I'm working on improving the UX of https://github.com/adamko-dev/dev-publish-plugin, a helper plugin for testing modules via publishing (without Maven Local, and build-cache friendly). It publishes to a local directory using a regular maven-publish repo, but adds addition up-to-date checks. One rough edge: if a project enables signing unconditionally (i.e. without something like

signing.setRequired { <project has tasks that publish to Maven Central> }

), then dev-publish also triggers signing, which fails on machines/CI without signing keys. Afaict it's not possible to disable signing per repository. The fix I'm looking at is skipping signing when only dev-publish tasks are in the task graph then disable the sign tasks (e.g. via

Sign.onlyIf {}

). But I'm not sure whether this should be a default opt-out behaviour, or an opt-in behaviour. Should dev-publish... 1. Automatically disable signing when only dev-publish tasks are requested? 2. Or just detect that signing is enabled but not configured, and warn/fail with a hint like "conditionally disable signing for local testing"?

I had this issue in Grolifant where the artifacts need to be signed for MavenCentral, and the solution was to create a separate publication for local testing which did not need signing. gitlab.com/ysb33rOrg/gradle/grolifant/-/blob/…/BaseLibraryPlugin.groovy?ref_type=heads In this file

org.ysb33r.ysf-project.sonatype.ossrh

enforces signing, but the

configureLocalPublishingForTesting

registers a second publication. As long as the build script is not configured to enforce signing on every publication it should be fine. HTH.