mirror of
https://github.com/hanzo-kotlin/sdk.git
synced 2026-10-30 20:02:19 +00:00
zeekay
c467eb2ad8
Publishing to Maven Central rode inside hanzo.yml's `binaries:` block behind `if [ -n "$GPG_SIGNING_KEY" ]`. hanzoai/ci fetches deploy credentials and has no occurrence of GPG_SIGNING, MAVEN_CENTRAL, SONATYPE or ORG_GRADLE_PROJECT anywhere in it, so that condition has been false on every run this repo has ever made: a tag assembled the jar, uploaded nothing, and reported success. Four alpha tags exist with an empty registry behind them. So the upload moves out of `binaries:` into .hanzo/workflows/publish-maven.yml — the shape python-sdk already publishes under — where it reads its credential from KMS and FAILS when the credential is absent. One lane per destination: `binaries:` attaches the jar to the release, this uploads to Central. The credential is registry-scoped, not repo-scoped: one `ai.hanzo` namespace and one signing key serve every JVM client, so it is sealed once at org hanzo, env prod, path `maven`, and hanzoai/java-sdk reads the same five keys. The POM is what a reader sees on Central before any code, so it names this artifact: a Kotlin client, at the public mirror a stranger can open, under a license that carries its URL. `Hanzo API` / `API documentation for Hanzo` named neither the language nor the thing, and the scm pointed at a redirect.