ci: fix sonatype publish

Author: neko-kai

.github/workflows/build.yml

@@ -177,11 +177,9 @@ jobs:
       - name: Build and Publish to Sonatype
         env:
           SONATYPE_SECRET: .secrets/credentials.sonatype-nexus.properties
-          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
-          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
-          CI_PULL_REQUEST: ${{ github.event_name == 'pull_request' }}
           CI_BRANCH: ${{ github.ref_name }}
           CI_BRANCH_TAG: ${{ github.ref_name }}
+          CI_PULL_REQUEST: ${{ github.event_name == 'pull_request' }}
         run: |
           mkdir .secrets
           echo "$SONATYPE_CREDENTIALS_FILE" > "$SONATYPE_SECRET"

.mdl/defs/actions.md

@@ -9,12 +9,11 @@
 - `USER`
 - `OPENSSL_IV`
 - `OPENSSL_KEY`
-- `SONATYPE_USERNAME`
-- `SONATYPE_PASSWORD`
+- `SONATYPE_SECRET`
 - `NODE_AUTH_TOKEN`
+- `CI_BRANCH`
 - `CI_BRANCH_TAG`
 - `CI_PULL_REQUEST`
-- `CI_BRANCH`
 
 # Axis
 - `platform`=`{jvm*|js|js-nojvm}`
@@ -306,22 +305,10 @@ JAVA_OPTIONS="${action.setup-jvm-options.java-options}"
 _JAVA_OPTIONS="$JAVA_OPTIONS"
 VERSION_COMMAND="${action.setup-scala.version-command}"
 
-SONATYPE_USERNAME_VAL="${env.SONATYPE_USERNAME}"
-SONATYPE_PASSWORD_VAL="${env.SONATYPE_PASSWORD}"
 CI_PULL_REQUEST_VAL="${env.CI_PULL_REQUEST}"
 CI_BRANCH_VAL="${env.CI_BRANCH}"
 CI_BRANCH_TAG_VAL="${env.CI_BRANCH_TAG}"
 
-if [[ -z "$SONATYPE_USERNAME_VAL" ]]; then
-  echo "Missing SONATYPE_USERNAME, skipping publish"
-  exit 0
-fi
-
-if [[ -z "$SONATYPE_PASSWORD_VAL" ]]; then
-  echo "Missing SONATYPE_PASSWORD, skipping publish"
-  exit 0
-fi
-
 if [[ "$CI_PULL_REQUEST_VAL" == "true" ]]; then
   echo "Publishing not allowed on pull requests"
   exit 0
@@ -332,9 +319,10 @@ if [[ "$CI_BRANCH_VAL" != "develop" && ! "$CI_BRANCH_TAG_VAL" =~ ^v ]]; then
   exit 0
 fi
 
-CREDENTIALS_FILE="${sys.project-root}/.secrets/credentials.sonatype-nexus.properties"
-mkdir -p "$(dirname "$CREDENTIALS_FILE")"
-printf "%s\n" "realm=Sonatype Nexus Repository Manager" "host=central.sonatype.com" "user=${SONATYPE_USERNAME_VAL}" "password=${SONATYPE_PASSWORD_VAL}" > "$CREDENTIALS_FILE"
+if [[ ! -f "$SONATYPE_SECRET" ]] ; then
+  echo "SONATYPE_SECRET=$SONATYPE_SECRET is not a file, failing publish"
+  exit 1
+fi
 
 if [[ "$CI_BRANCH_TAG_VAL" =~ ^v.*$ ]]; then
   sbt -batch -no-colors -v \