You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@casbin.apache.org by "cooronx (via GitHub)" <gi...@apache.org> on 2026/04/25 07:01:23 UTC
[PR] fix: replace semantic release with snapshot workflows [casbin-jcasbin]
cooronx opened a new pull request, #517:
URL: https://github.com/apache/casbin-jcasbin/pull/517
After a PR is merged into master:
- The build workflow runs Maven tests and coverage.
- If build succeeds, the Maven snapshot workflow runs.
- It finds the latest formal tag, for example v1.99.0.
- It computes the next minor snapshot version, for example 1.100.0-SNAPSHOT.
- It deploys that artifact to the Sonatype snapshot repository (maven).
- The source snapshot workflow also runs after build succeeds.
- It creates a GitHub prerelease like v1.100.0-snapshot.1, v1.100.0-snapshot.2, etc.
- Snapshot release notes are incremental from the previous snapshot tag.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For additional commands, e-mail: commits-help@casbin.apache.org
Re: [PR] fix: replace semantic release with snapshot workflows [casbin-jcasbin]
Posted by "hsluoyz (via GitHub)" <gi...@apache.org>.
hsluoyz merged PR #517:
URL: https://github.com/apache/casbin-jcasbin/pull/517
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For additional commands, e-mail: commits-help@casbin.apache.org
Re: [PR] fix: replace semantic release with snapshot workflows [casbin-jcasbin]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #517:
URL: https://github.com/apache/casbin-jcasbin/pull/517#discussion_r3141735842
##########
.github/workflows/source-snapshot.yml:
##########
@@ -0,0 +1,139 @@
+name: Build Source Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
+ runs-on: ubuntu-latest
Review Comment:
Snapshot numbering is derived from existing tags (`LAST_SNAPSHOT_NUMBER + 1`). If multiple runs execute concurrently (e.g., several merges close together), they can compute the same next number and then race to create the same tag, causing one run to fail. Consider adding a `concurrency` group (and optionally `cancel-in-progress: false`) to serialize snapshot-release creation on `master`.
##########
.github/workflows/source-snapshot.yml:
##########
@@ -0,0 +1,139 @@
+name: Build Source Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+ ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+ - name: Compute snapshot metadata
+ id: snapshot
+ run: |
+ LATEST_RELEASE_TAG="$(
+ git tag --list 'v*' |
+ grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' |
+ sort -V |
+ tail -n 1
+ )"
+
+ if [ -z "${LATEST_RELEASE_TAG}" ]; then
+ BASE_VERSION="0.1.0"
+ else
+ RELEASE_VERSION="${LATEST_RELEASE_TAG#v}"
+ MAJOR="${RELEASE_VERSION%%.*}"
+ REST="${RELEASE_VERSION#*.}"
+ MINOR="${REST%%.*}"
+ NEXT_MINOR="$((MINOR + 1))"
+ BASE_VERSION="${MAJOR}.${NEXT_MINOR}.0"
+ fi
+
+ ESCAPED_BASE_VERSION="${BASE_VERSION//./\\.}"
+ LAST_SNAPSHOT_NUMBER="$(
+ git tag --list "v${BASE_VERSION}-snapshot.*" |
+ sed -nE "s/^v${ESCAPED_BASE_VERSION}-snapshot\\.([0-9]+)$/\\1/p" |
+ sort -n |
+ tail -n 1
+ )"
+ LAST_SNAPSHOT_NUMBER="${LAST_SNAPSHOT_NUMBER:-0}"
+ NEXT_SNAPSHOT_NUMBER="$((LAST_SNAPSHOT_NUMBER + 1))"
+ SNAPSHOT_VERSION="v${BASE_VERSION}-snapshot.${NEXT_SNAPSHOT_NUMBER}"
+ BASENAME="jcasbin-${SNAPSHOT_VERSION#v}-src"
+
+ echo "latest_release_tag=${LATEST_RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+ echo "base_version=${BASE_VERSION}" >> "${GITHUB_OUTPUT}"
+ echo "number=${NEXT_SNAPSHOT_NUMBER}" >> "${GITHUB_OUTPUT}"
+ echo "version=${SNAPSHOT_VERSION}" >> "${GITHUB_OUTPUT}"
+ echo "basename=${BASENAME}" >> "${GITHUB_OUTPUT}"
+ if [ -n "${LAST_SNAPSHOT_NUMBER}" ] && [ "${LAST_SNAPSHOT_NUMBER}" -gt 0 ]; then
+ echo "previous_tag=v${BASE_VERSION}-snapshot.${LAST_SNAPSHOT_NUMBER}" >> "${GITHUB_OUTPUT}"
+ else
+ echo "previous_tag=${LATEST_RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+ fi
+
+ - name: Generate snapshot release notes
+ run: |
+ PREVIOUS_TAG="${{ steps.snapshot.outputs.previous_tag }}"
+ CURRENT_TAG="${{ steps.snapshot.outputs.version }}"
+ CURRENT_VERSION="${CURRENT_TAG#v}"
+ RELEASE_DATE="$(date -u +%F)"
+ RANGE="HEAD"
+
+ if [ -n "${PREVIOUS_TAG}" ]; then
+ RANGE="${PREVIOUS_TAG}..HEAD"
+ fi
+
+ FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(feat)(\(.+\))?: ' || true)"
+ FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(fix)(\(.+\))?: ' || true)"
+ DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(docs?|doc)(\(.+\))?: ' || true)"
Review Comment:
The release-notes regexes don’t match Conventional Commits that include breaking-change markers (e.g. `feat!:` / `fix(scope)!:`). Since semantic-release previously relied on Conventional Commits, this will cause some commits to be omitted from snapshot notes. Consider updating the patterns to allow an optional `!` before the colon.
```suggestion
FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(feat)(\(.+\))?!?: ' || true)"
FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(fix)(\(.+\))?!?: ' || true)"
DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(docs?|doc)(\(.+\))?!?: ' || true)"
```
##########
.github/workflows/maven-snapshot.yml:
##########
@@ -0,0 +1,70 @@
+name: Publish Maven Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ publish-maven-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
Review Comment:
`workflow_dispatch` can be run from any branch/ref, but the job `if:` currently allows publishing a snapshot whenever the workflow is manually dispatched. That makes it easy to accidentally deploy snapshots built from non-`master` code. Consider tightening the condition to only allow `workflow_dispatch` when `github.ref == 'refs/heads/master'` (or otherwise enforce the intended ref).
```suggestion
if: ${{ github.repository == 'apache/casbin-jcasbin' && ((github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master') || github.event.workflow_run.conclusion == 'success') }}
```
##########
.github/workflows/source-snapshot.yml:
##########
@@ -0,0 +1,139 @@
+name: Build Source Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
Review Comment:
`workflow_dispatch` can be run from any branch/ref, but the job `if:` currently allows creating snapshot tags/releases whenever the workflow is manually dispatched. This can create prereleases from non-`master` code and pollute the tag namespace. Consider restricting manual dispatch to `master` (e.g., by adding a `github.ref` guard in the job `if:`).
```suggestion
if: ${{ github.repository == 'apache/casbin-jcasbin' && ((github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master') || github.event.workflow_run.conclusion == 'success') }}
```
##########
.github/workflows/source-release-draft.yml:
##########
@@ -0,0 +1,125 @@
+name: Build Source Release Draft
+
+on:
+ push:
+ tags:
+ - "v*"
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-release-draft:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && !contains(github.ref_name, '-') }}
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ - name: Compute release metadata
+ id: release
+ run: |
+ TAG_NAME="${GITHUB_REF_NAME}"
+ if ! [[ "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+ echo "Unsupported release tag: ${TAG_NAME}" >&2
+ exit 1
+ fi
+
+ VERSION="${TAG_NAME#v}"
+ BASENAME="jcasbin-${VERSION}-src"
+ PREVIOUS_TAG="$(
+ git tag --list 'v*' |
+ grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' |
+ sort -V |
+ awk -v current="${TAG_NAME}" '
+ $0 == current {
+ print previous
+ exit
+ }
+ {
+ previous = $0
+ }
+ '
+ )"
+
+ echo "tag=${TAG_NAME}" >> "${GITHUB_OUTPUT}"
+ echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+ echo "basename=${BASENAME}" >> "${GITHUB_OUTPUT}"
+ echo "previous_tag=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
+
+ - name: Generate release notes
+ run: |
+ CURRENT_TAG="${{ steps.release.outputs.tag }}"
+ CURRENT_VERSION="${{ steps.release.outputs.version }}"
+ PREVIOUS_TAG="${{ steps.release.outputs.previous_tag }}"
+ RELEASE_DATE="$(date -u +%F)"
+ RANGE="${CURRENT_TAG}"
+
+ if [ -n "${PREVIOUS_TAG}" ]; then
+ RANGE="${PREVIOUS_TAG}..${CURRENT_TAG}"
+ fi
+
+ FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(feat)(\(.+\))?: ' || true)"
+ FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(fix)(\(.+\))?: ' || true)"
+ DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(docs?|doc)(\(.+\))?: ' || true)"
Review Comment:
The release-notes regexes don’t match Conventional Commits that include breaking-change markers (e.g. `feat!:` / `fix(scope)!:`), so those commits won’t appear in the drafted release notes. Consider updating the patterns to allow an optional `!` before the colon.
```suggestion
FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(feat)(\(.+\))?!?: ' || true)"
FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(fix)(\(.+\))?!?: ' || true)"
DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei '^(docs?|doc)(\(.+\))?!?: ' || true)"
```
##########
.github/workflows/maven-ci.yml:
##########
@@ -35,19 +30,3 @@ jobs:
uses: codecov/codecov-action@v1
Review Comment:
`codecov/codecov-action@v1` is an older major; consider upgrading to a currently supported major (and adjusting config if needed) to avoid deprecation/security issues.
```suggestion
uses: codecov/codecov-action@v4
```
##########
.github/workflows/maven-ci.yml:
##########
@@ -22,11 +22,6 @@ jobs:
uses: actions/setup-java@v1
Review Comment:
`actions/setup-java@v1` is an older major. Consider upgrading to `actions/setup-java@v4` (it supports Java 8) to avoid deprecations and pick up security fixes.
```suggestion
uses: actions/setup-java@v4
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For additional commands, e-mail: commits-help@casbin.apache.org