Sign the Gradle plugins on the Plugin Portal with the release key

The Plugin Portal copies of the plugins had no signatures, while Maven
Central and the GitHub release carry one for every file. With the
signing plugin applied, plugin-publish signs the plugin's publications
and uploads the signatures of its jars and POM along with them. The
release job passes the key from the same two secrets JReleaser uses.
Without the key nothing is signed, and publishPlugins refuses to
publish.

Checked with another RSA key, since only the release job holds the
release key. The staging repository gets a signature for the jar, the
sources, the javadoc, the POM, the module and the four marker POMs.
publishPlugins --validate-only passes. Without the key the signing
tasks are skipped, --validate-only still passes, and a real
publishPlugins stops with the new error. :gradle-open-java-format:check
passes.

Author: abashev

.github/workflows/release.yml

@@ -8,9 +8,9 @@ name: Release
 # validated first, and the publish job publishes both only once both are in. A version whose native build
 # fails publishes nothing, and its deployments can be dropped in the Portal.
 #
-# Once Maven Central serves both, the Gradle plugins go to the Gradle Plugin Portal. After publishing, a
-# draft GitHub release on the tag collects the runnable jar, the Gradle and IDE plugins and the native
-# binaries.
+# Once Maven Central serves both, the Gradle plugins go to the Gradle Plugin Portal, signed with the same
+# release key. After publishing, a draft GitHub release on the tag collects the runnable jar, the Gradle
+# and IDE plugins and the native binaries.
 #
 # Needs six repository secrets: JRELEASER_MAVENCENTRAL_USERNAME and JRELEASER_MAVENCENTRAL_PASSWORD (the
 # Central Portal user token), JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE, and
@@ -262,11 +262,13 @@ jobs:
             done
           done
 
-      - name: Publish the Gradle plugins
+      - name: Sign and publish the Gradle plugins
         run: ./gradlew :gradle-open-java-format:publishPlugins
         env:
           GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
           GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
+          JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
+          JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
 
   # What Maven Central does not carry — the runnable formatter jar, the Gradle plugins' jar, the IntelliJ
   # plugin zip, the Eclipse plugin jar, and every platform's native binary as a plain download — goes into

gradle-open-java-format/build.gradle

@@ -1,8 +1,10 @@
 // For the Gradle Plugin Portal: publishPlugins, run by the release workflow once Maven Central serves the
 // version's jars and native images — the plugins depend on them. The key comes from GRADLE_PUBLISH_KEY and
-// GRADLE_PUBLISH_SECRET. It applies java-gradle-plugin and maven-publish itself.
+// GRADLE_PUBLISH_SECRET. It applies java-gradle-plugin and maven-publish itself, and once the signing
+// plugin is applied it signs what it uploads.
 apply plugin: 'com.gradle.plugin-publish'
 apply plugin: 'groovy'
+apply plugin: 'signing'
 apply plugin: 'open-java-format.publishing-conventions'
 
 description = 'Gradle plugins for open-java-format: formatting tasks, the Spotless step and IntelliJ configuration'
@@ -162,11 +164,27 @@ tasks.named("test").configure {
     }
 }
 
-// The Portal never takes a version back, so only a release version goes up — X.Y.Z or X.Y.Z.N, as for Maven
-// Central in open-java-format.release-conventions. --validate-only checks the metadata of any version.
+// Signed with the release key, which also signs the Maven Central artifacts and the GitHub release. Only the
+// release job has it, in JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE; anywhere else nothing is
+// signed.
+def signingKey = providers.environmentVariable('JRELEASER_GPG_SECRET_KEY').getOrNull()
+def signed = signingKey != null
+signing {
+    required = false
+    if (signed) {
+        useInMemoryPgpKeys(signingKey, providers.environmentVariable('JRELEASER_GPG_PASSPHRASE').get())
+    }
+}
+
+// The Portal never takes a version back, so only a signed release version goes up — X.Y.Z or X.Y.Z.N, as for
+// Maven Central in open-java-format.release-conventions. --validate-only checks the metadata of any version.
 def portalVersion = provider { project.version.toString() }
 tasks.named('publishPlugins') {
     doFirst {
+        if (!validateOnly.getOrElse(false) && !signed) {
+            throw new GradleException('Refusing to publish unsigned plugins to the Gradle Plugin Portal: set '
+                    + 'JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE, or pass --validate-only.')
+        }
         if (!validateOnly.getOrElse(false) && !(portalVersion.get() ==~ /\d+\.\d+\.\d+(\.\d+)?/)) {
             throw new GradleException("Refusing to publish ${portalVersion.get()} to the Gradle Plugin Portal: check "
                     + 'out a release tag on a clean working tree, or pass --validate-only.')