Issue Publishing Plugin

[puneetbehl]

See Build Log https://github.com/grails/gorm-graphql/actions/runs/7031268849

[guillermocalvo]

@puneetbehl I think the root cause of the problem is that we're not supposed to publish snapshot versions to the Sonatype artifact repository that is currently configured. This would explain why task initializeSonatypeStagingRepository comes back as "forbidden" by https://oss.sonatype.org/service/local/.

In fact, I can see that something similar must have happened before 2.0.1 release. Does that ring any bells?

[puneetbehl]

Yes, but the build I am referring to is not publishing a SNAPSHOT version.

[guillermocalvo]

Yes, but the build I am referring to is not publishing a SNAPSHOT version.

The build log references commit 2ba74f4, which contains projectVersion=3.0.0-SNAPSHOT as you can see here. So it all kind of makes sense. Unless I'm missing something not obvious here. 🤔

@puneetbehl What's the specific version you are expecting to publish, anyway? FWIW branch 3.0.x also contains projectVersion=3.0.0-SNAPSHOT at the moment.

[puneetbehl]

Whenever we publish a release it automatically update the projectVersion property to appropriate version (see here).

You should be able to find more clarification in the Release Workflow Pre Release Step. I think the problem is not related to the publishing SNAPSHOT.

[matrei]

@guillermocalvo It seems that the nexusUrl is not set in the pulled in gradle script: https://raw.githubusercontent.com/grails/grails-common-build/v2.0.0/common-publishing.gradle:

if (isReleaseVersion) {
    apply plugin: 'maven-publish'
    apply plugin: "io.github.gradle-nexus.publish-plugin"

    nexusPublishing {
        repositories {
            sonatype {
                def ossUser = System.getenv("SONATYPE_USERNAME") ?: project.hasProperty("sonatypeOssUsername") ? project.sonatypeOssUsername : ''
                def ossPass = System.getenv("SONATYPE_PASSWORD") ?: project.hasProperty("sonatypeOssPassword") ? project.sonatypeOssPassword : ''
                def ossStagingProfileId = System.getenv("SONATYPE_STAGING_PROFILE_ID") ?: project.hasProperty("sonatypeOssStagingProfileId") ? project.sonatypeOssStagingProfileId : ''
                username = ossUser
                password = ossPass
                stagingProfileId = ossStagingProfileId
            }
        }
        transitionCheckOptions {
             maxRetries.set(40)
             delayBetween.set(java.time.Duration.ofMillis(2000))
        }
    }
}

According to https://github.com/gradle-nexus/publish-plugin:

Important. Users registered in Sonatype after 24 February 2021 need to customize the following URLs:

nexusPublishing {
    repositories {
        sonatype {  //only for users registered in Sonatype after 24 Feb 2021
            nexusUrl.set(uri("https://s01.oss.sonatype.org/service/local/"))
            snapshotRepositoryUrl.set(uri("https://s01.oss.sonatype.org/content/repositories/snapshots/"))
        }
    }
}

Could this be the problem?

[puneetbehl]

Yes, I believe that is the problem.

[guillermocalvo]

Could this be the problem?

@matrei I was assuming Grails was registered before 2021, because there are lots of Grails artifacts in the original instance oss.sonatype.org.

But there are Grails artifacts in the post-2021 instance s01.oss.sonatype.org too, so I don't know what to think anymore 🤔

@puneetbehl Which one is the correct one?

[puneetbehl]

It is the later one. Please refer to any other Grails project such as Grails Database Migration Plugin, Grails Spring Security, Grails Async, Grails Core, Grails Data Mapping, etc. which are correctly configured and publishing to Sonatype.

[guillermocalvo]

It is the later one. Please refer to any other Grails project such as Grails Database Migration Plugin, Grails Spring Security, Grails Async, Grails Core, Grails Data Mapping, etc. which are correctly configured and publishing to Sonatype.

@puneetbehl Ok so gorm-graphql configures nexusPublishing via grails-common-build. I see you updated the URL there, but gorm-graphql is still pointing to v2.0.0, which doesn't include those changes. So I just created a PR to make it point to master for a lack of a more specific tag.