tutorial

Monitoring JReleaser with Vigilmon

JReleaser automates JVM project releases to Maven Central, Docker registries, Homebrew, Snap, and more — but GPG key failures, Sonatype staging issues, and registry auth problems block releases silently. Here's how to monitor every layer of your JReleaser pipeline with Vigilmon.

JReleaser is the Go ecosystem's GoReleaser, built for the JVM world — it automates signing, checksumming, and publishing Java, Kotlin, Groovy, and Scala artifacts to Maven Central, Gradle Plugin Portal, Docker registries, Homebrew, Snap, Flatpak, and dozens of other destinations. A single JReleaser config can touch six or more publishing targets in one release run. Any one of them — a GPG key rotation, an expired Sonatype token, a Snapcraft build submission timeout — can silently block your release. Vigilmon gives you end-to-end observability over every JReleaser publishing target so you catch failures before users report missing artifacts.

What You'll Set Up

  • JReleaser server availability monitor (port 3000)
  • Maven Central publishing health via Sonatype OSSRH
  • Artifact signing health (GPG, Cosign, jarsigning)
  • Docker image build and push health per registry
  • GitHub/GitLab release API connectivity
  • Homebrew/Scoop formula update health
  • Snap/Flatpak publishing health
  • Artifact checksum integrity alerts

Prerequisites

  • JReleaser CLI or Gradle/Maven plugin configured for your project
  • At least one release target configured (Maven Central, GitHub Releases, or Docker)
  • A free Vigilmon account

Step 1: Monitor the JReleaser Server

JReleaser can run in server mode (port 3000 by default) to expose a webhook API for triggering release pipelines from CI/CD events. When this server is down, all automated release triggers fail.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter your JReleaser server health URL: http://your-jreleaser-server:3000/health.
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Click Save.

If your JReleaser server exposes a /metrics or /actuator/health endpoint (it uses Spring Boot under the hood), point Vigilmon at the actuator endpoint for richer health signals.

Step 2: Monitor Maven Central Publishing Health

Publishing to Maven Central via Sonatype OSSRH is the most error-prone step in a JVM release. The Sonatype API, GPG signing, staging repository promotion, and sync delay all have independent failure modes.

Add a heartbeat that fires only after successful Maven Central staging promotion:

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Name it JReleaser Maven Central Heartbeat.
  3. Set Expected ping interval to match your release cadence (e.g., 24h).
  4. Copy the generated heartbeat URL.

In your CI pipeline (GitHub Actions example):

- name: Release to Maven Central
  run: ./gradlew jreleaserFullRelease
  env:
    JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
    JRELEASER_NEXUS2_USERNAME: ${{ secrets.NEXUS_USERNAME }}
    JRELEASER_NEXUS2_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}

- name: Ping Vigilmon on successful Maven Central release
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_MAVEN_HB_URL }}"

Also add an HTTP monitor for the Sonatype OSSRH API:

  1. Add Monitor → HTTP / HTTPS.
  2. URL: https://oss.sonatype.org/service/local/status.
  3. Check interval: 5 minutes.
  4. Expected status: 200.

Step 3: Monitor Artifact Signing Health

JReleaser supports GPG signing, Cosign signing, and jarsigning for Java archives. Key rotation without updating CI secrets is the most common cause of signing failures.

Add a heartbeat for the signing stage:

- name: Sign artifacts
  run: ./gradlew jreleaserSign
  env:
    JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
    JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}

- name: Verify signatures
  run: |
    for f in build/jreleaser/checksums/*.asc; do
      gpg --verify "$f" || exit 1
    done
    curl -fsS "${{ secrets.VIGILMON_SIGNING_HB_URL }}"

Set the heartbeat interval to your release cadence. If the GPG key expires or the secret rotates without updating JRELEASER_GPG_SECRET_KEY, the signing step fails silently — the heartbeat misses its window and Vigilmon pages your team.

Step 4: Monitor Docker Image Build and Push Health

JReleaser builds and pushes multi-arch Docker images as part of the release. Each registry (Docker Hub, GHCR, ECR) has its own authentication path.

Add TCP port monitors for each target registry:

  1. Add Monitor → TCP Port Check.
  2. Docker Hub: host registry-1.docker.io, port 443.
  3. GHCR: host ghcr.io, port 443.
  4. Set Check interval: 2 minutes per registry.

For push health, add a heartbeat that fires after successful image push:

- name: Build and push Docker images
  run: ./gradlew jreleaserPublish -Pjreleaser.distributions=docker
  env:
    JRELEASER_DOCKER_DEFAULT_USERNAME: ${{ secrets.DOCKER_USERNAME }}
    JRELEASER_DOCKER_DEFAULT_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

- name: Ping Vigilmon Docker push heartbeat
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_DOCKER_HB_URL }}"

Step 5: Monitor GitHub/GitLab Release API Connectivity

JReleaser creates GitHub or GitLab releases and uploads release assets via their APIs. Rate limit exhaustion or token scope issues fail at the upload stage after the entire build has completed.

Add an HTTP monitor for the GitHub API:

  1. Add Monitor → HTTP / HTTPS.
  2. URL: https://api.github.com.
  3. Check interval: 5 minutes.
  4. Expected status: 200.

Add a pre-release CI check for token validity:

- name: Validate GitHub token scopes
  run: |
    scopes=$(curl -fsS -H "Authorization: token $GITHUB_TOKEN" \
      -I https://api.github.com/user | grep -i x-oauth-scopes)
    echo "Token scopes: $scopes"
    echo "$scopes" | grep -q "repo" || (echo "::error::Missing 'repo' scope" && exit 1)
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Step 6: Monitor Homebrew and Scoop Formula Update Health

JReleaser submits pull requests to Homebrew tap repositories and Scoop bucket repos after each release. PR creation failures mean package managers serve stale versions.

Add a heartbeat for each formula update:

- name: Update Homebrew formula
  run: ./gradlew jreleaserRelease -Pjreleaser.distributions=homebrew
  env:
    JRELEASER_GITHUB_TOKEN: ${{ secrets.BREW_TAP_TOKEN }}

- name: Ping Vigilmon Homebrew heartbeat
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_HOMEBREW_HB_URL }}"

- name: Update Scoop manifest
  run: ./gradlew jreleaserRelease -Pjreleaser.distributions=scoop
  env:
    JRELEASER_GITHUB_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}

- name: Ping Vigilmon Scoop heartbeat
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_SCOOP_HB_URL }}"

Set each heartbeat's expected interval to your release cadence. Token expiry for BREW_TAP_TOKEN and SCOOP_BUCKET_TOKEN are independent — monitor them separately.

Step 7: Monitor Snap and Flatpak Publishing Health

JReleaser submits to Snapcraft and Flathub via their respective APIs. Snapcraft authentication uses short-lived macaroon tokens; Flathub submissions require manual review but the submission API must be reachable.

Add TCP and HTTP monitors:

  1. Add Monitor → HTTP / HTTPS.
  2. Snapcraft: https://dashboard.snapcraft.io (expected status 200).
  3. Flathub: https://flathub.org (expected status 200).
  4. Check interval: 10 minutes.

Add heartbeats for submission success:

- name: Submit to Snapcraft
  run: ./gradlew jreleaserRelease -Pjreleaser.distributions=snap

- name: Ping Vigilmon Snap heartbeat
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_SNAP_HB_URL }}"

Step 8: Monitor Artifact Checksum Integrity

JReleaser generates SHA-256 checksums for all release artifacts. Checksum mismatch — caused by artifact mutation after checksum generation or filesystem errors — is a critical security failure.

Add a post-release checksum validation step:

- name: Validate artifact checksums
  run: |
    cd build/jreleaser/checksums
    sha256sum -c checksums.txt || (echo "::error::Checksum mismatch detected" && exit 1)
    curl -fsS "${{ secrets.VIGILMON_CHECKSUM_HB_URL }}"

Step 9: Configure Alerting

In Vigilmon, go to Alert Channels and set up tiered notifications:

  • PagerDuty — page on-call for signing failures, Maven Central staging failures, or JReleaser server downtime (these block all artifact availability).
  • Slack #releases — notify for Docker push failures, Homebrew/Scoop heartbeat misses, and GitHub API issues.
  • Email digest — weekly summary of Snap/Flatpak submission health and checksum integrity.

Recommended thresholds:

  • JReleaser server: alert after 1 failed check (immediate pipeline impact).
  • Signing heartbeat: alert after missed window + 15 minutes (allow for slow key operations).
  • Maven Central heartbeat: alert after missed window + 60 minutes (staging promotion takes time).
  • Registry TCP monitors: alert after 3 consecutive failures.

Conclusion

JReleaser turns a complex JVM release into a single command, but that power comes with hidden failure surface: Sonatype staging queues, GPG key rotation, per-registry Docker credentials, and Snapcraft macaroons all expire independently. With Vigilmon monitoring your JReleaser server, CI heartbeats for each publishing target, and TCP checks for downstream registries, every layer of your release pipeline becomes as observable as your production API. You'll know about signing failures, stale Homebrew formulae, and Maven Central staging issues before your users file bug reports.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles