[jira] [Created] (THRIFT-6327) Document the credentials the release workflows need in one place

["Jens Geyer (Jira)" <ji...@apache.org>]

Jens Geyer created THRIFT-6327:
----------------------------------

             Summary: Document the credentials the release workflows need in one place
                 Key: THRIFT-6327
                 URL: https://issues.apache.org/jira/browse/THRIFT-6327
             Project: Thrift
          Issue Type: Improvement
          Components: Build Process
            Reporter: Jens Geyer
             Fix For: 0.26.0


h2. Situation

Six workflows publish something when a release is published: {{pypi.yml}}, {{release_ruby.yml}}, {{release_rust.yml}}, {{dotnet-tool.yml}}, {{winget.yml}} and {{chocolatey.yml}}. Between them they need one repository variable, two repository secrets and four trusted publishing policies configured on the receiving side.

Every one of those is documented, and no two of them are documented in the same place. {{doc/ReleaseManagement.md}} mentions {{CHOCO_API_KEY}} inside the Chocolatey prose, {{WINGET_TOKEN}} inside the WinGet prose, and the NuGet policy and {{NUGET_USER}} inside a bullet under "Third Party Package Managers"; the PyPI policy is in the pypi bullet; the crates.io and RubyGems ones are not described at all.

So a release manager who wants to know what has to be set up before their first release has no way to find out other than reading the whole document, and a new one cannot tell which failures are "not configured yet" from which are real.

h2. Change

Add one section to {{doc/ReleaseManagement.md}} listing what the release automation needs: the name, whether it is a secret or a variable, what it is, which workflow consumes it, and what happens when it is missing.

The per package prose stays where it is. The new section is the lookup, and it links into that prose rather than repeating it.

Worth recording in the same place, because it is not obvious from the outside:

* Four of the six publish over trusted publishing and hold no stored credential at all - PyPI, RubyGems, crates.io and NuGet. Only WinGet and Chocolatey use a stored secret, and only because neither has an OIDC path.
* {{WINGET_TOKEN}} has to be a *classic* personal access token. Fine grained tokens are not supported by {{wingetcreate}}.
* The WinGet and Chocolatey steps do not fail when their secret is absent: they build and upload the artifact, write a warning and say in the run summary how to publish by hand. That is deliberate, so that a missing secret cannot fail a release, but it does mean a green run is not proof that anything was published.

_Drafted with AI assistance (Claude Opus 5); reviewed and posted by Jens Geyer._




--
This message was sent by Atlassian Jira
(v8.20.10#820010)