[alonsopf89]

Summary

Configures Maven Central release staging for GoogleCloudPlatform/appengine-java-standard through Google's OSS Exit Gate (appengine-java/mavencentral).

Key Changes

• Artifact Registry Staging Target: Stages release artifacts to us-maven.pkg.dev/oss-exit-gate-prod/appengine-java--mavencentral via the oss-exit-gate publishing profile/repository (leaving normal builds, unit tests, and snapshot workflows unaffected).
• Preemptive Staging Cleanup & Release Manifest: Before publishing a new release, stale packages in appengine-java--mavencentral should be cleaned via gcloud artifacts packages list/delete, followed by uploading manifest.json ({"publish_all": true}) to gs://oss-exit-gate-prod-projects-bucket/appengine-java/mavencentral/manifests/ to trigger OSS Exit Gate verification and Maven Central publication:

  # 1. Clean up stale releases from staging repo
  packages=$(gcloud artifacts packages list \
      --project="oss-exit-gate-prod" \
      --location="us" \
      --repository="appengine-java--mavencentral" \
      --format="value(name)" 2>/dev/null)
  echo "${packages}" | xargs -r -I {} sh -c '
      gcloud artifacts packages delete "{}" \
          --project="oss-exit-gate-prod" \
          --location="us" \
          --repository="appengine-java--mavencentral" \
          --quiet
  '
  
  # 2. Stage signed artifacts & upload release manifest
  mvn deploy -P sonatype-oss-release,oss-exit-gate
  echo '{"publish_all": true}' > /tmp/manifest.json
  gcloud storage cp /tmp/manifest.json \
      "gs://oss-exit-gate-prod-projects-bucket/appengine-java/mavencentral/manifests/manifest-$(date +%s).json"

• Verification: OSS Exit Gate resources (appengine-java--mavencentral) are provisioned and end-to-end Artifact Registry + GCS manifest smoke testing has been verified (HTTP 201 + rc=0).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[ludoch]

Pleas explain why we need this. Which bug does it fix?

[alonsopf89]

Hi @ludoch — this isn't fixing a product bug in App Engine; it's part of Google's Open Source Security migration moving Google-owned Maven Central package releases off long-lived Sonatype credentials (OSSRH / Central tokens) onto OSS Exit Gate.

Specifically, this adds an opt-in oss-exit-gate Maven profile that stages release artifacts to the dedicated Artifact Registry staging repository (us-maven.pkg.dev/oss-exit-gate-prod/appengine-java--mavencentral), and updates kokoro/gcp_ubuntu/release.sh to trigger the OSS Exit Gate publication pipeline via GCS manifest instead of publishing directly with static credentials. Normal local and CI builds (without -Poss-exit-gate) are completely unchanged.

Happy to ping you internally (fernandoalonso@google.com) with the internal tracking bug and documentation links!