Publish to Maven Central via the Sonatype Central Portal

.github/workflows/release.yml

@@ -1,103 +1,99 @@
 on:
   push:
     branches: [ master ]
+  # Manual run: publishes the current build.gradle version to Maven Central
+  # without creating a tag / GitHub release (e.g. to retry a failed publish).
+  workflow_dispatch:
 
 jobs:
   check-release-tag:
+    if: ${{ github.event_name == 'push' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Prepare tag
         id: prepare_tag
         continue-on-error: true
         run: |
           export TAG=v$(awk '/^version = / { gsub("\"", ""); print $3 }' build.gradle)
           echo "TAG=$TAG" >> $GITHUB_ENV
 
           export CHECK_TAG=$(git tag | grep $TAG)
           if [[ $CHECK_TAG ]]; then
             echo "Skipping because release tag already exists"
             exit 1
           fi
       - name: Output
         id: release_output
         if: ${{ steps.prepare_tag.outcome == 'success' }}
         run: |
-          echo "::set-output name=tag::${{ env.TAG }}"
+          echo "tag=${{ env.TAG }}" >> $GITHUB_OUTPUT
     outputs:
       tag: ${{ steps.release_output.outputs.tag }}
 
   create-github-release:
     runs-on: ubuntu-latest
     needs: check-release-tag
     if: ${{ needs.check-release-tag.outputs.tag }}
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - name: Prepare tag
         run: |
           export TAG=v$(awk '/^version = / { gsub("\"", ""); print $3 }' build.gradle)
           echo "TAG=$TAG" >> $GITHUB_ENV
-      - name: Setup git
-        run: |
-          git config user.email "pusher-ci@pusher.com"
-          git config user.name "Pusher CI"
       - name: Prepare description
         run: |
           csplit -s CHANGELOG.md "/##/" {1}
           cat xx01 > CHANGELOG.tmp
       - name: Create Release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ env.TAG }}
-          release_name: ${{ env.TAG }}
+          name: ${{ env.TAG }}
           body_path: CHANGELOG.tmp
           draft: false
           prerelease: false
 
   publish:
     runs-on: ubuntu-latest
     needs: create-github-release
+    if: ${{ always() && (needs.create-github-release.result == 'success' || github.event_name == 'workflow_dispatch') }}
     steps:
       - uses: actions/checkout@v4
+      - name: Set up JDK
+        uses: actions/setup-java@v4
+        with:
+          java-version: "11"
+          distribution: "temurin"
       - name: Create gradle.properties
         shell: bash
         run: |
           mkdir -p _gradle_user_home
           echo "GRADLE_USER_HOME=_gradle_user_home" >> $GITHUB_ENV
           cat <<FILE > _gradle_user_home/gradle.properties
-          github.username=${{ secrets.PUSHER_CI_GITHUB_PRIVATE_TOKEN }}
-          github.password=""
           maven.username=${{ secrets.MAVEN_USERNAME }}
           maven.password=${{ secrets.MAVEN_PASSWORD }}
           signing.keyId=${{ secrets.SIGNING_KEY_ID }}
           signing.password=${{ secrets.SIGNING_PASSWORD }}
           signing.secretKeyRingFile=_gradle_user_home/pusher-maven-gpg-signing-key.gpg
           FILE
           echo "${{ secrets.PUSHER_MAVEN_GPG_SIGNING_KEY }}" | base64 --decode > _gradle_user_home/pusher-maven-gpg-signing-key.gpg
-      - name: Publish
-        run: |
-          ./gradlew publish
-
-  finish-release:
-    runs-on: ubuntu-latest
-    needs: publish
-    env:
-      NEXUS_USERNAME: ${{ secrets.MAVEN_USERNAME }}
-      NEXUS_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: get_staging_repository_id
-        name: Get staging repository id
+      - name: Upload to Sonatype staging
+        run: ./gradlew publish
+      # Hands the uploaded staging repository to the Central Portal, which
+      # validates it and releases it to Maven Central. Must run from the same
+      # job (same IP address) as the upload above.
+      - name: Release to Maven Central
+        env:
+          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
         run: |
-          echo "staging_repository_id=$(python3 scripts/get_staging_repository_id.py)" >> $GITHUB_OUTPUT
-      - name: Release
-        uses: nexus-actions/release-nexus-staging-repo@main
-        with:
-          username: ${{ secrets.MAVEN_USERNAME }}
-          password: ${{ secrets.MAVEN_PASSWORD }}
-          staging_repository_id: ${{ steps.get_staging_repository_id.outputs.staging_repository_id }}
+          TOKEN=$(printf '%s:%s' "$MAVEN_USERNAME" "$MAVEN_PASSWORD" | base64 -w0)
+          curl --fail-with-body -sS -X POST \
+            -H "Authorization: Bearer $TOKEN" \
+            "https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/com.pusher?publishing_type=automatic"

build.gradle

@@ -131,8 +131,9 @@ publishing {
     }
     repositories {
         maven {
-            def releaseRepositoryUrl = "https://oss.sonatype.org/service/local/staging/deploy/maven2/"
-            def snapshotRepositoryUrl = "https://oss.sonatype.org/content/repositories/snapshots/"
+            // Sonatype Central Portal (OSSRH was shut down on 2025-06-30)
+            def releaseRepositoryUrl = "https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/"
+            def snapshotRepositoryUrl = "https://central.sonatype.com/repository/maven-snapshots/"
             url = version.endsWith("SNAPSHOT") ? snapshotRepositoryUrl : releaseRepositoryUrl
             credentials {
                 username = findProperty("maven.username") ?: ""