Skip to content

Commit 5a595be

Browse files
jodastephenjodastephen
authored
Ensure GitHub Releases include asc files (#632)
Add OpenSSF badge https://bestpractices.coreinfrastructure.org/en/projects/6310
1 parent 12559d7 commit 5a595be

File tree

5 files changed

+76
-50
lines changed

5 files changed

+76
-50
lines changed

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ on:
99
tags:
1010
- 'v*'
1111
- 'website*'
12-
pull_request_target:
12+
pull_request:
1313
branches:
14-
- '*'
14+
- 'main'
1515

1616
permissions:
1717
contents: read

‎.github/workflows/tzdbupdate.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,14 @@ on:
88
schedule:
99
- cron: '50 1 * * *'
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
tzdbcheck:
16+
permissions:
17+
contents: write # for peter-evans/create-pull-request to create branch
18+
pull-requests: write # for peter-evans/create-pull-request to create a PR
1319
runs-on: ubuntu-latest
1420

1521
steps:

‎README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ public String getBirthMonthText(LocalDate dateOfBirth) {
3939

4040
Joda-Time is licensed under the business-friendly [Apache 2.0 licence](https://www.joda.org/joda-time/licenses.html).
4141

42+
![Tidelift dependency check](https://tidelift.com/badges/github/JodaOrg/joda-time)
43+
[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/6310/badge)](https://bestpractices.coreinfrastructure.org/projects/6310)
44+
4245

4346
### Documentation
4447
Various documentation is available:
@@ -71,8 +74,6 @@ Available in the [Maven Central repository](https://search.maven.org/search?q=g:
7174
compile 'joda-time:joda-time:2.11.0'
7275
```
7376

74-
![Tidelift dependency check](https://tidelift.com/badges/github/JodaOrg/joda-time)
75-
7677

7778
### Related projects
7879
Related projects at GitHub:

‎pom.xml‎

Lines changed: 59 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -867,37 +867,61 @@
867867
</activation>
868868
<build>
869869
<plugins>
870-
<!-- Sign artifacts -->
870+
<!-- Use nexus plugin to directly release -->
871+
<plugin>
872+
<groupId>org.sonatype.plugins</groupId>
873+
<artifactId>nexus-staging-maven-plugin</artifactId>
874+
<version>${nexus-staging-maven-plugin.version}</version>
875+
<extensions>true</extensions>
876+
<configuration>
877+
<nexusUrl>https://oss.sonatype.org/</nexusUrl>
878+
<serverId>sonatype-joda-staging</serverId>
879+
<description>Releasing ${project.groupId}:${project.artifactId}:${project.version}</description>
880+
<keepStagingRepositoryOnCloseRuleFailure>true</keepStagingRepositoryOnCloseRuleFailure>
881+
<autoReleaseAfterClose>true</autoReleaseAfterClose>
882+
</configuration>
883+
</plugin>
884+
<!-- Create dist files -->
885+
<!-- Since we cannot sign a single file, we put everything in the deploy phase -->
886+
<!-- The standard files are signed in the verify phase and then deployed to Maven Central using nexus-staging-maven-plugin -->
887+
<!-- Then (and only then) we create and attach the dist files, sign them, and release them to GitHub Releases -->
871888
<plugin>
872889
<groupId>org.apache.maven.plugins</groupId>
873-
<artifactId>maven-gpg-plugin</artifactId>
890+
<artifactId>maven-assembly-plugin</artifactId>
874891
<executions>
875892
<execution>
876-
<id>sign-artifacts</id>
877-
<phase>verify</phase>
893+
<id>make-assembly</id>
894+
<phase>deploy</phase>
878895
<goals>
879-
<goal>sign</goal>
896+
<goal>single</goal>
880897
</goals>
898+
<configuration>
899+
<descriptors>
900+
<descriptor>src/main/assembly/dist.xml</descriptor>
901+
</descriptors>
902+
<tarLongFileMode>gnu</tarLongFileMode>
903+
</configuration>
881904
</execution>
882905
</executions>
883906
</plugin>
884-
<!-- Create dist files -->
907+
<!-- Sign artifacts, which now includes the dist files -->
885908
<plugin>
886909
<groupId>org.apache.maven.plugins</groupId>
887-
<artifactId>maven-assembly-plugin</artifactId>
888-
<configuration>
889-
<attach>false</attach>
890-
<descriptors>
891-
<descriptor>src/main/assembly/dist.xml</descriptor>
892-
</descriptors>
893-
<tarLongFileMode>gnu</tarLongFileMode>
894-
</configuration>
910+
<artifactId>maven-gpg-plugin</artifactId>
895911
<executions>
896912
<execution>
897-
<id>make-assembly</id>
898-
<phase>install</phase>
913+
<id>sign-artifacts</id>
914+
<phase>verify</phase>
899915
<goals>
900-
<goal>single</goal>
916+
<goal>sign</goal>
917+
</goals>
918+
</execution>
919+
<!-- this execution must be located after nexus-staging-maven-plugin (see comment above about ordering) -->
920+
<execution>
921+
<id>sign-dist-artifacts</id>
922+
<phase>deploy</phase>
923+
<goals>
924+
<goal>sign</goal>
901925
</goals>
902926
</execution>
903927
</executions>
@@ -907,45 +931,34 @@
907931
<groupId>de.jutzig</groupId>
908932
<artifactId>github-release-plugin</artifactId>
909933
<version>1.4.0</version>
910-
<configuration>
911-
<releaseName>Release v${project.version}</releaseName>
912-
<description>See the [change notes](https://www.joda.org/joda-time/changes-report.html#a${project.version}) for more information.</description>
913-
<tag>v${project.version}</tag>
914-
<overwriteArtifact>true</overwriteArtifact>
915-
<fileSets>
916-
<fileSet>
917-
<directory>${project.build.directory}</directory>
918-
<includes>
919-
<include>${project.artifactId}*-dist.tar.gz</include>
920-
<include>${project.artifactId}*-dist.zip</include>
921-
</includes>
922-
</fileSet>
923-
</fileSets>
924-
</configuration>
925934
<executions>
926935
<execution>
927936
<id>github-releases</id>
928937
<phase>deploy</phase>
929938
<goals>
930939
<goal>release</goal>
931940
</goals>
941+
<configuration>
942+
<releaseName>Release v${project.version}</releaseName>
943+
<description>See the [change notes](https://www.joda.org/joda-time/changes-report.html#a${project.version}) for more information.</description>
944+
<tag>v${project.version}</tag>
945+
<overwriteArtifact>true</overwriteArtifact>
946+
<fileSets>
947+
<fileSet>
948+
<directory>${project.build.directory}</directory>
949+
<includes>
950+
<include>${project.artifactId}-${project.version}-dist.tar.gz</include>
951+
<include>${project.artifactId}-${project.version}-dist.tar.gz.asc</include>
952+
<include>${project.artifactId}-${project.version}-dist.zip</include>
953+
<include>${project.artifactId}-${project.version}-dist.zip.asc</include>
954+
<include>${project.artifactId}-${project.version}.jar.asc</include>
955+
</includes>
956+
</fileSet>
957+
</fileSets>
958+
</configuration>
932959
</execution>
933960
</executions>
934961
</plugin>
935-
<!-- Use nexus plugin to directly release -->
936-
<plugin>
937-
<groupId>org.sonatype.plugins</groupId>
938-
<artifactId>nexus-staging-maven-plugin</artifactId>
939-
<version>${nexus-staging-maven-plugin.version}</version>
940-
<extensions>true</extensions>
941-
<configuration>
942-
<nexusUrl>https://oss.sonatype.org/</nexusUrl>
943-
<serverId>sonatype-joda-staging</serverId>
944-
<description>Releasing ${project.groupId}:${project.artifactId}:${project.version}</description>
945-
<keepStagingRepositoryOnCloseRuleFailure>true</keepStagingRepositoryOnCloseRuleFailure>
946-
<autoReleaseAfterClose>true</autoReleaseAfterClose>
947-
</configuration>
948-
</plugin>
949962
</plugins>
950963
</build>
951964
<properties>

‎src/changes/changes.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,15 @@
99

1010
<!-- types are add, fix, remove, update -->
1111
<release version="SNAPSHOT" date="SNAPSHOT" description="SNAPSHOT">
12+
<action dev="jodastephen" type="update">
13+
Update build scripts and fix static analysis warnings.
14+
</action>
1215
<action dev="jodastephen" type="update">
1316
Switch master to main.
1417
</action>
18+
<action dev="jodastephen" type="update">
19+
DateTimeZone data updated to version 2022cgtz.
20+
</action>
1521
</release>
1622
<release version="2.11.0" date="2022-08-12" description="v2.11.0">
1723
<action dev="jodastephen" type="fix">

0 commit comments

Comments
 (0)