ci(publish): add Maven Central publishing to release workflow

Author: jhateley-godaddy

.github/workflows/release.yml

@@ -19,10 +19,40 @@ jobs:
   release-please:
     name: Release Please
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      version: ${{ steps.release.outputs.version }}
     steps:
       - name: Run Release Please
+        id: release
         uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
+          manifest-file: .release-please-manifest.json
+
+  publish:
+    name: Publish to Maven Central
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK and GPG
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: 'gradle'
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase: GPG_PASSPHRASE
+
+      - name: Publish to Maven Central
+        run: ./gradlew publishAllPublicationsToMavenCentralRepository
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/AnsClient.java

@@ -18,7 +18,7 @@
  * Client for connecting to ANS-registered agents with configurable verification.
  *
  * <p>This is the main entry point for agent-to-agent communication. Use
- * {@link com.godaddy.ans.sdk.discovery.DiscoveryClient} separately for agent
+ * {@code DiscoveryClient} from the discovery module separately for agent
  * resolution if needed.</p>
  *
  * <h2>Quick Start - Request/Response</h2>

ans-sdk-agent-client/src/main/java/com/godaddy/ans/sdk/agent/verification/DnsResolverConfig.java

@@ -17,6 +17,7 @@
  *
  * <h2>Resolver Options</h2>
  * <table>
+ *   <caption>Available DNS resolver configurations</caption>
  *   <tr><th>Config</th><th>Primary IP</th><th>Provider</th></tr>
  *   <tr><td>CLOUDFLARE</td><td>1.1.1.1</td><td>Cloudflare DNS</td></tr>
  *   <tr><td>GOOGLE</td><td>8.8.8.8</td><td>Google Public DNS</td></tr>

ans-sdk-api/build.gradle.kts

@@ -72,4 +72,13 @@ tasks.compileJava {
 // Disable checkstyle for generated code
 tasks.named("checkstyleMain") {
     enabled = false
+}
+
+// Ensure source/javadoc jars wait for code generation
+tasks.named("sourcesJar") {
+    dependsOn(tasks.openApiGenerate)
+}
+
+tasks.named("javadocJar") {
+    dependsOn(tasks.openApiGenerate)
 }

build.gradle.kts

@@ -7,9 +7,20 @@ plugins {
 
 allprojects {
     group = "com.godaddy.ans"
-    version = "0.1.0"
+    version = "0.1.0" // x-release-please-version
 }
 
+// Modules to publish (excludes examples)
+val publishableModules = setOf(
+    "ans-sdk-api",
+    "ans-sdk-core",
+    "ans-sdk-crypto",
+    "ans-sdk-registration",
+    "ans-sdk-discovery",
+    "ans-sdk-agent-client",
+    "ans-sdk-transparency"
+)
+
 subprojects {
     apply(plugin = "java-library")
     apply(plugin = "checkstyle")
@@ -65,4 +76,77 @@ subprojects {
             }
         }
     }
+
+    // Apply publishing only to publishable modules
+    if (name in publishableModules) {
+        apply(plugin = "maven-publish")
+        apply(plugin = "signing")
+
+        java {
+            withSourcesJar()
+            withJavadocJar()
+        }
+
+        configure<PublishingExtension> {
+            publications {
+                create<MavenPublication>("mavenJava") {
+                    from(components["java"])
+
+                    pom {
+                        name.set(project.name)
+                        description.set("ANS SDK - ${project.name}")
+                        url.set("https://github.com/godaddy/ans-sdk-java")
+
+                        licenses {
+                            license {
+                                name.set("MIT License")
+                                url.set("https://opensource.org/licenses/MIT")
+                            }
+                        }
+
+                        developers {
+                            developer {
+                                id.set("godaddy")
+                                name.set("GoDaddy")
+                                email.set("oswg@godaddy.com")
+                            }
+                        }
+
+                        scm {
+                            connection.set("scm:git:git://github.com/godaddy/ans-sdk-java.git")
+                            developerConnection.set("scm:git:ssh://github.com/godaddy/ans-sdk-java.git")
+                            url.set("https://github.com/godaddy/ans-sdk-java")
+                        }
+                    }
+                }
+            }
+
+            repositories {
+                // Maven Central via Sonatype Central Portal
+                maven {
+                    name = "mavenCentral"
+                    url = uri("https://central.sonatype.com/api/v1/publisher/upload")
+
+                    credentials {
+                        username = System.getenv("MAVEN_CENTRAL_USERNAME")
+                            ?: project.findProperty("mavenCentralUsername") as String? ?: ""
+                        password = System.getenv("MAVEN_CENTRAL_PASSWORD")
+                            ?: project.findProperty("mavenCentralPassword") as String? ?: ""
+                    }
+                }
+            }
+        }
+
+        configure<SigningExtension> {
+            // Only sign when publishing to Maven Central (skip for local testing)
+            setRequired({
+                gradle.taskGraph.hasTask("publishAllPublicationsToMavenCentralRepository")
+            })
+
+            // Use GPG command (key imported by actions/setup-java)
+            useGpgCmd()
+
+            sign(the<PublishingExtension>().publications["mavenJava"])
+        }
+    }
 }