Skip to content

Conversation

@tgodzik
Copy link
Contributor

@tgodzik tgodzik commented Dec 9, 2025

I still need to test it out, let me know if anyone spots something obviously wrong

Comment on lines 56 to 60
uses: crazy-max/ghaction-import-gpg@v6
with:
gpg_private_key: ${{ secrets.SCALA_PGP_KEY }}
passphrase : ${{ secrets.SCALA_PGP_PASSPHRASE }}
fingerprint : ${{ vars.SCALA_PGP_FINGERPRINT }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not really a fan of using random actions from internet and feeding them with our secrets. Potentially we can use here commit SHA instead of mutable tag version (even though it's less visible) - same should be done eventually for next nightlies.

For 3.8.0 releases I'm currently using the old workflow:

  • I've restored the PGP setup in sbt 64a1c4d
  • seperated the org.scalajs and org.scala-lang aritfacts (otherwise it would fail Maven validation, cannot publish multiple namespaces in same deployement) 1987102

I'm planning to forward-port these to main when we'll be closer to the stable release.
There's even more issues that arised recently in the new build which are fine for nightly releases, but fail in Sonatype:

  • clean recentlly stopped pruning target/sona-staging - 2968bbf

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just copied over the other nightly releasing, for sure I can adjust to your changes yeah. I guess we also need scala#659 ?

Btw. wouldn't the command I use here only release the compiler? I copied over the command from the original nightly releasing.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I reverted using that action, crazy-max does not indeed sound great confidence wise. Should I add back all the steps from the original nightly workflow? I think the current changes should work as we didn't change almost anything in the build in scala3-lts repo (which I now realized)

set -e

# Usage:
# SONATYPE_USER=<sonatype user> SONATYPE_PW=<sonatype pw> PGP_PW=<pgp pw> PGP_SECRET=<pgp secret> ./sbtPublish <publish cmd>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still uses PGP_PW and PGP_SECRET not used in this script.
I think it would better to continue using the old script if possible, should be possible if we'd restore changes from release-3.8.0 mentioned below

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we might not need the script altogether. I will just use sbt

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I got back to the state in 3.7.4 tag

@tgodzik tgodzik force-pushed the publish-lts-nightly branch from 59678ea to f719ce7 Compare December 9, 2025 17:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants