jianguotian opened a new pull request, #86: URL: https://github.com/apache/paimon-mosaic/pull/86
## Summary Move Java RC signing and Apache Nexus staging out of GitHub Actions. CI builds and uploads unsigned Java candidate artifacts, while the Release Manager validates the exact RC provenance and performs credentialed signing and staging locally. ## Changes - Replace the credential-bearing Java deploy job with unsigned multi-platform packaging and an immutable `java-package` artifact. - Add a local Release Manager staging command that binds the official Release run to the signed annotated tag, commit, workflow, latest valid artifact ID, digest, size, and clean source tree. - Fail closed on Git/GitHub transport, Python import, curl, tar, Maven/JVM, GPG, plugin-resolution, artifact, signing, and pre-Nexus provenance drift. - Pin and verify the complete Maven plugin closure, generate isolated Maven settings, sign locally, and deploy through one controlled Maven lifecycle. - Validate exact JAR/classifier contents, legal metadata, Java class contracts, native formats, executable mappings, loader-visible JNI exports, and source/Javadoc correspondence. - Add release preflight/vote gates, Bash 3.2-compatible adversarial tests, and Release Manager documentation. ## Scope - Java RC staging only. - No runtime or public API changes. - No Python wheel, Rust crate, or snapshot-publishing behavior changes. - The Release Manager still performs the final Nexus close/release decision manually. ## Validation - [x] One commit directly on the current `apache/paimon-mosaic:main`. - [x] Commit tree is identical to `jianguotian/paimon-mosaic#29` head `7022f867401ef352bedc9c752b23d61d63963578`. - [x] `python3 -m pytest -q tools/tests` — 173 passed. - [x] Local Java staging tests — 69/69 passed on Bash 3.2 and Bash 4.4. - [x] Maven `clean compile` and Java class-contract validation passed. - [x] Python compile, Bash syntax, YAML parsing, and `git diff --check` passed. - [x] Source archive created and independently verified against this commit. - [x] The tree-equivalent source PR completed all six CI checks successfully. - [ ] Upstream GitHub Actions checks after PR creation. ## Notes - This is an independent, single-commit upstream submission based on https://github.com/jianguotian/paimon-mosaic/pull/29; the original fork PR and branch remain unchanged. - GPG and Nexus credentials remain local to the Release Manager and are never passed to GitHub Actions. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
