ppkarwasz opened a new pull request, #505: URL: https://github.com/apache/logging-parent/pull/505
Currently `verify-reproducibility-reusable.yaml` resolves the reference artifacts from the Nexus snapshot repository, so a snapshot deployed by a concurrent run can be picked up instead of the one produced by the current run. This PR fixes the race condition, by uploading the snapshot repo as a workflow artifact: - `deploy-snapshot-reusable.yaml` now publishes the local staging directory of `nexus-staging-maven-plugin` (`target/nexus-staging/deferred`, the exact bits uploaded to Nexus) as a run artifact and exports its name as a `repository-artifact-name` output. - `verify-reproducibility-reusable.yaml` accepts a new `reference-artifact-name` input. When set, the artifact is downloaded and used as a `file://` reference repository. Exactly one of `nexus-url` and `reference-artifact-name` must be provided. The release path is unaffected: releases are verified against their dedicated staging repository via `nexus-url`, which is already immutable per release. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
