Ensure that all maintainers can publish new Scala Steward versions

[fthomas]

In the past I was the only one publishing Scala Steward versions (via scripts/release.sh). I would like to enable all members of @scala-steward-org/core (:wave: @exoego @mzuehlke) to publish new versions if you want to. Is there anything I need to do so that you can publish new versions? Maybe someone just needs to try it and see what fails.

[exoego]

Hi, Thomas. First of all, many thanks for your long contributions to Scala ecosystems with Scala Steward.

I suggest to set up https://github.com/sbt/sbt-ci-release so any maintainers can publish new versions without keeping secrets like the Sonatype token or password.

[fthomas]

We're already using sbt-ci-release. Maybe you should just try running the scripts/release.sh and see if everything works. :-)

[exoego]

Oh, I was not aware of that 😅 I will review the existing PRs and try running scripts/release.sh in a few days.

[henricook]

That'd be great @exoego - i'm very much looking forward to using dependencyOverrides when the next release is tagged

[fthomas]

Btw, https://github.com/scala-steward-org/scala-steward/issues/2486 lists what I've done previously to publish new versions.

[exoego]

Sorry for long delay.

I tried scripts/releas.sh and encountered:

$ ./scripts/release.sh 0.15.0
error: gpg failed to sign the data
error: unable to sign the tag
Enumerating objects: 14, done.
Counting objects: 100% (14/14), done.
Delta compression using up to 10 threads
Compressing objects: 100% (14/14), done.
Writing objects: 100% (14/14), 10.58 KiB | 174.00 KiB/s, done.
Total 14 (delta 0), reused 14 (delta 0), pack-reused 0
To https://github.com/exoego/scala-steward.git
 * [new tag]           v0.10.0 -> v0.10.0
 * [new tag]           v0.11.0 -> v0.11.0
 * [new tag]           v0.12.0 -> v0.12.0
 * [new tag]           v0.13.0 -> v0.13.0
 * [new tag]           v0.14.0 -> v0.14.0
 * [new tag]           v0.3.0 -> v0.3.0
 * [new tag]           v0.4.0 -> v0.4.0
 * [new tag]           v0.5.0 -> v0.5.0
 * [new tag]           v0.6.0 -> v0.6.0
 * [new tag]           v0.7.0 -> v0.7.0
 * [new tag]           v0.8.0 -> v0.8.0
 * [new tag]           v0.8.1 -> v0.8.1
 * [new tag]           v0.9.0 -> v0.9.0
 * [new tag]           v0.9.1 -> v0.9.1

Looks like I can not push to scala-steward-org/scasla-steward

[fthomas]

error: gpg failed to sign the data error: unable to sign the tag

Looks like signing the tag didn't work.

[exoego]

Is it OK to create a new tag 0.15.0 from GitHub UI https://github.com/scala-steward-org/scala-steward/releases/new ?

[fthomas]

I would prefer creating the tag via the release script so that we all use the same procedure for creating releases.

[fthomas]

@exoego I just published 0.15.0 myself. Feel free to try it again with 0.16.0 as soon as a new PR is merged.

[fthomas]

0.16.0 was released yesterday and it wasn't me. :-) So I guess someone from @scala-steward-org/core created a new tag via GitHub's web interface. Unfortunately the tag is signed with a key owned by GitHub, so I don't know who created that tag, but it demonstrates that any maintainer can publish new releases and this ticket can be closed.

[armanbilge]

Unfortunately the tag is signed with a key owned by GitHub, so I don't know who created that tag

Based on the CI job I'm guessing @alejandrohdezma? :) https://github.com/scala-steward-org/scala-steward/actions/runs/3511909519

[exoego]

I do not. Probably alenajdro.

[alejandrohdezma]

Yeah, it was me. BTW I'm working on a new proposal for the CI to have semi-automated releases, so that the features do not accumulate for months on end. Something similar to what we have for the https://github.com/scala-steward-org/scala-steward-action. WDYT?

[fthomas]

Sounds good to me!

I'm closing this since we now have proof that I'm not the only one who can publish new versions.