Copilot commented on code in PR #1161: URL: https://github.com/apache/pekko-http/pull/1161#discussion_r3570542663
########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir dist + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL + cd dist + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab dist/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Upload source dist + uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f + with: + project: pekko-http + version: ${{ steps.generate-source-archive.outputs.version }} + + stage-jars-to-nexus: + runs-on: ubuntu-24.04 + if: ${{ inputs.jars }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Setup Java 17 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + with: + distribution: temurin + java-version: 17 + + - name: Install sbt + uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0 + + - name: Install Graphviz + run: |- + sudo apt-get install graphviz Review Comment: `apt-get install graphviz` is missing `-y` (will block on interactive prompt) and there is no `apt-get update`, which can lead to transient install failures on fresh runners. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir dist + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL + cd dist + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab dist/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Upload source dist + uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f + with: + project: pekko-http + version: ${{ steps.generate-source-archive.outputs.version }} + + stage-jars-to-nexus: + runs-on: ubuntu-24.04 + if: ${{ inputs.jars }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Setup Java 17 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + with: + distribution: temurin + java-version: 17 + + - name: Install sbt + uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0 + + - name: Install Graphviz + run: |- + sudo apt-get install graphviz + + # We intentionally do not use the Coursier cache for release candiates, Review Comment: Typo in comment: "candiates" -> "candidates". ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 Review Comment: This workflow pins `actions/checkout` to v5.0.1, while other workflows in this repo are pinned to v6.0.2. Updating keeps the workflow consistent with the repo’s established action versions and security fixes. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION Review Comment: `GITHUB_OUTPUT` should be quoted, and VERSION parsing currently assumes a leading `v`. Since the `v*` guard is commented out, tags without `v` would produce an incorrect VERSION output for the ATR upload. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 Review Comment: This workflow pins `actions/checkout` to v5.0.1, while other workflows in this repo are pinned to v6.0.2. Updating keeps the workflow consistent with the repo’s established action versions and security fixes. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir dist + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL + cd dist + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab dist/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Upload source dist + uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f + with: + project: pekko-http + version: ${{ steps.generate-source-archive.outputs.version }} + + stage-jars-to-nexus: + runs-on: ubuntu-24.04 + if: ${{ inputs.jars }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 Review Comment: This workflow pins `actions/checkout` to v5.0.1, while other workflows in this repo are pinned to v6.0.2. Updating keeps the workflow consistent with the repo’s established action versions and security fixes. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION Review Comment: Version parsing assumes the tag starts with `v` (via `sed` stripping the first character). Since the `v*` guard is currently commented out, running this on a tag like `1.4.0-RC1` would produce an incorrect VERSION and artifact names. Use parameter expansion to strip an optional leading `v` and the `-RC*` suffix. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR Review Comment: RC_VERSION parsing uses `tail -c +2`, which silently drops the first character even when the ref does not start with `v`. Also, the directory variable is used unquoted in several shell commands. This can lead to incorrect staging paths or brittle scripting. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir dist + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL + cd dist + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab dist/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Upload source dist + uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f + with: + project: pekko-http + version: ${{ steps.generate-source-archive.outputs.version }} + + stage-jars-to-nexus: + runs-on: ubuntu-24.04 + if: ${{ inputs.jars }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Setup Java 17 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + with: + distribution: temurin + java-version: 17 + + - name: Install sbt + uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0 + + - name: Install Graphviz + run: |- + sudo apt-get install graphviz + + # We intentionally do not use the Coursier cache for release candiates, + # to reduce attack surface + + # It would be better to split this into 3 steps, where only the first + # uses sbt and the signing/staging are done with well-known tools + # reducing attack surface, but this seems to be the state of the art: + - name: Build, sign and stage artifacts + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + + sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned" + sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose" + env: + REF: ${{ github.ref_name }} + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + SONATYPE_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }} + SONATYPE_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }} + + email-template: + runs-on: ubuntu-24.04 + if: ${{ inputs.email-template }} + steps: + - name: Generate vote email template + run: |- + export MODULE="Pekko HTTP" + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + if [[ "$VERSION" =~ ^1\.([0-9]+)\.[0-9]+$ ]]; then + export BRANCH="1.${BASH_REMATCH[1]}.x" + else + export BRANCH="main" + fi + echo "VERSION=$VERSION" + echo "RC_VERSION=$RC_VERSION" + echo "BRANCH=$BRANCH" + + export DISCUSS=$(curl 'https://lists.apache.org/api/stats.lua?list=dev&domain=pekko.apache.org' | jq ".emails.[] | .subject, .mid" | grep -A1 "$MODULE $VERSION" | tail -1 | tr -d \") + echo "DISCUSS=$DISCUSS" + export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true"; | jq .thread.mid | tr -d \") + echo "DISCUSS_THREAD=$DISCUSS_THREAD" + + export RELEASE_NOTES=https://github.com/apache/pekko-http/pull/$(curl https://api.github.com/repos/apache/pekko-http/pulls?state=all | jq ".[] | .title, .number" | grep -A1 "Release notes for $VERSION" | tail -1) + echo "RELEASE_NOTES=$RELEASE_NOTES" + + export SENDER=$(curl "https://api.github.com/users/$ACTOR"; | jq .name | tr -d \") + echo "SENDER=$SENDER" Review Comment: The GitHub API calls are unauthenticated, which is prone to rate limiting on shared runner IPs. Also, `jq` should use `-r` instead of stripping quotes with `tr`. Passing the workflow token as an Authorization header makes this step more reliable. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir dist + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL + cd dist + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab dist/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Upload source dist + uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f + with: + project: pekko-http + version: ${{ steps.generate-source-archive.outputs.version }} + + stage-jars-to-nexus: + runs-on: ubuntu-24.04 + if: ${{ inputs.jars }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Setup Java 17 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + with: + distribution: temurin + java-version: 17 + + - name: Install sbt + uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0 + + - name: Install Graphviz + run: |- + sudo apt-get install graphviz + + # We intentionally do not use the Coursier cache for release candiates, + # to reduce attack surface + + # It would be better to split this into 3 steps, where only the first + # uses sbt and the signing/staging are done with well-known tools + # reducing attack surface, but this seems to be the state of the art: + - name: Build, sign and stage artifacts + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + + sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned" + sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose" + env: + REF: ${{ github.ref_name }} + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + SONATYPE_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }} + SONATYPE_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }} + + email-template: + runs-on: ubuntu-24.04 + if: ${{ inputs.email-template }} + steps: + - name: Generate vote email template + run: |- + export MODULE="Pekko HTTP" + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) Review Comment: VERSION/RC_VERSION parsing assumes a leading `v` (via `sed` and `tail -c +2`). Since this step uses both values to generate the vote email, triggering the workflow from a non-`v` tag would produce incorrect links and subject text. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir dist + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL + cd dist + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab dist/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Upload source dist + uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f + with: + project: pekko-http + version: ${{ steps.generate-source-archive.outputs.version }} + + stage-jars-to-nexus: + runs-on: ubuntu-24.04 + if: ${{ inputs.jars }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Setup Java 17 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + with: + distribution: temurin + java-version: 17 + + - name: Install sbt + uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0 + + - name: Install Graphviz + run: |- + sudo apt-get install graphviz + + # We intentionally do not use the Coursier cache for release candiates, + # to reduce attack surface + + # It would be better to split this into 3 steps, where only the first + # uses sbt and the signing/staging are done with well-known tools + # reducing attack surface, but this seems to be the state of the art: + - name: Build, sign and stage artifacts + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + + sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned" + sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose" + env: + REF: ${{ github.ref_name }} + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + SONATYPE_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }} + SONATYPE_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }} + + email-template: + runs-on: ubuntu-24.04 + if: ${{ inputs.email-template }} + steps: + - name: Generate vote email template + run: |- + export MODULE="Pekko HTTP" + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + if [[ "$VERSION" =~ ^1\.([0-9]+)\.[0-9]+$ ]]; then + export BRANCH="1.${BASH_REMATCH[1]}.x" + else + export BRANCH="main" + fi + echo "VERSION=$VERSION" + echo "RC_VERSION=$RC_VERSION" + echo "BRANCH=$BRANCH" + + export DISCUSS=$(curl 'https://lists.apache.org/api/stats.lua?list=dev&domain=pekko.apache.org' | jq ".emails.[] | .subject, .mid" | grep -A1 "$MODULE $VERSION" | tail -1 | tr -d \") + echo "DISCUSS=$DISCUSS" + export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true"; | jq .thread.mid | tr -d \") + echo "DISCUSS_THREAD=$DISCUSS_THREAD" Review Comment: The current `jq` usage emits quoted JSON strings and then strips quotes via `tr -d \"`, which is brittle and hard to read. Prefer `jq -r` for raw output and use `curl -sS` to reduce noisy logs. ########## .github/workflows/stage-release-candidate.yml: ########## @@ -0,0 +1,354 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Stage release candidate + +on: + workflow_dispatch: + inputs: + source-tar-to-svn: + description: "Stage the source tarball to svn (old)" + default: true + type: boolean + source-tar-to-atr: + description: "Stage the source tarball to ATR (new)" + default: true + type: boolean + jars: + description: "Stage the binary jars to nexus" + default: true + type: boolean + email-template: + description: "Generate vote email template" + default: true + type: boolean + +permissions: + contents: read + +jobs: + # Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate + # Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml + stage-release-candidate-to-svn: + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-svn }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir archive + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL + cd archive + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab archive/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Install Apache Subversion + run: |- + sudo apt-get update + sudo apt-get install -y subversion + + - name: Upload source dist + run: |- + svn checkout https://dist.apache.org/repos/dist/dev/pekko dist + cd dist + + export RC_VERSION=$(echo $REF | tail -c +2) + export DIR="HTTP-$RC_VERSION" + + mkdir $DIR + cp ../archive/* $DIR + svn add $DIR + svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR + env: + PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }} + PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }} + REF: ${{ github.ref_name }} + + stage-release-candidate-to-atr: + permissions: + id-token: write + contents: read + runs-on: ubuntu-24.04 + if: ${{ inputs.source-tar-to-atr }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Generate source archive + id: generate-source-archive + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") + echo "version=$VERSION" >> $GITHUB_OUTPUT + PREFIX=apache-pekko-http-$VERSION + DATE=$(git log -n1 --format=%cs | tr -d -) + TARBALL=$PREFIX-src-$DATE.tgz + + mkdir dist + git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL + cd dist + sha512sum $TARBALL > $TARBALL.sha512 + env: + REF: ${{ github.ref_name }} + + - name: Sign source archive + run: |- + echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show + gpg -ab dist/*.tgz + env: + PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }} + + - name: Upload source dist + uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f + with: + project: pekko-http + version: ${{ steps.generate-source-archive.outputs.version }} + + stage-jars-to-nexus: + runs-on: ubuntu-24.04 + if: ${{ inputs.jars }} + steps: + - name: Check version parameter + run: |- + # To be enabled after this workflow has been tested: + #if [[ "$REF" != "v"* ]]; then + # echo "Trigger this workflow on a version tag" + # exit 1 + #fi + if [[ "$REF" != *"-RC"* ]]; then + echo "Trigger this workflow on an RC tag" + exit 1 + fi + export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") + export RC_VERSION=$(echo $REF | tail -c +2) + echo "Version: $VERSION" + echo "RC Version: $RC_VERSION" + env: + REF: ${{ github.ref_name }} + + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 + with: + fetch-depth: 0 + fetch-tags: true + persist-credentials: false + + - name: Setup Java 17 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + with: + distribution: temurin + java-version: 17 + + - name: Install sbt + uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0 + + - name: Install Graphviz + run: |- + sudo apt-get install graphviz + + # We intentionally do not use the Coursier cache for release candiates, + # to reduce attack surface + + # It would be better to split this into 3 steps, where only the first + # uses sbt and the signing/staging are done with well-known tools + # reducing attack surface, but this seems to be the state of the art: + - name: Build, sign and stage artifacts + run: |- + VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") Review Comment: VERSION parsing assumes a leading `v` (via `sed` stripping the first character). Since the `v*` guard is commented out, triggering on a non-`v` tag would publish artifacts with an incorrect version string. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
