ci: use configured Maven credentials (#9)

Co-authored-by: kriptoburak <kriptoburak@users.noreply.github.com>

Author: Burak Bayır

.github/workflows/publish-sonatype.yml

@@ -39,10 +39,10 @@ jobs:
       - name: Validate release credentials
         run: bash ./bin/check-release-environment
         env:
-          SONATYPE_USERNAME: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME }}
-          SONATYPE_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD }}
-          GPG_SIGNING_KEY: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY }}
-          GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD }}
+          SONATYPE_USERNAME: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME || secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD || secrets.SONATYPE_PASSWORD }}
+          GPG_SIGNING_KEY: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY || secrets.GPG_SIGNING_KEY }}
+          GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD || secrets.GPG_SIGNING_PASSWORD }}
 
       - name: Publish signed artifacts
         shell: bash
@@ -56,7 +56,7 @@ jobs:
             --no-daemon \
             --stacktrace
         env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD }}
-          GPG_SIGNING_KEY: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY }}
-          GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD }}
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME || secrets.SONATYPE_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD || secrets.SONATYPE_PASSWORD }}
+          GPG_SIGNING_KEY: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY || secrets.GPG_SIGNING_KEY }}
+          GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD || secrets.GPG_SIGNING_PASSWORD }}

.github/workflows/release-doctor.yml

@@ -35,10 +35,10 @@ jobs:
       - name: Check release environment
         run: bash ./bin/check-release-environment
         env:
-          SONATYPE_USERNAME: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME }}
-          SONATYPE_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD }}
-          GPG_SIGNING_KEY: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY }}
-          GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD }}
+          SONATYPE_USERNAME: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME || secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD || secrets.SONATYPE_PASSWORD }}
+          GPG_SIGNING_KEY: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY || secrets.GPG_SIGNING_KEY }}
+          GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD || secrets.GPG_SIGNING_PASSWORD }}
 
       - name: Build local Maven artifacts
         run: ./gradlew publishToMavenLocal -PpublishLocal --no-daemon --stacktrace

bin/check-release-workflow

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+cd -- "$(dirname -- "$0")/.."
+
+workflows=(
+  .github/workflows/publish-sonatype.yml
+  .github/workflows/release-doctor.yml
+)
+secret_fallbacks=(
+  "secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME || secrets.SONATYPE_USERNAME"
+  "secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD || secrets.SONATYPE_PASSWORD"
+  "secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY || secrets.GPG_SIGNING_KEY"
+  "secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD || secrets.GPG_SIGNING_PASSWORD"
+)
+
+for workflow in "${workflows[@]}"; do
+  for fallback in "${secret_fallbacks[@]}"; do
+    if ! grep -Fq "$fallback" "$workflow"; then
+      printf '%s must support %s.\n' "$workflow" "$fallback"
+      exit 1
+    fi
+  done
+done
+
+grep -Fq 'environment: maven-central' .github/workflows/publish-sonatype.yml
+
+printf 'Release workflows use the configured Maven Central secrets.\n'

scripts/lint

@@ -6,6 +6,8 @@ cd "$(dirname "$0")/.."
 
 echo "==> Running lints"
 
+bash ./bin/check-release-workflow
+
 if command -v ktfmt &> /dev/null; then
     echo "==> Checking ktfmt"
     ./scripts/kotlin-format --dry-run --set-exit-if-changed