ppkarwasz opened a new pull request, #505:
URL: https://github.com/apache/logging-parent/pull/505

   Currently `verify-reproducibility-reusable.yaml` resolves the reference 
artifacts from the Nexus snapshot repository, so a snapshot deployed by a 
concurrent run can be picked up instead of the one produced by the current run.
   
   This PR fixes the race condition, by uploading the snapshot repo as a 
workflow artifact:
   
   - `deploy-snapshot-reusable.yaml` now publishes the local staging directory 
of `nexus-staging-maven-plugin` (`target/nexus-staging/deferred`, the exact 
bits uploaded to Nexus) as a run artifact and exports its name as a 
`repository-artifact-name` output.
   - `verify-reproducibility-reusable.yaml` accepts a new 
`reference-artifact-name` input. When set, the artifact is downloaded and used 
as a `file://` reference repository. Exactly one of `nexus-url` and 
`reference-artifact-name` must be provided.
   
   The release path is unaffected: releases are verified against their 
dedicated staging repository via `nexus-url`, which is already immutable per 
release.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to