Automate releases

[loosebazooka]

• Create sigstore-java-releasers admin group (@vlsi, @loosebazooka, @patflynn)

Gradle:

• Move ownership from vlsi to sigstore-java-releasers on gradle plugin portal
• Add gradle release secrets to repo

Maven-Central:

• Add pgp key to repo
• publish public key to keyserver
• Add sigstore-java-releasers as authorized releaser on dev.sigstore
• Add maven release secrets to repo
• Ensure Gradle plugin is released on Central as well

[loosebazooka]

So the current iteration isn't fully automatic

• tagging does not trigger a release
  • sigstore-java release action is a "workflow_dispatch"
  • gradle plugins releases action is also a "workflow_dispatch"
• maven central releases still need a user to log in and close+release the artifact
• gradle plugins aren't released to maven central

[szpak]

maven central releases still need a user to log in and close+release the artifact

That could be automatized with https://github.com/gradle-nexus/publish-plugin/

[loosebazooka]

Oh right, thanks, I was hoping for a little human intervention on purpose at first. I think @vlsi release plugin does automation as well?

[szpak]

Most likely yes. As Visi is closer to this project, probably his plugin will be "better supported" here.

[szpak]

Oh right, thanks, I was hoping for a little human intervention on purpose at first.

Sure, that's a good idea to verify the things.

Btw, in some projects (e.g. the Apache projects), people close the staging repository, giving the others chance to test it manually, verify content, etc. And once it is done, the staging repository can be released (manually or from a manual step in the pipeline).

Of course, sigstore-java might not need that - e.g. having a good test harness and some other verifications in place. I know many project which release automatically from tag (or from [#DO_RELEASE] in the commit message).

[loosebazooka]

Yeah I agree. We're a little immature in release right now. Will work on a better mechanism. I don't have a preference on release plugin. So either is fine.