Skip to content

Repository navigation

build(deps): bump Maven Publish to 0.34.0 #910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dpiet-oai merged 6 commits into from
Sep 24, 2026
+19 −17
Merged

build(deps): bump Maven Publish to 0.34.0 #910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9918710
build(deps): bump com.vanniktech:gradle-maven-publish-plugin in /
dependabot[bot] Aug 20, 2026
49bf350
Merge commit '0971c8717c087eccb60e0ce94323f142794b6a58' into HEAD
dpiet-oai Sep 24, 2026
0345d4c
fix(build): use a compatible Maven Publish release and preserve signing
dpiet-oai Sep 24, 2026
899e7cc
Merge commit 'fc188194e7e016dfd8dd327d6f855dfe48c08b1c' into HEAD
dpiet-oai Sep 24, 2026
5415ada
fix(build): verify the published sources task after plugin upgrade
dpiet-oai Sep 24, 2026
6971c4d
Merge commit '3f00bce4be75ba0791f926c13231b499704f9a95' into HEAD
dpiet-oai Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions buildSrc/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
plugins {
`kotlin-dsl`
kotlin("jvm") version "1.9.20"
id("com.vanniktech.maven.publish") version "0.28.0"
id("com.vanniktech.maven.publish") version "0.34.0"
}

repositories {
Expand All @@ -11,7 +11,7 @@ repositories {

dependencies {
implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.20")
implementation("com.vanniktech:gradle-maven-publish-plugin:0.28.0")
implementation("com.vanniktech:gradle-maven-publish-plugin:0.34.0")

testImplementation(kotlin("test"))
testImplementation("org.junit.jupiter:junit-jupiter:6.1.3")
Expand Down
22 changes: 16 additions & 6 deletions buildSrc/src/main/kotlin/openai.publish.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import com.vanniktech.maven.publish.JavadocJar
import com.vanniktech.maven.publish.KotlinJvm
import com.vanniktech.maven.publish.MavenPublishBaseExtension
import com.vanniktech.maven.publish.SonatypeHost
import org.gradle.plugins.signing.SigningExtension

plugins {
id("com.vanniktech.maven.publish")
Expand All @@ -23,14 +23,17 @@ repositories {
mavenCentral()
}

extra["signingInMemoryKey"] = System.getenv("GPG_SIGNING_KEY")
extra["signingInMemoryKeyId"] = System.getenv("GPG_SIGNING_KEY_ID")
extra["signingInMemoryKeyPassword"] = System.getenv("GPG_SIGNING_PASSWORD")

configure<MavenPublishBaseExtension> {
if (!project.hasProperty("publishLocal")) {
signAllPublications()
publishToMavenCentral(SonatypeHost.CENTRAL_PORTAL)
configure<SigningExtension> {
useInMemoryPgpKeys(
System.getenv("GPG_SIGNING_KEY_ID"),
System.getenv("GPG_SIGNING_KEY"),
System.getenv("GPG_SIGNING_PASSWORD"),
)
Comment on lines +30 to +34

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add a regression check for the release signing path

This replaces the credential-loading and Maven Central publication path, but the commit adds no Gradle or shell regression coverage that executes signing with a synthetic key and verifies the resulting local publication. The manual disposable-key validation is not repeatable in CI, so a future plugin or credential-wiring change could leave the protected release workflow unable to sign or publish artifacts without any pull-request check detecting it.

AGENTS.md reference: AGENTS.md:L41-L45

Useful? React with 👍 / 👎.

@markstuart-oai markstuart-oai Sep 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] Commit a regression check for the new signing wiring

Please turn the reported disposable-key smoke check into repeatable Gradle or shell coverage for this change. AGENTS.md requires focused regression coverage for signing/publication logic. The existing publication test in GradleCacheTrustPolicyTest starts after key-ID export and substitutes a fake gradlew, so it never exercises this provider configuration or verifies a signature; normal build CI does not establish those properties either.

A small fixture should apply the production publication convention with a synthetic key, exercise the non-publishLocal signing branch against local artifacts, verify the resulting signatures, and assert that a non-SNAPSHOT signing task fails when the key is absent. It should need no production credentials or Central upload. This is the same remaining coverage concern as the existing unresolved thread, not evidence of a current unsigned-release bug.

}
publishToMavenCentral()
}

coordinates(project.group.toString(), project.name, project.version.toString())
Expand Down Expand Up @@ -67,6 +70,13 @@ configure<MavenPublishBaseExtension> {
}
}

// Preserve Kotlin source paths when Maven Publish uses Gradle's Java sources task.
tasks.named<Jar>("sourcesJar") {
filesMatching("**/*.kt") {
path = "main/$path"
}
}

tasks.withType<Zip>().configureEach {
isZip64 = true
}
10 changes: 1 addition & 9 deletions openai-java-core/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
import com.openai.gradle.CoreCompilationClaimedSourceIncludeSpec
import com.openai.gradle.CoreCompilationClaimedSourceSpec
import com.openai.gradle.CoreCompilationDependencies
import com.openai.gradle.CoreCompilationShards
Expand Down Expand Up @@ -86,15 +85,8 @@ val coreJar = tasks.named<Jar>("jar") {
duplicatesStrategy = DuplicatesStrategy.FAIL
}

val coreSourcesJar = tasks.named<Jar>("kotlinSourcesJar") {
val coreSourcesJar = tasks.named<Jar>("sourcesJar") {
duplicatesStrategy = DuplicatesStrategy.FAIL
from(
fileTree("src/main/kotlin").matching {
include(CoreCompilationClaimedSourceIncludeSpec())
}
) {
into("main")
}
}

val verifyCoreCompilationArtifact =
Expand Down
Loading