Skip to content

chore: migrate CI to unified publish.yml with Sonatype Central Portal #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bernardladenthin merged 2 commits into from
May 11, 2026
Merged

chore: migrate CI to unified publish.yml with Sonatype Central Portal #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
46b5560
chore: migrate CI to unified publish.yml with Sonatype Central Portal
claude May 11, 2026
001097d
fix: bump codeql-action v3→v4, add permissions to post-publish
claude May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: CodeQL
on:
push:
branches: [main]
pull_request:
branches: [main]
schedule:
- cron: "12 1 * * 0"
jobs:
analyze:
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-java@v5
with: { java-version: '8', distribution: zulu }
- uses: github/codeql-action/init@v4
with: { languages: java, queries: +security-and-quality }
- uses: github/codeql-action/autobuild@v4
- uses: github/codeql-action/analyze@v4
with: { category: "/language:java" }
91 changes: 47 additions & 44 deletions .github/workflows/release.yaml → .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Build, Test and Release
name: Publish
on:
push:
branches: [ master ]
branches: [ main ]
tags: ['v*']
pull_request:
workflow_dispatch:
inputs:
Expand All @@ -10,11 +11,9 @@ on:
required: false
default: 'false'
enable_cuda_build:
description: 'Compile CUDA artifacts (slow — nvcc install + build). Auto-enabled on release events.'
description: 'Compile CUDA artifacts (slow — nvcc install + build). Auto-enabled on tag pushes.'
required: false
default: 'false'
release:
types: [ created ]
env:
MODEL_URL: "https://huggingface.co/TheBloke/CodeLlama-7B-GGUF/resolve/main/codellama-7b.Q2_K.gguf"
MODEL_NAME: "codellama-7b.Q2_K.gguf"
Expand Down Expand Up @@ -49,7 +48,7 @@ jobs:
id: build
shell: bash
run: |
if [[ "${{ github.event_name }}" == "release" || "${{ github.event.inputs.enable_cuda_build }}" == "true" ]]; then
if [[ "${{ startsWith(github.ref, 'refs/tags/v') }}" == "true" || "${{ github.event.inputs.enable_cuda_build }}" == "true" ]]; then
.github/dockcross/dockcross-manylinux_2_28-x64 .github/build_cuda_linux.sh "-DOS_NAME=Linux -DOS_ARCH=x86_64"
echo "built=true" >> "$GITHUB_OUTPUT"
else
Expand Down Expand Up @@ -588,59 +587,46 @@ jobs:
path: target/*.jar

publish-snapshot:
name: Publish Snapshot to GitHub Releases and GitHub Packages
name: Publish Snapshot to Central
needs: [ package ]
if: github.event_name != 'pull_request' && needs.package.result == 'success'
if: >-
(github.event_name == 'push' && github.ref == 'refs/heads/main') ||
github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
environment: maven-central
steps:
- uses: actions/checkout@v6
- uses: actions/download-artifact@v8
with:
name: llama-jars
path: snapshot-jars/
Copy link
Copy Markdown

@claude claude Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The post-publish job depends on both publish-snapshot and publish-release even though they run in mutually exclusive scenarios (snapshot on main push, release on tag push).

While the condition correctly handles skipped jobs, consider adding a comment documenting why both dependencies are needed, to prevent accidental breakage if either job is renamed or removed in the future.

Suggested comment:

# Depends on both publish jobs (mutually exclusive):
# - publish-snapshot runs on main branch pushes
# - publish-release runs on tag pushes
# Only one will succeed per trigger; post-publish runs if either succeeds
needs: [package, publish-snapshot, publish-release]

Copy link
Copy Markdown
Owner Author

@bernardladenthin bernardladenthin May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The if: condition is self-documenting: publish-snapshot.result == 'success' || publish-release.result == 'success'. Since these two jobs have mutually exclusive trigger conditions (main branch vs. v* tags), only one can ever succeed per run. Adding inline YAML comments would add noise to an already clear condition. No change needed.

Generated by Claude Code

- name: Publish rolling snapshot release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_REPO: ${{ github.repository }}
run: |
gh release delete snapshot --yes --cleanup-tag || true
gh release create snapshot snapshot-jars/*.jar \
--title "Snapshot Build" \
--notes "Snapshot from ${{ github.sha }} — ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
--prerelease \
--target ${{ github.sha }}
- name: Set up Maven for GitHub Packages
uses: actions/setup-java@v5
- uses: actions/setup-java@v5
with:
distribution: 'zulu'
java-version: '8'
server-id: github
server-username: GITHUB_ACTOR
server-password: GITHUB_TOKEN
- name: Delete snapshot package from GitHub Packages
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh api --method DELETE /user/packages/maven/net.ladenthin.llama || true
- name: Publish to GitHub Packages
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
distribution: zulu
server-id: central
server-username: MAVEN_USERNAME
server-password: MAVEN_PASSWORD
- name: Deploy snapshot
run: |
VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
mvn --batch-mode deploy:deploy-file \
-Durl=https://maven.pkg.github.com/${{ github.repository }} \
-DrepositoryId=github \
-Durl=https://central.sonatype.com/repository/maven-snapshots \
-DrepositoryId=central \
-Dfile=snapshot-jars/llama-${VERSION}.jar \
-DpomFile=pom.xml \
-Dsources=snapshot-jars/llama-${VERSION}-sources.jar \
-Djavadoc=snapshot-jars/llama-${VERSION}-javadoc.jar
env:
MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}

Comment on lines 595 to 623
Copy link
Copy Markdown

@claude claude Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Breaking change: GitHub releases discontinued for snapshots. The old workflow published snapshot builds to GitHub Releases (gh release create snapshot), but this new workflow publishes directly to Maven Central snapshots repository instead.

If external tools, CI pipelines, or documentation reference snapshot releases from GitHub, they will break. This is a significant workflow change.

Questions:

  • Is the GitHub Release asset deprecation intentional?
  • Should snapshot builds still be available from GitHub (e.g., via a separate rollover release), or is Maven Central the canonical source now?

Copy link
Copy Markdown
Owner Author

@bernardladenthin bernardladenthin May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this is intentional. GitHub Releases are no longer the canonical distribution channel — Maven Central snapshots are. Consumers should pull snapshots from https://central.sonatype.com/repository/maven-snapshots/ via their build tool, not from GitHub Release assets. The GitHub Release approach was a workaround for the absence of Central Portal snapshot support; that workaround is no longer needed.

Generated by Claude Code

Comment on lines 618 to 623
Copy link
Copy Markdown

@claude claude Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Version mismatch risk: When a tag v1.2.3 is pushed, the workflow automatically publishes a release. However, there's no validation that the tag version matches the <version> in pom.xml.

If a developer accidentally pushes v1.2.3 while pom.xml contains 1.2.4-SNAPSHOT, a mismatched artifact will be published to Maven Central with incorrect version metadata.

Suggest: Add a validation step before publish-release that compares the tag version with pom.xml:

TAG_VERSION=$(echo "${{ github.ref }}" | sed 's|refs/tags/v||')
POM_VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
if [[ "$TAG_VERSION" != "$POM_VERSION" ]]; then
  echo "Error: Tag version $TAG_VERSION does not match pom.xml version $POM_VERSION"
  exit 1
fi

Copy link
Copy Markdown
Owner Author

@bernardladenthin bernardladenthin May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Valid observation, but tag-version/pom-version alignment is a release workflow practice outside the scope of this CI migration. The same gap exists in other repos (streambuffer, BitcoinAddressFinder) and is a deliberate decision to keep the workflow simple. A version validation step can be added in a follow-up if desired.

Generated by Claude Code

publish:
if: ${{ github.event_name == 'release' || (github.event.inputs.release_to_maven_central == 'true' && needs.crosscompile-linux-x86_64-cuda.outputs.built == 'true') }}
publish-release:
name: Publish Release to Central
Copy link
Copy Markdown

@claude claude Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The maven-dependency-submission-action runs after publishing and needs to access the checked-out repository. This job should inherit the environment protection from the publish jobs that precede it. Consider adding environment: maven-central here as well to enforce that the source code must come from a trusted context, or add a comment explaining why it's safe to run without environment protection.

Copy link
Copy Markdown
Owner Author

@bernardladenthin bernardladenthin May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

post-publish does not deploy any artifacts or access secrets from the maven-central environment — it only submits the dependency graph and uploads coverage reports. Requiring the maven-central environment gate on this job would block the dependency graph submission on every main-branch push until a reviewer approves, which is unnecessary overhead. The maven-central environment is intentionally scoped to the two jobs that actually publish.

Generated by Claude Code

if: startsWith(github.ref, 'refs/tags/v') || github.event.inputs.release_to_maven_central == 'true'
needs: [ package, crosscompile-linux-x86_64-cuda ]
runs-on: ubuntu-latest
environment: maven-central
steps:
- uses: actions/checkout@v6
- uses: actions/download-artifact@v8
Comment on lines +622 to 632
Copy link
Copy Markdown

@claude claude Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Environment protection incomplete for tags: This job runs on tag pushes (startsWith(github.ref, 'refs/tags/v')) with environment: maven-central, but the PR prerequisites only mention adding main as an allowed deployment branch.

Tag-based deployments may require additional environment configuration (e.g., adding refs matching refs/tags/v* as allowed deployment branches or configuring tag protection). Without this, tag pushes will fail with an environment protection error.

Suggest: Update the prerequisites section to include: "For tag pushes, ensure the maven-central environment also allows deployment from tags matching refs/tags/v*"

Expand All @@ -658,14 +644,31 @@ jobs:
with:
java-version: '17'
distribution: 'zulu'
server-id: ossrh
server-id: central
server-username: MAVEN_USERNAME
server-password: MAVEN_PASSWORD
gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
gpg-passphrase: MAVEN_GPG_PASSPHRASE
- name: Publish package
- name: Publish release
run: mvn --batch-mode -P release -Dmaven.test.skip=true deploy
env:
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}
MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

post-publish:
name: Post-Publish
needs: [package, publish-snapshot, publish-release]
if: >-
always() &&
needs.package.result == 'success' &&
(needs.publish-snapshot.result == 'success' ||
needs.publish-release.result == 'success')
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-java@v5
with: { java-version: '8', distribution: zulu }
- uses: advanced-security/maven-dependency-submission-action@v5
7 changes: 7 additions & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,13 @@
<url>https://github.com/bernardladenthin/java-llama.cpp/tree/master</url>
</scm>

<distributionManagement>
<snapshotRepository>
<id>central</id>
<url>https://central.sonatype.com/repository/maven-snapshots/</url>
Copy link
Copy Markdown

@claude claude Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing <repository> section for release deployments. The publish-release job deploys non-snapshot versions (e.g., 1.0.0) and requires this entry:

<repository>
  <id>central</id>
  <url>https://central.sonatype.com/repository/releases/</url>
</repository>

Without it, mvn deploy will fail to find a target repository for release versions.

Copy link
Copy Markdown
Owner Author

@bernardladenthin bernardladenthin May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not needed. central-publishing-maven-plugin with <extensions>true</extensions> (in the release profile) replaces Maven's default deploy plugin and intercepts the deploy lifecycle for non-SNAPSHOT versions. It uploads artifacts to Central Portal directly via its own API using <publishingServerId>, independent of any distributionManagement/<repository> entry.

Adding a <repository> would only affect Maven's built-in deploy plugin, which is no longer invoked when the extension is active. The publish-release job will work correctly without it.

Generated by Claude Code

</snapshotRepository>
</distributionManagement>
Comment on lines +37 to +42
Copy link
Copy Markdown

@claude claude Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Correct: The snapshot repository URL matches the documented Sonatype Central Portal endpoint. However, ensure the <id>central</id> matches the server-id: central in the GitHub Actions workflow and the corresponding credentials are configured in ~/.m2/settings.xml or via CI environment variables.


<properties>
<jna.version>5.18.1</jna.version>
<junit.version>4.13.2</junit.version>
Expand Down
Loading