You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@grails.apache.org by "jamesfredley (via GitHub)" <gi...@apache.org> on 2026/08/26 17:07:50 UTC
[PR] ci: opt-in Apache Trusted Releases (ATR) Alpha 3 automation [grails-core]
jamesfredley opened a new pull request, #16229:
URL: https://github.com/apache/grails-core/pull/16229
## Summary
Opt-in GitHub Actions for [Apache Trusted Releases](https://release-test.apache.org/) **Alpha 3** plus one extra MANUAL step we found a TLP already automates. The default `dist/dev` + Nexus staging path is unchanged until the PMC sets `ATR_ENABLED=true` and configures Trusted Publishing.
This is **not** ATR Beta. Beta is not generally available ([tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520) still open). Host remains `release-test.apache.org`. Actions are pinned to `apache/tooling-actions@e8594ee9cc5ef5fbb48c367a9ab87042c0ccbbc5`.
### What this automates (with citations)
| Step | How | Why we may |
|------|-----|------------|
| Compose (upload signed zips) | `Release - ATR Upload (experimental)` / optional `atr_upload` job | Official example: https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml — Pekko also uploads to ATR |
| Resolve vote | `Release - ATR Resolve Vote (experimental)` | https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml |
| One `[ANNOUNCE]` to `announce@apache.org` | `Release - ATR Announce (experimental)` (once; extra lists stay manual) | https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml |
| Record Maven Central in ATR | `Release - ATR Record Distribution (experimental)` `platform=MAVEN` | https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml |
| Promote closed Nexus staging | `Release - Promote Nexus Staging` (`environment: release`) | Apache Polaris TLP already does this post-vote: https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml — same `NEXUS_STAGE_DEPLOYER_*` secrets Grails already uses to drop staging. Signing in GHA is allowed by https://www.apache.org/legal/release-policy.html |
### What stays manual (with citations)
- **72-hour PMC vote / vote start** — no Tooling GHA; https://www.apache.org/legal/release-policy.html and https://tooling.apache.org/trusted-releases.html. If using ATR, discard the generated `dist/dev` `[VOTE]` email so there is only one thread.
- **`dist/release` SVN** — https://infra.apache.org/github-actions-policy.html forbids GHA writing official release data without Infra authorization. After the one ATR announce, a committer `svn move`s exactly `dist/atr/grails/core/<version>` → `dist/release/grails/core/<version>` (https://release-test.apache.org/docs/promoting-to-release). Polaris leaves the same `svn mv` manual. Do **not** run `releaseDistributions.sh` for an ATR candidate.
- **ASF Reporter** — login form, no documented public API, no TLP GHA precedent.
- **Extra announce lists** (`dev@grails`, `users@grails`, `dev@groovy`) — ATR rejects a second announce for the same version.
Vote-start must set download path suffix `core/<version>` (or `core/{{VERSION}}`); the announce path input is compatibility-only.
### Setup
1. Configure Trusted Publishing on ATR for `grails-core` (workflow paths listed in `RELEASE.md`).
2. Optional repo var `ATR_ENABLED=true` to also upload from the main `Release` workflow.
3. Signing UID convention: `Automated Release Signing <pr...@grails.apache.org>`.
7.0.x can be cherry-picked later if wanted. Default line is 8.0.x.
## Test plan
- [ ] YAML parses / `validateActions` allowlists the pinned `apache/tooling-actions` SHA
- [ ] Dry-read `RELEASE.md` Experimental ATR + "What GitHub Actions may automate"
- [ ] Confirm `Release - Promote Nexus Staging` is `workflow_dispatch` + `environment: release` and is **not** auto-triggered
- [ ] After Trusted Publishing is configured, dry-run ATR Upload on a milestone tag in a non-production pass
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4416679619
##########
RELEASE.md:
##########
@@ -433,6 +440,97 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging (experimental)` is `workflow_dispatch` plus the protected `release` environment. It uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging, but that account's promotion permission is unverified. Keep using the Nexus UI or local script. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | Nexus UI or `.github/scripts/releaseJarFiles.sh`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The Infra-issued RSA 4096 key in `KEYS`, `Apache Grails Automated Release Signing <pr...@grails.apache.org>`, fingerprint `08E2 CEC4 7E38 FE41 5F08 0AB6 2ADE CADC 1177 5306`, already satisfies this requirement. The release workflow imports this key from `GRAILS_GPG_KEY` and signs with it using `GPG_KEY_ID`. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
+5. Optional repository variables, after that setup:
+
+ * `ATR_ENABLED=true`
+ * `ATR_PROJECT=grails` (the ATR project slug)
+ * `ATR_HOST=releases.apache.org` (optional; this is the default)
+ * `ATR_SSH_PORT=2222` (optional; this is the default)
+
+Do not enable ATR auto-archive of the prior release. On the ATR path, the release manager still removes the previous `dist/release` folder by hand so other current release lines are preserved.
+
+After publishing the new release, list the folders with `svn ls https://dist.apache.org/repos/dist/release/grails/core/` and select only the superseded release to remove. Keep the new version and the current releases on other lines. Use the same removal command as `.github/scripts/releaseDistributions.sh` with `SVN_FOLDER=core`, replacing `<folder>` with the selected folder name (without the trailing slash), as your ASF user:
+
+```bash
+svn rm -m "Remove previous release <folder>" https://dist.apache.org/repos/dist/release/grails/core/<folder>
+```
+
+### Using ATR alongside a Grails release
+
+Keep the current `Release` workflow as the source of signed artifacts. After the `source` job has uploaded the zips to the GitHub Release:
+
+1. **Compose.** Run `Release - ATR Upload (experimental)`, or rely on `atr_upload` when `ATR_ENABLED=true`. This rsyncs `sources/apache-grails-<version>-src.zip` and, under `distribution/`, the binary zip, the wrapper zip, and the documentation zip, each with `.asc` and `.sha512`. The upload declares the release tag commit. ATR then checks that the source zip is a subset of that commit: omitted files are allowed, and files that are not in the git tree are not, except `PKG-INFO` when `pyproject.toml` is present. This zip adds `CHECKSUMS`, `PUBLISHED_ARTIFACTS`, `BUILD_DATE`, and `GIT_TAGS` under `grails/`. That records a concern from `atr.tasks.checks.compare.source_trees`. Starting the vote requires acknowledging that concern. A project ignore can mark the same checker as an exception, but a broad ignore also hides unexpected extra files, so acknowledge the concern until ATR can allow those specific added paths. Do not treat `dist/dev` as the files under vote when ATR is the staging
location. See [Staging and voting](https://releases.apache.org/docs/staging-and-voting).
+2. **Vote.** Start the vote on ATR. There is no Tooling GitHub Action for this. Select automatic publication to the SVN distribution area. The download path comes from the project suffix `core/{{VERSION}}`, which the current `release-on-atr` action does not override. Discard any `dist/dev` `[VOTE]` email if the `upload` job printed one; it skips that email when `ATR_ENABLED=true`. Keep the 72-hour PMC vote. The GitHub `release` environment approval is still the gate for later jobs.
+3. **Resolve.** After the vote passes, run `Release - ATR Resolve Vote (experimental)` with `passed`. That replaces sending the `[RESULT][VOTE]` email by hand. `cancelled` is also a valid resolution.
+4. **Publish.** If automatic publication was selected, ATR has committed the voted artifacts to `dist/release/grails/core/<version>/`. Otherwise press Publish on the finish page. Do not run `releaseDistributions.sh` and do not move `dist/atr`.
+5. **Maven Central.** Use the Nexus UI or `.github/scripts/releaseJarFiles.sh` as your ASF user. The promotion workflow remains experimental until the stage-deployer account's promotion permission is verified. Once Maven Central is live, run `Release - ATR Record Distribution (experimental)` with `platform=MAVEN`, `distribution_owner_namespace=org.apache.grails`, and `distribution_package=grails-bom`. If the project tagging spec names Maven, ATR will not announce until that record exists.
+6. **Public destinations named by the announcement.** Publish the voted documentation zip, release the version to SDKMAN!, and update plus publish the static website so [https://grails.apache.org/download.html](https://grails.apache.org/download.html) lists this version. The generated announcement links to that page. Confirm the page shows the new version before announcing.
+7. **Announce.** Run `Release - ATR Announce (experimental)` once; it always sends to `announce@apache.org`. Leave `announce_body` empty to render `.github/vote_templates/announce.txt` (milestone wording is included only for `M` / `RC` versions). One successful announce must not be repeated for another list. If ATR rejects the call because the artifacts are not on the download mirrors yet, check the ATR finish page and retry that same announce. Do not retry an ambiguous failure. Then send the same body from your `@apache.org` address to `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org`.
+
+To find the verification base URL for an ATR candidate, open that candidate's page on the configured ATR host. The page provides a `curl` download one-liner and a list of file URLs at `/download/urls/<project>/<version>`. Read the actual source and binary file URLs from that list, and take the common directory prefix immediately before `sources/` and `distribution/`. Do not use the candidate page, the URL-list endpoint itself, or a GitHub release URL as the base.
+
+Confirm from the listed URLs that both subfolders are exposed under that common prefix exactly as `atr_upload` uploads them. `etc/bin/download-release-artifacts.sh` appends `/sources/<filename>` for the source artifacts and `/distribution/<filename>` for the binary, wrapper, and documentation artifacts, including their signatures and checksums. Do not assume ATR preserves that layout: if the listed URLs do not expose both subfolders under one base, this override cannot consume them as-is; do not guess a download URL pattern.
Review Comment:
Optional: this hedge can be replaced with the concrete base. In ATR's `atr/get/download.py`, `_generate_file_url_list` builds every line of `/download/urls/<project>/<version>` from the recursive relative path of each uploaded file, and the `path` route serves `/download/path/<project>/<version>/<path:file_path>` as an attachment. So while a candidate is under vote the base is `https://<atr-host>/download/path/grails/<version>`, and `sources/` and `distribution/` survive exactly as `atr_upload` rsyncs them. Naming that base here, with the URL list as the confirmation step, saves the release manager deriving it. The same endpoint switches to the published mirror URLs once the version reaches the RELEASE phase, so the override only applies during the vote.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4414087011
##########
RELEASE.md:
##########
@@ -433,6 +440,87 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging (experimental)` is `workflow_dispatch` plus the protected `release` environment. It uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging, but that account's promotion permission is unverified. Keep using the Nexus UI or local script. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | Nexus UI or `.github/scripts/releaseJarFiles.sh`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The Infra-issued RSA 4096 key in `KEYS`, `Apache Grails Automated Release Signing <pr...@grails.apache.org>`, fingerprint `08E2 CEC4 7E38 FE41 5F08 0AB6 2ADE CADC 1177 5306`, already satisfies this requirement. The release workflow imports this key from `GRAILS_GPG_KEY` and signs with it using `GPG_KEY_ID`. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
+5. Optional repository variables, after that setup:
+
+ * `ATR_ENABLED=true`
+ * `ATR_PROJECT=grails` (the ATR project slug)
+ * `ATR_HOST=releases.apache.org` (optional; this is the default)
+ * `ATR_SSH_PORT=2222` (optional; this is the default)
+
+Do not enable ATR auto-archive of the prior release. On the ATR path, the release manager still removes the previous `dist/release` folder by hand so other current release lines are preserved.
Review Comment:
Fixed in af420cf6a5. RELEASE.md now shows the svn rm command from releaseDistributions.sh, including the dist/release/grails/core URL.
##########
RELEASE.md:
##########
@@ -433,6 +440,87 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging (experimental)` is `workflow_dispatch` plus the protected `release` environment. It uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging, but that account's promotion permission is unverified. Keep using the Nexus UI or local script. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | Nexus UI or `.github/scripts/releaseJarFiles.sh`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The Infra-issued RSA 4096 key in `KEYS`, `Apache Grails Automated Release Signing <pr...@grails.apache.org>`, fingerprint `08E2 CEC4 7E38 FE41 5F08 0AB6 2ADE CADC 1177 5306`, already satisfies this requirement. The release workflow imports this key from `GRAILS_GPG_KEY` and signs with it using `GPG_KEY_ID`. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
+5. Optional repository variables, after that setup:
+
+ * `ATR_ENABLED=true`
+ * `ATR_PROJECT=grails` (the ATR project slug)
+ * `ATR_HOST=releases.apache.org` (optional; this is the default)
+ * `ATR_SSH_PORT=2222` (optional; this is the default)
+
+Do not enable ATR auto-archive of the prior release. On the ATR path, the release manager still removes the previous `dist/release` folder by hand so other current release lines are preserved.
+
+### Using ATR alongside a Grails release
+
+Keep the current `Release` workflow as the source of signed artifacts. After the `source` job has uploaded the zips to the GitHub Release:
+
+1. **Compose.** Run `Release - ATR Upload (experimental)`, or rely on `atr_upload` when `ATR_ENABLED=true`. This rsyncs `sources/apache-grails-<version>-src.zip` and, under `distribution/`, the binary zip, the wrapper zip, and the documentation zip, each with `.asc` and `.sha512`. The upload declares the release tag commit. ATR then checks that the source zip is a subset of that commit: omitted files are allowed, and files that are not in the git tree are not, except `PKG-INFO` when `pyproject.toml` is present. This zip adds `CHECKSUMS`, `PUBLISHED_ARTIFACTS`, `BUILD_DATE`, and `GIT_TAGS` under `grails/`. That records a concern from `atr.tasks.checks.compare.source_trees`. Starting the vote requires acknowledging that concern. A project ignore can mark the same checker as an exception, but a broad ignore also hides unexpected extra files, so acknowledge the concern until ATR can allow those specific added paths. Do not treat `dist/dev` as the files under vote when ATR is the staging
location. See [Staging and voting](https://releases.apache.org/docs/staging-and-voting).
+2. **Vote.** Start the vote on ATR. There is no Tooling GitHub Action for this. Select automatic publication to the SVN distribution area. The download path comes from the project suffix `core/{{VERSION}}`, which the current `release-on-atr` action does not override. Discard any `dist/dev` `[VOTE]` email if the `upload` job printed one; it skips that email when `ATR_ENABLED=true`. Keep the 72-hour PMC vote. The GitHub `release` environment approval is still the gate for later jobs.
+3. **Resolve.** After the vote passes, run `Release - ATR Resolve Vote (experimental)` with `passed`. That replaces sending the `[RESULT][VOTE]` email by hand. `cancelled` is also a valid resolution.
+4. **Publish.** If automatic publication was selected, ATR has committed the voted artifacts to `dist/release/grails/core/<version>/`. Otherwise press Publish on the finish page. Do not run `releaseDistributions.sh` and do not move `dist/atr`.
+5. **Maven Central.** Use the Nexus UI or `.github/scripts/releaseJarFiles.sh` as your ASF user. The promotion workflow remains experimental until the stage-deployer account's promotion permission is verified. Once Maven Central is live, run `Release - ATR Record Distribution (experimental)` with `platform=MAVEN`, `distribution_owner_namespace=org.apache.grails`, and `distribution_package=grails-bom`. If the project tagging spec names Maven, ATR will not announce until that record exists.
+6. **Public destinations named by the announcement.** Publish the voted documentation zip, release the version to SDKMAN!, and update plus publish the static website so [https://grails.apache.org/download.html](https://grails.apache.org/download.html) lists this version. The generated announcement links to that page. Confirm the page shows the new version before announcing.
+7. **Announce.** Run `Release - ATR Announce (experimental)` once; it always sends to `announce@apache.org`. Leave `announce_body` empty to render `.github/vote_templates/announce.txt` (milestone wording is included only for `M` / `RC` versions). One successful announce must not be repeated for another list. If ATR rejects the call because the artifacts are not on the download mirrors yet, check the ATR finish page and retry that same announce. Do not retry an ambiguous failure. Then send the same body from your `@apache.org` address to `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org`.
+
+To verify an ATR candidate, set `GRAILS_DISTRIBUTION_BASE_URL` when running `verify.sh` or `download-release-artifacts.sh`, or supply `distribution_base_url` to `Release - Verify Troubleshooting`, to the ATR candidate directory for that version containing `sources/` and `distribution/`, not a GitHub release URL. Leave it empty to keep the default `https://dist.apache.org/repos/dist/dev/grails/core/<version>`; GitHub release asset downloads remain unchanged.
Review Comment:
Fixed in af420cf6a5. RELEASE.md says to take the common prefix before sources/ and distribution/ from the candidate file URL list. An empty GRAILS_DISTRIBUTION_BASE_URL still uses dist/dev.
##########
AGENTS.md:
##########
@@ -61,7 +61,7 @@ export GRADLE_OPTS="-Dorg.gradle.jvmargs=-Xmx4G"
12. **Clean violations before commit** - Before every automated commit, run `./gradlew clean aggregateViolations :grails-test-report:check --continue` from the root. The root `clean` runs `cleanViolationReports`, which deletes the analyzer reports and aggregate reports so every module is re-analyzed; without it, analyzers for unchanged modules stay UP-TO-DATE and their previous results are aggregated. Ensure the Checkstyle, CodeNarc, and `REPOSITORY_CONVENTIONS` reports have no issues, and ensure PMD and SpotBugs reports have no issues for their enabled projects. Enable PMD or SpotBugs per project through the `grailsCodeAnalysis` extension in that module's `build.gradle`; the `-Pgrails.code-analysis.enabled.pmd[.projects]` and `-Pgrails.code-analysis.enabled.spotbugs[.projects]` properties are baseline-run overrides. Disabled tools report their disabled status, not a clean result. Also review the test result reports under `grails-test-report/build/reports/tests/` and ensure there ar
e no failures. `--continue` is required: the aggregate Markdown reports are written only by the aggregate lane, so without it a failing analyzer stops the build before the report that explains the failure is produced. Running an analyzer task directly, such as `./gradlew :grails-core:checkstyleMain`, produces only that task's own XML report and deliberately leaves the aggregate Markdown untouched, so a partial run can never overwrite an authoritative full-repository report.
13. **Mandatory test coverage** - Any class touched in a commit MUST be covered with tests that verify all behavior. You must run ALL tests in the affected module(s) and ensure they pass before committing.
14. **The BOM must manage the latest version** - `validateDependencyVersions` enforces that the BOM (`dependencies.gradle`) manages a version `>=` every transitively-resolved version. When it fails, **bump the version in `dependencies.gradle`** so the BOM wins — never silence it with `allowedBomOverrides` or an exclusion unless there is an explicit, documented conflict or an agreed-upon workaround. See [Dependency Management](#dependency-management).
-15. **GitHub Actions must use ASF-approved references** - Every third-party action SHA must appear in the ASF allowlist; `actions/*` use the full tag of their latest release and `apache/*` use version or branch references, never SHAs. See [GitHub Actions](#github-actions).
+15. **GitHub Actions must use ASF-approved references** - Every third-party action SHA must appear in the ASF allowlist; `actions/*` use the full tag of their latest release and `apache/*` use version or branch references, never SHAs, except `apache/tooling-actions/*`: these actions are untagged and ATR Trusted Publishing requires a full commit hash. See [GitHub Actions](#github-actions).
Review Comment:
Fixed in af420cf6a5. violation-fixer SKILL.md now has the same apache/tooling-actions full-commit-hash exception as AGENTS.md. The general apache rule is unchanged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-6500450784
Follow-up af420cf6a5 documents the dist/release svn rm command, how to derive the ATR verification base, and the tooling-actions hash exception in the violation-fixer skill. The earlier path-only replies are restated on those threads.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4326564249
##########
.github/workflows/release-atr-announce.yml:
##########
@@ -0,0 +1,137 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Experimental Apache Trusted Releases (ATR) announce step.
+# Sends ONE announcement through ATR. The first successful announce promotes
+# the candidate from preview to released, so this workflow must not be rerun
+# for additional mailing lists. The recipient is restricted to announce@apache.org.
+# ATR documentation and the official workflow example:
+# https://tooling.apache.org/
+# https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
+# After it succeeds, send the remaining lists by hand from your @apache.org
+# address: dev@grails.apache.org, users@grails.apache.org, and
+# dev@groovy.apache.org.
+#
+# Prerequisites (see RELEASE.md "Experimental: Apache Trusted Releases"):
+# * This workflow listed under the project's ATR finish workflow paths
+# * Vote already resolved as passed on ATR
+name: "Release - ATR Announce (experimental)"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 7.0.0 or 8.0.0-M1)'
+ required: true
+ type: string
+ previous_version:
+ description: 'Previous released version without the v prefix, used in the compare URL'
+ required: true
+ type: string
+ announce_email_to:
+ description: 'Must be announce@apache.org. Do not rerun this workflow for other lists.'
+ required: true
+ type: string
+ default: announce@apache.org
+ announce_body:
Review Comment:
We need to fix the announce template to autofill PREVIOUS_VERSION if we're going to use this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4408368561
##########
.github/workflows/release-promote-jars.yml:
##########
@@ -0,0 +1,83 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Apache Polaris, a TLP, promotes a closed staging repository after its vote:
+# https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml
+# Grails already uses the same NEXUS_STAGE_DEPLOYER_* secrets in
+# release-drop-staging.yml. This workflow never writes dist.apache.org/release:
+# https://infra.apache.org/github-actions-policy.html
+name: "Release - Promote Nexus Staging"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 8.0.0-M1)'
+ required: true
+ type: string
+ staging_description:
+ description: 'Nexus staging repository description (defaults to <repository>:<version>)'
+ required: false
+ type: string
+ default: ''
+ repository:
+ description: 'Repository name used only for the default staging description'
+ required: false
+ type: string
+ default: grails-core
+permissions:
+ contents: read
+jobs:
+ promote:
+ name: "Promote Nexus staging repository"
+ environment: release
+ # Keep the release environment restricted to trusted refs.
+ runs-on: ubuntu-24.04
+ steps:
+ - name: "📥 Checkout the workflow ref"
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+ - name: "📝 Establish staging description"
+ env:
+ VERSION: ${{ inputs.version }}
+ STAGING_DESCRIPTION_INPUT: ${{ inputs.staging_description }}
+ REPOSITORY: ${{ inputs.repository }}
+ run: |
+ set -euo pipefail
+ if [ -z "${VERSION}" ]; then
+ echo "::error::Version must not be empty."
+ exit 1
+ fi
+ if [ -n "${STAGING_DESCRIPTION_INPUT}" ]; then
+ echo "STAGING_DESCRIPTION=${STAGING_DESCRIPTION_INPUT}" >> "$GITHUB_ENV"
+ else
+ echo "STAGING_DESCRIPTION=${REPOSITORY}:${VERSION}" >> "$GITHUB_ENV"
+ fi
+ - name: "🚀 Promote Nexus staging repository"
+ env:
+ NEXUS_USER: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-promote.txt
##########
.github/workflows/release-promote-jars.yml:
##########
@@ -0,0 +1,83 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Apache Polaris, a TLP, promotes a closed staging repository after its vote:
+# https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml
+# Grails already uses the same NEXUS_STAGE_DEPLOYER_* secrets in
+# release-drop-staging.yml. This workflow never writes dist.apache.org/release:
+# https://infra.apache.org/github-actions-policy.html
+name: "Release - Promote Nexus Staging"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 8.0.0-M1)'
+ required: true
+ type: string
+ staging_description:
+ description: 'Nexus staging repository description (defaults to <repository>:<version>)'
+ required: false
+ type: string
+ default: ''
+ repository:
+ description: 'Repository name used only for the default staging description'
+ required: false
+ type: string
+ default: grails-core
+permissions:
+ contents: read
+jobs:
+ promote:
+ name: "Promote Nexus staging repository"
+ environment: release
+ # Keep the release environment restricted to trusted refs.
+ runs-on: ubuntu-24.04
+ steps:
+ - name: "📥 Checkout the workflow ref"
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+ - name: "📝 Establish staging description"
+ env:
+ VERSION: ${{ inputs.version }}
+ STAGING_DESCRIPTION_INPUT: ${{ inputs.staging_description }}
+ REPOSITORY: ${{ inputs.repository }}
+ run: |
+ set -euo pipefail
+ if [ -z "${VERSION}" ]; then
+ echo "::error::Version must not be empty."
+ exit 1
+ fi
+ if [ -n "${STAGING_DESCRIPTION_INPUT}" ]; then
+ echo "STAGING_DESCRIPTION=${STAGING_DESCRIPTION_INPUT}" >> "$GITHUB_ENV"
+ else
+ echo "STAGING_DESCRIPTION=${REPOSITORY}:${VERSION}" >> "$GITHUB_ENV"
+ fi
+ - name: "🚀 Promote Nexus staging repository"
+ env:
+ NEXUS_USER: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-promote.txt
##########
RELEASE.md:
##########
@@ -433,6 +439,83 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging` is `workflow_dispatch` plus the protected `release` environment. It follows the [Apache Polaris TLP promotion workflow](https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml) and uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | `Release - Promote Nexus Staging`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The release workflow imports `GRAILS_GPG_KEY` and signs with `GPG_KEY_ID`. Confirm that selected key matches this UID before the workflows will be accepted. If it does not, ask Infrastructure for a key that does. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-key.txt
##########
RELEASE.md:
##########
@@ -325,29 +326,34 @@ Confirm the Grails PMC votes passed with a +1 from at least 3 PMC members. The `
### Release the Staged Jar files
-The `release` job in the `Release` workflow has a step entitled `🚀 Release JAR files - MANUAL`. You can release the jar
-files by one of 2 ways:
+After the PMC vote has passed and the protected `release` environment is approved, prefer the opt-in
+`Release - Promote Nexus Staging` workflow. Run it from Actions with the version without `v`; leave
+`staging_description` empty to use `grails-core:<version>`. This is manually dispatched after the vote, following the
+[Apache Polaris TLP precedent](https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml).
-1. On https://repository.apache.org/#stagingRepositories, the staged artifacts must be released by opening the `grails-core` staging repository and
- clicking the `Release` button. It took almost 2 hours for the initial ASF release to publish these jars to Maven
- Central.
-2. Alternatively, the `release` job in the `Release` workflow will output an example command line to release the staging
- repository via the scripts checked into grails-core. Execute the script & set the placeholder values to release the
- jar files.
+The following remain fallbacks:
+
+1. On https://repository.apache.org/#stagingRepositories, release the staged artifacts by opening the `grails-core` staging repository and
+ clicking the `Release` button. It took almost 2 hours for the initial ASF release to publish these jars to Maven
+ Central.
+2. Run `.github/scripts/releaseJarFiles.sh grails-core:<version> <ASF_USER>`. The script prompts for a password unless
+ `NEXUS_PASS` is already set, which is how the protected workflow supplies its secret.
### Move the distributions from `dev` to `release`
-On dist.apache.org, the staged source distribution, binary distributions & documentation distribution must be moved from `https://dist.apache.org/repos/dist/dev/grails/` to `https://dist.apache.org/repos/dist/release/grails/`. Per ASF
-infrastructure, this must be performed manually, and we are not allowed to automate it via a gated approval workflow.
-Either move them via your SVN client or use the checked in script to perform these actions as your user.
+If this candidate was staged on ATR, skip this `dist/dev` move. Beta ATR commits the voted artifacts directly to `svn:dist:release` when the release is published. Set the Grails project's download path suffix to `core/{{VERSION}}` so the tree is `dist/release/grails/core/<version>/`, which is where the source, binary, wrapper, and documentation distributions belong. Do not run `releaseDistributions.sh` for an ATR candidate, and do not move anything out of `dist/atr`. See [Apache Trusted Releases (ATR)](#apache-trusted-releases-atr).
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-svn.txt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4408371894
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/RepositoryConventionsTask.groovy:
##########
@@ -51,8 +51,10 @@ abstract class RepositoryConventionsTask extends DefaultTask {
private static final Pattern DOCKER_IMAGE_DIGEST = Pattern.compile(/^docker:\/\/[^@\s]+@sha256:[0-9a-f]{64}$/)
private static final Pattern CONTAINER_IMAGE_DIGEST = Pattern.compile(/^[^@\s]+@sha256:[0-9a-f]{64}$/)
// GitHub-official and first-party ASF actions track upstream ASF approvals, so they use version or
- // branch references and are never pinned to a commit SHA.
+ // branch references and are never pinned to a commit SHA. apache/tooling-actions is the exception:
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-agents.txt
##########
.github/workflows/release-atr-announce.yml:
##########
@@ -0,0 +1,137 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Experimental Apache Trusted Releases (ATR) announce step.
+# Sends ONE announcement through ATR. The first successful announce promotes
+# the candidate from preview to released, so this workflow must not be rerun
+# for additional mailing lists. The recipient is restricted to announce@apache.org.
+# ATR documentation and the official workflow example:
+# https://tooling.apache.org/
+# https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
+# After it succeeds, send the remaining lists by hand from your @apache.org
+# address: dev@grails.apache.org, users@grails.apache.org, and
+# dev@groovy.apache.org.
+#
+# Prerequisites (see RELEASE.md "Experimental: Apache Trusted Releases"):
+# * This workflow listed under the project's ATR finish workflow paths
+# * Vote already resolved as passed on ATR
+name: "Release - ATR Announce (experimental)"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 7.0.0 or 8.0.0-M1)'
+ required: true
+ type: string
+ previous_version:
+ description: 'Previous released version without the v prefix, used in the compare URL'
+ required: true
+ type: string
+ announce_email_to:
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-mail.txt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-6488058738
## ✅ All tests passed ✅
🏷️ Commit: 4d3cf237b7e1ce47cd02806c563ef9098b84a5b1
▶️ Tests: 101995 executed
⚪️ Checks: 97/97 completed
---
_Learn more about TestLens at [testlens.app/docs](https://testlens.app/docs/features/pr-comment/)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4414095446
##########
.github/scripts/releaseJarFiles.sh:
##########
@@ -30,8 +30,10 @@ fi
STAGING_DESCRIPTION="$1"
NEXUS_USER="$2"
-read -r -s -p "Password: " NEXUS_PASS
-echo
+if [[ -z "${NEXUS_PASS:-}" ]]; then
Review Comment:
Posted again because the earlier reply was only a local path. In 4d3cf237b7 the script reads GRAILS_NEXUS_PASSWORD. The promotion workflow maps the existing NEXUS_STAGE_DEPLOYER_PW secret to it. Posted again because the earlier reply was only a local path. previous_version is optional. The workflow finds the nearest prior release tag and strips the leading v. An explicit override still works. Posted again because the earlier reply was only a local path. Automated promotion is not preferred. Stage-deployer promotion permission is still unverified, and no Infra approval is claimed. Posted again because the earlier reply was only a local path. The Infra-issued RSA 4096 key already in KEYS is the signing key. The instruction to seek another key is gone. Posted again because the earlier reply was only a local path. When ATR_ENABLED is true, the dist/dev SVN staging steps are skipped. Previous-release cleanup stays manual. Posted again because the earlier reply was only a local path. AG
ENTS.md allows a full commit hash only for apache/tooling-actions, because those actions are untagged and ATR Trusted Publishing requires it. Posted again because the earlier reply was only a local path. The announce workflow always sends to announce@apache.org. It must not be rerun to reach another list.[0]
##########
.github/workflows/release-atr-announce.yml:
##########
@@ -0,0 +1,137 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Experimental Apache Trusted Releases (ATR) announce step.
+# Sends ONE announcement through ATR. The first successful announce promotes
+# the candidate from preview to released, so this workflow must not be rerun
+# for additional mailing lists. The recipient is restricted to announce@apache.org.
+# ATR documentation and the official workflow example:
+# https://tooling.apache.org/
+# https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
+# After it succeeds, send the remaining lists by hand from your @apache.org
+# address: dev@grails.apache.org, users@grails.apache.org, and
+# dev@groovy.apache.org.
+#
+# Prerequisites (see RELEASE.md "Experimental: Apache Trusted Releases"):
+# * This workflow listed under the project's ATR finish workflow paths
+# * Vote already resolved as passed on ATR
+name: "Release - ATR Announce (experimental)"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 7.0.0 or 8.0.0-M1)'
+ required: true
+ type: string
+ previous_version:
+ description: 'Previous released version without the v prefix, used in the compare URL'
+ required: true
+ type: string
+ announce_email_to:
+ description: 'Must be announce@apache.org. Do not rerun this workflow for other lists.'
+ required: true
+ type: string
+ default: announce@apache.org
+ announce_body:
Review Comment:
Posted again because the earlier reply was only a local path. In 4d3cf237b7 the script reads GRAILS_NEXUS_PASSWORD. The promotion workflow maps the existing NEXUS_STAGE_DEPLOYER_PW secret to it. Posted again because the earlier reply was only a local path. previous_version is optional. The workflow finds the nearest prior release tag and strips the leading v. An explicit override still works. Posted again because the earlier reply was only a local path. Automated promotion is not preferred. Stage-deployer promotion permission is still unverified, and no Infra approval is claimed. Posted again because the earlier reply was only a local path. The Infra-issued RSA 4096 key already in KEYS is the signing key. The instruction to seek another key is gone. Posted again because the earlier reply was only a local path. When ATR_ENABLED is true, the dist/dev SVN staging steps are skipped. Previous-release cleanup stays manual. Posted again because the earlier reply was only a local path. AG
ENTS.md allows a full commit hash only for apache/tooling-actions, because those actions are untagged and ATR Trusted Publishing requires it. Posted again because the earlier reply was only a local path. The announce workflow always sends to announce@apache.org. It must not be rerun to reach another list.[1]
##########
.github/workflows/release-promote-jars.yml:
##########
@@ -0,0 +1,83 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Apache Polaris, a TLP, promotes a closed staging repository after its vote:
+# https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml
+# Grails already uses the same NEXUS_STAGE_DEPLOYER_* secrets in
+# release-drop-staging.yml. This workflow never writes dist.apache.org/release:
+# https://infra.apache.org/github-actions-policy.html
+name: "Release - Promote Nexus Staging"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 8.0.0-M1)'
+ required: true
+ type: string
+ staging_description:
+ description: 'Nexus staging repository description (defaults to <repository>:<version>)'
+ required: false
+ type: string
+ default: ''
+ repository:
+ description: 'Repository name used only for the default staging description'
+ required: false
+ type: string
+ default: grails-core
+permissions:
+ contents: read
+jobs:
+ promote:
+ name: "Promote Nexus staging repository"
+ environment: release
+ # Keep the release environment restricted to trusted refs.
+ runs-on: ubuntu-24.04
+ steps:
+ - name: "📥 Checkout the workflow ref"
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+ - name: "📝 Establish staging description"
+ env:
+ VERSION: ${{ inputs.version }}
+ STAGING_DESCRIPTION_INPUT: ${{ inputs.staging_description }}
+ REPOSITORY: ${{ inputs.repository }}
+ run: |
+ set -euo pipefail
+ if [ -z "${VERSION}" ]; then
+ echo "::error::Version must not be empty."
+ exit 1
+ fi
+ if [ -n "${STAGING_DESCRIPTION_INPUT}" ]; then
+ echo "STAGING_DESCRIPTION=${STAGING_DESCRIPTION_INPUT}" >> "$GITHUB_ENV"
+ else
+ echo "STAGING_DESCRIPTION=${REPOSITORY}:${VERSION}" >> "$GITHUB_ENV"
+ fi
+ - name: "🚀 Promote Nexus staging repository"
+ env:
+ NEXUS_USER: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
Review Comment:
Posted again because the earlier reply was only a local path. In 4d3cf237b7 the script reads GRAILS_NEXUS_PASSWORD. The promotion workflow maps the existing NEXUS_STAGE_DEPLOYER_PW secret to it. Posted again because the earlier reply was only a local path. previous_version is optional. The workflow finds the nearest prior release tag and strips the leading v. An explicit override still works. Posted again because the earlier reply was only a local path. Automated promotion is not preferred. Stage-deployer promotion permission is still unverified, and no Infra approval is claimed. Posted again because the earlier reply was only a local path. The Infra-issued RSA 4096 key already in KEYS is the signing key. The instruction to seek another key is gone. Posted again because the earlier reply was only a local path. When ATR_ENABLED is true, the dist/dev SVN staging steps are skipped. Previous-release cleanup stays manual. Posted again because the earlier reply was only a local path. AG
ENTS.md allows a full commit hash only for apache/tooling-actions, because those actions are untagged and ATR Trusted Publishing requires it. Posted again because the earlier reply was only a local path. The announce workflow always sends to announce@apache.org. It must not be rerun to reach another list.[2]
##########
RELEASE.md:
##########
@@ -433,6 +439,83 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging` is `workflow_dispatch` plus the protected `release` environment. It follows the [Apache Polaris TLP promotion workflow](https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml) and uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | `Release - Promote Nexus Staging`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The release workflow imports `GRAILS_GPG_KEY` and signs with `GPG_KEY_ID`. Confirm that selected key matches this UID before the workflows will be accepted. If it does not, ask Infrastructure for a key that does. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
Review Comment:
Posted again because the earlier reply was only a local path. In 4d3cf237b7 the script reads GRAILS_NEXUS_PASSWORD. The promotion workflow maps the existing NEXUS_STAGE_DEPLOYER_PW secret to it. Posted again because the earlier reply was only a local path. previous_version is optional. The workflow finds the nearest prior release tag and strips the leading v. An explicit override still works. Posted again because the earlier reply was only a local path. Automated promotion is not preferred. Stage-deployer promotion permission is still unverified, and no Infra approval is claimed. Posted again because the earlier reply was only a local path. The Infra-issued RSA 4096 key already in KEYS is the signing key. The instruction to seek another key is gone. Posted again because the earlier reply was only a local path. When ATR_ENABLED is true, the dist/dev SVN staging steps are skipped. Previous-release cleanup stays manual. Posted again because the earlier reply was only a local path. AG
ENTS.md allows a full commit hash only for apache/tooling-actions, because those actions are untagged and ATR Trusted Publishing requires it. Posted again because the earlier reply was only a local path. The announce workflow always sends to announce@apache.org. It must not be rerun to reach another list.[3]
##########
RELEASE.md:
##########
@@ -325,29 +326,34 @@ Confirm the Grails PMC votes passed with a +1 from at least 3 PMC members. The `
### Release the Staged Jar files
-The `release` job in the `Release` workflow has a step entitled `🚀 Release JAR files - MANUAL`. You can release the jar
-files by one of 2 ways:
+After the PMC vote has passed and the protected `release` environment is approved, prefer the opt-in
+`Release - Promote Nexus Staging` workflow. Run it from Actions with the version without `v`; leave
+`staging_description` empty to use `grails-core:<version>`. This is manually dispatched after the vote, following the
+[Apache Polaris TLP precedent](https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml).
-1. On https://repository.apache.org/#stagingRepositories, the staged artifacts must be released by opening the `grails-core` staging repository and
- clicking the `Release` button. It took almost 2 hours for the initial ASF release to publish these jars to Maven
- Central.
-2. Alternatively, the `release` job in the `Release` workflow will output an example command line to release the staging
- repository via the scripts checked into grails-core. Execute the script & set the placeholder values to release the
- jar files.
+The following remain fallbacks:
+
+1. On https://repository.apache.org/#stagingRepositories, release the staged artifacts by opening the `grails-core` staging repository and
+ clicking the `Release` button. It took almost 2 hours for the initial ASF release to publish these jars to Maven
+ Central.
+2. Run `.github/scripts/releaseJarFiles.sh grails-core:<version> <ASF_USER>`. The script prompts for a password unless
+ `NEXUS_PASS` is already set, which is how the protected workflow supplies its secret.
### Move the distributions from `dev` to `release`
-On dist.apache.org, the staged source distribution, binary distributions & documentation distribution must be moved from `https://dist.apache.org/repos/dist/dev/grails/` to `https://dist.apache.org/repos/dist/release/grails/`. Per ASF
-infrastructure, this must be performed manually, and we are not allowed to automate it via a gated approval workflow.
-Either move them via your SVN client or use the checked in script to perform these actions as your user.
+If this candidate was staged on ATR, skip this `dist/dev` move. Beta ATR commits the voted artifacts directly to `svn:dist:release` when the release is published. Set the Grails project's download path suffix to `core/{{VERSION}}` so the tree is `dist/release/grails/core/<version>/`, which is where the source, binary, wrapper, and documentation distributions belong. Do not run `releaseDistributions.sh` for an ATR candidate, and do not move anything out of `dist/atr`. See [Apache Trusted Releases (ATR)](#apache-trusted-releases-atr).
Review Comment:
Posted again because the earlier reply was only a local path. In 4d3cf237b7 the script reads GRAILS_NEXUS_PASSWORD. The promotion workflow maps the existing NEXUS_STAGE_DEPLOYER_PW secret to it. Posted again because the earlier reply was only a local path. previous_version is optional. The workflow finds the nearest prior release tag and strips the leading v. An explicit override still works. Posted again because the earlier reply was only a local path. Automated promotion is not preferred. Stage-deployer promotion permission is still unverified, and no Infra approval is claimed. Posted again because the earlier reply was only a local path. The Infra-issued RSA 4096 key already in KEYS is the signing key. The instruction to seek another key is gone. Posted again because the earlier reply was only a local path. When ATR_ENABLED is true, the dist/dev SVN staging steps are skipped. Previous-release cleanup stays manual. Posted again because the earlier reply was only a local path. AG
ENTS.md allows a full commit hash only for apache/tooling-actions, because those actions are untagged and ATR Trusted Publishing requires it. Posted again because the earlier reply was only a local path. The announce workflow always sends to announce@apache.org. It must not be rerun to reach another list.[4]
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/RepositoryConventionsTask.groovy:
##########
@@ -51,8 +51,10 @@ abstract class RepositoryConventionsTask extends DefaultTask {
private static final Pattern DOCKER_IMAGE_DIGEST = Pattern.compile(/^docker:\/\/[^@\s]+@sha256:[0-9a-f]{64}$/)
private static final Pattern CONTAINER_IMAGE_DIGEST = Pattern.compile(/^[^@\s]+@sha256:[0-9a-f]{64}$/)
// GitHub-official and first-party ASF actions track upstream ASF approvals, so they use version or
- // branch references and are never pinned to a commit SHA.
+ // branch references and are never pinned to a commit SHA. apache/tooling-actions is the exception:
Review Comment:
Posted again because the earlier reply was only a local path. In 4d3cf237b7 the script reads GRAILS_NEXUS_PASSWORD. The promotion workflow maps the existing NEXUS_STAGE_DEPLOYER_PW secret to it. Posted again because the earlier reply was only a local path. previous_version is optional. The workflow finds the nearest prior release tag and strips the leading v. An explicit override still works. Posted again because the earlier reply was only a local path. Automated promotion is not preferred. Stage-deployer promotion permission is still unverified, and no Infra approval is claimed. Posted again because the earlier reply was only a local path. The Infra-issued RSA 4096 key already in KEYS is the signing key. The instruction to seek another key is gone. Posted again because the earlier reply was only a local path. When ATR_ENABLED is true, the dist/dev SVN staging steps are skipped. Previous-release cleanup stays manual. Posted again because the earlier reply was only a local path. AG
ENTS.md allows a full commit hash only for apache/tooling-actions, because those actions are untagged and ATR Trusted Publishing requires it. Posted again because the earlier reply was only a local path. The announce workflow always sends to announce@apache.org. It must not be rerun to reach another list.[5]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Alpha 3 automation [grails-core]
Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-5429260363
## 🚨 TestLens detected 1 failed test 🚨
Here is what you can do:
1) Inspect the test failures carefully.
2) If you are convinced that some of the tests are flaky, you can mute them below.
3) Finally, trigger a rerun by checking the rerun checkbox.
### Test Summary
#### [CI / Functional Tests \(Java 21, indy\=false\)](https://github.com/apache/grails-core/actions/runs/32993182481/job/98255600753?pr=16229) > :grails-test-examples-scaffolding:integrationTest
| Test | Runs | Flakiness |
|---|---|--:|
| UserControllerSpec > User list | ❌ | [2% 🟡](https://github.com/apache/grails-core/issues/16030) |
🏷️ Commit: ae4f3c4697259142dc1d0d77b4a4f17270dc35d9
▶️ Tests: 58883 executed
🟡 Checks: 63/79 completed
### Test Failures
<details>
<summary><strong>UserControllerSpec > User list</strong> (:grails-test-examples-scaffolding:integrationTest in <a href="https://github.com/apache/grails-core/actions/runs/32993182481/job/98255600753?pr=16229">CI / Functional Tests (Java 21, indy=false)</a>)</summary>
```
geb.waiting.WaitTimeoutException: condition did not pass in 30 seconds (failed with exception)
at geb.waiting.Wait.waitFor(Wait.groovy:128)
at geb.waiting.DefaultWaitingSupport.doWaitFor(DefaultWaitingSupport.groovy:55)
at geb.waiting.DefaultWaitingSupport.waitFor(DefaultWaitingSupport.groovy:41)
at geb.Page.waitFor(Page.groovy:120)
at com.example.pages.LoginPage.login(LoginPage.groovy:39)
at com.example.UserControllerSpec.User list(UserControllerSpec.groovy:48)
Caused by: Assertion failed:
title != pageTitle && $('input', name: 'username').empty
| | | |
| | | false
| | 'Please sign in'
| false
'Please sign in'
at com.example.pages.LoginPage.login_closure1(LoginPage.groovy:39)
at com.example.pages.LoginPage.login_closure1(LoginPage.groovy)
at geb.waiting.Wait.waitFor(Wait.groovy:117)
... 5 more
```
</details>
### Rerun Controls
> [!NOTE]
> Checks are currently running using the configuration below.
Select tests to mute in this pull request:
🔲 UserControllerSpec > User list <!-- uniqueId=[engine:spock]/[spec:com.example.UserControllerSpec]/[feature:$spock_feature_1_0] -->
Reuse successful test results:
🔲 ♻️ Only rerun the tests that failed or were muted before
Click the checkbox to trigger a rerun:
🔲 **Rerun jobs**
---
_Learn more about TestLens at [testlens.app/docs](https://testlens.app/docs/features/pr-comment/)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4326549436
##########
.github/scripts/releaseJarFiles.sh:
##########
@@ -30,8 +30,10 @@ fi
STAGING_DESCRIPTION="$1"
NEXUS_USER="$2"
-read -r -s -p "Password: " NEXUS_PASS
-echo
+if [[ -z "${NEXUS_PASS:-}" ]]; then
Review Comment:
If we're going to expose environment variables external to this script, they should not be generically named. Please name this to reflect it's for Grails or the ASF
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Alpha 3 automation [grails-core]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-5429246828
## [Codecov](https://app.codecov.io/gh/apache/grails-core/pull/16229?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 54.1488%. Comparing base ([`351652b`](https://app.codecov.io/gh/apache/grails-core/commit/351652b1b05db4862357f1d1e8daafd4d20834b3?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`ae4f3c4`](https://app.codecov.io/gh/apache/grails-core/commit/ae4f3c4697259142dc1d0d77b4a4f17270dc35d9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/grails-core/pull/16229?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## 8.0.x #16229 +/- ##
=============================================
Coverage 54.1488% 54.1488%
+ Complexity 20258 20257 -1
=============================================
Files 2098 2098
Lines 100920 100920
Branches 17898 17898
=============================================
Hits 54647 54647
Misses 38484 38484
Partials 7789 7789
```
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4326573716
##########
.github/workflows/release-promote-jars.yml:
##########
@@ -0,0 +1,83 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Apache Polaris, a TLP, promotes a closed staging repository after its vote:
+# https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml
+# Grails already uses the same NEXUS_STAGE_DEPLOYER_* secrets in
+# release-drop-staging.yml. This workflow never writes dist.apache.org/release:
+# https://infra.apache.org/github-actions-policy.html
+name: "Release - Promote Nexus Staging"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 8.0.0-M1)'
+ required: true
+ type: string
+ staging_description:
+ description: 'Nexus staging repository description (defaults to <repository>:<version>)'
+ required: false
+ type: string
+ default: ''
+ repository:
+ description: 'Repository name used only for the default staging description'
+ required: false
+ type: string
+ default: grails-core
+permissions:
+ contents: read
+jobs:
+ promote:
+ name: "Promote Nexus staging repository"
+ environment: release
+ # Keep the release environment restricted to trusted refs.
+ runs-on: ubuntu-24.04
+ steps:
+ - name: "📥 Checkout the workflow ref"
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+ - name: "📝 Establish staging description"
+ env:
+ VERSION: ${{ inputs.version }}
+ STAGING_DESCRIPTION_INPUT: ${{ inputs.staging_description }}
+ REPOSITORY: ${{ inputs.repository }}
+ run: |
+ set -euo pipefail
+ if [ -z "${VERSION}" ]; then
+ echo "::error::Version must not be empty."
+ exit 1
+ fi
+ if [ -n "${STAGING_DESCRIPTION_INPUT}" ]; then
+ echo "STAGING_DESCRIPTION=${STAGING_DESCRIPTION_INPUT}" >> "$GITHUB_ENV"
+ else
+ echo "STAGING_DESCRIPTION=${REPOSITORY}:${VERSION}" >> "$GITHUB_ENV"
+ fi
+ - name: "🚀 Promote Nexus staging repository"
+ env:
+ NEXUS_USER: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
Review Comment:
The user we use to stage can't promote the jars, has infra changed their opinion on this? Otherwise this will fail.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4412978981
##########
RELEASE.md:
##########
@@ -433,6 +440,87 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging (experimental)` is `workflow_dispatch` plus the protected `release` environment. It uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging, but that account's promotion permission is unverified. Keep using the Nexus UI or local script. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | Nexus UI or `.github/scripts/releaseJarFiles.sh`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The Infra-issued RSA 4096 key in `KEYS`, `Apache Grails Automated Release Signing <pr...@grails.apache.org>`, fingerprint `08E2 CEC4 7E38 FE41 5F08 0AB6 2ADE CADC 1177 5306`, already satisfies this requirement. The release workflow imports this key from `GRAILS_GPG_KEY` and signs with it using `GPG_KEY_ID`. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
+5. Optional repository variables, after that setup:
+
+ * `ATR_ENABLED=true`
+ * `ATR_PROJECT=grails` (the ATR project slug)
+ * `ATR_HOST=releases.apache.org` (optional; this is the default)
+ * `ATR_SSH_PORT=2222` (optional; this is the default)
+
+Do not enable ATR auto-archive of the prior release. On the ATR path, the release manager still removes the previous `dist/release` folder by hand so other current release lines are preserved.
+
+### Using ATR alongside a Grails release
+
+Keep the current `Release` workflow as the source of signed artifacts. After the `source` job has uploaded the zips to the GitHub Release:
+
+1. **Compose.** Run `Release - ATR Upload (experimental)`, or rely on `atr_upload` when `ATR_ENABLED=true`. This rsyncs `sources/apache-grails-<version>-src.zip` and, under `distribution/`, the binary zip, the wrapper zip, and the documentation zip, each with `.asc` and `.sha512`. The upload declares the release tag commit. ATR then checks that the source zip is a subset of that commit: omitted files are allowed, and files that are not in the git tree are not, except `PKG-INFO` when `pyproject.toml` is present. This zip adds `CHECKSUMS`, `PUBLISHED_ARTIFACTS`, `BUILD_DATE`, and `GIT_TAGS` under `grails/`. That records a concern from `atr.tasks.checks.compare.source_trees`. Starting the vote requires acknowledging that concern. A project ignore can mark the same checker as an exception, but a broad ignore also hides unexpected extra files, so acknowledge the concern until ATR can allow those specific added paths. Do not treat `dist/dev` as the files under vote when ATR is the staging
location. See [Staging and voting](https://releases.apache.org/docs/staging-and-voting).
+2. **Vote.** Start the vote on ATR. There is no Tooling GitHub Action for this. Select automatic publication to the SVN distribution area. The download path comes from the project suffix `core/{{VERSION}}`, which the current `release-on-atr` action does not override. Discard any `dist/dev` `[VOTE]` email if the `upload` job printed one; it skips that email when `ATR_ENABLED=true`. Keep the 72-hour PMC vote. The GitHub `release` environment approval is still the gate for later jobs.
+3. **Resolve.** After the vote passes, run `Release - ATR Resolve Vote (experimental)` with `passed`. That replaces sending the `[RESULT][VOTE]` email by hand. `cancelled` is also a valid resolution.
+4. **Publish.** If automatic publication was selected, ATR has committed the voted artifacts to `dist/release/grails/core/<version>/`. Otherwise press Publish on the finish page. Do not run `releaseDistributions.sh` and do not move `dist/atr`.
+5. **Maven Central.** Use the Nexus UI or `.github/scripts/releaseJarFiles.sh` as your ASF user. The promotion workflow remains experimental until the stage-deployer account's promotion permission is verified. Once Maven Central is live, run `Release - ATR Record Distribution (experimental)` with `platform=MAVEN`, `distribution_owner_namespace=org.apache.grails`, and `distribution_package=grails-bom`. If the project tagging spec names Maven, ATR will not announce until that record exists.
+6. **Public destinations named by the announcement.** Publish the voted documentation zip, release the version to SDKMAN!, and update plus publish the static website so [https://grails.apache.org/download.html](https://grails.apache.org/download.html) lists this version. The generated announcement links to that page. Confirm the page shows the new version before announcing.
+7. **Announce.** Run `Release - ATR Announce (experimental)` once; it always sends to `announce@apache.org`. Leave `announce_body` empty to render `.github/vote_templates/announce.txt` (milestone wording is included only for `M` / `RC` versions). One successful announce must not be repeated for another list. If ATR rejects the call because the artifacts are not on the download mirrors yet, check the ATR finish page and retry that same announce. Do not retry an ambiguous failure. Then send the same body from your `@apache.org` address to `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org`.
+
+To verify an ATR candidate, set `GRAILS_DISTRIBUTION_BASE_URL` when running `verify.sh` or `download-release-artifacts.sh`, or supply `distribution_base_url` to `Release - Verify Troubleshooting`, to the ATR candidate directory for that version containing `sources/` and `distribution/`, not a GitHub release URL. Leave it empty to keep the default `https://dist.apache.org/repos/dist/dev/grails/core/<version>`; GitHub release asset downloads remain unchanged.
Review Comment:
Where does the release manager get this URL? The ATR docs (staging-and-voting, uploading-files) give no per-file download pattern; the candidate page offers a `curl` one-liner and a list of file URLs at `/download/urls/<project>/<version>`, and nothing says whether the `sources/` and `distribution/` subfolders that `atr_upload` rsyncs survive in those URLs. Please say here where to read the directory from, and note that `download-release-artifacts.sh` needs those two subfolders exactly as the upload job lays them out, since that is the layout the script appends to this URL.
##########
RELEASE.md:
##########
@@ -433,6 +440,87 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging (experimental)` is `workflow_dispatch` plus the protected `release` environment. It uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging, but that account's promotion permission is unverified. Keep using the Nexus UI or local script. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | Nexus UI or `.github/scripts/releaseJarFiles.sh`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The Infra-issued RSA 4096 key in `KEYS`, `Apache Grails Automated Release Signing <pr...@grails.apache.org>`, fingerprint `08E2 CEC4 7E38 FE41 5F08 0AB6 2ADE CADC 1177 5306`, already satisfies this requirement. The release workflow imports this key from `GRAILS_GPG_KEY` and signs with it using `GPG_KEY_ID`. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
+5. Optional repository variables, after that setup:
+
+ * `ATR_ENABLED=true`
+ * `ATR_PROJECT=grails` (the ATR project slug)
+ * `ATR_HOST=releases.apache.org` (optional; this is the default)
+ * `ATR_SSH_PORT=2222` (optional; this is the default)
+
+Do not enable ATR auto-archive of the prior release. On the ATR path, the release manager still removes the previous `dist/release` folder by hand so other current release lines are preserved.
Review Comment:
This says the removal is done by hand but not how, and the ATR path has no script for it. On the dist/dev path `releaseDistributions.sh` lists `dist/release/grails/core`, offers each folder other than the new version, and runs `svn rm -m "Remove previous release <folder>" https://dist.apache.org/repos/dist/release/grails/core/<folder>`. Please put that command here, or split the prune loop out of the script so the ATR path can run the same step, so the release manager is not left to reconstruct it from the script.
##########
AGENTS.md:
##########
@@ -61,7 +61,7 @@ export GRADLE_OPTS="-Dorg.gradle.jvmargs=-Xmx4G"
12. **Clean violations before commit** - Before every automated commit, run `./gradlew clean aggregateViolations :grails-test-report:check --continue` from the root. The root `clean` runs `cleanViolationReports`, which deletes the analyzer reports and aggregate reports so every module is re-analyzed; without it, analyzers for unchanged modules stay UP-TO-DATE and their previous results are aggregated. Ensure the Checkstyle, CodeNarc, and `REPOSITORY_CONVENTIONS` reports have no issues, and ensure PMD and SpotBugs reports have no issues for their enabled projects. Enable PMD or SpotBugs per project through the `grailsCodeAnalysis` extension in that module's `build.gradle`; the `-Pgrails.code-analysis.enabled.pmd[.projects]` and `-Pgrails.code-analysis.enabled.spotbugs[.projects]` properties are baseline-run overrides. Disabled tools report their disabled status, not a clean result. Also review the test result reports under `grails-test-report/build/reports/tests/` and ensure there ar
e no failures. `--continue` is required: the aggregate Markdown reports are written only by the aggregate lane, so without it a failing analyzer stops the build before the report that explains the failure is produced. Running an analyzer task directly, such as `./gradlew :grails-core:checkstyleMain`, produces only that task's own XML report and deliberately leaves the aggregate Markdown untouched, so a partial run can never overwrite an authoritative full-repository report.
13. **Mandatory test coverage** - Any class touched in a commit MUST be covered with tests that verify all behavior. You must run ALL tests in the affected module(s) and ensure they pass before committing.
14. **The BOM must manage the latest version** - `validateDependencyVersions` enforces that the BOM (`dependencies.gradle`) manages a version `>=` every transitively-resolved version. When it fails, **bump the version in `dependencies.gradle`** so the BOM wins — never silence it with `allowedBomOverrides` or an exclusion unless there is an explicit, documented conflict or an agreed-upon workaround. See [Dependency Management](#dependency-management).
-15. **GitHub Actions must use ASF-approved references** - Every third-party action SHA must appear in the ASF allowlist; `actions/*` use the full tag of their latest release and `apache/*` use version or branch references, never SHAs. See [GitHub Actions](#github-actions).
+15. **GitHub Actions must use ASF-approved references** - Every third-party action SHA must appear in the ASF allowlist; `actions/*` use the full tag of their latest release and `apache/*` use version or branch references, never SHAs, except `apache/tooling-actions/*`: these actions are untagged and ATR Trusted Publishing requires a full commit hash. See [GitHub Actions](#github-actions).
Review Comment:
One more copy of the rule this relaxes (commenting here because the file is not in the diff): `.agents/skills/violation-fixer/SKILL.md` line 119 still says `apache/*` must use "a version or branch reference, never a 40-hex SHA". That table is what an agent follows when it fixes a `REPOSITORY_CONVENTIONS` finding, so as written it would replace the hash the gate now requires with `@main`. Please add the `apache/tooling-actions/*` exception there too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Alpha 3 automation [grails-core]
Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-5545274865
## ✅ All tests passed ✅
🏷️ Commit: a0f3e500f954bbe506f5fcbc42816494bd708301
▶️ Tests: 66044 executed
⚪️ Checks: 90/90 completed
---
_Learn more about TestLens at [testlens.app/docs](https://testlens.app/docs/features/pr-comment/)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4326746255
##########
.github/workflows/release-atr-announce.yml:
##########
@@ -0,0 +1,137 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Experimental Apache Trusted Releases (ATR) announce step.
+# Sends ONE announcement through ATR. The first successful announce promotes
+# the candidate from preview to released, so this workflow must not be rerun
+# for additional mailing lists. The recipient is restricted to announce@apache.org.
+# ATR documentation and the official workflow example:
+# https://tooling.apache.org/
+# https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
+# After it succeeds, send the remaining lists by hand from your @apache.org
+# address: dev@grails.apache.org, users@grails.apache.org, and
+# dev@groovy.apache.org.
+#
+# Prerequisites (see RELEASE.md "Experimental: Apache Trusted Releases"):
+# * This workflow listed under the project's ATR finish workflow paths
+# * Vote already resolved as passed on ATR
+name: "Release - ATR Announce (experimental)"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 7.0.0 or 8.0.0-M1)'
+ required: true
+ type: string
+ previous_version:
+ description: 'Previous released version without the v prefix, used in the compare URL'
+ required: true
+ type: string
+ announce_email_to:
Review Comment:
This input can only ever hold `announce@apache.org`; any other value fails the first step. Drop the input and hardcode the recipient in the step. An input that exists only to be rejected invites someone to try the project lists through it.
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/RepositoryConventionsTask.groovy:
##########
@@ -51,8 +51,10 @@ abstract class RepositoryConventionsTask extends DefaultTask {
private static final Pattern DOCKER_IMAGE_DIGEST = Pattern.compile(/^docker:\/\/[^@\s]+@sha256:[0-9a-f]{64}$/)
private static final Pattern CONTAINER_IMAGE_DIGEST = Pattern.compile(/^[^@\s]+@sha256:[0-9a-f]{64}$/)
// GitHub-official and first-party ASF actions track upstream ASF approvals, so they use version or
- // branch references and are never pinned to a commit SHA.
+ // branch references and are never pinned to a commit SHA. apache/tooling-actions is the exception:
Review Comment:
AGENTS.md (CLAUDE.md links to it) still states the rule this relaxes: critical rule 12 says `apache/*` use "version or branch references, never SHAs", and the GitHub Actions section says "Never pin either by SHA". Please add the `apache/tooling-actions` exception there too, with the reason (untagged, full hash required by ATR Trusted Publishing), so the guide and the gate agree.
##########
RELEASE.md:
##########
@@ -433,6 +439,83 @@ Announcements should come from your apache email address (see https://infra.apac
expected format. The announcement should be sent to `dev@grails.apache.org`, `dev@groovy.apache.org`, `users@grails.apache.org`, &
`announce@apache.org`. See the `close` job for a generated email.
+### What GitHub Actions may automate
+
+The following boundaries preserve PMC authority and use only opt-in, protected workflows. Apache's release policy permits
+automated release infrastructure to sign artifacts, while the vote remains a community email process.
+
+| Activity | GitHub Actions boundary and evidence |
+| --- | --- |
+| ATR compose, resolve, one announce, and distribution record | Opt-in workflows call [ASF Tooling actions](https://github.com/apache/tooling-actions) against [ATR Beta](https://releases.apache.org/docs/). Official examples: [compose](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml), [resolve](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml), [announce](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml), and [record](https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml). |
+| Signing in GitHub Actions | [Apache release policy](https://www.apache.org/legal/release-policy.html) requires release artifacts to be signed by the Release Manager or automated release infrastructure. ATR [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) accepts those signatures when the committee is eligible for CI builds. |
+| Publish the voted distributions to `dist/release` | Beta ATR commits the approved artifacts to `svn:dist:release` itself. The workflow calls ATR. It does not write SVN. See [Promoting to release](https://releases.apache.org/docs/promoting-to-release). |
+| Documentation and website content | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) permits work on website content and other non-released data. Grails already deploys documentation from GitHub Actions. |
+| Promote closed Nexus staging after a passed vote | `Release - Promote Nexus Staging` is `workflow_dispatch` plus the protected `release` environment. It follows the [Apache Polaris TLP promotion workflow](https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml) and uses the existing `NEXUS_STAGE_DEPLOYER_USER` / `NEXUS_STAGE_DEPLOYER_PW` secrets used to drop staging. |
+| Skip `dist/dev` only when using ATR | ATR candidates may skip the traditional staging location as described in [Staging and voting](https://releases.apache.org/docs/staging-and-voting). The `dist/dev` plus Nexus path remains Grails' official default until the PMC opts in to ATR. |
+
+The following must remain manual:
+
+| Activity | Why it remains manual |
+| --- | --- |
+| Start the binding PMC vote and hold it for at least 72 hours | [Apache release policy](https://www.apache.org/legal/release-policy.html) says release votes SHOULD remain open for at least 72 hours. ATR can send and tally the vote email, but `apache/tooling-actions` has no action that starts a vote. |
+| Move `dist/dev` distributions when ATR is not used | [GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) prohibits automated services from pushing official release data without prior Infrastructure authorization. The default Grails path still uses `releaseDistributions.sh` as the release manager. |
+| Rebuild and compare artifacts on trusted hardware | Trusted Publishing requires an independent rebuild outside GitHub Actions before publication. Grails already documents that comparison in this file. |
+| Report the release to ASF Reporter | [ASF Reporter addrelease](https://reporter.apache.org/addrelease.html) has no documented public API. |
+| Send lists beyond the one ATR announcement | ATR rejects a second announcement for the same release. Send `dev@grails.apache.org`, `users@grails.apache.org`, and `dev@groovy.apache.org` manually after the single ATR announce. |
+| Forge, SDKMAN!, the static website, and the blog | ATR records external distributions. It does not publish those Grails channels. |
+
+ATR Beta on `releases.apache.org` publishes finished releases directly to `svn:dist:release`. The PMC email that announces Beta to `pmcs@` is still tracked by [tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520). That open issue does not keep the platform on Alpha.
+
+## Apache Trusted Releases (ATR)
+
+[ASF Tooling](https://tooling.apache.org/) runs [Apache Trusted Releases](https://releases.apache.org/) to automate compose, vote, and finish. ATR is **Beta**. The existing `dist/dev` to `dist/release` and Nexus staging path remains the official Grails process until the PMC opts in. See the [ATR documentation](https://releases.apache.org/docs/) and [apache/tooling-actions](https://github.com/apache/tooling-actions).
+
+The workflows pin `apache/tooling-actions` to `dcba9f4ed2956f7a30113c3067e766eeda37d891` (`main` on 2026-10-08). [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) says these actions are not tagged and must be referenced by a full commit hash, not `@main`. Other `apache/*` actions stay on a branch. `validateRepositoryConventions` requires that commit hash for `apache/tooling-actions/*` and still rejects a commit hash for every other `apache/*` action.
+
+| Manual step today | Tooling action | Grails workflow |
+| --- | --- | --- |
+| Upload source, binary, wrapper, and docs zips | `upload-to-atr` | `Release - ATR Upload (experimental)`, or `atr_upload` in `release.yml` when `ATR_ENABLED=true` |
+| Send the `[VOTE]` email | none (start the vote in the [ATR UI](https://releases.apache.org/) or with `atr vote start`) | — |
+| Send the `[RESULT][VOTE]` email | `release-on-atr` with `resolve: true` | `Release - ATR Resolve Vote (experimental)` |
+| Publish the voted zips to `dist/release` | ATR, when automatic publication was selected at vote start, or the Publish button | not a GitHub Actions SVN write |
+| Promote Nexus staging to Maven Central | none | `Release - Promote Nexus Staging`, then `Release - ATR Record Distribution (experimental)` with `platform=MAVEN` |
+| Send the `[ANNOUNCE]` email | `release-on-atr` with `announce: true` | `Release - ATR Announce (experimental)` once, to `announce@apache.org` |
+| ASF Reporter, Forge, SDKMAN!, website, blog | none | unchanged |
+
+### Opt-in setup
+
+1. Log in at https://releases.apache.org/ with ASF credentials and confirm the Grails project. Discuss on [dev@tooling.apache.org](https://lists.apache.org/list.html?dev@tooling.apache.org) / [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG).
+2. Set the project download path suffix to `core/{{VERSION}}`. Grails publishes under `dist/release/grails/core/<version>/`, not in the committee root next to `KEYS`.
+3. Configure [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) for repository `grails-core`:
+
+ * Compose: `.github/workflows/release.yml` and `.github/workflows/release-atr-upload.yml`
+ * Vote: `.github/workflows/release-atr-resolve.yml`
+ * Finish: `.github/workflows/release-atr-announce.yml` and `.github/workflows/release-atr-record.yml`
+
+4. The committee page must show CI builds enabled. That requires a signing key whose primary UID contains `Automated Release Signing` and whose email is `private@grails.apache.org`. The release workflow imports `GRAILS_GPG_KEY` and signs with `GPG_KEY_ID`. Confirm that selected key matches this UID before the workflows will be accepted. If it does not, ask Infrastructure for a key that does. Voters still compare an independent rebuild on trusted hardware with the uploaded artifacts.
Review Comment:
This prerequisite is already met, so the step should say so rather than hedge. The only key in KEYS is `Apache Grails Automated Release Signing <pr...@grails.apache.org>` (RSA 4096, fingerprint `08E2 CEC4 7E38 FE41 5F08 0AB6 2ADE CADC 1177 5306`, issued by Infra in May 2025), and the 7.0.6 and 8.0.0-RC2 signatures were made with it (key id `2ADECADC11775306`), so the release workflow already signs with the automated key. Please replace "Confirm that selected key matches this UID ... ask Infrastructure for a key that does" with a statement that the Infra-issued key in KEYS satisfies this, so the next release manager does not go looking for a key to compare.
##########
.github/workflows/release-promote-jars.yml:
##########
@@ -0,0 +1,83 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Apache Polaris, a TLP, promotes a closed staging repository after its vote:
+# https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml
+# Grails already uses the same NEXUS_STAGE_DEPLOYER_* secrets in
+# release-drop-staging.yml. This workflow never writes dist.apache.org/release:
+# https://infra.apache.org/github-actions-policy.html
+name: "Release - Promote Nexus Staging"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 8.0.0-M1)'
+ required: true
+ type: string
+ staging_description:
+ description: 'Nexus staging repository description (defaults to <repository>:<version>)'
+ required: false
+ type: string
+ default: ''
+ repository:
+ description: 'Repository name used only for the default staging description'
+ required: false
+ type: string
+ default: grails-core
+permissions:
+ contents: read
+jobs:
+ promote:
+ name: "Promote Nexus staging repository"
+ environment: release
+ # Keep the release environment restricted to trusted refs.
+ runs-on: ubuntu-24.04
+ steps:
+ - name: "📥 Checkout the workflow ref"
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+ - name: "📝 Establish staging description"
+ env:
+ VERSION: ${{ inputs.version }}
+ STAGING_DESCRIPTION_INPUT: ${{ inputs.staging_description }}
+ REPOSITORY: ${{ inputs.repository }}
+ run: |
+ set -euo pipefail
+ if [ -z "${VERSION}" ]; then
+ echo "::error::Version must not be empty."
+ exit 1
+ fi
+ if [ -n "${STAGING_DESCRIPTION_INPUT}" ]; then
+ echo "STAGING_DESCRIPTION=${STAGING_DESCRIPTION_INPUT}" >> "$GITHUB_ENV"
+ else
+ echo "STAGING_DESCRIPTION=${REPOSITORY}:${VERSION}" >> "$GITHUB_ENV"
+ fi
+ - name: "🚀 Promote Nexus staging repository"
+ env:
+ NEXUS_USER: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
Review Comment:
I went looking for evidence either way and found none that this account can promote. Nothing on infra.apache.org says what the stage-deployer role may do beyond deploy, close and drop. The Polaris workflow this PR cites has no run on record that reached its Nexus release step: the real runs failed earlier, and the step logs of its two green runs have expired, so whether those were dry runs (the workflow's default) is unknowable. parquet-java has the same design with zero runs, and OpenDAL's Java artifacts on Central are not at the version its workflow reported released. So the precedent is a design, not a demonstration. Before this merges, please either dispatch the workflow against the closed staging repo of the next milestone or ask Infra in a ticket, and until one of those succeeds, drop the "prefer this workflow" wording in RELEASE.md and in the release job's echo so the documented path stays the one we know works.
##########
RELEASE.md:
##########
@@ -325,29 +326,34 @@ Confirm the Grails PMC votes passed with a +1 from at least 3 PMC members. The `
### Release the Staged Jar files
-The `release` job in the `Release` workflow has a step entitled `🚀 Release JAR files - MANUAL`. You can release the jar
-files by one of 2 ways:
+After the PMC vote has passed and the protected `release` environment is approved, prefer the opt-in
+`Release - Promote Nexus Staging` workflow. Run it from Actions with the version without `v`; leave
+`staging_description` empty to use `grails-core:<version>`. This is manually dispatched after the vote, following the
+[Apache Polaris TLP precedent](https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml).
-1. On https://repository.apache.org/#stagingRepositories, the staged artifacts must be released by opening the `grails-core` staging repository and
- clicking the `Release` button. It took almost 2 hours for the initial ASF release to publish these jars to Maven
- Central.
-2. Alternatively, the `release` job in the `Release` workflow will output an example command line to release the staging
- repository via the scripts checked into grails-core. Execute the script & set the placeholder values to release the
- jar files.
+The following remain fallbacks:
+
+1. On https://repository.apache.org/#stagingRepositories, release the staged artifacts by opening the `grails-core` staging repository and
+ clicking the `Release` button. It took almost 2 hours for the initial ASF release to publish these jars to Maven
+ Central.
+2. Run `.github/scripts/releaseJarFiles.sh grails-core:<version> <ASF_USER>`. The script prompts for a password unless
+ `NEXUS_PASS` is already set, which is how the protected workflow supplies its secret.
### Move the distributions from `dev` to `release`
-On dist.apache.org, the staged source distribution, binary distributions & documentation distribution must be moved from `https://dist.apache.org/repos/dist/dev/grails/` to `https://dist.apache.org/repos/dist/release/grails/`. Per ASF
-infrastructure, this must be performed manually, and we are not allowed to automate it via a gated approval workflow.
-Either move them via your SVN client or use the checked in script to perform these actions as your user.
+If this candidate was staged on ATR, skip this `dist/dev` move. Beta ATR commits the voted artifacts directly to `svn:dist:release` when the release is published. Set the Grails project's download path suffix to `core/{{VERSION}}` so the tree is `dist/release/grails/core/<version>/`, which is where the source, binary, wrapper, and documentation distributions belong. Do not run `releaseDistributions.sh` for an ATR candidate, and do not move anything out of `dist/atr`. See [Apache Trusted Releases (ATR)](#apache-trusted-releases-atr).
Review Comment:
Two things `releaseDistributions.sh` does are lost on the ATR path and nothing here picks them up. The `upload` job still commits the candidate to `dist/dev/grails/core/<version>` whether or not `ATR_ENABLED` is set, and with the `svn mv` skipped that copy stays there for good (the abort workflow has the exact `svnmucc rm` for it). And the script's loop that offers to remove the prior release folder from `dist/release` never runs, so old releases accumulate until someone prunes them by hand; the auto-archive caveat in the ATR section only says not to let ATR do it. Please either gate the SVN steps of `upload` on `ATR_ENABLED` not being `true` (the job itself has to stay, `release` needs it) or add both the `svn rm` of the dev copy and the prior-release pruning to the ATR **Publish** step.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-6486962367
Follow-up is `4d3cf237b7`.
The Nexus password variable is `GRAILS_NEXUS_PASSWORD`. The announce recipient is hardcoded, and an empty `previous_version` comes from the nearest prior tag. `dist/dev` SVN steps are skipped when ATR is enabled, and verification can take that candidate directory explicitly. The signing-key text matches `KEYS`, and `AGENTS.md` documents the tooling-actions hash exception.
The stage-deployer promotion permission is still unverified. The docs no longer prefer that workflow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-6253619485
## ✅ All tests passed ✅
🏷️ Commit: 62afef9c4131997665a42779acec1dabbd036b84
▶️ Tests: 99748 executed
⚪️ Checks: 91/91 completed
---
_Learn more about TestLens at [testlens.app/docs](https://testlens.app/docs/features/pr-comment/)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#issuecomment-6506640487
## ✅ All tests passed ✅
🏷️ Commit: af420cf6a5228a25d4013a30728c7b189dad4569
▶️ Tests: 92285 executed
⚪️ Checks: 97/97 completed
---
_Learn more about TestLens at [testlens.app/docs](https://testlens.app/docs/features/pr-comment/)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4408368300
##########
.github/workflows/release-atr-announce.yml:
##########
@@ -0,0 +1,137 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Experimental Apache Trusted Releases (ATR) announce step.
+# Sends ONE announcement through ATR. The first successful announce promotes
+# the candidate from preview to released, so this workflow must not be rerun
+# for additional mailing lists. The recipient is restricted to announce@apache.org.
+# ATR documentation and the official workflow example:
+# https://tooling.apache.org/
+# https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
+# After it succeeds, send the remaining lists by hand from your @apache.org
+# address: dev@grails.apache.org, users@grails.apache.org, and
+# dev@groovy.apache.org.
+#
+# Prerequisites (see RELEASE.md "Experimental: Apache Trusted Releases"):
+# * This workflow listed under the project's ATR finish workflow paths
+# * Vote already resolved as passed on ATR
+name: "Release - ATR Announce (experimental)"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 7.0.0 or 8.0.0-M1)'
+ required: true
+ type: string
+ previous_version:
+ description: 'Previous released version without the v prefix, used in the compare URL'
+ required: true
+ type: string
+ announce_email_to:
+ description: 'Must be announce@apache.org. Do not rerun this workflow for other lists.'
+ required: true
+ type: string
+ default: announce@apache.org
+ announce_body:
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-prev.txt
##########
.github/scripts/releaseJarFiles.sh:
##########
@@ -30,8 +30,10 @@ fi
STAGING_DESCRIPTION="$1"
NEXUS_USER="$2"
-read -r -s -p "Password: " NEXUS_PASS
-echo
+if [[ -z "${NEXUS_PASS:-}" ]]; then
Review Comment:
@C:\Users\james\AppData\Local\Temp\reply-atr-pass.txt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: opt-in Apache Trusted Releases (ATR) Beta automation [grails-core]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on code in PR #16229:
URL: https://github.com/apache/grails-core/pull/16229#discussion_r4414098481
##########
.github/workflows/release-atr-announce.yml:
##########
@@ -0,0 +1,137 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Experimental Apache Trusted Releases (ATR) announce step.
+# Sends ONE announcement through ATR. The first successful announce promotes
+# the candidate from preview to released, so this workflow must not be rerun
+# for additional mailing lists. The recipient is restricted to announce@apache.org.
+# ATR documentation and the official workflow example:
+# https://tooling.apache.org/
+# https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
+# After it succeeds, send the remaining lists by hand from your @apache.org
+# address: dev@grails.apache.org, users@grails.apache.org, and
+# dev@groovy.apache.org.
+#
+# Prerequisites (see RELEASE.md "Experimental: Apache Trusted Releases"):
+# * This workflow listed under the project's ATR finish workflow paths
+# * Vote already resolved as passed on ATR
+name: "Release - ATR Announce (experimental)"
+on:
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version without the v prefix (e.g. 7.0.0 or 8.0.0-M1)'
+ required: true
+ type: string
+ previous_version:
+ description: 'Previous released version without the v prefix, used in the compare URL'
+ required: true
+ type: string
+ announce_email_to:
Review Comment:
Posted again because the earlier reply was only a local path. In 4d3cf237b7 the script reads GRAILS_NEXUS_PASSWORD. The promotion workflow maps the existing NEXUS_STAGE_DEPLOYER_PW secret to it. Posted again because the earlier reply was only a local path. previous_version is optional. The workflow finds the nearest prior release tag and strips the leading v. An explicit override still works. Posted again because the earlier reply was only a local path. Automated promotion is not preferred. Stage-deployer promotion permission is still unverified, and no Infra approval is claimed. Posted again because the earlier reply was only a local path. The Infra-issued RSA 4096 key already in KEYS is the signing key. The instruction to seek another key is gone. Posted again because the earlier reply was only a local path. When ATR_ENABLED is true, the dist/dev SVN staging steps are skipped. Previous-release cleanup stays manual. Posted again because the earlier reply was only a local path. AG
ENTS.md allows a full commit hash only for apache/tooling-actions, because those actions are untagged and ATR Trusted Publishing requires it. Posted again because the earlier reply was only a local path. The announce workflow always sends to announce@apache.org. It must not be rerun to reach another list.[6]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org