Skip to content

Add Sonatype Maven Central publishing support#9

Merged
gclaro-idme merged 6 commits into
masterfrom
maven-central-sonatype-publishing
Apr 15, 2026
Merged

Add Sonatype Maven Central publishing support#9
gclaro-idme merged 6 commits into
masterfrom
maven-central-sonatype-publishing

Conversation

@antspriggs
Copy link
Copy Markdown
Contributor

@antspriggs antspriggs commented Apr 14, 2026

Summary

  • Javadoc JAR: Adds Dokka plugin (v1.9.20) to generate KDoc-based Javadoc output, packaged as a -javadoc.jar
  • Sources JAR: Registers a sourcesJar task packaging src/main/java + src/main/kotlin as a -sources.jar
  • GPG Signing: Applies the signing plugin with in-memory PGP key support; signing activates when SIGNING_KEY + SIGNING_PASSWORD env vars are present (no-op locally without keys)
  • Complete POM metadata: Adds url, licenses, developers, and scm blocks required by Sonatype's validation rules
  • Sonatype OSSRH publishing: Adds io.github.gradle-nexus:publish-plugin at root; configures s01.oss.sonatype.org staging/snapshot URLs; release workflow publishes then closes+releases the staging repository

Required GitHub secrets

Add these to the release environment before running the workflow:

Secret Description
SONATYPE_USERNAME Sonatype OSSRH account username
SONATYPE_PASSWORD Sonatype OSSRH account token/password
SIGNING_KEY_ID Short (8-char) GPG key ID
SIGNING_KEY ASCII-armored GPG private key (gpg --armor --export-secret-keys KEY_ID)
SIGNING_PASSWORD GPG key passphrase

Test plan

  • Run ./gradlew :sdk:publishReleasePublicationToMavenLocalRepository locally to verify POM, sources JAR, and Javadoc JAR are generated
  • Inspect ~/.m2/repository/me/id/auth/android-auth-sample-code/ to confirm all five artifacts: .aar, .pom, -sources.jar, -javadoc.jar, .module
  • Set signing env vars and verify .asc signature files appear alongside the artifacts
  • Trigger a draft release workflow run to validate the Sonatype publish step with test credentials

🤖 Generated with Claude Code

antspriggs and others added 5 commits March 27, 2026 09:29
@antspriggs @claude
Address pre-release security audit findings (all Critical + High)
b448677 
Fixes all 4 Critical and 5 High findings, plus 5 of 6 Medium and all 3
Low findings from the pre-release security audit.

Critical:
- [#1] State validation is now unconditional; missing state throws
  StateMismatch, closing the CSRF / authorization code injection vector
- [#2] Public IDmeAuth constructor now requires Context and defaults to
  EncryptedCredentialStore; CredentialStore demoted to internal
- [#3] JWKSClient cache fields are @volatile and all access is serialised
  through a Mutex, eliminating the race condition
- [#4] policies() sends credentials via HTTP Basic Auth header instead of
  GET query parameter, keeping the client secret out of server logs

High:
- [#5] Demo network_security_config.xml removes user-cert trust and sets
  cleartextTrafficPermitted=false
- [#6] iss and aud JWT claims are now mandatory; tokens that omit either
  throw JWTClaimInvalid instead of silently passing
- [#7] JWTValidator validates nbf with 30-second clock skew tolerance and
  applies the same skew window to exp
- [#8] IDmeAuthManager replaces the single CompletableDeferred with a
  ConcurrentHashMap keyed by state; IDmeAuth passes state as sessionId
  so callbacks cannot be routed to the wrong flow
- [#9] extractJSON is now suspend and calls JWTValidator before decoding,
  ensuring userinfo JWT signatures are verified before claims are exposed

Medium:
- [#10] Log.isEnabled flag (default false) gates all SDK log output to
  prevent credential leakage in release builds
- [#11] Redirect URI validation rejects http/https/javascript/file/data
  schemes in IDmeAuth, AuthorizationRequest, and GroupsRequest
- [#12] clearSync() cancels the refresh deferred before nulling state,
  reducing the window for concurrent-write races
- [#13] expiresIn is coerced to [0, 86400] seconds before multiplication,
  preventing integer-overflow-induced negative expiry timestamps
- [#14] AuthViewModel extends AndroidViewModel (provides Context to
  IDmeAuth); clientSecret is only forwarded in OAUTH mode

Low:
- [#15] secure-pipeline-ast.yml pinned to immutable commit SHA instead
  of mutable @master ref
- [#17] Demo release build enables minification
- [#18] Base64URL.decode() throws IDmeAuthError.InvalidJWT on failure
  instead of returning null; JWTDecoder call sites cleaned up accordingly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@antspriggs @claude
Add GitHub Packages Maven publishing workflow
fed48ec 
- Apply maven-publish plugin to :sdk with release publication (com.idme:idme-auth-sdk)
- Configure GitHubPackages repository using GITHUB_TOKEN
- Add GROUP and VERSION_NAME to gradle.properties
- Add publish.yml workflow triggered on GitHub Release or workflow_dispatch

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@antspriggs @claude
Resolve merge with master: adopt release.yml publishing approach
97bddb0 
- Accept master's release.yml and build.yml workflows (comprehensive publishing
  with build attestations and curl-based GitHub Packages upload)
- Resolve sdk/build.gradle.kts conflict: use master's me.id.auth:idme-auth-sample
  coordinates and version from -PreleaseVersion flag instead of gradle.properties
- Remove redundant publish.yml (superseded by release.yml)
- Remove GROUP/VERSION_NAME from gradle.properties (version is passed at release time)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@antspriggs @claude
Rename artifactId to android-auth-sample-code
79b6c9f 
Aligns Maven coordinates with the repository name:
me.id.auth:android-auth-sample-code:<version>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@antspriggs @claude
Add Sonatype Maven Central publishing support
a9f123e 
- Add Dokka plugin for Javadoc JAR generation (required by Sonatype)
- Add sources JAR task (required by Sonatype)
- Apply signing plugin with in-memory PGP key support for CI
- Complete POM metadata: url, licenses, developers, and SCM (required by Sonatype)
- Wire Dokka + nexus-publish plugin into root buildscript classpath
- Configure Sonatype OSSRH staging repository via nexus-publish plugin
- Add Sonatype publish step to release workflow using five new secrets:
  SONATYPE_USERNAME, SONATYPE_PASSWORD, SIGNING_KEY_ID, SIGNING_KEY, SIGNING_PASSWORD

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@antspriggs antspriggs requested review from a team as code owners April 14, 2026 17:28
seftena
seftena reviewed Apr 14, 2026
View reviewed changes
Comment thread .github/workflows/secure-pipeline-ast.yml

jobs:
execute:
uses: IDme/workflow-library/.github/workflows/secure-pipeline-ast.yml@7a259bb101fd4f20d7cd0137c1f99e8d60af0859
Copy link
Copy Markdown
Contributor

@seftena seftena Apr 14, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@antspriggs Where is this ID coming from to replace @master

@service-idme-github
Copy link
Copy Markdown

service-idme-github commented Apr 14, 2026 •
edited
Loading

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@nat-ray @claude
Merge master into maven-central-sonatype-publishing, resolving conflicts
52bd1d5 
- Keep Sonatype OSSRH publish step and Maven Central summary in release.yml
- Keep secure-pipeline-ast.yml (reject master's deletion)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
nat-ray pushed a commit that referenced this pull request Apr 15, 2026
@antspriggs @claude
Add GitHub Packages Maven publishing workflow (#7)
bf7bed2 
* Address pre-release security audit findings (all Critical + High)

Fixes all 4 Critical and 5 High findings, plus 5 of 6 Medium and all 3
Low findings from the pre-release security audit.

Critical:
- [#1] State validation is now unconditional; missing state throws
  StateMismatch, closing the CSRF / authorization code injection vector
- [#2] Public IDmeAuth constructor now requires Context and defaults to
  EncryptedCredentialStore; CredentialStore demoted to internal
- [#3] JWKSClient cache fields are @volatile and all access is serialised
  through a Mutex, eliminating the race condition
- [#4] policies() sends credentials via HTTP Basic Auth header instead of
  GET query parameter, keeping the client secret out of server logs

High:
- [#5] Demo network_security_config.xml removes user-cert trust and sets
  cleartextTrafficPermitted=false
- [#6] iss and aud JWT claims are now mandatory; tokens that omit either
  throw JWTClaimInvalid instead of silently passing
- [#7] JWTValidator validates nbf with 30-second clock skew tolerance and
  applies the same skew window to exp
- [#8] IDmeAuthManager replaces the single CompletableDeferred with a
  ConcurrentHashMap keyed by state; IDmeAuth passes state as sessionId
  so callbacks cannot be routed to the wrong flow
- [#9] extractJSON is now suspend and calls JWTValidator before decoding,
  ensuring userinfo JWT signatures are verified before claims are exposed

Medium:
- [#10] Log.isEnabled flag (default false) gates all SDK log output to
  prevent credential leakage in release builds
- [#11] Redirect URI validation rejects http/https/javascript/file/data
  schemes in IDmeAuth, AuthorizationRequest, and GroupsRequest
- [#12] clearSync() cancels the refresh deferred before nulling state,
  reducing the window for concurrent-write races
- [#13] expiresIn is coerced to [0, 86400] seconds before multiplication,
  preventing integer-overflow-induced negative expiry timestamps
- [#14] AuthViewModel extends AndroidViewModel (provides Context to
  IDmeAuth); clientSecret is only forwarded in OAUTH mode

Low:
- [#15] secure-pipeline-ast.yml pinned to immutable commit SHA instead
  of mutable @master ref
- [#17] Demo release build enables minification
- [#18] Base64URL.decode() throws IDmeAuthError.InvalidJWT on failure
  instead of returning null; JWTDecoder call sites cleaned up accordingly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add GitHub Packages Maven publishing workflow

- Apply maven-publish plugin to :sdk with release publication (com.idme:idme-auth-sdk)
- Configure GitHubPackages repository using GITHUB_TOKEN
- Add GROUP and VERSION_NAME to gradle.properties
- Add publish.yml workflow triggered on GitHub Release or workflow_dispatch

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Rename artifactId to android-auth-sample-code

Aligns Maven coordinates with the repository name:
me.id.auth:android-auth-sample-code:<version>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
@gclaro-idme gclaro-idme merged commit 1255b8e into master Apr 15, 2026
2 checks passed
@gclaro-idme gclaro-idme deleted the maven-central-sonatype-publishing branch April 15, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@seftena seftena seftena left review comments

@nat-ray nat-ray nat-ray approved these changes

@gclaro-idme gclaro-idme gclaro-idme approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@antspriggs @service-idme-github @nat-ray @seftena @gclaro-idme