Re: [PR] optimize: restore Snap.svg header and stop RC Docker publish [incubator-seata]

[via GitHub]

Copilot commented on code in PR #8227:
URL: https://github.com/apache/incubator-seata/pull/8227#discussion_r4045170782


##########
.github/workflows/publish-docker.yml:
##########
@@ -47,39 +54,40 @@ jobs:
       # step 3
       - name: "Print maven version"
         run: ./mvnw -version
-      # step 4 based on java8
-      - name: "Publish images to DockerHub based on java8"
-        if: matrix.java == 8
+      # step 4 snapshot/dev java8 (never release-image)
+      - name: "Publish snapshot images to DockerHub based on java8"
+        if: ${{ matrix.java == 8 && (github.event_name != 'workflow_dispatch' 
|| inputs.publish_release == false) }}

Review Comment:
   A manual dispatch with the default `publish_release=false` still executes 
this publishing step. The `image` profile enables Jib publishing but leaves 
`image.tags` at its default `latest` (`build/pom.xml:148`), which both server 
image configurations consume. As a result, a default manual run from any 
selected ref can retarget `latest` even though release publishing was not 
enabled. Do not run this snapshot path for `workflow_dispatch`; only the 
explicitly opted-in release steps should publish on manual runs.



##########
.github/workflows/publish-docker.yml:
##########
@@ -47,39 +54,40 @@ jobs:
       # step 3
       - name: "Print maven version"
         run: ./mvnw -version
-      # step 4 based on java8
-      - name: "Publish images to DockerHub based on java8"
-        if: matrix.java == 8
+      # step 4 snapshot/dev java8 (never release-image)
+      - name: "Publish snapshot images to DockerHub based on java8"
+        if: ${{ matrix.java == 8 && (github.event_name != 'workflow_dispatch' 
|| inputs.publish_release == false) }}
+        env:
+          REGISTRY_USERNAME: ${{ secrets.DOCKERHUB_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          ./mvnw -T 4C clean package 
-Dimage.name=eclipse-temurin:8u422-b05-jdk -Pimage -DskipTests -e -B 
-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn
+      # official tags: only workflow_dispatch with publish_release=true after 
the vote
+      - name: "Publish official images to DockerHub based on java8"
+        if: ${{ matrix.java == 8 && github.event_name == 'workflow_dispatch' 
&& inputs.publish_release }}

Review Comment:
   `workflow_dispatch` can target any branch, but `publish_release` is the only 
guard on every release step. Setting it to true on a feature or development 
branch builds that ref with Docker credentials and publishes its version tags 
(including `latest` for Java 8), even though the workflow says release images 
should be published only after an approved vote. Restrict release publishing to 
the repository's approved release-ref pattern, or protect these steps with a 
release environment that requires approval.



##########
distribution/NOTICE:
##########
@@ -4,6 +4,14 @@ Copyright 2023-2026 The Apache Software Foundation
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).
 
+Snap.svg
+Snap.svg is licensed under the Apache license version 2.0, January 2004 (see 
LICENSE file).
+Copyright (c) 2013 - 2017 Adobe Systems Incorporated. All rights reserved.
+
+This product contains a modified portion of Snap.svg
+(https://github.com/adobe-webplatform/Snap.svg/blob/master/src/svg.js)
+in saga/seata-saga-statemachine-designer/src/render/PathMap.js.
+

Review Comment:
   This tracked aggregate is not the NOTICE packaged at the distribution root. 
During `prepare-package`, `distribution/pom.xml:150-184` rebuilds 
`target/NOTICE` from the common headers of `NOTICE-server` and 
`NOTICE-namingserver`, and `release-seata.xml:197-227` packages that generated 
file plus both component NOTICE files. Neither source NOTICE contains this 
Snap.svg attribution, so a release build omits it from all packaged NOTICE 
files. Add the block to the common header of both component NOTICE files and 
regenerate this aggregate.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscr...@seata.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscr...@seata.apache.org
For additional commands, e-mail: notifications-h...@seata.apache.org