Skip to content

Commit b074ee4

Browse files
committed
Udpate releasing information
1 parent d4294d0 commit b074ee4

1 file changed

Lines changed: 159 additions & 61 deletions

File tree

RELEASING.md

Lines changed: 159 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -2,66 +2,97 @@
22

33
## Prerequisites
44

5-
### Setup OSSRH and Signing
5+
### Setup Maven Central Portal Publishing
66

7-
If you haven't deployed artifacts to Maven Central before, you need to set up
8-
your OSSRH (OSS Repository Hosting) account and signing keys.
7+
> [!IMPORTANT]
8+
> The OSSRH service will reach the end-of-life sunset date on June 30th, 2025.
9+
> After this, it is recommended to only use Sonatype's Central Publisher Portal
10+
> to publish artifacts to Maven Central. See
11+
> [the official notice](https://central.sonatype.org/news/20250326_ossrh_sunset/)
12+
> for more details.
13+
14+
If you do not have a Central Portal account on Sonatype, you need to set up your
15+
account to publish via the Central Portal.
916

1017
- Follow the instructions on [this
11-
page](http://central.sonatype.org/pages/ossrh-guide.html) to set up an account
12-
with OSSRH.
13-
- You only need to create the account, not set up a new project
14-
- Contact an OpenTelemetry Operations Java maintainer to add your account
15-
after you have created it.
16-
- (For release deployment only) [Install
17-
GnuPG](http://central.sonatype.org/pages/working-with-pgp-signatures.html#installing-gnupg)
18-
and [generate your key
19-
pair](http://central.sonatype.org/pages/working-with-pgp-signatures.html#generating-a-key-pair).
20-
You'll also need to [publish your public
21-
key](http://central.sonatype.org/pages/working-with-pgp-signatures.html#distributing-your-public-key)
22-
to make it visible to the Sonatype servers. For gpg 2.1 or newer, you also
23-
need to [export the
24-
keys](https://docs.gradle.org/current/userguide/signing_plugin.html#sec:signatory_credentials)
25-
with command `gpg --keyring secring.gpg --export-secret-keys >
26-
~/.gnupg/secring.gpg`.
27-
- Put your GnuPG key password and OSSRH account information in
28-
`<your-home-directory>/.gradle/gradle.properties`:
18+
page](https://central.sonatype.org/register/central-portal/) to set up an
19+
account with Central Portal.
20+
- You only need to create the account, not set up a new project.
21+
- Contact an OpenTelemetry Operations Java maintainer to add your account
22+
after you have created it.
23+
24+
### Setup artifact signing
25+
26+
The artifacts must be signed before being published for consumption. Follow
27+
these steps to set up artifact signing:
28+
- [Install
29+
GnuPG](http://central.sonatype.org/pages/working-with-pgp-signatures.html#installing-gnupg)
30+
and [generate your key
31+
pair](http://central.sonatype.org/pages/working-with-pgp-signatures.html#generating-a-key-pair).
32+
- You'll also need to [publish your public
33+
key](http://central.sonatype.org/pages/working-with-pgp-signatures.html#distributing-your-public-key)
34+
to make it visible to the Sonatype servers. For gpg 2.1 or newer, you also
35+
need to [export the
36+
keys](https://docs.gradle.org/current/userguide/signing_plugin.html#sec:signatory_credentials)
37+
with command
38+
`gpg --keyring secring.gpg --export-secret-keys > ~/.gnupg/secring.gpg`.
39+
- Put your GnuPG key password and Central Portal account information in
40+
`<your-home-directory>/.gradle/gradle.properties`:
2941

3042
```text
3143
# You need the signing properties only if you are making release deployment
3244
signing.keyId=<8-character-public-key-id>
3345
signing.password=<key-password>
3446
signing.secretKeyRingFile=<your-home-directory>/.gnupg/secring.gpg
3547
36-
ossrhUsername=<ossrh-username>
37-
ossrhPassword=<ossrh-password>
48+
centralPortalUsername=<ossrh-username>
49+
centralPortalPassword=<ossrh-password>
3850
checkstyle.ignoreFailures=false
3951
```
4052
4153
> [!TIP]
42-
> If your key-generation is failing, checkout the [help section](#help-timeout-during-key-generation-process) at the bottom of this document.
54+
> If your key-generation is failing, checkout the
55+
> [help section](#help-timeout-during-key-generation-process) at the bottom of
56+
> this document.
4357
4458
### Using GPG-Agent for artifact signing
4559
4660
> [!NOTE]
4761
> These instructions are for modern linux where `gpg` refers to the 2.0 version.
4862
49-
If you're running in linux and would like to use the GPG agent to remember your PGP key passwords instead of keeping them in a plain-text file on your home directory,
50-
you can configure the following in `<your-home-directory>/.gradle/gradle.properties`:
63+
If you're running in linux and would like to use the GPG agent to remember your
64+
PGP key passwords instead of keeping them in a plain-text file on your home
65+
directory, you can configure the following in
66+
`<your-home-directory>/.gradle/gradle.properties`:
5167
5268
```text
53-
ossrhUsername=<generated-token-user>
54-
ossrhPassword=<generated-token-key>
69+
centralPortalUsername=<generated-token-user>
70+
centralPortalPassword=<generated-token-key>
5571
5672
signingUseGpgCmd=true
5773
signing.gnupg.executable=gpg
5874
signing.gnupg.keyName=<secret key id (large hash)>
5975
```
60-
Note: You can retrieve the list of previously created GPG keys on your machine by using `gpg --list-secret-keys`.
76+
77+
Note: You can retrieve the list of previously created GPG keys on your machine
78+
by using `gpg --list-secret-keys`. Additionally, you might still be asked for
79+
the GPG key's passphrase while signing the artifact, you can store the key in a
80+
password manager (or in the built-in Keyring) to avoid entering the password
81+
manually.\
82+
For more details, checkout the
83+
[help section](#help-timeout-while-singing-during-release-process) on the bottom
84+
of this guide.
6185
6286
> [!IMPORTANT]
63-
> Starting June 2024, due to a change to the OSSRH authentication backend, the maven publish plugin now requires [a user token](https://central.sonatype.org/publish/generate-token/) instead of a typical username and password used in the Nexus UI.
64-
> Follow the steps in the [link](https://central.sonatype.org/publish/generate-token/) to generate a user token, if not done already - this will provide you with a `tokenuser` and `tokenkey`. Replace `<generated-token-user>` and `<generated-token-key>` with the generated `tokenuser` and `tokenkey` in your `gradle.properties` file to successfully publish artifacts.
87+
> The user tokens for publishing to the Central Portal are different from those
88+
> used for OSSRH. If you haven't already, you must generate a new Portal Token
89+
> to publish to the Central Portal.
90+
> Follow the steps in this
91+
> [link](https://central.sonatype.org/publish/generate-portal-token/) to
92+
> generate a user token - this will provide you with a Portal token containing a
93+
> `username` and `password`. Replace `<generated-token-user>` and
94+
> `<generated-token-key>` with the generated `username` and `password` in your
95+
> `gradle.properties` file to successfully publish artifacts.
6596
6697
### Ensuring you can push tags to GitHub upstream
6798
@@ -71,15 +102,33 @@ token](https://help.github.com/articles/creating-a-personal-access-token-for-the
71102
72103
## Release a Snapshot
73104
74-
If you've followed the above steps, you can release snapshots for consumption using the following:
105+
If you've followed the above steps, you can release snapshots for consumption
106+
using the following:
75107
76108
```bash
77109
$ ./gradlew snapshot
78110
```
79111

80-
## Releasing a Candidate (Optional)
112+
SNAPSHOT releases are intended for developers to make pre-release versions of
113+
their projects available for testing. Published snapshots should be visible
114+
using the
115+
[directory listing for com.google.cloud.opentelemetry](https://central.sonatype.com/service/rest/repository/browse/maven-snapshots/com/google/cloud/opentelemetry/)
116+
namespace.
117+
118+
See
119+
[Publishing Snapshot Releases](https://central.sonatype.org/publish/publish-portal-snapshots/#publishing-snapshot-releases)
120+
for more details.
121+
122+
## Preparing a release candidate (Optional)
123+
124+
> [!TIP]
125+
> Preparing a release candidate involves the same steps as preparing a final
126+
> version. The only difference is in how a release candidate is tagged.\
127+
> Release candidates are pre-release version of libraries, close to the final
128+
> stable release, this is typically not required for this repository.
81129
82-
After following the above steps, you can release candidates from `main` or `v<major>.<minor>.x` branches.
130+
After following the above steps, you can release candidates from `main` or
131+
`v<major>.<minor>.x` branches.
83132

84133
For example, to release the v0.14.0-RC1 candidate, do the following:
85134

@@ -93,12 +142,18 @@ $ git push origin v0.14.0-RC1
93142
Next follow [Releasing on Maven Central](#releasing-on-maven-central) to close + publish the
94143
[repository on OSSRH](https://oss.sonatype.org/#stagingRepositories).
95144

96-
97145
Note: In the future, the `-Prelease.version` flag should not be required.
98146

99-
## Release a final verison
147+
## Preparing a final verison
148+
149+
> [!IMPORTANT]
150+
> The nebula-release plugin automatically tags the current release with the
151+
> appropriate number based on the previous release. Make sure that the release
152+
> version being provided in the argument for the candidate task matches the
153+
> latest tag.
100154
101-
After following the above steps, you can release candidates from `main` or `v<major>.<minor>.x` branches.
155+
After following the above steps, you can release candidates from `main` or
156+
`v<major>.<minor>.x` branches.
102157

103158
For example, to release the v0.14.0 candidate, do the following:
104159

@@ -109,14 +164,11 @@ $ ./gradlew candidate -Prelease.version=0.14.0
109164
$ git push origin v0.14.0
110165
```
111166

112-
*Note: If you do not have a CredentialsProvider registered for GitHub, the `candidate` task may fail to upload tags to the GitHub repository and the overall command may take a long time to report completion on the task. In this case, before moving forward - check if tags were pushed to GitHub. If not, manually push the tags before continuing.*\
113-
*Next, check if the staging repository is created on the [nexus repository manager](https://oss.sonatype.org/#stagingRepositories). If the repository is already created, continue with the next steps.*
114-
115-
Follow [Releasing on Maven Central](#releasing-on-maven-central) to close + publish the
116-
[repository on OSSRH](https://oss.sonatype.org/#stagingRepositories).
117-
118-
After this, follow the [Announcment](#Announcement) documentation to advertise the release and update README files.
119-
167+
*Note: If you do not have a CredentialsProvider registered for GitHub, the
168+
`candidate` task may fail to upload tags to the GitHub repository and the
169+
overall command may take a long time to report completion on the task.
170+
In this case, before moving forward - check if tags were pushed to GitHub.
171+
If not, manually push the tags before continuing.*\
120172

121173
Note: In the future, the `-Prelease.version` flag should not be required.
122174

@@ -130,37 +182,65 @@ gone through code review. For the current release use:
130182
$ git checkout -b v$MAJOR.$MINOR.$PATCH tags/v$MAJOR.$MINOR.$PATCH
131183
```
132184

185+
## Uploading the release artifacts to Central Portal
186+
187+
> [!IMPORTANT]
188+
> This task will create a deployment on the Central Portal, visible on their UI.
189+
> It should only be run after the release is prepared.
190+
191+
After preparing the release, the release artifacts need to be uploaded to
192+
Central Portal so that they can be released on Maven Central.\
193+
To upload the prepared release artifacts, run the following gradle task:
194+
195+
```shell
196+
./gradlew sonatypeUploadDefaultRepository
197+
```
198+
199+
The task will respond with an HTTP status code. If the status code is 200, the
200+
artifacts are successfully uploaded on the Central Portal and should be visible
201+
on the UI.
202+
133203
## Releasing on Maven Central
134204

135205
Once all the artifacts have been pushed to the staging repository, the
136206
repository must first be `closed`, which will trigger several sanity checks on
137207
the repository. If this completes successfully, the repository can then be
138208
`released`, which will begin the process of pushing the new artifacts to Maven
139-
Central (the staging repository will be destroyed in the process). You can see
140-
the complete process for releasing to Maven Central on the [OSSRH
141-
site](http://central.sonatype.org/pages/releasing-the-deployment.html).
209+
Central (the staging repository will be destroyed in the process).
210+
211+
These are manual steps which must be performed from the Central Portal's UI,
212+
which can be accessed by logging into https://central.sonatype.com/publishing.
213+
You should see a deployment under the "Deployments" tab.
214+
215+
You can see the complete process for publishing & releasing to Maven Central on
216+
[Central Portal site](https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#publishing-by-using-the-portal-ossrh-staging-api).
142217

143218
Note: This can/will be automated in the future.
144219

145220
### Things to check before 'closing' on Maven Central
146221

147-
Before closing the staging repository, it is important to verify that the contents of all the
148-
published modules are looking good. Particularly, the version numbers should be what are expected,
149-
and they include any custom release qualifiers (like 'alpha') which are set. Make sure that:
150-
- The generated POM files for the individual module have the correct version number.
151-
- The dependencies for an individual module in the POM file are the expected ones & they dependencies have the correct versions.
152-
- The module content includes all the artifacts that are expected to be published - for instance, sourcesJar, javadocs, additional variants like a shaded JAR in some cases, etc.
222+
Before closing the staging repository, it is important to verify that the
223+
contents of all the published modules are looking good. Particularly, the
224+
version numbers should be what are expected, and they include any custom release
225+
qualifiers (like 'alpha') which are set. Make sure that:
226+
- The generated POM files for the individual module have the correct version
227+
number.
228+
- The dependencies for an individual module in the POM file are the expected
229+
ones & they dependencies have the correct versions.
230+
- The module content includes all the artifacts that are expected to be
231+
published - for instance, sourcesJar, javadocs, additional variants like a
232+
shaded JAR in some cases, etc.
153233
- The file sizes for the published artifacts should seem reasonable.
154234

155235
## Announcement
156236

157-
Once deployment finishes, go to GitHub [release
158-
page](https://github.com/GoogleCloudPlatform/opentelemetry-operations-java/releases),
237+
Once deployment finishes, go to GitHub
238+
[release page](https://github.com/GoogleCloudPlatform/opentelemetry-operations-java/releases),
159239
press `Draft a new release` to write release notes about the new release.
160240

161241
You can use `git log upstream/v$MAJOR.$((MINOR-1)).x..upstream/v$MAJOR.$MINOR.x
162-
--graph --first-parent` or the GitHub [compare
163-
tool](https://github.com/GoogleCloudPlatform/opentelemetry-operations-java/compare/)
242+
--graph --first-parent` or the GitHub
243+
[compare tool](https://github.com/GoogleCloudPlatform/opentelemetry-operations-java/compare/)
164244
to view a summary of all commits since last release as a reference.
165245

166246
Please pick major or important user-visible changes only.
@@ -177,9 +257,27 @@ $ git cherry-pick -x $COMMIT
177257
```
178258

179259
### Help: Timeout during key-generation process
180-
If you see timeout errors when you run `gpg --gen-key` to generate your keys, it maybe because you are running the command on a server and do not have access to a UI.
260+
If you see timeout errors when you run `gpg --gen-key` to generate your keys,
261+
it maybe because you are running the command on a server and do not have access
262+
to a UI.\
181263
A common example is - running this command on a remote machine over ssh.
182264

183-
The issue here is that this command opens up a UI dialog asking for you to set a passphrase, waiting for input for a fixed time.
265+
The issue here is that this command opens up a UI dialog asking for you to set a
266+
passphrase, waiting for input for a fixed time.
267+
268+
The easiest way to fix this is to run it on a machine for which you have UI
269+
access.
270+
271+
### Help: Timeout while signing during release process
272+
If you see timeout errors when you run `./gradlew snapshot` or
273+
`./gradlew candidate` this could be because the process is expecting your GPGKey
274+
passphrase and timed out waiting on it.
275+
This is expected if you do not have access to the UI of the machine which runs
276+
the gradle task.\
277+
A common example is - running this command on a remote machine over ssh.
278+
279+
The issue here is that this command opens up a UI dialog asking for you to set a
280+
passphrase, waiting for input for a fixed time.
184281

185-
The easiest way to fix this is to run it on a machine for which you have UI access.
282+
The easiest way to fix this is to run it on a machine for which you have UI
283+
access.

0 commit comments

Comments
 (0)