This is an automated email from the ASF dual-hosted git repository. EmryZhang pushed a commit to branch prepare/lua-1.47.0-workflow in repository https://gitbox.apache.org/repos/asf/casbin-lua-casbin.git
commit 1df0b44109ac7864b8e52cda70e984a93df11375 Author: Zhangyanrui123 <[email protected]> AuthorDate: Sat Nov 7 23:29:09 2026 +0800 Keep tag workflows from publishing unapproved releases --- .github/workflows/release.yml | 129 ++++++++++-------------------------------- RELEASING.md | 92 ++++++++++++++++++++++++++++++ scripts/prepare-source.sh | 42 ++++++++++++++ 3 files changed, 164 insertions(+), 99 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b865046..4e18ee3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,109 +1,40 @@ -name: Release - -# Releases are cut manually by pushing a git tag (Apache releases must be voted on, -# so nothing is published automatically on merge/commit). +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 # -# git tag v1.4.0-rc1 && git push origin v1.4.0-rc1 -> GitHub pre-release (for the Apache vote) -# git tag v1.4.0 && git push origin v1.4.0 -> GitHub release + LuaRocks upload +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Prepare release source + +# Tags prepare review input, never a GitHub Release or a LuaRocks upload. on: push: - tags: - - 'v*' + tags: ['v*'] + workflow_dispatch: permissions: - contents: write - -env: - # Base name of the Apache source artifact: apache-<ARTIFACT_ID>-<version>-incubating-src.tar.gz - ARTIFACT_ID: casbin-lua + contents: read jobs: - release: - name: GitHub Release - if: github.repository == 'apache/casbin-lua-casbin' + source: runs-on: ubuntu-latest - outputs: - version: ${{ steps.vars.outputs.version }} - prerelease: ${{ steps.vars.outputs.prerelease }} steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Resolve version from tag - id: vars - run: | - set -euo pipefail - TAG="${GITHUB_REF_NAME}" - VERSION="${TAG#v}" - # A "-rc<N>" suffix marks an Apache release candidate -> GitHub pre-release only. - if [[ "${VERSION}" == *-rc* ]]; then - PRERELEASE=true - else - PRERELEASE=false - fi - # The source artifact always carries the final version, never the rc suffix, so that - # the exact bits that were voted on can be promoted unchanged. - BASE_VERSION="${VERSION%%-rc*}" - { - echo "tag=${TAG}" - echo "version=${BASE_VERSION}" - echo "prerelease=${PRERELEASE}" - } >> "$GITHUB_OUTPUT" - - - name: Build Apache source package - id: package - run: | - set -euo pipefail - NAME="apache-${ARTIFACT_ID}-${{ steps.vars.outputs.version }}-incubating-src" - mkdir -p dist - # git archive ships exactly what is tracked at the tag, with a single top-level - # directory named after the tarball, and no .git metadata. - git archive --format=tar.gz --prefix="${NAME}/" -o "dist/${NAME}.tar.gz" HEAD - (cd dist && sha512sum "${NAME}.tar.gz" > "${NAME}.tar.gz.sha512") - ls -l dist - - - name: Create GitHub release - run: | - set -euo pipefail - if [ "${{ steps.vars.outputs.prerelease }}" = "true" ]; then - FLAG="--prerelease" - else - FLAG="--latest" - fi - gh release create "${GITHUB_REF_NAME}" \ - --title "${GITHUB_REF_NAME}" \ - --generate-notes \ - ${FLAG} \ - dist/* - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - luarocks: - name: Publish to LuaRocks - needs: release - if: needs.release.outputs.prerelease == 'false' - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Set up Lua - uses: leafo/[email protected] + - uses: actions/checkout@v4 + - name: Prepare unsigned review archive + run: bash scripts/prepare-source.sh "$GITHUB_SHA" "$RUNNER_TEMP/casbin-source" + - uses: actions/upload-artifact@v4 with: - luaVersion: 5.1 - - - name: Set up luarocks - uses: ./.github/actions/setup-luarocks - - - name: Set up CJSON - run: luarocks install lua-cjson - - - name: Upload rockspec - run: | - set -euo pipefail - rv="${{ needs.release.outputs.version }}" - cp ./.github/luarocks-template.rockspec "./casbin-${rv}-1.rockspec" - sed -i "2iversion = \"${rv}-1\"" "./casbin-${rv}-1.rockspec" - sed -i "5i\ \ \ tag = \"v${rv}\"" "./casbin-${rv}-1.rockspec" - cat "casbin-${rv}-1.rockspec" - luarocks upload "casbin-${rv}-1.rockspec" --force --skip-pack --api-key=${{ secrets.LUAROCKS_API_KEY }} + name: casbin-lua-source-${{ github.sha }} + path: ${{ runner.temp }}/casbin-source/* + if-no-files-found: error diff --git a/RELEASING.md b/RELEASING.md new file mode 100644 index 0000000..b5c0fd6 --- /dev/null +++ b/RELEASING.md @@ -0,0 +1,92 @@ +<!-- +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, +software distributed under the License is distributed on an +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied. See the License for the +specific language governing permissions and limitations +under the License. +--> + +# Releasing Apache Casbin for Lua (incubating) + +The tag workflow only prepares unsigned review input as a CI artifact. It has +read-only repository permissions and no LuaRocks credentials. Branch pushes, +RC tags, final tags, manual dispatch and retries do not publish a release. + +## Prepare and review a candidate + +1. Merge the reviewed release changes. Check the actual commit's CI and the + version in `.github/luarocks-template.rockspec` (currently `1.47.0-1`). Keep + the LuaRocks name `casbin` and import `require("casbin")` compatible. +2. From a clean checkout, run + `bash scripts/prepare-source.sh <full-commit-sha> <new-output-directory>`. + The script archives the specified commit, uses an incubating filename, + checks the legal-file copies and writes an LF-terminated SHA-512 file. + It refuses to overwrite an existing output directory. This step does not + sign, stage, tag or publish anything. +3. Extract the archive, review LICENSE/NOTICE/DISCLAIMER and all bundled + material, run Apache RAT and reconcile its actual coverage. Run `luacheck .` + and `busted tests -o htest` with the supported Lua runtimes and dependencies. +4. To check the installed package, copy the committed rockspec template to + `casbin-1.47.0-1.rockspec`, run `luarocks lint` and `luarocks make` against the + extracted source in an isolated tree, then test from outside the checkout. + Check CachedEnforcer, DatabaseAdapter, every installed module and the legal + files under the rock's `doc` directory. These local builds are not releases. +5. The release manager reviews the final archive, signs it with an ASF identity + whose public key is in Casbin KEYS, and stages the immutable archive, + `.sha512` and `.asc` in the appropriate ASF development distribution path. + Download them again and verify the signature/checksum and an extracted build. +6. Seek the required public Casbin PPMC endorsement and Incubator PMC approval + for those exact bytes. Record both vote/result links. A new candidate with + changed bytes requires new review/votes. A tag or CI success is not approval. + +## Publish approved originals + +Only after both approvals, and with the release manager's authorization: + +1. Promote the voted source archive and its existing signature/checksum unchanged + to the ASF release distribution at `incubator/casbin/lua/1.47.0/`. Confirm + the public downloads match the voted hashes. Do not regenerate the archive + from the final tag. The final tag must point to the voted source commit. +2. Download the approved archive and verify its checksum/signature. Extract the + rockspec template from it, retaining its ASF source URL and source directory, + and name it `casbin-1.47.0-1.rockspec`. Before upload, run `luarocks pack` and + verify that the resulting source rock embeds the exact approved tarball; + also install it in a clean consumer and review its contents. Check that the + package/version has not already been published. +3. An authorized LuaRocks administrator uploads that reviewed rockspec with + `luarocks upload casbin-1.47.0-1.rockspec --skip-pack`. Supply credentials + through the administrator's normal secure mechanism. Never use `--force`. + If a retry finds an existing version, compare its source and metadata first; + do not overwrite it. Registry control and ASF distribution permissions are + separate prerequisites. +4. If creating a GitHub Release, attach the voted originals, include the + incubation disclaimer below, and link the official ASF source, KEYS and + [verification instructions](https://www.apache.org/info/verification.html). + Do not replace existing assets or move `latest` before approval. Historical + releases through 1.46.0 predate Apache incubation. +5. Verify the live LuaRocks page, downloaded rock, installed consumer and GitHub + display. Announce the approved release and record the public archive links. + +References: [ASF Release Policy](https://www.apache.org/legal/release-policy.html), +[Incubation Policy](https://incubator.apache.org/policy/incubation.html#releases), +[distribution guidance](https://incubator.apache.org/guides/distribution.html). + +Apache Casbin is an effort undergoing incubation at The Apache Software +Foundation (ASF), sponsored by the Apache Incubator. Incubation is required +of all newly accepted projects until a further review indicates that the +infrastructure, communications, and decision making process have stabilized +in a manner consistent with other successful ASF projects. While incubation +status is not necessarily a reflection of the completeness or stability of +the code, it does indicate that the project has yet to be fully endorsed by +the ASF. diff --git a/scripts/prepare-source.sh b/scripts/prepare-source.sh new file mode 100644 index 0000000..c4d07db --- /dev/null +++ b/scripts/prepare-source.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +set -euo pipefail +if [ "$#" -ne 2 ]; then + echo "Usage: bash scripts/prepare-source.sh <commit> <new-output-directory>" >&2 + exit 2 +fi +commit=$(git rev-parse --verify --end-of-options "${1}^{commit}") +output=$2 +version=$(git show "${commit}:.github/luarocks-template.rockspec" | + sed -n 's/^version = "\([0-9][0-9.]*\)-1"$/\1/p') +if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Expected a committed major.minor.patch LuaRocks version" >&2 + exit 1 +fi +name="apache-casbin-lua-${version}-incubating-src" +mkdir "$output" # Deliberately fail on an existing destination, including retries. +git archive --format=tar.gz --prefix="$name/" -o "$output/$name.tar.gz" "$commit" +for file in LICENSE NOTICE DISCLAIMER; do + tar -xOf "$output/$name.tar.gz" "$name/$file" > "$output/$file.check" + test -s "$output/$file.check" + tar -xOf "$output/$name.tar.gz" "$name/doc/$file" | cmp - "$output/$file.check" + rm "$output/$file.check" +done +(cd "$output" && sha512sum "$name.tar.gz" > "$name.tar.gz.sha512") +printf 'Source commit: %s\nUnsigned review input: %s\n' "$commit" "$output/$name.tar.gz" --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
