From 4de4214357f50d2ff93c2ce33bac24c81a38e9d7 Mon Sep 17 00:00:00 2001 From: Tim te Beek Date: Wed, 19 Aug 2026 23:59:02 +0200 Subject: [PATCH 1/3] Publish snapshots to the Code Genome Project instead of Sonatype Registers CGP's S3 bucket as a Maven publishing repository, mirroring org.openrewrite.build.publish-cgp, and points the CI publish-snapshots step at it with the CGP AWS credentials. --- .github/workflows/ci.yml | 13 ++++++++----- README.md | 12 ++++++++++-- build.gradle.kts | 1 - plugin/build.gradle.kts | 15 +++++++++++++++ 4 files changed, 33 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index df1cf425d..7953e44ed 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,12 +43,15 @@ jobs: run: ./gradlew ${{ env.GRADLE_SWITCHES }} build - name: publish-snapshots if: github.event_name != 'pull_request' - run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publishPluginMavenPublicationToSonatypeRepository -x test -x publishPlugins + run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publishPluginMavenPublicationToCgpRepository -x test -x publishPlugins env: - ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USERNAME }} - ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_TOKEN }} - ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_SIGNING_KEY }} - ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_SIGNING_PASSWORD }} + AWS_ACCESS_KEY_ID: ${{ secrets.CGP_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.CGP_AWS_SECRET_ACCESS_KEY }} + AWS_REGION: us-west-2 + # Gradle's own s3:// transport still bundles AWS SDK for Java 1.x, which prints a + # deprecation banner with a stack trace on every upload. Drop once Gradle ships + # https://github.com/gradle/gradle/pull/29686 (milestone 9.8.0). + AWS_JAVA_V1_DISABLE_DEPRECATION_ANNOUNCEMENT: true notify: if: (failure() || cancelled()) && github.event_name == 'schedule' && (github.repository_owner == 'openrewrite' || github.repository_owner == 'moderneinc') diff --git a/README.md b/README.md index 2ab8c2372..09c564379 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ rewrite { } ``` -### Consuming latest snapshots from OSSRH +### Consuming latest snapshots from the Code Genome Project To use the latest `-SNAPSHOT` of the `rewrite-gradle-plugin`, update your project's `settings.gradle.kts`: @@ -54,7 +54,11 @@ pluginManagement { repositories { // ... maven { - url = uri("https://central.sonatype.com/repository/maven-snapshots/") + url = uri("https://artifacts.codegenomeproject.org/maven") + credentials { + username = "USERNAME" + password = "TOKEN" + } } // ... // you'll likely also need this if you don't have a pluginManagement section already: @@ -64,6 +68,10 @@ pluginManagement { } ``` +The Code Genome Project repository requires authentication. Sign in to the Code Genome Project to +create a download token, then replace `USERNAME` with the email or username you signed in with and +`TOKEN` with that token. + The plugin can be consumed in your `build.gradle.kts`: ```kts diff --git a/build.gradle.kts b/build.gradle.kts index 2a7391975..a56d3bb0c 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -48,7 +48,6 @@ nexusPublishing { repositories { sonatype { nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/")) - snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/")) } } } diff --git a/plugin/build.gradle.kts b/plugin/build.gradle.kts index d0d068978..c4e7e2c21 100644 --- a/plugin/build.gradle.kts +++ b/plugin/build.gradle.kts @@ -81,6 +81,21 @@ repositories { google() } +publishing { + repositories { + // Region-qualified host, else Gradle's S3 transport defaults to us-east-1 (the bucket is us-west-2). + maven { + name = "cgp" + url = uri("s3://codegenome-artifacts.s3.us-west-2.amazonaws.com/maven") + credentials(AwsCredentials::class) { + accessKey = System.getenv("AWS_ACCESS_KEY_ID") + secretKey = System.getenv("AWS_SECRET_ACCESS_KEY") + sessionToken = System.getenv("AWS_SESSION_TOKEN") + } + } + } +} + val latest = if (project.hasProperty("releasing")) { "latest.release" } else { From 685a12fd09c66dac5e9da300f9941651e0e6aba4 Mon Sep 17 00:00:00 2001 From: Tim te Beek Date: Tue, 25 Aug 2026 23:15:37 +0200 Subject: [PATCH 2/3] Stop publishing to Sonatype and consuming org.openrewrite from Maven Central Drops the gradle-nexus publish plugin and its nexusPublishing block, which were vestigial: org.openrewrite:plugin was never on Maven Central, as releases go to the Gradle Plugin Portal via publishPlugins. Removes the Sonatype snapshots repository and excludes org.openrewrite and io.moderne from Maven Central and the plugin portal (which proxies Central) whenever CGP credentials are configured, so those groups resolve from CGP alone. --- build.gradle.kts | 9 --------- plugin/build.gradle.kts | 37 +++++++++++++++++++------------------ 2 files changed, 19 insertions(+), 27 deletions(-) diff --git a/build.gradle.kts b/build.gradle.kts index a56d3bb0c..52d6802d6 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -1,6 +1,5 @@ plugins { id("nebula.release") version "latest.release" - id("io.github.gradle-nexus.publish-plugin") version "latest.release" id("org.owasp.dependencycheck") version "latest.release" apply false id("nebula.maven-resolved-dependencies") version "latest.release" apply false id("nebula.maven-apache-license") version "latest.release" apply false @@ -44,12 +43,4 @@ allprojects { } } -nexusPublishing { - repositories { - sonatype { - nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/")) - } - } -} - evaluationDependsOn(":plugin") diff --git a/plugin/build.gradle.kts b/plugin/build.gradle.kts index c4e7e2c21..3771bdd6a 100644 --- a/plugin/build.gradle.kts +++ b/plugin/build.gradle.kts @@ -40,11 +40,12 @@ repositories { } } - val codegenomeUsername = providers.gradleProperty("codegenomeUsername").orNull - val codegenomePassword = providers.gradleProperty("codegenomePassword").orNull - if (!codegenomeUsername.isNullOrEmpty() && !codegenomePassword.isNullOrEmpty()) { - // CGP is the first publish target for both snapshots and releases, so consult it - // ahead of Sonatype and Maven Central; group-scoped to the artifacts it serves. + val codegenomeUsername = providers.gradleProperty("codegenomeUsername").getOrElse("") + val codegenomePassword = providers.gradleProperty("codegenomePassword").getOrElse("") + val codegenomeConfigured = codegenomeUsername.isNotEmpty() && codegenomePassword.isNotEmpty() + if (codegenomeConfigured) { + // CGP is the only source of org.openrewrite and io.moderne artifacts; group-scoped to + // the artifacts it serves so an outage can't break resolution of third-party releases. maven { name = "codegenome" url = uri("https://artifacts.codegenomeproject.org/maven") @@ -59,25 +60,25 @@ repositories { } } - if (!releasing) { - maven { - url = uri("https://central.sonatype.com/repository/maven-snapshots") - // Only consult the snapshots repo for groups that actually publish snapshots we consume, - // so a snapshots-repo outage can't break resolution of third-party releases. - mavenContent { - includeGroupAndSubgroups("org.openrewrite") - includeGroupAndSubgroups("io.moderne") - } - } - } - mavenCentral { mavenContent { excludeVersionByRegex(".+", ".+", ".+-rc-?[0-9]*") + if (codegenomeConfigured) { + excludeGroupAndSubgroups("org.openrewrite") + excludeGroupAndSubgroups("io.moderne") + } } } - gradlePluginPortal() + // The plugin portal proxies Maven Central, so it needs the same exclusion to keep these groups on CGP + gradlePluginPortal { + if (codegenomeConfigured) { + (this as MavenArtifactRepository).content { + excludeGroupAndSubgroups("org.openrewrite") + excludeGroupAndSubgroups("io.moderne") + } + } + } google() } From 8e0bc2621362af7f770338b92d23bcc55b3aa53e Mon Sep 17 00:00:00 2001 From: Tim te Beek Date: Wed, 26 Aug 2026 11:56:20 +0200 Subject: [PATCH 3/3] Link the Code Genome Project token claiming page from the README --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 09c564379..401d14283 100644 --- a/README.md +++ b/README.md @@ -68,9 +68,9 @@ pluginManagement { } ``` -The Code Genome Project repository requires authentication. Sign in to the Code Genome Project to -create a download token, then replace `USERNAME` with the email or username you signed in with and -`TOKEN` with that token. +The [Code Genome Project](https://codegenomeproject.org/) repository requires authentication. +[Sign in to get a download token](https://codegenomeproject.org/token), then replace `USERNAME` with +the email or username you signed in with and `TOKEN` with that token. The plugin can be consumed in your `build.gradle.kts`: