ci: restore reliable Maven Central publishing - #824
Conversation
There was a problem hiding this comment.
Pull request overview
This PR repairs Maven Central (Sonatype) publishing after CI was refactored to use a reusable workflow, ensuring the publish path receives the required protected secrets and that both compatibility checks and publishing run from the same validated source ref.
Changes:
- Pass secrets into the Sonatype reusable workflow via
secrets: inheritfrom the caller workflows. - Add a “validate source ref” job and thread the validated ref through runtime-compatibility and publish checkouts.
- Add fail-fast credential validation for required Sonatype/GPG secrets and allow the manual recovery workflow to publish an existing release tag.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/runtime-compatibility.yml | Adds a workflow_call input to run runtime compatibility against a caller-provided git ref. |
| .github/workflows/publish-sonatype.yml | Extends manual publishing to accept a required existing release tag and forwards it to the reusable workflow, inheriting secrets. |
| .github/workflows/publish-sonatype-reusable.yml | Adds a validate job to select the source ref, gates publishing on runtime compatibility, validates credentials early, and checks out the validated ref for publishing. |
| .github/workflows/create-releases.yml | Ensures the automated release workflow opts into secret inheritance when calling the reusable Sonatype publish workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa4797e18a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jbeckwith-oai
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db6b0c8bef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jbeckwith-oai
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (4)
.github/workflows/runtime-compatibility.yml:69
- Same issue as above: the checkout ref uses
inputs.refdirectly, which can breakscheduleruns. Gateinputs.refusage on the event type.
ref: ${{ inputs.ref || github.sha }}
.github/workflows/create-releases.yml:40
- The
releasejob is bound to the protectedpublishenvironment even though it only selects/validates the source. This expands the publish-secret boundary earlier than necessary and can also block automatic releases if the environment requires approval. Bindenvironment: publishonly to the actual publish job.
if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-java'
runs-on: ubuntu-24.04
timeout-minutes: 15
environment: publish
outputs:
.github/workflows/create-releases.yml:185
- The GraalVM native-image file check fails silently (no error output) when the directory is missing/empty, which makes release failures harder to diagnose. Emit a clear
::error::message (matching other steps in this workflow) before exiting non-zero.
- name: Check generated GraalVM files
run: |
directory="openai-java-core/src/main/resources/META-INF/native-image"
[[ -d "$directory" && -n "$(ls -A "$directory")" ]]
.github/workflows/runtime-compatibility.yml:37
inputs.*is only guaranteed to be available forworkflow_call/workflow_dispatch. Since this workflow also runs onschedule, referencinginputs.refdirectly can fail on scheduled runs. Gate theinputs.refaccess ongithub.event_name == 'workflow_call'.
This issue also appears on line 69 of the same file.
ref: ${{ inputs.ref || github.sha }}
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Suppressed comments (3)
.github/workflows/runtime-compatibility.yml:70
- Same as above: the checkout
ref:expression usesinputs.refin a workflow that can run onschedule. Guardinputs.refbehind aworkflow_callcheck so scheduled runs reliably fall back togithub.sha.
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
ref: ${{ inputs.ref || github.sha }}
.github/workflows/create-releases.yml:40
environment: publishis set on therelease(source selection) job. If thepublishenvironment is protected, this will force approvals / environment gating before the unprivileged validation + source selection steps and also makes the publish secrets available earlier than necessary. Consider removing the environment binding from this job and keeping it only on the actual Maven Central publish job.
runs-on: ubuntu-24.04
timeout-minutes: 15
environment: publish
outputs:
.github/workflows/create-releases.yml:244
- The Maven Central polling step only waits for
*.pomand the primary*.jar. This can still report success while-sources.jar/-javadoc.jarare not yet publicly served, even though the publishing plugin config enables both (buildSrc/src/main/kotlin/openai.publish.gradle.kts:37-42). To fully close the “false green” gap, include those jars in the poll set.
for artifact in $MAVEN_ARTIFACTS; do
for extension in pom jar; do
url="$MAVEN_CENTRAL_BASE_URL/$artifact/$version/$artifact-$version.$extension"
if ! curl --fail --silent --show-error --head --location \
--connect-timeout 10 --max-time 30 "$url" >/dev/null; then
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (1)
.github/workflows/create-releases.yml:40
jobs.releaseis bound to the protectedpublishenvironment even though it only selects/validates the source and may exit without publishing (e.g., scheduled/push runs wherereleases_createdis false). If the environment requires approvals, this will block or require manual approval for non-publishing runs and expands the protected-environment scope beyond the actual publication step. Consider keepingenvironment: publishonly on thepublishjob (and any steps that truly need those secrets).
timeout-minutes: 15
environment: publish
outputs:
jbeckwith-oai
changed the title
Summary
publishenvironmentRoot cause
#811 moved Maven Central publishing into a reusable workflow. The
v4.46.0andv4.47.0runs reached a job named for thepublishenvironment, but all four Sonatype/GPG values were empty at that boundary. Both runs failed during GPG import before Gradle publishing began.The last successful release,
v4.45.0, used a normal top-level publish job. This change returns to that proven secret boundary. It also closes the false-green gap where the Vanniktech task can return after Central Portal accepts an upload but before Maven Central serves it publicly.Design
The workflow has three jobs:
refs/tags/<version>and verifies the tag, published GitHub release target,mainancestry, and Gradle version.environment: publish, then poll Maven Central for every expected POM, binary, sources, and Javadoc file.Retries require an operator to confirm in Central Portal that the immutable version has no existing deployment. A single non-cancelling concurrency group prevents overlapping automatic releases and retries.
Recovery after merge
v4.46.0has no existing deployment.Create releasesmanually frommainwithrelease_tag=v4.46.0and check the confirmation input.v4.47.0.Do not retry a red post-upload run until its Central Portal deployment state is understood.
Addresses #823.
Validation
git diff --checkv4.46.0andv4.47.0GitHub releasesv4.45.0releasev4.46.0andv4.47.0