Skip to content

Commit 2a06bfa

Browse files
retronymretronym
committed
Merge pull request #20 from retronym/topic/tag-driven-release-take-2
Rework tag driven release infrastructure
2 parents 0e38cb3 + 4a6cfc9 commit 2a06bfa

13 files changed

+143
-75
lines changed

Diff for: ‎.travis.yml

+7-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
language: scala
22
env:
33
global:
4-
- PUBLISH_JDK=oraclejdk8 # admin/build.sh only publishes when running on this jdk
5-
# Don't commit sensitive files, instead commit a version encrypted with $SECRET,
6-
# this environment variable is encrypted with this repo's private key and stored below:
7-
# (See http://docs.travis-ci.com/user/environment-variables/#Secure-Variables.)
8-
secure: "sGB53QddmPmQ4ftCGYxT0gaJcFt0bpMJoGxJRJCFTxdzg6nNMqJ9qDWbyJo7vDFx30axNQlyBH928pUiS5KfsmvzVdoVHUBEUJlF1lBurlpx06tGLuBdcFDwUF5ybi7SGRNdUPuX/6uLdgK5clpcW16/pcfT5Qr5vo/0mvPY85s="
4+
- PUBLISH_JDK=oraclejdk8
5+
# PGP_PASSPHRASE
6+
- secure: "BzgzRZLYa52rS/hBfzf43b++CfDhdcd3Mmu8tsyBHgThSQOd2YBLbV5kWD8aYVFKVHfW7XX0PTe3F+rR/fFZqGItE6o8Px0Y7Vzb5pqjlaQdxFEJ+WrsnshS0xuAKZ7OwVHRp+d+jznaCwRxEo2vpW3ko1OPAJ8cxfhVL/4C1I0="
7+
# SONA_USER
8+
- secure: "lx2qFeFxh9AFmyHR7hH4Qf9flIEx8VgYj6ebzuxp1cc1ZZiXHC1256x0bHFDUH9bhJACOazOrco/+v6MBAriBkWxLBc98FrC6OkVeQMFW2ffWSBuHRclilKsQA/Lsgc81Wg+WV105hOqUNAkTXgroblInNt+KS+DhC/8FVoh9ZY="
9+
# SONA_PASS
10+
- secure: "FZC+FZnBNeklA150vW5QDZJ5J7t+DExJrgyXWM46Wh0MobjH8cvydgC3qatItb0rDBV8l7zO1LDwl2KEi92aefw2a8E49z6qVOHgUXiI3SAx7M0UO0FFeKPmTXCLcBlbnGLcUqNjIZfuIEufQvPblKTl8qN4eMmcMn9jsNzJr28="
911
script:
1012
- admin/build.sh
1113
scala:

Diff for: ‎admin/README.md

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
## Tag Driven Releasing
2+
3+
### Background Reading
4+
5+
- http://docs.travis-ci.com/user/environment-variables/
6+
- http://docs.travis-ci.com/user/encryption-keys/
7+
- http://docs.travis-ci.com/user/encrypting-files/
8+
9+
### Initial setup for the repository
10+
11+
To configure tag driven releases from Travis CI.
12+
13+
1. Generate a key pair for this repository with `./admin/genKeyPair.sh`.
14+
Edit `.travis.yml` and `admin/build.sh` as prompted.
15+
2. Publish the public key to https://pgp.mit.edu
16+
3. Store other secrets as encrypted environment variables with `admin/encryptEnvVars.sh`.
17+
Edit `.travis.yml` as prompted.
18+
4. Edit `.travis.yml` to use `./admin/build.sh` as the build script,
19+
and edit that script to use the tasks required for this project.
20+
5. Edit `.travis.yml` to select which JDK will be used for publishing.
21+
22+
It is important to add comments in .travis.yml to identify the name
23+
of each environment variable encoded in a `:secure` section.
24+
25+
After all of these steps, your .travis.yml should contain config of the
26+
form:
27+
28+
language: scala
29+
env:
30+
global:
31+
- PUBLISH_JDK=openjdk6
32+
# PGP_PASSPHRASE
33+
- secure: "XXXXXX"
34+
# SONA_USER
35+
- secure: "XXXXXX"
36+
# SONA_PASS
37+
- secure: "XXXXXX"
38+
script:
39+
- admin/build.sh
40+
41+
If Sonatype credentials change in the future, step 3 can be repeated
42+
without generating a new key.
43+
44+
### Testing
45+
46+
1. Follow the release process below to create a dummy release (e.g. 0.1.0-TEST1).
47+
Confirm that the release was staged to Sonatype but do not release it to Maven
48+
central. Instead, drop the staging repository.
49+
50+
### Performing a release
51+
52+
1. Create a GitHub "Release" (with a corresponding tag) via the GitHub
53+
web interface.
54+
2. Travis CI will schedule a build for this release. Review the build logs.
55+
3. Log into https://oss.sonatype.org/ and identify the staging repository.
56+
4. Sanity check its contents
57+
5. Release staging repository to Maven and send out release announcement.
58+

Diff for: ‎admin/build.sh

+7-3
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,14 @@ if [ "$TRAVIS_JDK_VERSION" == "$PUBLISH_JDK" ] && [[ "$TRAVIS_TAG" =~ ^v[0-9]+\.
1010
myVer=$(echo $TRAVIS_TAG | sed -e s/^v// | sed -e 's/_[0-9]*\.[0-9]*//')
1111
publishVersion='set every version := "'$myVer'"'
1212
extraTarget="publish-signed"
13-
1413
cat admin/gpg.sbt >> project/plugins.sbt
15-
admin/decrypt.sh sensitive.sbt
16-
(cd admin/ && ./decrypt.sh secring.asc)
14+
cp admin/publish-settings.sbt .
15+
16+
# Copied from the output of genKeyPair.sh
17+
K=$encrypted_1ce132863fa7_key
18+
IV=$encrypted_1ce132863fa7_iv
19+
20+
aes-256-cbc -K $K -iv $IV -in admin/secring.asc.enc -out admin/secring.asc -d
1721
fi
1822

1923
sbt ++$TRAVIS_SCALA_VERSION "$publishVersion" clean update test publishLocal $extraTarget

Diff for: ‎admin/decrypt.sh

-2
This file was deleted.

Diff for: ‎admin/encrypt.sh

-2
This file was deleted.

Diff for: ‎admin/encryptAll.sh

-19
This file was deleted.

Diff for: ‎admin/encryptEnvVars.sh

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
#
3+
# Encrypt sonatype credentials so that they can be
4+
# decrypted in trusted builds on Travis CI.
5+
#
6+
set -e
7+
8+
read -s -p 'SONA_USER: ' SONA_USER
9+
travis encrypt SONA_USER="$SONA_USER"
10+
read -s -p 'SONA_PASS: ' SONA_PASS
11+
travis encrypt SONA_PASS="$SONA_PASS"

Diff for: ‎admin/genKeyPair.sh

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/bash
2+
#
3+
# Generates a key pair for this repository to sign artifacts.
4+
# Encrypt the private key and its passphrase in trusted builds
5+
# on Travis CI.
6+
#
7+
set -e
8+
9+
# Based on https://gist.github.com/kzap/5819745:
10+
function promptDelete() {
11+
if [[ -f "$1" ]]; then
12+
echo About to delete $1, Enter for okay / CTRL-C to cancel
13+
read
14+
rm "$1"
15+
fi
16+
}
17+
for f in admin/secring.asc.enc admin/secring.asc admin/pubring.asc; do promptDelete "$f"; done
18+
19+
echo Generating key pair. Please enter 1. repo name 2. [email protected], 3. a new passphrase
20+
cp admin/gpg.sbt project
21+
sbt 'set pgpReadOnly := false' \
22+
'set pgpPublicRing := file("admin/pubring.asc")' \
23+
'set pgpSecretRing := file("admin/secring.asc")' \
24+
'pgp-cmd gen-key'
25+
rm project/gpg.sbt
26+
27+
echo ============================================================================================
28+
echo Encrypting admin/secring.asc. Update K and IV variables in admin/build.sh accordingly.
29+
echo ============================================================================================
30+
travis encrypt-file admin/secring.asc
31+
rm admin/secring.asc
32+
mv secring.asc.enc admin
33+
34+
echo ============================================================================================
35+
echo Encrypting environment variables. Add each to a line in .travis.yml. Include a comment
36+
echo with the name of the corresponding variable
37+
echo ============================================================================================
38+
read -s -p 'PGP_PASSPHRASE: ' PGP_PASSPHRASE
39+
travis encrypt PGP_PASSPHRASE="$PGP_PASSPHRASE"
40+

Diff for: ‎admin/gpg.sbt

-24
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,2 @@
11

22
addSbtPlugin("com.typesafe.sbt" % "sbt-pgp" % "0.8.3") // only added when publishing:
3-
4-
// There's a companion sensitive.sbt, which was created like this:
5-
//
6-
// 1. in an sbt shell that has the sbt-pgp plugin, create pgp key in admin/:
7-
//
8-
// sbt
9-
// set pgpReadOnly := false
10-
// set pgpPublicRing := file("admin/pubring.asc")
11-
// set pgpSecretRing := file("admin/secring.asc")
12-
// pgp-cmd gen-key // use $passPhrase
13-
// Please enter the name associated with the key: $repoName
14-
// Please enter the email associated with the key: [email protected]
15-
// Please enter the passphrase for the key: $passphrase
16-
//
17-
// 2. create sensitive.sbt with contents:
18-
//
19-
// pgpPassphrase := Some($passPhrase.toArray)
20-
//
21-
// pgpPublicRing := file("admin/pubring.asc")
22-
//
23-
// pgpSecretRing := file("admin/secring.asc")
24-
//
25-
// credentials += Credentials("Sonatype Nexus Repository Manager", "oss.sonatype.org", $sonaUser, $sonaPass)
26-

Diff for: ‎admin/publish-settings.sbt

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
pgpPassphrase := Some(sys.prop("PGP_PASSPHRASE").toArray)
2+
3+
pgpPublicRing := file("admin/pubring.asc")
4+
5+
pgpSecretRing := file("admin/secring.asc")
6+
7+
credentials += Credentials("Sonatype Nexus Repository Manager", "oss.sonatype.org", sys.prop("SONA_USER"), sys.prop("SONA_PASS"))

Diff for: ‎admin/pubring.asc

+13-13
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
-----BEGIN PGP PUBLIC KEY BLOCK-----
22
Version: BCPG v1.49
33

4-
mQENBFSzVhYBCADp261YcgfWCNZ/IrSpvk1LaqnomeDjktUuCy3LD0WQ/B750vpV
5-
gograxIWDfGK3TaHHdiRTV0OmfhhA6Dv/E8wFiHc1psn8mtaL+tQQcFHCLqBnTEe
6-
/VQXZLrHoFsMSBRrFY0rHZGXtCS0DKIxSeqlba4RH9eS4Q35LzBjMBLKewBCwben
7-
mDMOMxLgTS21xqe7OoyrcQGg3nFPLBMM8hgrqmVH9lYc5c2NuTMSHC4/wUozTwMm
8-
SxmEQ1Ga2lEpVAcaJ6r7bz0+QwX62cMs57nkGuf3SP2D5/+igDkkoVb447wESHHG
9-
s3BZw9ThblHXJOZ5Xb64fvQ3/vCjivLqZIepABEBAAG0NXNjYWxhLWphdmE4LWNv
4+
mQENBFS1xA0BCAC0t2c5MhkWyUbkWsZM4DmIN+/pDjNCr2DNmbIG3gB8i4MI71q/
5+
fj+Ob0lemjJNnNc4ii6+s9RrOcwR1EU4IA8mO79NN+i2yVUhe0LmOWgyfXvG8Qpg
6+
hLmdMrkgOHK0hpWbXJ0i2NGPch4gI6YRJF95yLojz2KENmiYGmSD8p1It06O2824
7+
Xhqc5Cm72/qXvonHP1+MugjiPxmyZN3ajSol0P7tZlgB7ikqpyL3kZXkc162bJ+H
8+
U6y6qUCcQqS5VQ7Fv9bIbTNOjN4ELLJn2ffLVe3ujRG6seioL0MfuQ/gV9IpGcGO
9+
Dew8Xu79QdDyVHQKgDy9N/J276JZ4j9nYCCxABEBAAG0NXNjYWxhLWphdmE4LWNv
1010
bXBhdCA8c2NhbGEtaW50ZXJuYWxzQGdvb2dsZWdyb3Vwcy5jb20+iQEcBBMBAgAG
11-
BQJUs1YWAAoJEF7zF/88US8Xdw4IAJmPcOka4Tc5s5eYAdwZuNOqUiuNO3/9+Za6
12-
tdGZQfQxUVN5PdgXhAGiKfRxrtSTjfzN+O/wiF/7NDqOQXBHNEx53Rzucq770WvL
13-
G5hUwr8MJB577OIyU2CQquslva3h2LbOt8lEHplLy0tI00zm6ueJNmxq36C4Mu3h
14-
l6QMs0zd29OqtUjWpkUNRnz+1HSdhRCPZNhX1bjhRaJARrhUtP24+g3wKgjg3H95
15-
yjPh4951r21w/x7msu+w0vSpdA7j/VJIzql6+2exh14YeLx9AFVDgvkJE6McHXX3
16-
ccr1eQ0FjYpWWUrBMXpS1Pz4SiwXEOOhs1xtsM7fHuikqhkXfHg=
17-
=oZnQ
11+
BQJUtcQNAAoJEGQWNEmlKase8pAH/Rb45Px88u7DDT53DU68zh84oDZLv9i46g7g
12+
16KI97nz17F9OEHdkzNEUA3EgCD1d2k+c/GIdQKg3avVdpNM7krK5SSNgHKcwe/F
13+
0YGMxvh+LgeK1JDuXFbwLJKR+7VIGVKkjw+Z2TC8hZfnD6Qy6c4xkukoBs6yfWQO
14+
tf8gSH6oQox4UIOB/+ADyypl9mnRxgdi1uPvd6UJnL/n9UDE8v1k+8WzO34nTVZr
15+
xWN28pAun5VpLuEq4GAr2JRfRiF+N0hGuS+htiU6hnO81BBK+NusWxI9Aitu8Zyh
16+
eulWpROXvUOw1eJequutgyGwEEQkRi+Yu+2eSM2/EPCWiLXkODk=
17+
=Qro7
1818
-----END PGP PUBLIC KEY BLOCK-----

Diff for: ‎admin/secring.asc.enc

-688 Bytes
Binary file not shown.

Diff for: ‎sensitive.sbt.enc

-7
This file was deleted.

0 commit comments

Comments
 (0)