ci(publish): publish releases to Sonatype Central #43

Merged

mph merged 1 commit from ci/publish-to-central into main

2026-08-15 09:52:21 +00:00

mph commented

2026-08-14 19:00:40 +00:00

Owner

What

Adds a second, independent central publish job to .github/workflows/publish.yml.
On v* tags it uploads PGP-signed release artifacts to Sonatype Central with
mill.javalib.SonatypeCentralPublishModule/publishAll.

Follows the proven scalatags-datastar pattern. The Forgejo and Nexus publishing
stays unchanged.

Why

The publish workflow targeted only the Forgejo registry and the e-BS Nexus. It
never had a Central target, so releases did not reach Maven Central. The
works.iterative namespace, the PGP signing key, and the Central account already
exist as org secrets (scalatags-datastar uses them). The works.iterative.support
groupId sits under that namespace.

Design notes

Separate job, not a step: one registry refusing a re-upload of a release it
already holds cannot block delivery to the other.
Snapshots stay on Forgejo. The Central Portal hosts releases only.
No test step in the job — tests run in PR CI (ci.yml).

Not yet verified (needs a live tag)

That the IWPublishModule trait (built for the e-BS Nexus) does not divert the
Central upload.
That sources/doc JARs and the POM meet Central's checks for every module,
including the ScalaJS cross-builds.

Secrets used: MILL_PGP_SECRET_BASE64, MILL_PGP_PASSPHRASE,
MILL_SONATYPE_USERNAME, MILL_SONATYPE_PASSWORD.

## What Adds a second, independent `central` publish job to `.github/workflows/publish.yml`. On `v*` tags it uploads PGP-signed release artifacts to Sonatype Central with `mill.javalib.SonatypeCentralPublishModule/publishAll`. Follows the proven `scalatags-datastar` pattern. The Forgejo and Nexus publishing stays unchanged. ## Why The publish workflow targeted only the Forgejo registry and the e-BS Nexus. It never had a Central target, so releases did not reach Maven Central. The `works.iterative` namespace, the PGP signing key, and the Central account already exist as org secrets (scalatags-datastar uses them). The `works.iterative.support` groupId sits under that namespace. ## Design notes - Separate job, not a step: one registry refusing a re-upload of a release it already holds cannot block delivery to the other. - Snapshots stay on Forgejo. The Central Portal hosts releases only. - No test step in the job — tests run in PR CI (`ci.yml`). ## Not yet verified (needs a live tag) - That the `IWPublishModule` trait (built for the e-BS Nexus) does not divert the Central upload. - That sources/doc JARs and the POM meet Central's checks for every module, including the ScalaJS cross-builds. Secrets used: `MILL_PGP_SECRET_BASE64`, `MILL_PGP_PASSPHRASE`, `MILL_SONATYPE_USERNAME`, `MILL_SONATYPE_PASSWORD`.

mph added 1 commit

2026-08-14 19:00:40 +00:00

ci(publish): add Sonatype Central publish job for release tags

CI / Run Tests (pull_request) Successful in 2m17s

Details

CI / Check Linting (pull_request) Successful in 2m22s

Details

CI / Check Formatting (pull_request) Successful in 53s

Details

CI / Compile (pull_request) Successful in 2m15s

Details

5e96d61006

Adds a second, independent publish job that uploads PGP-signed release
artifacts to Sonatype Central on v* tags, following the scalatags-datastar
pattern. Snapshots stay on the Forgejo registry (Central hosts releases only).
The works.iterative.support groupId sits under the works.iterative namespace
already registered on Central; the PGP key and Central account are org secrets.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mph merged commit 9c1a6350ae into main

2026-08-15 09:52:21 +00:00

mph deleted branch ci/publish-to-central

2026-08-15 09:52:21 +00:00

mph referenced this pull request from a commit

2026-08-15 09:52:22 +00:00

Merge pull request 'ci(publish): publish releases to Sonatype Central' (#43) from ci/publish-to-central into main