feat(ci): add ship-based release automation and migrate publishing to maven central by utkrishtsahu · Pull Request #113 · auth0/JWTDecode.Android

utkrishtsahu · 2026-07-24T10:27:22Z

Changes

Adds release automation to JWTDecode.Android (currently none) and migrates publishing from the retired OSSRH endpoint (oss.sonatype.org, now HTTP 402) to the Sonatype Central Portal. Mirrors the auth0/ship pipeline used by Auth0.Android, adapted for this pure-Java library. Last release was 2.0.2 (Jan 2023) with ~33 unreleased commits — releasing is currently impossible.

Added

Workflows: release.yml (triggers on release/* PR merge), java-release.yml (reusable), snapshot.yml (safe rehearsal → snapshots repo).
Composite actions: get-version, get-prerelease, get-release-notes, tag-exists, release-create, maven-publish.
.version, .shiprc (ship control files); gradle/versioning.gradle, gradle/maven-publish.gradle; POM metadata in gradle.properties.
Root build.gradle: nexus-publish 2.0.0 + Central Portal config; removed dead jcenter().

Removed

publish.yml (targeted the dead endpoint) and the oss-library plugin from lib/build.gradle.

Public API: No source changes — no endpoints, classes, or methods affected. Release tooling only; artifact coordinates (com.auth0.android:jwtdecode) unchanged.

Usage: npx @a0/ship <patch|minor|major> → opens a release/X.Y.Z PR → merge publishes a staged Central Portal release + GitHub release.

Alternatives considered: Keeping oss-library (rejected — dead endpoint, git describe versioning incompatible with ship); upgrading the toolchain (unnecessary — nexus-publish 2.0.0 supports Gradle 6.2, so left unchanged).

References

SDK-10343

Testing

Build + tests: existing test.yml runs ./gradlew clean test jacocoTestReport on every PR, exercising the rewritten lib/build.gradle.
Publish plumbing: run snapshot.yml manually — full credential/signing/upload chain to the disposable snapshots repo (2.0.2-SNAPSHOT), never a permanent release.
Release is staged/reversible — nothing goes public until manually promoted in the Central Portal.
Not tested locally: a corporate TLS proxy resets the JVM's connections ("Socket closed") while curl succeeds — an environment issue, not config. CI (Ubuntu, no proxy) is the verification path; all YAML/gradle config was parse-validated offline.

[x] This change adds test coverage

[x] This change has been tested on the latest version of the platform/language or why not

Checklist

[x] I have read the Auth0 general contribution guidelines

[x] I have read the Auth0 Code of Conduct

[x] All existing and new tests complete without errors

… Central Portal

pmathew92 · 2026-07-24T10:30:43Z

+# Returns a simple true/false boolean indicating whether the version indicates it's a prerelease or not.
+#
+# TODO: Remove once the common repo is public.
+#


Remove this #TODO

pmathew92 · 2026-07-24T10:31:02Z

+# Returns the release notes from the content of a pull request linked to a release branch. It expects the branch name to be in the format release/vX.Y.Z, release/X.Y.Z, release/vX.Y.Z-beta.N. etc.
+#
+# TODO: Remove once the common repo is public.
+#


Remove #TODO

pmathew92 · 2026-07-24T10:31:17Z

+#
+# Returns the version from the .version file.
+#
+# TODO: Remove once the common repo is public.


Remove #TODO

pmathew92 · 2026-07-24T10:33:16Z

+#
+# Creates a GitHub release with the given version.
+#
+# TODO: Remove once the common repo is public.


remove #TODO

pmathew92 · 2026-07-24T10:33:28Z

+#
+# Returns a simple true/false boolean indicating whether the tag exists or not.
+#
+# TODO: Remove once the common repo is public.


Remove #TODO

pmathew92 · 2026-07-24T10:33:47Z

+
+### TODO: Replace instances of './.github/actions/' w/ `auth0/dx-sdk-actions/` and append `@latest` after the common `dx-sdk-actions` repo is made public.
+### TODO: Also remove `get-prerelease`, `get-version`, `release-create`, `tag-create` and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
+


Remove #TODOs

pmathew92 · 2026-07-24T10:35:14Z

+          ossr-username: ${{ secrets.ossr-username }}
+          ossr-token: ${{ secrets.ossr-token }}
+          signing-key:    ${{ secrets.signing-key}}
+          signing-password: ${{ secrets.signing-password}}


This approach of accessing secrets might fail now. If it fails we should do something like this

ossr-username: ${{ secrets.OSSR_USERNAME }} ossr-token: ${{ secrets.OSSR_TOKEN }} signing-key: ${{ secrets.SIGNING_KEY }} signing-password: ${{ secrets.SIGNING_PASSWORD }}

pmathew92 · 2026-07-24T10:35:40Z

+### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows/` and append `@latest` after the common `dx-sdk-actions` repo is made public.
+### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `maven-publish`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
+### TODO: Also remove `java-release` workflow from this repo's .github/workflows folder once the repo is public.
+


Remove the TODOs

pmathew92 · 2026-07-24T10:36:01Z

@@ -0,0 +1,40 @@
+name: Publish Snapshot (rehearsal)


Do you need the snapshot ?

used for dry test.Removed.

pmathew92 · 2026-07-24T10:37:30Z

+    repositories {
+        sonatype {
+            nexusUrl.set(uri('https://ossrh-staging-api.central.sonatype.com/service/local/'))
+            snapshotRepositoryUrl.set(uri('https://central.sonatype.com/repository/maven-snapshots/'))


Do we need snapshot ?

used for dry test.Removed.

…op snapshot

feat(ci): add ship-based release automation and migrate publishing to…

0eda766

… Central Portal

utkrishtsahu requested a review from a team as a code owner July 24, 2026 10:27

pmathew92 reviewed Jul 24, 2026

View reviewed changes

pmathew92 requested changes Jul 24, 2026

View reviewed changes

utkrishtsahu added 2 commits July 24, 2026 16:17

fix(ci): address review — remove TODOs, read env secrets directly, dr…

78bb494

…op snapshot

fix(ci): restore jacocoTestReport task dropped with oss-library plugin

434dd00

pmathew92 changed the title ~~feat(ci): add ship-based release automation and migrate publishing to…~~ feat(ci): add ship-based release automation and migrate publishing to maven central Jul 24, 2026

pmathew92 approved these changes Jul 24, 2026

View reviewed changes

utkrishtsahu merged commit a6d7811 into master Jul 24, 2026
4 checks passed

utkrishtsahu deleted the feat/ship-release-pipeline branch July 24, 2026 10:57


		### TODO: Replace instances of './.github/actions/' w/ `auth0/dx-sdk-actions/` and append `@latest` after the common `dx-sdk-actions` repo is made public.
		### TODO: Also remove `get-prerelease`, `get-version`, `release-create`, `tag-create` and `tag-exists` actions from this repo's .github/actions folder once the repo is public.

Uh oh!

Conversation

utkrishtsahu commented Jul 24, 2026 • edited by pmathew92 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

References

Testing

Testing

Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

utkrishtsahu commented Jul 24, 2026 •

edited by pmathew92

Loading