chore: separate consumer docs from maintainer docs, and Appoly from the script - #113
Merged
Merged
Conversation
…he script This repository is public, so three things that were fine while it was effectively internal are no longer. The publish script hard-failed for anyone who is not Appoly: it required the 1Password CLI and a vault item nobody else can reach, with no alternative. It now resolves credentials from the environment first and only falls back to 1Password, so a fork, a different secret manager, or CI needs no diff against the script. Supplying only some of the five variables is now rejected rather than topped up from the vault — mixing sources silently is how a release gets signed with one identity and uploaded with another. The vault coordinates are out of version control. They are not secrets, but they are reconnaissance: which 1Password account, which vault, which item holds a signing key. They move to a git-ignored scripts/publish.conf, with publish.conf.example documenting the shape. Maintainers need their own copy; CONTRIBUTING.md says so. The README told consumers how to run the release script, which needs vault access and so is unusable by almost everyone reading it — and it sat above the BOM section. That moves to CONTRIBUTING.md along with the release process, which CLAUDE.md now points at instead of restating. Also deletes the migration plan. The migration is done; a plan document only goes stale from here. Its durable parts are in the 1.9.0 release notes, which the README now links for the three consumers still to move, and the rest is in git history. Verified: the 1Password path passes a full dry run; a fork with no config gets an error naming both options; environment-supplied credentials skip 1Password entirely. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The first line an agent reads about this project described the publishing setup it no longer uses. Also notes the repository is public, since that is the assumption behind the vault coordinates living outside version control. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The config moved out of the public repo with nowhere stated to find it, which would have left the next person to release guessing. It lives in the same 1Password item as the credentials it points at. Anyone who can release already holds that item, so the audience for the config is exactly the set of people who can read it — no second system to grant access to, and no way for the pointer to drift from what it points at. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the Maven Central move, prompted by a simple observation: this repo is public, and several things were written as though it weren't.
The publish script no longer requires being Appoly
It hard-failed for anyone else —
opCLI plus a vault item they can't reach, no alternative. Credentials now resolve in two tiers: environment first (export the fiveORG_GRADLE_PROJECT_*vars and 1Password is never invoked), 1Password fallback otherwise. A fork needs no diff against the script.Supplying some variables is now rejected rather than topped up from the vault. That path silently produced a release signed with one identity and uploaded with another.
Vault coordinates out of version control
Not secrets — knowing an item's name grants nobody access — but reconnaissance: which 1Password account, which vault, which item holds a signing key. Useful for a targeted phish, useless to a forker.
They move to a git-ignored
scripts/publish.conf, with a committedpublish.conf.example. Maintainers need their own copy —CONTRIBUTING.mdcovers it. Also scrubbed a colleague's name from the migration doc's dead-ends section.Git history keeps the old values, deliberately: rewriting public history is disproportionate to recon-level info.
README is consumer-facing again
"Testing an unreleased change" needed vault access to act on, and sat above the BOM section. Moved to
CONTRIBUTING.md, which is now the single source of truth for release process —CLAUDE.mdpoints at it rather than restating it.R8/ProGuard stayed in the README: "you don't need to author keep rules" is a consumer question that pre-empts a release-only crash.
Migration plan deleted
The migration is done; the plan only goes stale from here. Durable parts live in the 1.9.0 release notes — which the README now links, since three consumers still have to move and that's their reference — and the rest is in git history.
Verification
publish.conf🤖 Generated with Claude Code