ci: migrate release to Sonatype Central Portal via nexus-publish

.github/actions/maven-publish/action.yml

@@ -1,58 +1,40 @@
 name: Publish release to Java
 
 inputs:
+  java-version:
+    required: true
   ossr-username:
     required: true
-  ossr-password:
+  ossr-token:
     required: true
   signing-key:
     required: true
   signing-password:
     required: true
-  java-version:
-    required: true
-  is-android:
-    required: true
-  version:
-    required: true
+
 
 runs:
   using: composite
 
   steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # pin@v4.4.0
 
-    - name: Setup Java
-      shell: bash
-      run: |
-        curl -s "https://get.sdkman.io" | bash
-        source "/home/runner/.sdkman/bin/sdkman-init.sh"
-        sdk list java
-        sdk install java "$JAVA_VERSION" && sdk default java "$JAVA_VERSION"
-      env:
-        JAVA_VERSION: ${{ inputs.java-version }}
+    - name: Set up Java
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # pin@v4
+      with:
+        distribution: 'temurin'
+        java-version: ${{ inputs.java-version }}
+        cache: 'gradle'
 
-    - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # pin@1.1.0
-
-    - name: Publish Java
-      shell: bash
-      if: inputs.is-android == 'false'
-      run: ./gradlew clean assemble sign publishMavenJavaPublicationToMavenRepository -PisSnapshot=false -Pversion="$VERSION" -PossrhUsername="$OSSR_USERNAME" -PossrhPassword="$OSSR_PASSWORD" -PsigningKey="$SIGNING_KEY" -PsigningPassword="$SIGNING_PASSWORD"
-      env:
-        VERSION: ${{ inputs.version }}
-        OSSR_USERNAME: ${{ inputs.ossr-username }}
-        OSSR_PASSWORD: ${{ inputs.ossr-password }}
-        SIGNING_KEY: ${{ inputs.signing-key }}
-        SIGNING_PASSWORD: ${{ inputs.signing-password }}
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # pin@v5
 
-    - name: Publish Android
+    - name: Publish Android/Java Packages to Maven
       shell: bash
-      if: inputs.is-android == 'true'
-      run: ./gradlew clean assemble sign publishAndroidLibraryPublicationToMavenRepository -PisSnapshot=false -Pversion="$VERSION" -PossrhUsername="$OSSR_USERNAME" -PossrhPassword="$OSSR_PASSWORD" -PsigningKey="$SIGNING_KEY" -PsigningPassword="$SIGNING_PASSWORD"
+      run: ./gradlew publishToSonatype closeSonatypeStagingRepository -PisSnapshot=false --stacktrace
       env:
-        VERSION: ${{ inputs.version }}
-        OSSR_USERNAME: ${{ inputs.ossr-username }}
-        OSSR_PASSWORD: ${{ inputs.ossr-password }}
+        MAVEN_USERNAME: ${{ inputs.ossr-username }}
+        MAVEN_PASSWORD: ${{ inputs.ossr-token }}
         SIGNING_KEY: ${{ inputs.signing-key }}
         SIGNING_PASSWORD: ${{ inputs.signing-password }}

.github/workflows/release.yml

@@ -9,19 +9,63 @@ on:
 permissions:
   contents: write
 
-### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows/` and append `@latest` after the common `dx-sdk-actions` repo is made public.
-### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `maven-publish`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
-### TODO: Also remove `java-release` workflow from this repo's .github/workflows folder once the repo is public.
-
 jobs:
   release:
-    uses: ./.github/workflows/java-release.yml
-    with:
-      java-version: 8.0.382-tem
-      is-android: true
-    secrets:
-      ossr-username: ${{ secrets.OSSR_USERNAME }}
-      ossr-password: ${{ secrets.OSSR_PASSWORD }}
-      signing-key: ${{ secrets.SIGNING_KEY }}
-      signing-password: ${{ secrets.SIGNING_PASSWORD }}
-      github-token: ${{ secrets.GITHUB_TOKEN }}
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
+    runs-on: ubuntu-latest
+    environment: release
+
+    steps:
+      # Checkout the code
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+        with:
+          fetch-depth: 0
+
+      # Get the version from the branch name
+      - id: get_version
+        uses: ./.github/actions/get-version
+
+      # Get the prerelease flag from the branch name
+      - id: get_prerelease
+        uses: ./.github/actions/get-prerelease
+        with:
+          version: ${{ steps.get_version.outputs.version }}
+
+      # Get the release notes
+      - id: get_release_notes
+        uses: ./.github/actions/get-release-notes
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          version: ${{ steps.get_version.outputs.version }}
+          repo_owner: ${{ github.repository_owner }}
+          repo_name: ${{ github.event.repository.name }}
+
+      # Check if the tag already exists
+      - id: tag_exists
+        uses: ./.github/actions/tag-exists
+        with:
+          tag: ${{ steps.get_version.outputs.version }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # If the tag already exists, exit with an error
+      - if: steps.tag_exists.outputs.exists == 'true'
+        run: exit 1
+
+      # Publish the release to Maven
+      - uses: ./.github/actions/maven-publish
+        with:
+          java-version: '11'
+          ossr-username: ${{ secrets.OSSR_USERNAME }}
+          ossr-token: ${{ secrets.OSSR_TOKEN }}
+          signing-key: ${{ secrets.SIGNING_KEY }}
+          signing-password: ${{ secrets.SIGNING_PASSWORD }}
+
+      # Create a release for the tag
+      - uses: ./.github/actions/release-create
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          name: ${{ steps.get_version.outputs.version }}
+          body: ${{ steps.get_release_notes.outputs.release-notes }}
+          tag: ${{ steps.get_version.outputs.version }}
+          commit: ${{ github.sha }}
+          prerelease: ${{ steps.get_prerelease.outputs.prerelease }}

.shiprc

@@ -1,6 +1,6 @@
 {
   "files": {
-    "auth0/build.gradle": [],
+    "lib/build.gradle": [],
     ".version": [],
     "README.md": []
   },

build.gradle

@@ -22,6 +22,22 @@ buildscript {
     }
 }
 
+plugins {
+    id 'io.github.gradle-nexus.publish-plugin' version '2.0.0'
+}
+
+nexusPublishing {
+    repositories {
+        sonatype {
+            nexusUrl.set(uri('https://ossrh-staging-api.central.sonatype.com/service/local/'))
+            snapshotRepositoryUrl.set(uri('https://central.sonatype.com/repository/maven-snapshots/'))
+            username.set(System.getenv("MAVEN_USERNAME"))
+            password.set(System.getenv("MAVEN_PASSWORD"))
+            stagingProfileId.set(MAVEN_GROUP_ID)
+        }
+    }
+}
+
 allprojects {
     group = 'com.auth0.android'
 

gradle.properties

@@ -17,4 +17,26 @@
 # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
 # org.gradle.parallel=true
 android.enableJetifier=false
-android.useAndroidX=true
+android.useAndroidX=true
+
+# Maven publishing / POM metadata
+MAVEN_GROUP_ID=com.auth0
+GROUP=com.auth0.android
+POM_ARTIFACT_ID=lock
+
+POM_NAME=Lock.Android
+POM_DESCRIPTION=The easiest way of securing your Android mobile apps with Auth0 & Lock
+POM_PACKAGING=aar
+
+POM_URL=https://github.com/auth0/Lock.Android
+POM_SCM_URL=https://github.com/auth0/Lock.Android
+POM_SCM_CONNECTION=scm:git@github.com:auth0/Lock.Android.git
+POM_SCM_DEV_CONNECTION=scm:git@github.com:auth0/Lock.Android.git
+
+POM_LICENCE_NAME=The MIT License (MIT)
+POM_LICENCE_URL=https://raw.githubusercontent.com/auth0/Lock.Android/master/LICENSE.md
+POM_LICENCE_DIST=repo
+
+POM_DEVELOPER_ID=auth0
+POM_DEVELOPER_NAME=Auth0
+POM_DEVELOPER_EMAIL=oss@auth0.com