Hi there. I am trying to deploy gradle plugins to maven central. For them to be accepted in maven-ce...

# gradle

[andylamax]

Hi there. I am trying to deploy gradle plugins to maven central. For them to be accepted in maven-central, I need to them to be signed. All of this how ever is going to be done in a CI & CD server.

The signing needs a keyId, a password, and a file. A bit not suitable for CI.

Are there best options? Those of you who have done this before, can you provide with me a helping hand? Probably point me to a build.gradle.script?

[mbonnin]

You can use in-memory keys: https://github.com/apollographql/apollo-android/blob/9a1513a988d8224f776a5edcbae0a4fb90fcf404/build.gradle.kts#L236

[Vampire]

Why is singing not suitable for CI?
If you want the release be done by CI, then the CI somehow has to have your signature information so that it can sign the files.
If you don't trust your CI to handle those credentials securely, you need to kick off the release from your local machine.
Alternatively you can deploy to some other service where no signature is necessary, that then always has to be specified even if someone is using Maven.
Afair JCenter does not need signing of the artifacts.

[Vampire]

The other question is, why you want to have a Gradle plugin in Maven Central instead of deployed to the Gradle Plugin Portal.

[andylamax]

Sorry, I meant I wanted to to deploy it to gradle plugin portal.

Also, In the future, I would like to deploy other libs to maven central

[andylamax]

Frankly after this long hustle, I have considered deploying to jcenter. But again I remember they had an issue with deploying module.json which are crucial when it comes to gradle metadata

[andylamax]

@mbonnin Thank you so much. Let me try and digest what I am looking at

[Vampire]

If you want to publish to plugin portal, then where is your problem?
The plugin portal does not need file signatures as far as I can see from https://plugins.gradle.org/docs/publish-plugin

[andylamax]

🙆‍♂️ I wish I had known

[andylamax]

I though well, since maven central requires signatures so will the gradlePluginPortal. Silly me

[mbonnin]

Yea, plugin portal is the way to go but as soon as your plugin is shipped alongside other libraries (which is often the case), that's not working anymore

[mbonnin]

I'd recommend publishing to mavenCentral over Jcenter. The signature step and having to go through jira to open an account is a bit more painful to setup but once this is done, the upload speed is way better

[mbonnin]

Also mavenCentral guarantees artifacts are immutable after release, which is a nice guarantee to have, you can be sure no one is going to change a lib under your feet

[andylamax]

Very true. My plugin is shipped with other libraries

[Vampire]

And Maven users do not need to declare any repository if it is in Maven Central.

[andylamax]

So, thanks to you two. I have published my plugins to gradlePluginPortal the plugins are still pending for approval. But Much much thanks

2nd: Now moving to publish libs to maven-central. Fingers crossed