You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by as...@apache.org on 2026/08/30 12:00:09 UTC
(maka) branch main updated: ci: declare the Desktop Nightly environment (#4260)
This is an automated email from the ASF dual-hosted git repository.
Astro-Han pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/maka.git
The following commit(s) were added to refs/heads/main by this push:
new 296b05a260 ci: declare the Desktop Nightly environment (#4260)
296b05a260 is described below
commit 296b05a26000df66e7fc35f38c5069a091ab1406
Author: AstroHan <le...@outlook.com>
AuthorDate: Sun Aug 30 20:00:04 2026 +0800
ci: declare the Desktop Nightly environment (#4260)
Declare a main-only, approval-free Nightly deployment environment through ASF's self-service repository configuration. Extend the repository control-plane contract so the environment cannot drift to another ref or approval model.
Generated-by: Codex
---
.asf.yaml | 9 +++++++++
.github/DESKTOP_NIGHTLY.md | 2 +-
.github/RELEASE_CHECKLIST.md | 8 ++++----
docs/cli-npm-release.md | 3 ++-
docs/cli-npm-release.zh-CN.md | 3 ++-
scripts/product-release.test.mjs | 20 +++++++++++---------
6 files changed, 29 insertions(+), 16 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
index ceacc9ef40..b85c3649de 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -110,6 +110,15 @@ github:
policies:
- name: main
type: branch
+ nightly:
+ required_reviewers: []
+ wait_timer: 0
+ prevent_self_review: false
+ deployment_branch_policy:
+ protected_branches: false
+ policies:
+ - name: main
+ type: branch
product-release:
required_reviewers:
- id: M4n5ter
diff --git a/.github/DESKTOP_NIGHTLY.md b/.github/DESKTOP_NIGHTLY.md
index f3f701eacb..91d2fd5d1f 100644
--- a/.github/DESKTOP_NIGHTLY.md
+++ b/.github/DESKTOP_NIGHTLY.md
@@ -28,7 +28,7 @@ Nightly currently uses the same application identity as the formal Desktop. Inst
## One-time setup
1. Ask Apache Infra to allow `apache/maka` to publish GitHub Actions output to `nightlies.apache.org` and whitelist the repository for the standard `NIGHTLIES_RSYNC_HOST`, `NIGHTLIES_RSYNC_KEY`, `NIGHTLIES_RSYNC_PATH`, `NIGHTLIES_RSYNC_PORT`, and `NIGHTLIES_RSYNC_USER` secrets.
-2. Create a GitHub Environment named `nightly` that permits only `main`. Verify that its jobs can read the five Infra-provided Nightlies secrets. Configure its macOS signing and notarization secrets: `CSC_LINK`, `CSC_KEY_PASSWORD`, `APPLE_API_KEY`, `APPLE_API_KEY_ID`, and `APPLE_API_ISSUER`. Do not expose these secrets to repository-wide or pull-request workflows.
+2. After the checked-in `.asf.yaml` reaches `main`, verify that ASF reconciliation created the `nightly` GitHub Environment with only `main` permitted and no approval gate. Do not maintain that policy manually in GitHub. Verify that its jobs can read the five Infra-provided Nightlies secrets. Configure its macOS signing and notarization secrets: `CSC_LINK`, `CSC_KEY_PASSWORD`, `APPLE_API_KEY`, `APPLE_API_KEY_ID`, and `APPLE_API_ISSUER`. Do not expose these secrets to repository-wide or p [...]
3. Configure npm Trusted Publishing for `apache/maka` and `.github/workflows/npm-publication.yml`, restricted to the `npm-publication` Environment and with both `npm publish` and `npm stage publish` allowed. Do not create or store a long-lived npm token.
4. After npm Trusted Publishing is ready, set `NPM_NIGHTLY_ENABLED` to `true`, run `npm publication` from `main` with `channel=nightly`, and verify the exact npm version and `nightly` dist-tag. This does not depend on Desktop Infra.
5. After Infra publishing and the `nightly` Environment secrets are ready, set `DESKTOP_NIGHTLY_ENABLED` to `true` and start a fresh npm Nightly. Confirm that its successful run triggers `Desktop Nightly`.
diff --git a/.github/RELEASE_CHECKLIST.md b/.github/RELEASE_CHECKLIST.md
index 0f78a82e5c..4402722337 100644
--- a/.github/RELEASE_CHECKLIST.md
+++ b/.github/RELEASE_CHECKLIST.md
@@ -63,10 +63,10 @@ Before the first product release, confirm the checked-in `.asf.yaml` has reconci
- the `Immutable release tags` ruleset blocks updates, force-pushes, and deletions of `v*` tags;
- the `release` Environment accepts only its declared source-candidate tag pattern and requires a
reviewer other than the triggering user;
-- `npm-publication` and `product-release` accept only `main`; `product-release` requires a reviewer
- other than the triggering user. `npm-publication` has no GitHub
- approval gate because scheduled Nightly publication is automatic; formal npm publication still
- requires human 2FA approval after staging.
+- `npm-publication`, `nightly`, and `product-release` accept only `main`; `product-release` requires
+ a reviewer other than the triggering user. `npm-publication` and `nightly` have no GitHub approval
+ gate because scheduled npm and Desktop Nightly publication is automatic; formal npm publication
+ still requires human 2FA approval after staging.
These controls close the check-to-upload and check-to-stage windows. Finalize uses GitHub Actions
OIDC rather than a stored signing key to attest every convenience artifact. Keep the Release in
diff --git a/docs/cli-npm-release.md b/docs/cli-npm-release.md
index b32c2ebaa4..1f5ee2b048 100644
--- a/docs/cli-npm-release.md
+++ b/docs/cli-npm-release.md
@@ -73,12 +73,13 @@ The workflow boundaries are:
### GitHub Environment
-The checked-in `.asf.yaml` is the authority for the `npm-publication` and `product-release`
+The checked-in `.asf.yaml` is the authority for the `npm-publication`, `nightly`, and `product-release`
Environments. After it reaches
`main`, confirm ASF reconciliation produced:
- a selected `main` branch rule for `npm-publication`, with no approval gate so the
scheduled Nightly can publish automatically;
+- a selected `main` branch rule for `nightly`, with no approval gate so Desktop Nightly can publish automatically;
- a selected `main` branch rule for `product-release`, with `M4n5ter` as required reviewer and
self-review disabled;
- administrator bypass disabled where repository policy permits it.
diff --git a/docs/cli-npm-release.zh-CN.md b/docs/cli-npm-release.zh-CN.md
index 012921f8bd..06f9bef79d 100644
--- a/docs/cli-npm-release.zh-CN.md
+++ b/docs/cli-npm-release.zh-CN.md
@@ -63,11 +63,12 @@ workflow 边界分别是：
### GitHub Environment
-仓库中的 `.asf.yaml` 是 `npm-publication` 和 `product-release` Environment 的权威。该配置进入 `main` 后，确认 ASF
+仓库中的 `.asf.yaml` 是 `npm-publication`、`nightly` 和 `product-release` Environment 的权威。该配置进入 `main` 后，确认 ASF
同步出的 live 配置满足：
- `npm-publication` 只允许 selected `main` branch；为保证 Nightly 自动运行，不设置
approval gate；
+- `nightly` 只允许 selected `main` branch；为保证 Desktop Nightly 自动运行，不设置 approval gate；
- `product-release` 只允许 selected `main` branch，required reviewer 为 `M4n5ter`，并禁止
self-review；
- 仓库策略允许时禁用 administrator bypass。
diff --git a/scripts/product-release.test.mjs b/scripts/product-release.test.mjs
index 334554aa76..04023366bc 100644
--- a/scripts/product-release.test.mjs
+++ b/scripts/product-release.test.mjs
@@ -777,15 +777,17 @@ test('repository control plane admits only each release phase owner ref', async
},
});
}
- assert.deepEqual(environments['npm-publication'], {
- required_reviewers: [],
- wait_timer: 0,
- prevent_self_review: false,
- deployment_branch_policy: {
- protected_branches: false,
- policies: [{ name: 'main', type: 'branch' }],
- },
- });
+ for (const name of ['npm-publication', 'nightly']) {
+ assert.deepEqual(environments[name], {
+ required_reviewers: [],
+ wait_timer: 0,
+ prevent_self_review: false,
+ deployment_branch_policy: {
+ protected_branches: false,
+ policies: [{ name: 'main', type: 'branch' }],
+ },
+ });
+ }
assert.deepEqual(
config.github.rulesets.find((ruleset) => ruleset.name === 'Immutable release tags'),
{
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org