Release everything from a tag, publishing only once both deployments are in

Each Maven Central deployment waited in the Portal until someone pressed
publish, and the Gradle plugins went to the Gradle Plugin Portal by hand
once Maven Central served the jars. A tag now releases everything:

- the jars and the native images are uploaded and validated as before,
  and each upload hands its deployment ID on;
- a publish job publishes both only once both are in, so a version whose
  native build fails publishes nothing and its deployments can be
  dropped in the Portal. It runs JReleaser again with the ID in
  JRELEASER_MAVENCENTRAL_DEPLOYMENT_ID and builds nothing; JReleaser
  1.26 drops a deploymentId set in the DSL. There is one leg per
  deployment, so a re-run repeats only the leg that failed;
- once Maven Central serves both, a job publishes the Gradle plugins
  with the new GRADLE_PUBLISH_KEY and GRADLE_PUBLISH_SECRET secrets;
- the draft GitHub release opens after publishing.

The mise tasks for releasing by hand are gone, and gh:secrets sets the
two Gradle Plugin Portal secrets as well.

Checked: the workflow parses and act orders its jobs as above. A
JReleaser dry run uploads with stage UPLOAD. With a deployment ID, the
task graph is jreleaserDeploy alone, and JReleaser resolves stage PUBLISH
with that ID, on a clean build too; the dry run then stops at the Portal
status call it skips. publishPlugins --validate-only passes. Handing the
ID on and the publishing itself can only run on a real tag.

Author: abashev

.github/workflows/release.yml

@@ -1,18 +1,20 @@
 name: Release
 
-# Tags only, and the tag is the version: the build reads it from GITHUB_REF_NAME and jreleaserDeploy
-# refuses anything that is not a clean X.Y.Z or X.Y.Z.N.
+# Tags only, and the tag is the version: the build reads it from GITHUB_REF_NAME, and jreleaserDeploy and
+# publishPlugins refuse anything that is not a clean X.Y.Z or X.Y.Z.N.
 #
 # Two deployments per tag, because a published groupId:artifactId:version can never gain files
-# afterwards: the jars go up as one, and every platform's native binary as another. Both are uploaded
-# and validated only — the Portal holds them until someone presses publish.
+# afterwards: the jars go up as one, and every platform's native binary as another. Each is uploaded and
+# validated first, and the publish job publishes both only once both are in. A version whose native build
+# fails publishes nothing, and its deployments can be dropped in the Portal.
 #
-# After both, a draft GitHub release on the tag collects the runnable jar, the IDE plugins and the native
-# binaries.
+# Once Maven Central serves both, the Gradle plugins go to the Gradle Plugin Portal. After publishing, a
+# draft GitHub release on the tag collects the runnable jar, the IDE plugins and the native binaries.
 #
-# Needs four repository secrets: JRELEASER_MAVENCENTRAL_USERNAME and JRELEASER_MAVENCENTRAL_PASSWORD
-# (the Central Portal user token) plus JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE. The draft
-# release uses the workflow's own GITHUB_TOKEN.
+# Needs six repository secrets: JRELEASER_MAVENCENTRAL_USERNAME and JRELEASER_MAVENCENTRAL_PASSWORD (the
+# Central Portal user token), JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE, and
+# GRADLE_PUBLISH_KEY and GRADLE_PUBLISH_SECRET (the Gradle Plugin Portal key). The draft release uses the
+# workflow's own GITHUB_TOKEN.
 on:
   push:
     tags:
@@ -29,6 +31,8 @@ jobs:
   jars:
     name: jars
     runs-on: ubuntu-latest
+    outputs:
+      deployment-id: ${{ steps.deployment.outputs.id }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -48,6 +52,16 @@ jobs:
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
           JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
 
+      - name: Hand the deployment to the publish job
+        id: deployment
+        run: |
+          id="$(sed -n 's/^deployMavenCentralSonatypeDeploymentId=//p' build/jreleaser/output.properties)"
+          if [ -z "$id" ]; then
+            echo "No deployment ID in build/jreleaser/output.properties"
+            exit 1
+          fi
+          echo "id=$id" >> "$GITHUB_OUTPUT"
+
       - name: Keep JReleaser's log
         if: ${{ failure() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -121,6 +135,8 @@ jobs:
     name: native deploy
     needs: native-images
     runs-on: ubuntu-latest
+    outputs:
+      deployment-id: ${{ steps.deployment.outputs.id }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -144,7 +160,7 @@ jobs:
       - name: Show what was collected
         run: ls -l native-images
 
-      # No GraalVM here: nothing is compiled, the binaries are published exactly as they arrived.
+      # No GraalVM here: nothing is compiled, the binaries are uploaded exactly as they arrived.
       - name: Stage, sign and upload the native images
         run: ./gradlew -PreleaseTarget=native -PnativeImages=native-images jreleaserDeploy
         env:
@@ -153,6 +169,16 @@ jobs:
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
           JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
 
+      - name: Hand the deployment to the publish job
+        id: deployment
+        run: |
+          id="$(sed -n 's/^deployMavenCentralSonatypeDeploymentId=//p' build/jreleaser/output.properties)"
+          if [ -z "$id" ]; then
+            echo "No deployment ID in build/jreleaser/output.properties"
+            exit 1
+          fi
+          echo "id=$id" >> "$GITHUB_OUTPUT"
+
       - name: Keep JReleaser's log
         if: ${{ failure() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -162,13 +188,92 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
+  # Both deployments are uploaded and validated by now. Publishing one is a JReleaser run given its ID,
+  # which builds nothing. One leg per deployment, so that a re-run repeats only the leg that failed.
+  publish:
+    name: publish (${{ matrix.deployment }})
+    needs: [jars, native-deploy]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - deployment: jars
+            id: ${{ needs.jars.outputs.deployment-id }}
+          - deployment: native
+            id: ${{ needs.native-deploy.outputs.deployment-id }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install JDK 21
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Publish the deployment
+        run: ./gradlew jreleaserDeploy
+        env:
+          JRELEASER_MAVENCENTRAL_DEPLOYMENT_ID: ${{ matrix.id }}
+          JRELEASER_DEPLOY_MAVEN_MAVENCENTRAL_SONATYPE_USERNAME: ${{ secrets.JRELEASER_MAVENCENTRAL_USERNAME }}
+          JRELEASER_DEPLOY_MAVEN_MAVENCENTRAL_SONATYPE_PASSWORD: ${{ secrets.JRELEASER_MAVENCENTRAL_PASSWORD }}
+          JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
+          JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
+
+      - name: Keep JReleaser's log
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jreleaser-log-publish-${{ matrix.deployment }}
+          path: build/jreleaser/trace.log
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # The plugins depend on the version's jars and native images, so they go up only once Maven Central
+  # serves both, which takes some minutes after the publish job. The Gradle Plugin Portal never takes a
+  # version back.
+  gradle-plugins:
+    name: Gradle plugins
+    needs: publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install JDK 21
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Wait for Maven Central to serve the version
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: |
+          for artifact in open-java-format open-java-format-native; do
+            url="https://repo1.maven.org/maven2/dev/openjavaformat/${artifact}/${VERSION}/${artifact}-${VERSION}.pom"
+            until curl --silent --fail --head --output /dev/null "$url"; do
+              echo "Waiting for ${url}"
+              sleep 30
+            done
+          done
+
+      - name: Publish the Gradle plugins
+        run: ./gradlew :gradle-open-java-format:publishPlugins
+        env:
+          GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
+          GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
+
   # What Maven Central does not carry — the runnable formatter jar, the IntelliJ plugin zip, the Eclipse
   # plugin jar, and every platform's native binary as a plain download — goes into a draft GitHub release
-  # on the tag, each file signed with the release key. Only once both deployments are in; publishing the
-  # draft is a click on GitHub, and a re-run fails while a release for the tag exists.
+  # on the tag, each file signed with the release key. Only once both deployments are published; publishing
+  # the draft is a click on GitHub, and a re-run fails while a release for the tag exists.
   github-release:
     name: draft GitHub release
-    needs: [jars, native-deploy]
+    needs: publish
     runs-on: ubuntu-latest
     permissions:
       contents: write

buildSrc/src/main/groovy/open-java-format.release-conventions.gradle

@@ -1,5 +1,6 @@
 // Applied to the root project: signs the staged publications and uploads them to the Maven Central
-// Portal. `mise run release` runs it; `mise run release:dry-run` rehearses without uploading.
+// Portal. The release workflow, .github/workflows/release.yml, runs it on a tag; --dryrun rehearses
+// without uploading.
 plugins {
     id 'base'
     id 'org.jreleaser'
@@ -15,9 +16,16 @@ plugins {
 // plugin zip, the Eclipse plugin jar and every platform's native binary as a plain download — each file
 // signed, plus a checksum file.
 //
-// gradle-open-java-format is not released here: its plugins go to the Gradle Plugin Portal by hand, with
-// `mise run release:gradle-plugin`, once the jars they depend on are published.
+// Publishing is a run of its own: with JRELEASER_MAVENCENTRAL_DEPLOYMENT_ID set, JReleaser publishes that
+// deployment, which an earlier run uploaded and the Portal validated, and nothing is built. The ID has to
+// be an environment variable: JReleaser 1.26 drops a deploymentId set in the DSL. The release workflow
+// uploads both deployments first and publishes them only once both are in, so a version whose native
+// build fails publishes nothing.
+//
+// gradle-open-java-format is not released here: the release workflow publishes its plugins to the Gradle
+// Plugin Portal once Maven Central serves the jars and native images they depend on.
 def releaseTarget = providers.gradleProperty('releaseTarget').getOrElse('jars')
+def deploymentToPublish = providers.environmentVariable('JRELEASER_MAVENCENTRAL_DEPLOYMENT_ID').getOrNull()
 def releasedProjects
 if (releaseTarget == 'jars') {
     releasedProjects = [
@@ -79,7 +87,7 @@ jreleaser {
             skipTag = true
             tagName = '{{projectVersion}}'
             releaseName = '{{projectVersion}}'
-            // Published by hand after a look, like the deployments waiting in the Portal.
+            // Published by hand after a look.
             draft = true
             changelog {
                 formatted = 'ALWAYS'
@@ -131,10 +139,12 @@ jreleaser {
                     url = 'https://central.sonatype.com/api/v1/publisher'
                     namespace = 'dev.openjavaformat'
                     applyMavenCentralRules = true
-                    // Upload and validate, then stop. The deployment waits in the Portal until someone
-                    // presses publish, so a version stays reversible until every one of its deployments
-                    // is in and has been looked at.
-                    stage = 'UPLOAD'
+                    // Upload and wait for the Portal to validate the deployment, then stop; its ID goes to
+                    // build/jreleaser/output.properties as deployMavenCentralSonatypeDeploymentId. Given
+                    // an ID, publish that deployment instead, and end once publishing has started rather
+                    // than waiting, up to half an hour, for Maven Central to serve the files.
+                    stage = deploymentToPublish == null ? 'UPLOAD' : 'PUBLISH'
+                    skipPublicationCheck = true
                     stagingRepositories.each { stagingRepository(it) }
                 }
             }
@@ -143,8 +153,11 @@ jreleaser {
 }
 
 tasks.named('jreleaserDeploy') {
-    releasedProjects.each { path ->
-        dependsOn "${path}:publishAllPublicationsToStagingRepository"
+    // Publishing a deployment that is already uploaded needs nothing built.
+    if (deploymentToPublish == null) {
+        releasedProjects.each { path ->
+            dependsOn "${path}:publishAllPublicationsToStagingRepository"
+        }
     }
 }
 

gradle-open-java-format/build.gradle

@@ -1,5 +1,6 @@
-// For the Gradle Plugin Portal: publishPlugins, run by hand once the version's jars are published on Maven
-// Central — the plugin depends on them. It applies java-gradle-plugin and maven-publish itself.
+// For the Gradle Plugin Portal: publishPlugins, run by the release workflow once Maven Central serves the
+// version's jars and native images — the plugins depend on them. The key comes from GRADLE_PUBLISH_KEY and
+// GRADLE_PUBLISH_SECRET. It applies java-gradle-plugin and maven-publish itself.
 apply plugin: 'com.gradle.plugin-publish'
 apply plugin: 'groovy'
 apply plugin: 'open-java-format.publishing-conventions'

mise.toml

@@ -20,38 +20,6 @@ run = "act push --job build --env JAVA_HOME=/opt/hostedtoolcache/Java_Temurin-Ho
 description = "Run the linux-aarch64 native job locally in Docker"
 run = "act push --job native --matrix platform:linux-aarch64"
 
-# ---- Releases ----
-# JReleaser stages, signs and uploads to the Maven Central Portal the modules listed in
-# buildSrc/src/main/groovy/open-java-format.release-conventions.gradle. The PGP key and the Portal
-# token come from JRELEASER_* variables or ~/.jreleaser/config.properties. Only a clean checkout of a
-# release tag is accepted. Run these through mise, not ./gradlew: JReleaser's POM check finds Java
-# through JAVA_HOME, which mise sets, and without it logs an error and carries on unchecked.
-#
-# These deploy the jars. The native images are a deployment of their own — one binary per platform,
-# built by one CI job per platform and uploaded together by .github/workflows/release.yml on a tag, because a
-# published version can never gain files afterwards.
-
-[tasks.release]
-description = "Stage, sign, and upload the release to the Maven Central Portal (publishing is a click there)"
-run = "./gradlew clean jreleaserDeploy"
-
-[tasks."release:dry-run"]
-description = "Rehearse the release: stage, sign and check the artifacts, upload nothing"
-run = "./gradlew clean jreleaserDeploy --dryrun"
-
-# The Gradle plugins go to the Gradle Plugin Portal instead, by hand and last: they depend on the version's
-# jars, so publish only once that deployment is live on Maven Central. The key and secret are
-# gradle.publish.key and gradle.publish.secret in ~/.gradle/gradle.properties. The Portal never takes a
-# version back; publishPlugins refuses anything but a release tag's version.
-
-[tasks."release:gradle-plugin"]
-description = "Publish the Gradle plugins to the Gradle Plugin Portal (once the jars are live on Maven Central)"
-run = "./gradlew :gradle-open-java-format:publishPlugins"
-
-[tasks."release:gradle-plugin:validate"]
-description = "Check the Gradle plugins' Portal metadata, publish nothing"
-run = "./gradlew :gradle-open-java-format:publishPlugins --validate-only"
-
 # ---- GitHub Actions secrets ----
 # Read from 1Password at apply time; nothing secret is stored in the repo. Requires gh
 # (authenticated with admin on this repository) and the 1Password CLI (`op signin` first).
@@ -107,10 +75,13 @@ apply() {
 
 apply BOT_PAT 'op://Private/open-java-format/GitHub/BOT_PAT'
 
-# What .github/workflows/release.yml signs and uploads with. Actions only: a Dependabot run never
-# releases, and the signing key has no business being readable from one.
+# What .github/workflows/release.yml signs and publishes with: the Central Portal token, the signing key
+# and the Gradle Plugin Portal key. Actions only: a Dependabot run never releases, and the signing key has
+# no business being readable from one.
 apply JRELEASER_MAVENCENTRAL_USERNAME 'op://Private/open-java-format/GitHub/JRELEASER_MAVENCENTRAL_USERNAME' actions
 apply JRELEASER_MAVENCENTRAL_PASSWORD 'op://Private/open-java-format/GitHub/JRELEASER_MAVENCENTRAL_PASSWORD' actions
 apply JRELEASER_GPG_SECRET_KEY 'op://Private/open-java-format/GitHub/JRELEASER_GPG_SECRET_KEY' actions
 apply JRELEASER_GPG_PASSPHRASE 'op://Private/open-java-format/GitHub/JRELEASER_GPG_PASSPHRASE' actions
+apply GRADLE_PUBLISH_KEY 'op://Private/open-java-format/GitHub/GRADLE_PUBLISH_KEY' actions
+apply GRADLE_PUBLISH_SECRET 'op://Private/open-java-format/GitHub/GRADLE_PUBLISH_SECRET' actions
 """