jamesfredley commented on code in PR #16025:
URL: https://github.com/apache/grails-core/pull/16025#discussion_r3677405547
##########
gradle/rat-root-config.gradle:
##########
@@ -20,6 +20,9 @@ apply plugin: 'org.nosphere.apache.rat'
tasks.named('rat') {
def allExcludes = [
'.asf.yaml', // ASF metadata for github integration excluded from
src zip
+ '.omo/**', // local agent work state excluded from src zip
+ '.claude/**', '.clinerules', '.cursorrules', '.windsurfrules', //
local agent configuration excluded from src zip
Review Comment:
Corrected. The important detail is that these are not untracked local files:
`CLAUDE.md`, `GEMINI.md`, `.clinerules`, `.cursorrules`, and `.windsurfrules`
are tracked symlinks to `AGENTS.md`, and `.claude/skills/*/SKILL.md` are
tracked symlinks into `.agents/skills/`. Gitignoring them would be wrong, and
excluding them from RAT was unnecessary because they resolve to files that
already carry the license header.
So the exclusions are now split by what each mechanism is actually for, and
the comments say the true reason:
- `.omo/**` and the new `.worktrees/**` - untracked local agent state and
worktrees. Gitignored (that part of your comment was correct and is now done)
and excluded from both RAT and the src zip.
- `.claude/settings.json` - a real JSON file, and JSON cannot carry a
license header, same rationale as the existing
`spring-configuration-metadata.json` entry.
- The symlinks - excluded from RAT only, and they ship in the src zip again
per your other comment.
On that last one: I first tried dropping the RAT exclusion entirely on the
theory that RAT would follow the link to `AGENTS.md`. It does not, portably.
`./gradlew rat` then failed with 8 unapproved licenses, because on a platform
without symlink support git materializes each one as a plain text file
containing the link target. The exclusion is kept with that written down as the
reason rather than the previous, inaccurate "excluded from src zip".
##########
.github/workflows/vulnerability-scan.yml:
##########
@@ -36,9 +36,9 @@ jobs:
contents: read
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@v6
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/release.yml:
##########
@@ -690,7 +698,7 @@ jobs:
# Runs on the JDK 21 pin, where settings.gradle auto-prunes the
Micronaut island.
run: ./gradlew grails-doc:build -PgithubBranch=${TARGET_BRANCH}
- name: "🚀 Publish to GitHub Pages"
- uses: apache/grails-github-actions/deploy-github-pages@asf
+ uses:
apache/grails-github-actions/deploy-github-pages@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Agreed, reverted. All `apache/grails-github-actions/*` references are back
to `@asf`, and `RepositoryConventionsTask` now exempts the `apache` owner
namespace from the SHA rule, so the gate no longer encodes the opposite of this
decision. A reference with an empty ref is still a violation, but any version
or branch ref is accepted.
##########
.github/workflows/release.yml:
##########
@@ -765,7 +773,7 @@ jobs:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }}
- name: "⚙️ Run post-release"
- uses: apache/grails-github-actions/post-release@asf
+ uses:
apache/grails-github-actions/post-release@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Agreed, reverted. All `apache/grails-github-actions/*` references are back
to `@asf`, and `RepositoryConventionsTask` now exempts the `apache` owner
namespace from the SHA rule, so the gate no longer encodes the opposite of this
decision. A reference with an empty ref is still a violation, but any version
or branch ref is accepted.
##########
.github/workflows/release.yml:
##########
@@ -373,11 +374,18 @@ jobs:
find . -depth \( -type f -o -type d \) -exec touch -d
"@${SOURCE_DATE_EPOCH}" {} +
- name: "📦 Create source distribution ZIP"
run: >
- zip -r
+ zip -yr
${DIST_NAME}-${VERSION}-src.zip
grails
-x 'grails/.git/*'
-x 'grails/.github/*'
+ -x 'grails/.omo/*'
Review Comment:
You are right, and the premise was wrong on my side. These are tracked
symlinks to `AGENTS.md` (and, under `.claude/skills/`, to `.agents/skills/`),
so there is nothing to gitignore and nothing to decide about checking them in.
They are already checked in deliberately.
The zip exclusions for them are removed, so they ship again. What remains
excluded from the zip is `.omo/*` and the new `.worktrees/*`, both genuinely
local and untracked, plus `.asf.yaml` (see the separate thread below).
`.gitignore` does now gain `.omo/` and `.worktrees/`, which is the part of
your comment that was correct: those are the genuinely local, untracked ones.
##########
.github/workflows/release.yml:
##########
@@ -373,11 +374,18 @@ jobs:
find . -depth \( -type f -o -type d \) -exec touch -d
"@${SOURCE_DATE_EPOCH}" {} +
- name: "📦 Create source distribution ZIP"
run: >
- zip -r
+ zip -yr
${DIST_NAME}-${VERSION}-src.zip
grails
-x 'grails/.git/*'
-x 'grails/.github/*'
+ -x 'grails/.omo/*'
+ -x 'grails/.claude/*'
+ -x 'grails/.clinerules'
+ -x 'grails/.cursorrules'
+ -x 'grails/.windsurfrules'
+ -x 'grails/CLAUDE.md'
Review Comment:
Agreed, and removed from the exclude list. `CLAUDE.md`, `GEMINI.md`,
`.clinerules`, `.cursorrules`, `.windsurfrules`, and `.claude/**` all ship
again.
This works cleanly because the step keeps `zip -y`: they are symlinks, so
they are stored as links pointing at `AGENTS.md` and `.agents/skills/**`, which
are themselves inside the zip. No dangling links and no duplicated content.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
