecified") { + return + } + def dependencyNode = dependenciesNode.appendNode('dependency') + dependencyNode.appendNode('groupId', it.group) + dependencyNode.appendNode('artifactId', it.name) + dependencyNode.appendNode('version', it.version) + } + } + } + } + } +} + +signing { + def signingKey = System.getenv("SIGNING_KEY") + def signingPassword = System.getenv("SIGNING_PASSWORD") + useInMemoryPgpKeys(signingKey, signingPassword) + sign publishing.publications +} + +publish.dependsOn build + +// Ensure the release AAR exists before the publication is signed. +tasks.matching { it.name == 'signReleasePublication' }.configureEach { + dependsOn tasks.matching { it.name == 'assembleRelease' || it.name == 'bundleReleaseAar' } +} diff --git a/gradle/versioning.gradle b/gradle/versioning.gradle new file mode 100644 index 00000000..a9e0d06e --- /dev/null +++ b/gradle/versioning.gradle @@ -0,0 +1,19 @@ +def getVersionFromFile() { + def versionFile = rootProject.file('.version') + return versionFile.text.readLines().first().trim() +} + +def isSnapshot() { + // Use project.property(...) explicitly: a bare `isSnapshot` resolves to this + // method (same name), not the -PisSnapshot project property. + return hasProperty('isSnapshot') ? project.property('isSnapshot').toBoolean() : true +} + +def getVersionName() { + return isSnapshot() ? project.version+"-SNAPSHOT" : project.version +} + +ext { + getVersionName = this.&getVersionName + getVersionFromFile = this.&getVersionFromFile +} diff --git a/lib/build.gradle b/lib/build.gradle index fb7ca75d..262c2f53 100644 --- a/lib/build.gradle +++ b/lib/build.gradle @@ -1,34 +1,12 @@ plugins { - id "com.auth0.gradle.oss-library.android" version "0.18.0" + id 'com.android.library' } -logger.lifecycle("Using version ${version} for ${name}") - -def signingKey = findProperty('signingKey') -def signingKeyPwd = findProperty('signingPassword') - -oss { - name 'Lock.Android' - repository 'Lock.Android' - organization 'auth0' - description 'The easiest way of securing your Android mobile apps with Auth0 & Lock' - skipAssertSigningConfiguration true +apply from: rootProject.file('gradle/versioning.gradle') - developers { - auth0 { - displayName = 'Auth0' - email = 'oss@auth0.com' - } - lbalmaceda { - displayName = 'Luciano Balmaceda' - email = 'luciano.balmaceda@auth0.com' - } - } -} +version = getVersionFromFile() -signing { - useInMemoryPgpKeys(signingKey, signingKeyPwd) -} +logger.lifecycle("Using version ${version} for ${name}") android { compileSdkVersion 31 @@ -83,3 +61,5 @@ dependencies { testImplementation 'com.jayway.awaitility:awaitility:1.7.0' testImplementation 'androidx.test.espresso:espresso-intents:3.4.0' } + +apply from: rootProject.file('gradle/maven-publish.gradle') From 7bab5b90189873c8a411b12db9fca640856ed8d7 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Fri, 4 Sep 2026 10:23:35 +0530 Subject: [PATCH 2/3] =?UTF-8?q?fix(ci):=20address=20review=20comments=20?= =?UTF-8?q?=E2=80=94=20remove=20duplicate=20plugin=20apply,=20fix=20POM=20?= =?UTF-8?q?deps,=20whitespace?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/actions/maven-publish/action.yml | 4 ++-- build.gradle | 2 -- gradle/maven-publish.gradle | 12 ++++++++++++ 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/actions/maven-publish/action.yml b/.github/actions/maven-publish/action.yml index 6bdbf7a4..b655b132 100644 --- a/.github/actions/maven-publish/action.yml +++ b/.github/actions/maven-publish/action.yml @@ -36,5 +36,5 @@ runs: env: MAVEN_USERNAME: ${{ inputs.ossr-username }} MAVEN_PASSWORD: ${{ inputs.ossr-token }} - SIGNING_KEY: ${{ inputs.signing-key}} - SIGNING_PASSWORD: ${{ inputs.signing-password}} + SIGNING_KEY: ${{ inputs.signing-key }} + SIGNING_PASSWORD: ${{ inputs.signing-password }} diff --git a/build.gradle b/build.gradle index b10e835d..253addb6 100644 --- a/build.gradle +++ b/build.gradle @@ -26,8 +26,6 @@ plugins { id 'io.github.gradle-nexus.publish-plugin' version '2.0.0' } -apply plugin: 'io.github.gradle-nexus.publish-plugin' - nexusPublishing { repositories { sonatype { diff --git a/gradle/maven-publish.gradle b/gradle/maven-publish.gradle index 035fa94a..80ee3d46 100644 --- a/gradle/maven-publish.gradle +++ b/gradle/maven-publish.gradle @@ -73,6 +73,17 @@ publishing { withXml { def dependenciesNode = asNode().appendNode('dependencies') + project.configurations.api.allDependencies.each { + if (it.group == null || it.version == null || it.name == null || it.name == "unspecified") { + return + } + def dependencyNode = dependenciesNode.appendNode('dependency') + dependencyNode.appendNode('groupId', it.group) + dependencyNode.appendNode('artifactId', it.name) + dependencyNode.appendNode('version', it.version) + dependencyNode.appendNode('scope', 'compile') + } + project.configurations.implementation.allDependencies.each { if (it.group == null || it.version == null || it.name == null || it.name == "unspecified") { return @@ -81,6 +92,7 @@ publishing { dependencyNode.appendNode('groupId', it.group) dependencyNode.appendNode('artifactId', it.name) dependencyNode.appendNode('version', it.version) + dependencyNode.appendNode('scope', 'runtime') } } } From 7a5073e752e1607a1cff957859b3033e2b824b8c Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Fri, 4 Sep 2026 11:23:13 +0530 Subject: [PATCH 3/3] chore(ci): remove unused id-token:write permission (no rl-scanner) --- .github/workflows/release.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 34e4eb54..5561f9fd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,7 +7,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: write jobs: