Skip to content

Repository and service setup

This page is the one-time bootstrap checklist for the two public repositories and the services owned by EnderFall LTD. None of these steps weaken the release gates in the build.

GitHub repositories

Create these public repositories in the EnderFall-LTD GitHub organization:

Repository Purpose License
EnderFall-LTD/enderfall-sdk SDK source, API, runtimes, plugin, tests, and documentation Apache-2.0
EnderFall-LTD/enderfall-sdk-template Minimal project users create their own repository from CC0-1.0

For enderfall-sdk, use main as the default branch, enable Issues and private vulnerability reporting, and select GitHub Actions as the Pages source. Create the protected release environment and restrict deployments to main. Require a review before that environment may run once more than one maintainer is available.

Protect main from force-pushes and deletion. Require the build and documentation checks after their first successful run. The runtime smoke matrix is deliberately reported separately from compilation.

For enderfall-sdk-template, enable Template repository in repository settings. Its default branch is also main.

Documentation DNS

The Pages workflow builds MkDocs in strict mode and deploys the site directory. The committed docs/CNAME file declares sdk.enderfall.co.uk.

At the authoritative DNS provider, create:

Type:   CNAME
Name:   sdk
Value:  enderfall-ltd.github.io
TTL:    1 hour (or provider default)

After the Pages deployment succeeds and DNS resolves, enter sdk.enderfall.co.uk as the repository's custom domain and enable Enforce HTTPS. Do not create a second A or AAAA record for sdk; a CNAME must be unambiguous.

Maven Central ownership

  1. Sign in to the Central Publisher Portal using the EnderFall-owned account.
  2. Add the namespace uk.co.enderfall.sdk.
  3. Copy the verification key generated by Central.
  4. Create a TXT record at the root of enderfall.co.uk with that exact value.
  5. Confirm the TXT record resolves publicly, then click Verify Namespace.
  6. Generate a Central user token. Store its generated username and password only in the protected GitHub release environment.

Central checks the exact reversed domain: uk.co.enderfall.sdk is proved at enderfall.co.uk, not at sdk.enderfall.co.uk.

Gradle Plugin Portal ownership

Create an organization-owned Plugin Portal account and API key. The plugin ID is uk.co.enderfall.sdk; its website and VCS URLs must already be public before the first submission. The first version is manually reviewed, and Gradle may request a DNS TXT record proving ownership of enderfall.co.uk.

Protected release secrets

Store all six values in the GitHub release environment, not as repository files or developer Gradle properties:

Secret Meaning
MAVEN_CENTRAL_USERNAME Username from a Central Portal user token
MAVEN_CENTRAL_PASSWORD Password from the same Central token
MAVEN_SIGNING_KEY ASCII-armored private OpenPGP key
MAVEN_SIGNING_PASSWORD Private-key passphrase
GRADLE_PUBLISH_KEY Plugin Portal API key
GRADLE_PUBLISH_SECRET Plugin Portal API secret

Use a dedicated signing key for releases, publish its public key to a public key server, keep an encrypted offline recovery copy, and never print the private key or tokens in workflow logs.

Current external-state check

The setup is complete only when all of these are true:

  • both GitHub URLs are public and the template flag is enabled;
  • the Pages workflow has deployed successfully;
  • sdk.enderfall.co.uk resolves and HTTPS is enforced;
  • Central shows uk.co.enderfall.sdk as verified;
  • the Plugin Portal account owns uk.co.enderfall.sdk;
  • the protected release environment contains all six secrets;
  • the release workflow still fails at verifyRuntimeMatrix until runtime acceptance is genuinely complete.