Continuous artifact deployment in clojars about clj-symphony

[maoo]

Thanks @pmonks , the build is green! https://travis-ci.org/symphonyoss/clj-symphony

I saved clojars credentials and added Travis configuration, using repository-specific environment variables (option no. 2).

To answer your question, yes, also the second approach is secure, since:

1. it boils down to the same implementation of the first approach (both encrypted and hidden on build logs)
2. variables are only visible by the creator, even in the settings page; the repository settings are only accessible by github project administrators; other administrators (that are not the variable creators) can only remove (and/or re-add) the variable, but cannot view its value.

One interesting note; symbols in passwords MUST be escaped, regardless of the approach selected.

I'll finalise the documentation on symphonyoss.atlassian.net before resolving the issue. Thanks again for this.

[pmonks]

Clojars is the idiomatic repository for Clojure - I would recommend that over Maven Central unless there's a strongly compelling reason not to use it.

[pmonks]

I've added support for automatic deployment from Travis CI to the project, however @maoo will need to create encrypted environment variables containing the Clojars credentials in order for deployment to occur (right now Travis CI builds will hang at the deploy step, since Leiningen isn't finding those environment variables and falls back on prompting for interactive input). These variables are:

1. CLOJARS_USERNAME - the username of the Clojars user
2. CLOJARS_PASSWORD - the password of that Clojars user

I've created a Clojars user appropriate for use by the Foundation, and sent those credentials via secure channel to @maoo.

As best I can tell, encrypted environment variables can be defined in TravisCI in one of 2 ways:

1. by adding encrypted environment variables to the .travis.yml file and submitting a PR (please reference this issue in the PR subject)
2. by defining repository-specific environment variables

(though it's not clear to me if the second approach is secure - @maoo do you know?)

In the meantime, I manually ran a Clojars deployment, to confirm that the pipeline is working (it is), so everything should Just Work™ once those environment variables are defined and a Travis CI build triggered.

[maoo]

Documentation ready; will be live on the Wiki next week.