Publish releases and snapshots to the Code Genome Project - #1191
Merged
Conversation
The codegenome profile only configures resolution, so releases went to Maven Central alone and reached CGP later, if at all, through the mirror scripts in moderneinc/codegenomeproject. Deploy to the bucket directly instead: its HTTP service is read-only, so an s3 wagon plus a profile that overrides distributionManagement gives the same dual publish the Gradle repositories get from RewriteCgpPublishPlugin.
mergify Bot
added a commit
to robfrank/linklift
that referenced
this pull request
Aug 20, 2026
âĶ 6.45.0 to 6.46.1 [skip ci] Bumps [org.openrewrite.maven:rewrite-maven-plugin](https://github.com/openrewrite/rewrite-maven-plugin) from 6.45.0 to 6.46.1. Release notes *Sourced from [org.openrewrite.maven:rewrite-maven-plugin's releases](https://github.com/openrewrite/rewrite-maven-plugin/releases).* > 6.46.1 > ------ > > What's Changed > -------------- > > * Publish releases and snapshots to the Code Genome Project by [`@âtimtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1191](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1191) > > **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.46.0...v6.46.1> > > 6.46.0 > ------ > > What's Changed > -------------- > > * Renew OWASP suppressions through 2026-09-01 by [`@âtimtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1186](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1186) > * Bump license-maven-plugin to 5.1.1 and drop the unused git extension by [`@âtimtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1187](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1187) > * chore(ci): bump org.apache.maven:maven-api-xml from 4.0.0-rc-5 to 4.0.0-rc-6 by [`@âdependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1188](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1188) > * chore(ci): bump org.owasp:dependency-check-maven from 12.2.2 to 13.0.0 by [`@âdependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1189](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1189) > * Reach the Code Genome Project from the release and bump workflows by [`@âtimtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1190](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1190) > > **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.45.1...v6.46.0> Commits * [`cf5d285`](openrewrite/rewrite-maven-plugin@cf5d285) [maven-release-plugin] prepare release v6.46.1 * [`b2693b9`](openrewrite/rewrite-maven-plugin@b2693b9) Bump rewrite.version property * [`2dc63be`](openrewrite/rewrite-maven-plugin@2dc63be) Downgrade rewrite-maven-plugin version to 6.46.1 * [`76a0020`](openrewrite/rewrite-maven-plugin@76a0020) Publish releases and snapshots to the Code Genome Project ([#1191](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1191)) * [`202c01b`](openrewrite/rewrite-maven-plugin@202c01b) Bump rewrite.version property * [`f2c931f`](openrewrite/rewrite-maven-plugin@f2c931f) [maven-release-plugin] prepare for next development iteration * [`b70ab47`](openrewrite/rewrite-maven-plugin@b70ab47) [maven-release-plugin] prepare release v6.46.0 * [`e0ff866`](openrewrite/rewrite-maven-plugin@e0ff866) Bump rewrite.version property * [`068603b`](openrewrite/rewrite-maven-plugin@068603b) Reach the Code Genome Project from the release and bump workflows ([#1190](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1190)) * [`3d2f5b5`](openrewrite/rewrite-maven-plugin@3d2f5b5) chore(ci): bump org.owasp:dependency-check-maven from 12.2.2 to 13.0.0 ([#1189](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1189)) * Additional commits viewable in [compare view](openrewrite/rewrite-maven-plugin@v6.45.0...v6.46.1) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
timtebeek
added a commit
that referenced
this pull request
Aug 26, 2026
Main meanwhile grew its own Code Genome Project publishing in #1191, but as a dual publish: Sonatype stays the deploy target and a codegenome-publish profile, activated by AWS credentials, points distributionManagement at the CGP bucket for a second deploy step in each workflow. This branch publishes solely to CGP, so the resolution keeps that single-target shape and drops the duplication it makes redundant: - pom.xml keeps CGP in the top-level distributionManagement, so the codegenome-publish profile that overrode it with the same coordinates is gone. - The s3 wagon is declared once, in main's .mvn/extensions.xml, rather than also in the pom's build extensions. - ci.yml and publish.yml drop the extra publish-*-codegenome steps, along with the Sonatype credentials and the --settings/--global-settings pair. Adopted from main: the CODEGENOME_USERNAME/CODEGENOME_TOKEN secret rename from #1197, the narrowed rollback condition keyed on steps.publish-release.outcome, and the README's CGP documentation from #1193, which covers what this branch's smaller README edit did and more.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
6.46.0released cleanly but never showed up under/maven/org/openrewrite/maven/rewrite-maven-plugin/â CGP still lists6.45.0as<release>.#1183/#1190added thecodegenomeprofile and forwardedCGP_ARTIFACTS_MAVEN_*, but that is resolution only;distributionManagementpoints at Sonatype alone. The versions CGP does host arrived after the fact, fromsync-recipes.sh/backfill-recipes.shinmoderneinc/codegenomeprojectmirroring Maven Central â manual scripts, no schedule, and a path that disappears as publishing moves off Central.Gradle repositories get a real dual publish from
RewriteCgpPublishPlugin, which adds the CGP bucket as a second publishing repository. There is no Maven counterpart, so this wires the equivalent by hand:.mvn/extensions.xmlgainsnet.pennix:maven-wagon-s3v2. The HTTP service is read-only, so deploys go tos3://codegenome-artifacts/mavendirectly; the wagon takes credentials and region from the AWS environment. A profile can't declare<build><extensions>, hence the core extension.codegenome-publishprofile overridesdistributionManagementto that bucket. Inactive unless explicitly requested, so ordinary builds and the Sonatype deploy are untouched.publish.ymlredeploys the artifactsrelease:performalready built intarget/checkout, as the last step â a failure there costs only the CGP copy, not the tag, the GitHub release or the version bump.rollbackis narrowed topublish-releasefailing so it can no longer fire on a release that already went out.ci.ymlpushes snapshots the same way, which is what ADR 0013 expects publishers to do (Central has no snapshots, andgc-snapshots.shreclaims them once the release ships).Maven merges the remote
maven-metadata.xmlon deploy, so<versions>/<release>/<latest>follow the semanticsregen-metadata.shimplements â<latest>may be a snapshot,<release>only ever a release.Verified locally that the wagon loads from
.mvn/extensions.xmland that ans3://deploy reaches S3 (fails on credentials, not on a missing connector), and that the profile flipsdistributionManagementto the bucket while the default stays Sonatype.6.46.0itself still needs a one-off backfill:scripts/sync-recipes.sh org.openrewrite.maven:rewrite-maven-plugin:6.46.0frommoderneinc/codegenomeproject, by someone with bucket write credentials.