Re: [PR] Release tooling: tag-based versioning, milestone prompt, and Docker images via GitHub Actions [skywalking-java]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng commented on PR #821:
URL: https://github.com/apache/skywalking-java/pull/821#issuecomment-5267720960

   Pushed `02a563e` after review feedback: the release path was rebuilding the agent rather than shipping the artifact that was voted on.
   
   The previous local `cmd_docker` extracted `apache-skywalking-java-agent-x.y.z.tgz` — the tarball that was signed, uploaded to dist, and voted on — and fed that directory to the Dockerfile as `ARG DIST`. Moving the push into Actions quietly dropped that property: `build-tar` ran `make build`, so the published image would have contained a **recompile of the tag** rather than the approved bits.
   
   Now `build-tar` is skipped on release events, and the tarball is downloaded from the Apache distribution area and verified before it can enter an image:
   
   ```bash
   curl -fsSL -O "${BASE}/${TARBALL}"        # dist/release/skywalking/java-agent/x.y.z
   curl -fsSL -O "${BASE}/${TARBALL}.asc"
   curl -fsSL -O "${BASE}/${TARBALL}.sha512"
   
   sha512sum -c "${TARBALL}.sha512"
   curl -fsSL https://downloads.apache.org/skywalking/KEYS | gpg --import
   gpg --verify "${TARBALL}.asc" "${TARBALL}"
   ```
   
   sha512 rules out a truncated download; the signature check rules out anything the release manager did not sign. `promote` does the `svn mv` from `dist/dev` to `dist/release` immediately before the GitHub Release that triggers the workflow, so the file is in place when the job runs.
   
   `build-docker` needed `always()` in its condition, since a skipped `build-tar` would otherwise skip it too. Development images are unchanged and still come from the artifact `build-tar` uploads.
   
   Verified against the real 9.7.0 artifact:
   
   ```
   apache-skywalking-java-agent-9.7.0.tgz: OK
   gpg:                using RSA key D360AB2AB20B28403270E2CBE8608938DB25E06B
   gpg: Good signature from "Sheng Wu <wu...@apache.org>"
   top-level: skywalking-agent/
   ```
   
   All three dist URLs return HTTP 200 and the KEYS file carries 29 public keys.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org