From 9302f430f5455f6917760ad95647c5377fc5aa95 Mon Sep 17 00:00:00 2001
From: Tim te Beek <tim@moderne.io>
Date: Thu, 30 Jul 2026 20:24:33 +0200
Subject: [PATCH] Publish snapshots to the Code Genome Project instead of Maven
 Central

Follow-up to #461, which forwarded CGP credentials for dependency resolution.
This moves the publication side over as well: the only Maven publication this
repo had was the CI snapshot upload to Sonatype, which now goes to CGP's S3
bucket instead. Releases continue to go to the Gradle Plugin Portal, which is
unaffected.

The cgp repository mirrors rewrite-build-gradle-plugin's
org.openrewrite.build.publish-cgp convention plugin, which this repo does not
apply, and is only registered when AWS credentials are present so `publish`
stays a no-op locally.
---
 .github/workflows/ci.yml | 15 ++++++++++-----
 README.md                |  9 +++++++--
 build.gradle.kts         | 10 ----------
 plugin/build.gradle.kts  | 21 +++++++++++++++++++++
 4 files changed, 38 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4c6a74438..48eb6e1d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,12 +43,17 @@ jobs:
         run: ./gradlew ${{ env.GRADLE_SWITCHES }} build
       - name: publish-snapshots
         if: github.event_name != 'pull_request'
-        run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publishPluginMavenPublicationToSonatypeRepository -x test -x publishPlugins
+        run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publish -x test -x publishPlugins
         env:
-          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USERNAME }}
-          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_TOKEN }}
-          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_SIGNING_KEY }}
-          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_SIGNING_PASSWORD }}
+          # Publish snapshots to the Code Genome Project. Empty when the secrets are unset, which
+          # leaves the cgp repository out of the build entirely, making `publish` a no-op.
+          AWS_ACCESS_KEY_ID: ${{ secrets.CGP_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CGP_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: us-west-2
+          # Gradle's own s3:// transport still bundles AWS SDK for Java 1.x, which prints a
+          # deprecation banner with a stack trace on every upload. Drop once Gradle ships
+          # https://github.com/gradle/gradle/pull/29686 (milestone 9.8.0).
+          AWS_JAVA_V1_DISABLE_DEPRECATION_ANNOUNCEMENT: true
 
   notify:
     if: (failure() || cancelled()) && github.event_name == 'schedule' && (github.repository_owner == 'openrewrite' || github.repository_owner == 'moderneinc')
diff --git a/README.md b/README.md
index 2ab8c2372..ded61fcbe 100644
--- a/README.md
+++ b/README.md
@@ -37,8 +37,9 @@ rewrite {
 }
 ```
 
-### Consuming latest snapshots from OSSRH
+### Consuming latest snapshots
 
+Snapshots are published to the Code Genome Project artifact repository, which requires credentials.
 To use the latest `-SNAPSHOT` of the `rewrite-gradle-plugin`, update your project's `settings.gradle.kts`:
 
 ```kts
@@ -54,7 +55,11 @@ pluginManagement {
     repositories {
         // ...
         maven {
-            url = uri("https://central.sonatype.com/repository/maven-snapshots/")
+            url = uri("https://artifacts.codegenomeproject.org/maven")
+            credentials {
+                username = providers.gradleProperty("codegenomeUsername").get()
+                password = providers.gradleProperty("codegenomePassword").get()
+            }
         }
         // ...
         // you'll likely also need this if you don't have a pluginManagement section already:
diff --git a/build.gradle.kts b/build.gradle.kts
index 2a7391975..52d6802d6 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -1,6 +1,5 @@
 plugins {
     id("nebula.release") version "latest.release"
-    id("io.github.gradle-nexus.publish-plugin") version "latest.release"
     id("org.owasp.dependencycheck") version "latest.release" apply false
     id("nebula.maven-resolved-dependencies") version "latest.release" apply false
     id("nebula.maven-apache-license") version "latest.release" apply false
@@ -44,13 +43,4 @@ allprojects {
     }
 }
 
-nexusPublishing {
-    repositories {
-        sonatype {
-            nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
-            snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
-        }
-    }
-}
-
 evaluationDependsOn(":plugin")
diff --git a/plugin/build.gradle.kts b/plugin/build.gradle.kts
index 24640506d..7e841d83e 100644
--- a/plugin/build.gradle.kts
+++ b/plugin/build.gradle.kts
@@ -71,6 +71,27 @@ repositories {
     google()
 }
 
+publishing {
+    repositories {
+        val awsAccessKeyId = providers.environmentVariable("AWS_ACCESS_KEY_ID").orNull
+        val awsSecretAccessKey = providers.environmentVariable("AWS_SECRET_ACCESS_KEY").orNull
+        if (!awsAccessKeyId.isNullOrEmpty() && !awsSecretAccessKey.isNullOrEmpty()) {
+            maven {
+                name = "cgp"
+                // Region-qualified host, else Gradle's S3 transport defaults to us-east-1 (the bucket is us-west-2).
+                url = uri("s3://codegenome-artifacts.s3.us-west-2.amazonaws.com/maven")
+                credentials(AwsCredentials::class) {
+                    accessKey = awsAccessKeyId
+                    secretKey = awsSecretAccessKey
+                    providers.environmentVariable("AWS_SESSION_TOKEN").orNull
+                            ?.takeIf { it.isNotEmpty() }
+                            ?.let { sessionToken = it }
+                }
+            }
+        }
+    }
+}
+
 val latest = if (project.hasProperty("releasing")) {
     "latest.release"
 } else {