chaokunyang opened a new pull request, #3976:
URL: https://github.com/apache/fory/pull/3976
## Why?
The `v1.7.0-rc2` vote identified three release blockers:
1. The ASF source archive contained 11 first-party source/build files
without ASF headers.
2. The Java Maven source-release ZIP collected 135 ignored workspace files
and its top-level
`LICENSE` did not account for bundled third-party-derived source.
3. Four Kotlin Javadoc JARs omitted `META-INF/LICENSE` and `META-INF/NOTICE`.
The published RC2 artifacts were compared with tag
`5f467b5c4721673eab6dc81fb365c74637c91d29` before changing their owning
build paths.
## What does this PR do?
- Adds ASF headers to the exact 11 reported first-party files.
- Adds the Java source release's third-party-derived source attribution
through Maven's existing
appended-resources mechanism, and completes `fory-core`'s `commons-lang3`
attribution.
- Rejects release publication from a dirty JVM source tree, including
ignored/untracked entries
below `java/`, `kotlin/`, or `scala/`.
- Packages and verifies the Java source-release ZIP before deployment. The
verifier requires the
archive to match the exact Git-tracked `java/` tree plus Maven's three
generated legal files and
checks that the appended attribution reached the top-level `LICENSE`.
- Stages the existing Kotlin legal resources into Dokka's output directory
and requires exactly
one `META-INF/LICENSE` and `META-INF/NOTICE` in every public Kotlin
Javadoc JAR.
- Disables annotation processing only for `fory-json`'s Java 17 Ant
execution, whose checked-in
subtype table intentionally simulates processor output. This fixes the
clean JDK 25 release
build exposed while rebuilding the artifacts.
## Related issues
None.
## Verification
- Clean detached Java release package with JDK 25:
`mvn -B --no-transfer-progress -T10 clean package -DskipTests
-Papache-release`
- `python ci/release.py verify_java_artifacts`: passed; the source-release
ZIP contained exactly
950 unique expected files, with no unexpected or missing entries, and the
complete appended
attribution in its top-level `LICENSE`.
- Transformed source archive inspection: all 11 reported first-party files
contain ASF headers.
- Clean detached Kotlin release package with JDK 25:
`mvn -B --no-transfer-progress clean package -DskipTests -Papache-release`
- `python ci/release.py verify_kotlin_artifacts`: passed for all four public
Kotlin artifacts; each
Javadoc JAR contained exactly one `META-INF/LICENSE` and `META-INF/NOTICE`.
- `python -m ruff format ci/release.py`, `python -m ruff check
ci/release.py`, and
`git diff --check`: passed.
No further tests were run, per contributor instruction; the changes affect
release inputs and
packaging rather than runtime serialization behavior.
## AI Contribution Checklist
- [x] Substantial AI assistance was used in this PR: `yes`
- [x] I included the standardized `AI Usage Disclosure` below.
- [x] The assistant completed a line-by-line self-review of the final diff.
- [ ] The human submitter has completed their personal line-by-line review.
- [ ] Two fresh AI review agents reviewed the final diff.
- [ ] Final clean review artifacts from both reviewers are linked below.
- [x] Artifact-level verification is recorded above.
- [x] No protocol or performance-sensitive runtime path changed;
compatibility tests and
benchmarks are not applicable.
- [x] Licensing and provenance were checked against the source files and
produced archives.
AI Usage Disclosure
- substantial_ai_assistance: yes
- scope: root-cause analysis, release-script and Maven configuration
drafting, artifact inspection,
and PR drafting
- affected_files_or_subsystems: ASF source headers, `ci/release.py`, Java
source-release legal
resources, `fory-core` legal metadata, `fory-json` release compilation,
and Kotlin Dokka packaging
- ai_review: main-agent line-by-line review completed; the required
two-reviewer loop was not run
because the contributor explicitly prohibited subagents, so this PR
remains a draft
- ai_review_artifacts: N/A pending contributor direction
- human_verification: release builds used `-DskipTests`; produced source and
Javadoc artifacts were
inspected with the recorded verifiers; human line-by-line review remains
pending
- performance_verification: N/A; no runtime serialization or hot-path
behavior changed
- provenance_license_confirmation: Apache-2.0-compatible provenance was
checked; no incompatible
third-party code was introduced, and existing derived source is now
attributed in the produced
source release
## Does this PR introduce any user-facing change?
- [ ] Does this PR introduce any public API change?
- [ ] Does this PR introduce any binary protocol compatibility change?
## Benchmark
N/A. This PR changes release packaging and validation only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
