Unable to release version 3.3.0

[wimdeblauwe]

I just tried to release a new version 3.3.0, but I keep running into issues with maven-gpg-plugin:

[INFO] --- maven-gpg-plugin:3.2.3:sign (sign-artifacts) @ htmx-spring-boot-parent ---
Warning:  
Warning:  W A R N I N G
Warning:  
Warning:  Do not store passphrase in any file (disk or SCM repository),
Warning:  instead rely on GnuPG agent or provide passphrase in 
Warning:  MAVEN_GPG_PASSPHRASE environment variable for batch mode.
Warning:  
Warning:  Sensitive content loaded from Mojo configuration
Warning:  
[INFO] Signer 'gpg' is signing 1 file with key default
gpg: no default secret key: No secret key
gpg: signing failed: No secret key
[INFO] --------------------------------------------------------------

I also tried to set the version explictly to 3.0.1 as there is a property in the pom.xml for it, but it was not used. But that gives the same error.

I did not change anything to the secrets that are available in Github on this project, so I don't know why this is now failing. If anybody has a clue, I would be happy to hear it.

[wimdeblauwe]

The warning is now gone due to #108 , but the error remains:

[INFO] --- maven-gpg-plugin:3.2.3:sign (sign-artifacts) @ htmx-spring-boot-parent ---
[INFO] Signer 'gpg' is signing 1 file with key default
gpg: no default secret key: No secret key
gpg: signing failed: No secret key

[wimdeblauwe]

Tried to go back to actions/setup-java@v3, but that did not help. We are using the setup as documented on https://github.com/actions/setup-java/blob/v4.2.1/docs/advanced-usage.md#Publishing-using-Apache-Maven, so I don't really know what is wrong.

[wimdeblauwe]

Found out that the key being expired is the actual problem.

To update the expired key, I had to run this locally on my own computer:

1. gpg --list-keys
2. gpg --edit-key <key-id>
3. Type expire and give a new validation duration (I used 2y). Also do this for the subkey 1. Type save at the end to save.
4. Send key to keyserver: gpg --keyserver keyserver.ubuntu.com --send-keys <key-id>
5. Export key in armor format: gpg --armor --export-secret-keys 551C42015FE63D5C73F7DB7BFF7009A7F3E0F71B > private.key
6. Copy the key to clipboard: cat private.key | pbcopy
7. Update the GPG_PRIVATE_KEY repository secret on GitHub.

Unfortunately, there is now a new error:

[INFO] --- maven-source-plugin:3.3.0:jar-no-fork (attach-sources) @ htmx-spring-boot ---
[INFO] Building jar: /home/runner/work/htmx-spring-boot/htmx-spring-boot/htmx-spring-boot/target/htmx-spring-boot-3.3.0-sources.jar
Error:  We have duplicated artifacts attached.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Parent of Spring Boot library for htmx 3.3.0:
[INFO] 
[INFO] Parent of Spring Boot library for htmx ............. SUCCESS [  6.476 s]
[INFO] Spring Boot library for htmx ....................... FAILURE [ 20.357 s]
[INFO] Spring Boot library for htmx and Thymeleaf ......... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  32.267 s
[INFO] Finished at: 2024-04-17T06:30:47Z
[INFO] ------------------------------------------------------------------------
Error:  Failed to execute goal org.apache.maven.plugins:maven-source-plugin:3.3.0:jar-no-fork (attach-sources) on project htmx-spring-boot: Presumably you have configured maven-source-plugn to execute twice times in your build. You have to configure a classifier for at least on of them. -> [Help 1]

[xhaggi]

Found out that the key being expired is the actual problem.

Good to know that you have found the reason. It's hard to test if I don't have access to the secrets 😄

[xhaggi]

I would recommended to move this into a branch and adjust the Github Action configuration for testing and drop the failed tags / releases. The POM is currently 3.1.0 but the tags are now 3.3.0.

[wimdeblauwe]

I dropped the 3.3.0 tag again now.

[xhaggi]

I cannot reproduce the error Error: We have duplicated artifacts attached on my local machine. I am not sure which version of Maven is used in the Github action. I am using the latest version Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae).

[INFO] Reactor Summary for Parent of Spring Boot library for htmx 3.1.0:
[INFO] 
[INFO] Parent of Spring Boot library for htmx ............. SUCCESS [  2.214 s]
[INFO] Spring Boot library for htmx ....................... SUCCESS [  9.429 s]
[INFO] Spring Boot library for htmx and Thymeleaf ......... FAILURE [  6.444 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  18.529 s
[INFO] Finished at: 2024-04-17T09:25:08+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.sonatype.plugins:nexus-staging-maven-plugin:1.6.13:deploy (injected-nexus-deploy) on project htmx-spring-boot-thymeleaf: Remote staging failed: 403 - Forbidden -> [Help 1]

[xhaggi]

Could you re-run Maven using the -X switch to enable full debug logging?

[wimdeblauwe]

I don't have time now, but how come you see version 3.1.0? The current latest version on main is 3.3.0: https://github.com/wimdeblauwe/htmx-spring-boot/blob/main/pom.xml#L15

[wimdeblauwe]

Fixed it. The reason was that the release build used mvn verify deploy instead of mvn deploy. Seems like a bug in the sources plugin to me that it makes a difference, but I am glad I found it. Thanks @xhaggi for helping me and the little improvements you did. See https://github.com/wimdeblauwe/htmx-spring-boot/releases/tag/3.3.0 for the release notes.