jamesfredley opened a new pull request, #16229: URL: https://github.com/apache/grails-core/pull/16229
## Summary Opt-in GitHub Actions for [Apache Trusted Releases](https://release-test.apache.org/) **Alpha 3** plus one extra MANUAL step we found a TLP already automates. The default `dist/dev` + Nexus staging path is unchanged until the PMC sets `ATR_ENABLED=true` and configures Trusted Publishing. This is **not** ATR Beta. Beta is not generally available ([tooling-trusted-releases#1520](https://github.com/apache/tooling-trusted-releases/issues/1520) still open). Host remains `release-test.apache.org`. Actions are pinned to `apache/tooling-actions@e8594ee9cc5ef5fbb48c367a9ab87042c0ccbbc5`. ### What this automates (with citations) | Step | How | Why we may | |------|-----|------------| | Compose (upload signed zips) | `Release - ATR Upload (experimental)` / optional `atr_upload` job | Official example: https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml — Pekko also uploads to ATR | | Resolve vote | `Release - ATR Resolve Vote (experimental)` | https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml | | One `[ANNOUNCE]` to `[email protected]` | `Release - ATR Announce (experimental)` (once; extra lists stay manual) | https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml | | Record Maven Central in ATR | `Release - ATR Record Distribution (experimental)` `platform=MAVEN` | https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml | | Promote closed Nexus staging | `Release - Promote Nexus Staging` (`environment: release`) | Apache Polaris TLP already does this post-vote: https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml — same `NEXUS_STAGE_DEPLOYER_*` secrets Grails already uses to drop staging. Signing in GHA is allowed by https://www.apache.org/legal/release-policy.html | ### What stays manual (with citations) - **72-hour PMC vote / vote start** — no Tooling GHA; https://www.apache.org/legal/release-policy.html and https://tooling.apache.org/trusted-releases.html. If using ATR, discard the generated `dist/dev` `[VOTE]` email so there is only one thread. - **`dist/release` SVN** — https://infra.apache.org/github-actions-policy.html forbids GHA writing official release data without Infra authorization. After the one ATR announce, a committer `svn move`s exactly `dist/atr/grails/core/<version>` → `dist/release/grails/core/<version>` (https://release-test.apache.org/docs/promoting-to-release). Polaris leaves the same `svn mv` manual. Do **not** run `releaseDistributions.sh` for an ATR candidate. - **ASF Reporter** — login form, no documented public API, no TLP GHA precedent. - **Extra announce lists** (`dev@grails`, `users@grails`, `dev@groovy`) — ATR rejects a second announce for the same version. Vote-start must set download path suffix `core/<version>` (or `core/{{VERSION}}`); the announce path input is compatibility-only. ### Setup 1. Configure Trusted Publishing on ATR for `grails-core` (workflow paths listed in `RELEASE.md`). 2. Optional repo var `ATR_ENABLED=true` to also upload from the main `Release` workflow. 3. Signing UID convention: `Automated Release Signing <[email protected]>`. 7.0.x can be cherry-picked later if wanted. Default line is 8.0.x. ## Test plan - [ ] YAML parses / `validateActions` allowlists the pinned `apache/tooling-actions` SHA - [ ] Dry-read `RELEASE.md` Experimental ATR + "What GitHub Actions may automate" - [ ] Confirm `Release - Promote Nexus Staging` is `workflow_dispatch` + `environment: release` and is **not** auto-triggered - [ ] After Trusted Publishing is configured, dry-run ATR Upload on a milestone tag in a non-production pass -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
