Update CI credential credhub references

Use better credhub key references and specify parameters in task yaml.

Closes gh-90

Author: philwebb

ci/pipeline.yml

@@ -156,11 +156,11 @@ jobs:
     file: git-repo/ci/tasks/sync-to-maven-central.yml
     params:
       BINTRAY_USERNAME: ((bintray-username))
-      BINTRAY_PASSWORD: ((bintray-password))
-      SONATYPE_USERNAME: ((sonatype-username))
-      SONATYPE_PASSWORD: ((sonatype-password))
+      BINTRAY_API_KEY: ((bintray-api-key))
       BINTRAY_SUBJECT: ((bintray-subject))
       BINTRAY_REPO: ((bintray-repo))
+      SONATYPE_USER_TOKEN: ((sonatype-user-token))
+      SONATYPE_PASSWORD_TOKEN: ((sonatype-password-token))
 - name: publish-eclipse-update-site
   serial: true
   plan:
@@ -177,9 +177,7 @@ jobs:
     file: git-repo/ci/tasks/publish-eclipse-update-site.yml
     params:
       BINTRAY_USERNAME: ((bintray-username))
-      BINTRAY_PASSWORD: ((bintray-password))
-      SONATYPE_USERNAME: ((sonatype-username))
-      SONATYPE_PASSWORD: ((sonatype-password))
+      BINTRAY_API_KEY: ((bintray-api-key))
       BINTRAY_SUBJECT: ((bintray-subject))
       BINTRAY_REPO: ((bintray-repo))
 groups:

ci/scripts/promote.sh

@@ -9,14 +9,14 @@ groupId=$( cat artifactory-repo/build-info.json | jq -r '.buildInfo.modules[0].i
 version=$( cat artifactory-repo/build-info.json | jq -r '.buildInfo.modules[0].id' | sed 's/.*:.*:\(.*\)/\1/' )
 
 
-if [[ $RELEASE_TYPE = "M" ]]; then
+if [[ ${RELEASE_TYPE} = "M" ]]; then
 	targetRepo="libs-milestone-local"
-elif [[ $RELEASE_TYPE = "RC" ]]; then
+elif [[ ${RELEASE_TYPE} = "RC" ]]; then
 	targetRepo="libs-milestone-local"
-elif [[ $RELEASE_TYPE = "RELEASE" ]]; then
+elif [[ ${RELEASE_TYPE} = "RELEASE" ]]; then
 	targetRepo="libs-release-local"
 else
-	echo "Unknown release type $RELEASE_TYPE" >&2; exit 1;
+	echo "Unknown release type ${RELEASE_TYPE}" >&2; exit 1;
 fi
 
 echo "Promoting ${buildName}/${buildNumber} to ${targetRepo}"
@@ -32,7 +32,7 @@ curl \
 	-X \
 	POST "${ARTIFACTORY_SERVER}/api/build/promote/${buildName}/${buildNumber}" > /dev/null || { echo "Failed to promote" >&2; exit 1; }
 
-if [[ $RELEASE_TYPE = "RELEASE" ]]; then
+if [[ ${RELEASE_TYPE} = "RELEASE" ]]; then
 	curl \
 		-s \
 		--connect-timeout 240 \
@@ -48,17 +48,17 @@ if [[ $RELEASE_TYPE = "RELEASE" ]]; then
 	ARTIFACTS_PUBLISHED=false
 	WAIT_TIME=5
 	COUNTER=0
-	while [ $ARTIFACTS_PUBLISHED == "false" ] && [ $COUNTER -lt 60 ]; do
+	while [ $artifactsPublished == "false" ] && [ $COUNTER -lt 60 ]; do
 		result=$( curl -s https://api.bintray.com/packages/"${BINTRAY_SUBJECT}"/"${BINTRAY_REPO}"/"${groupId}" )
 		versions=$( echo "$result" | jq -r '.versions' )
 		exists=$( echo "$versions" | grep "$version" -o || true )
 		if [ "$exists" = "$version" ]; then
-			ARTIFACTS_PUBLISHED=true
+			artifactsPublished=true
 		fi
 		COUNTER=$(( COUNTER + 1 ))
 		sleep $WAIT_TIME
 	done
-	if [[ $ARTIFACTS_PUBLISHED = "false" ]]; then
+	if [[ $artifactsPublished = "false" ]]; then
 		echo "Failed to publish"
 		exit 1
 	fi

ci/scripts/publish-eclipse-update-site.sh

@@ -13,7 +13,7 @@ curl \
 		-s \
 		--connect-timeout 240 \
 		--max-time 2700 \
-		-u ${BINTRAY_USERNAME}:${BINTRAY_PASSWORD} \
+		-u ${BINTRAY_USERNAME}:${BINTRAY_API_KEY} \
 		-f \
 		-X PUT \
 		-T "artifactory-repo/io/spring/javaformat/io.spring.javaformat.eclipse.site/${version}/io.spring.javaformat.eclipse.site-${version}.zip" \
@@ -33,7 +33,7 @@ curl \
 		-s \
 		--connect-timeout 240 \
 		--max-time 2700 \
-		-u ${BINTRAY_USERNAME}:${BINTRAY_PASSWORD} \
+		-u ${BINTRAY_USERNAME}:${BINTRAY_API_KEY} \
 		-f \
 		-X PUT \
 		-T "target/repository/content.jar" \
@@ -43,7 +43,7 @@ curl \
 		-s \
 		--connect-timeout 240 \
 		--max-time 2700 \
-		-u ${BINTRAY_USERNAME}:${BINTRAY_PASSWORD} \
+		-u ${BINTRAY_USERNAME}:${BINTRAY_API_KEY} \
 		-f \
 		-X PUT \
 		-T "target/repository/artifacts.jar" \

ci/scripts/stage.sh

@@ -13,22 +13,22 @@ git clone git-repo stage-git-repo > /dev/null
 pushd stage-git-repo > /dev/null
 
 snapshotVersion=$( xmllint --xpath '/*[local-name()="project"]/*[local-name()="version"]/text()' pom.xml )
-if [[ $RELEASE_TYPE = "RELEASE" ]]; then
+if [[ ${RELEASE_TYPE} = "RELEASE" ]]; then
 	stageVersion=$( strip_snapshot_suffix $snapshotVersion)
 	nextVersion=$( bump_version_number $snapshotVersion)
 else
-	echo "Unknown release type $RELEASE_TYPE" >&2; exit 1;
+	echo "Unknown release type ${RELEASE_TYPE}" >&2; exit 1;
 fi
 
-echo "Staging $stageVersion (next version will be $nextVersion)"
-run_maven versions:set -DnewVersion=$stageVersion -DgenerateBackupPoms=false
+echo "Staging ${stageVersion} (next version will be ${nextVersion})"
+run_maven versions:set -DnewVersion=${stageVersion} -DgenerateBackupPoms=false
 run_maven org.eclipse.tycho:tycho-versions-plugin:update-eclipse-metadata
 
 git config user.name "Spring Buildmaster" > /dev/null
 git config user.email "[email protected]" > /dev/null
 git add pom.xml > /dev/null
-git commit -m"Release v$stageVersion" > /dev/null
-git tag -a "v$stageVersion" -m"Release v$stageVersion" > /dev/null
+git commit -m"Release v${stageVersion}" > /dev/null
+git tag -a "v${stageVersion}" -m"Release v${stageVersion}" > /dev/null
 
 run_maven clean deploy -U -Dfull -DaltDeploymentRepository=distribution::default::file://${repository}
 
@@ -38,7 +38,7 @@ run_maven versions:set -DnewVersion=$nextVersion -DgenerateBackupPoms=false
 run_maven org.eclipse.tycho:tycho-versions-plugin:update-eclipse-metadata
 sed -i "s/:release-version:.*/:release-version: ${stageVersion}/g" README.adoc
 git add . > /dev/null
-git commit -m"Next development version (v$nextVersion)" > /dev/null
+git commit -m"Next development version (v${nextVersion})" > /dev/null
 
 echo "DONE"
 

ci/scripts/sync-to-maven-central.sh

@@ -11,8 +11,8 @@ echo "Syncing ${buildName}/${buildNumber} to Maven Central"
 			-s \
 			--connect-timeout 240 \
 			--max-time 2700 \
-			-u ${BINTRAY_USERNAME}:${BINTRAY_PASSWORD} \
-			-H "Content-Type: application/json" -d "{\"username\": \"${SONATYPE_USERNAME}\", \"password\": \"${SONATYPE_PASSWORD}\"}" \
+			-u ${BINTRAY_USERNAME}:${BINTRAY_API_KEY} \
+			-H "Content-Type: application/json" -d "{\"username\": \"${SONATYPE_USER_TOKEN}\", \"password\": \"${SONATYPE_PASSWORD_TOKEN}\"}" \
 			-f \
 			-X \
 			POST "https://api.bintray.com/maven_central_sync/${BINTRAY_SUBJECT}/${BINTRAY_REPO}/${groupId}/versions/${version}" > /dev/null || { echo "Failed to sync" >&2; exit 1; }

ci/tasks/promote.yml

@@ -3,5 +3,12 @@ platform: linux
 inputs:
 - name: git-repo
 - name: artifactory-repo
+params:
+  RELEASE_TYPE
+  ARTIFACTORY_SERVER:
+  ARTIFACTORY_USERNAME:
+  ARTIFACTORY_PASSWORD:
+  BINTRAY_SUBJECT:
+  BINTRAY_REPO:
 run:
   path: git-repo/ci/scripts/promote.sh

ci/tasks/publish-eclipse-update-site.yml

@@ -3,5 +3,8 @@ platform: linux
 inputs:
 - name: git-repo
 - name: artifactory-repo
+params:
+  BINTRAY_USERNAME:
+  BINTRAY_API_KEY:
 run:
   path: git-repo/ci/scripts/publish-eclipse-update-site.sh

ci/tasks/stage.yml

@@ -8,5 +8,7 @@ outputs:
 caches:
 - path: maven
 - path: gradle
+params:
+  RELEASE_TYPE
 run:
   path: git-repo/ci/scripts/stage.sh

ci/tasks/sync-to-maven-central.yml

@@ -3,5 +3,12 @@ platform: linux
 inputs:
 - name: git-repo
 - name: artifactory-repo
+params:
+  BINTRAY_USERNAME:
+  BINTRAY_API_KEY:
+  BINTRAY_SUBJECT:
+  BINTRAY_REPO:
+  SONATYPE_USER_TOKEN:
+  SONATYPE_PASSWORD_TOKEN:
 run:
   path: git-repo/ci/scripts/sync-to-maven-central.sh