Publish solely to the Code Genome Project, dropping Maven Central

.github/workflows/ci.yml

@@ -43,12 +43,17 @@ jobs:
         run: ./gradlew ${{ env.GRADLE_SWITCHES }} build
       - name: publish-snapshots
         if: github.event_name != 'pull_request'
-        run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publishPluginMavenPublicationToSonatypeRepository -x test -x publishPlugins
+        run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publish -x test -x publishPlugins
         env:
-          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USERNAME }}
-          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_TOKEN }}
-          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_SIGNING_KEY }}
-          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_SIGNING_PASSWORD }}
+          # Publish snapshots to the Code Genome Project. Empty when the secrets are unset, which
+          # leaves the cgp repository out of the build entirely, making `publish` a no-op.
+          AWS_ACCESS_KEY_ID: ${{ secrets.CGP_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CGP_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: us-west-2
+          # Gradle's own s3:// transport still bundles AWS SDK for Java 1.x, which prints a
+          # deprecation banner with a stack trace on every upload. Drop once Gradle ships
+          # https://github.com/gradle/gradle/pull/29686 (milestone 9.8.0).
+          AWS_JAVA_V1_DISABLE_DEPRECATION_ANNOUNCEMENT: true
 
   notify:
     if: (failure() || cancelled()) && github.event_name == 'schedule' && (github.repository_owner == 'openrewrite' || github.repository_owner == 'moderneinc')

README.md

@@ -37,8 +37,9 @@ rewrite {
 }
 ```
 
-### Consuming latest snapshots from OSSRH
+### Consuming latest snapshots
 
+Snapshots are published to the Code Genome Project artifact repository, which requires credentials.
 To use the latest `-SNAPSHOT` of the `rewrite-gradle-plugin`, update your project's `settings.gradle.kts`:
 
 ```kts
@@ -54,7 +55,11 @@ pluginManagement {
     repositories {
         // ...
         maven {
-            url = uri("https://central.sonatype.com/repository/maven-snapshots/")
+            url = uri("https://artifacts.codegenomeproject.org/maven")
+            credentials {
+                username = providers.gradleProperty("codegenomeUsername").get()
+                password = providers.gradleProperty("codegenomePassword").get()
+            }
         }
         // ...
         // you'll likely also need this if you don't have a pluginManagement section already:

build.gradle.kts

@@ -1,6 +1,5 @@
 plugins {
     id("nebula.release") version "latest.release"
-    id("io.github.gradle-nexus.publish-plugin") version "latest.release"
     id("org.owasp.dependencycheck") version "latest.release" apply false
     id("nebula.maven-resolved-dependencies") version "latest.release" apply false
     id("nebula.maven-apache-license") version "latest.release" apply false
@@ -44,13 +43,4 @@ allprojects {
     }
 }
 
-nexusPublishing {
-    repositories {
-        sonatype {
-            nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
-            snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
-        }
-    }
-}
-
 evaluationDependsOn(":plugin")

plugin/build.gradle.kts

@@ -71,6 +71,27 @@ repositories {
     google()
 }
 
+publishing {
+    repositories {
+        val awsAccessKeyId = providers.environmentVariable("AWS_ACCESS_KEY_ID").orNull
+        val awsSecretAccessKey = providers.environmentVariable("AWS_SECRET_ACCESS_KEY").orNull
+        if (!awsAccessKeyId.isNullOrEmpty() && !awsSecretAccessKey.isNullOrEmpty()) {
+            maven {
+                name = "cgp"
+                // Region-qualified host, else Gradle's S3 transport defaults to us-east-1 (the bucket is us-west-2).
+                url = uri("s3://codegenome-artifacts.s3.us-west-2.amazonaws.com/maven")
+                credentials(AwsCredentials::class) {
+                    accessKey = awsAccessKeyId
+                    secretKey = awsSecretAccessKey
+                    providers.environmentVariable("AWS_SESSION_TOKEN").orNull
+                            ?.takeIf { it.isNotEmpty() }
+                            ?.let { sessionToken = it }
+                }
+            }
+        }
+    }
+}
+
 val latest = if (project.hasProperty("releasing")) {
     "latest.release"
 } else {