Sign the Maven Central upload, and probe the forge registry before publishing #14

Merged

mph merged 1 commit from wip/publish-pgp-passphrase into main

2026-09-12 08:13:52 +00:00

mph commented

2026-09-12 08:11:42 +00:00

Owner

The v3.12.0 tag run (run 775) published 3.12.0 to the forge Maven registry and then failed in the Maven Central step:

org.bouncycastle.openpgp.PGPException: Exception decrypting key
  mill.javalib.pgp.worker.PgpSignerWorker.extractPrivateKey(PgpSignerWorker.scala:146)

Mill 1.1.x reads the key from MILL_PGP_SECRET_BASE64 and its passphrase from MILL_PGP_PASSPHRASE (both names are in the Mill jars). The step passed only the key, so the key could not be decrypted. ac93b22 had removed the passphrase with the reason "key has no passphrase", which does not hold for the current key. The organisation secret MILL_PGP_PASSPHRASE exists.

The registry answers 409 for a release version it already holds, and that error ends the job before the Central step. So a repeat of a tag run could never reach Central. A probe of the version POM now guards the registry step:

release version, POM present -> skip (3.12.0 -> http 200)
release version, POM absent -> publish (9.9.9 -> http 404)
-SNAPSHOT -> always publish, no probe

After the merge, the tag v3.12.0 moves to the merge commit, so that the tag run uses this workflow. The release content does not change: build.mill stays at 3.12.0. The tag run then skips the registry step, which already holds 3.12.0, and publishes to Maven Central.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B4W95VNg8J3zinj28YSSRE

The v3.12.0 tag run (run 775) published 3.12.0 to the forge Maven registry and then failed in the Maven Central step: ``` org.bouncycastle.openpgp.PGPException: Exception decrypting key mill.javalib.pgp.worker.PgpSignerWorker.extractPrivateKey(PgpSignerWorker.scala:146) ``` Mill 1.1.x reads the key from `MILL_PGP_SECRET_BASE64` and its passphrase from `MILL_PGP_PASSPHRASE` (both names are in the Mill jars). The step passed only the key, so the key could not be decrypted. `ac93b22` had removed the passphrase with the reason "key has no passphrase", which does not hold for the current key. The organisation secret `MILL_PGP_PASSPHRASE` exists. The registry answers 409 for a release version it already holds, and that error ends the job before the Central step. So a repeat of a tag run could never reach Central. A probe of the version POM now guards the registry step: - release version, POM present -> skip (3.12.0 -> http 200) - release version, POM absent -> publish (9.9.9 -> http 404) - -SNAPSHOT -> always publish, no probe After the merge, the tag v3.12.0 moves to the merge commit, so that the tag run uses this workflow. The release content does not change: build.mill stays at 3.12.0. The tag run then skips the registry step, which already holds 3.12.0, and publishes to Maven Central. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01B4W95VNg8J3zinj28YSSRE

mph added 1 commit

2026-09-12 08:11:42 +00:00

Sign the Central upload and offer the registry only what it accepts

CI / test (pull_request) Successful in 47s

Details

CI / lint (pull_request) Successful in 50s

Details

CI / format (pull_request) Successful in 42s

Details

CI / compile (pull_request) Successful in 45s

Details

2856539376

The v3.12.0 tag run published to the forge Maven registry and then failed
in the Maven Central step: 'PGPException: Exception decrypting key'. Mill
reads the key from MILL_PGP_SECRET_BASE64 and its passphrase from
MILL_PGP_PASSPHRASE, and the step passed only the key. The step now passes
the passphrase, which the organisation holds as a secret.

The registry answers 409 for a release version it already holds, which ends
the job before Maven Central. A probe of the version's POM now guards the
registry step, so a repeated tag run reaches Maven Central. A -SNAPSHOT
skips the probe and is always published.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4W95VNg8J3zinj28YSSRE

mph merged commit b2082a247d into main

2026-09-12 08:13:52 +00:00

mph referenced this pull request from a commit

2026-09-12 08:13:54 +00:00

Merge pull request 'Sign the Maven Central upload, and probe the forge registry before publishing' (#14) from wip/publish-pgp-passphrase into main