Jens-G opened a new pull request, #3912: URL: https://github.com/apache/thrift/pull/3912
Doc-only. Follow-up to the Windows packaging series ([#3901](https://github.com/apache/thrift/pull/3901), [#3893](https://github.com/apache/thrift/pull/3893), [#3895](https://github.com/apache/thrift/pull/3895), [#3896](https://github.com/apache/thrift/pull/3896), [#3898](https://github.com/apache/thrift/pull/3898), [#3897](https://github.com/apache/thrift/pull/3897)), all merged. Six workflows publish something when a GitHub release is published — `pypi.yml`, `release_ruby.yml`, `release_rust.yml`, `dotnet-tool.yml`, `winget.yml`, `chocolatey.yml`. Between them they need one repository variable, two repository secrets and four trusted-publishing policies on the receiving side. **Every one of those was already documented, and no two of them in the same place:** | | was documented in | |---|---| | `CHOCO_API_KEY` | the Chocolatey prose | | `WINGET_TOKEN` | the WinGet prose | | NuGet policy + `NUGET_USER` | a bullet under *Third Party Package Managers* | | PyPI policy | a different bullet in the same list | | crates.io, RubyGems policies | nowhere | So a release manager preparing their first release could only find out what needs setting up by reading the whole document, and couldn't tell "not configured yet" from a real failure. This adds one `### Release Automation Credentials` section: what each item is, secret vs. variable, which workflow consumes it, and what happens when it's missing. The per-package prose stays where it is — the new section is the lookup and links into it rather than duplicating it. ## Three things worth writing down - **Four of the six hold no stored credential at all.** PyPI, RubyGems, crates.io and NuGet publish over trusted publishing, exchanging the run's OIDC token for a short-lived key. What has to exist is a *policy* naming this repo, the workflow file and the `release` environment. Only WinGet and Chocolatey use a stored secret, because neither has an OIDC path. - **`WINGET_TOKEN` must be a _classic_ PAT** with `public_repo`. Fine-grained tokens are not supported by `wingetcreate`. - **A green run does not prove anything was published.** The WinGet and Chocolatey steps deliberately do *not* fail when their secret is absent — they build and upload the artifact, emit a `::warning::` and print how to publish by hand in the run summary. That keeps a missing secret from failing a release, but it means the summary is what to read, not the tick. ## Verified, not transcribed Every row was checked against the merged workflows rather than written from memory: - `NUGET_USER` is referenced as `vars.` (a variable); `WINGET_TOKEN` and `CHOCO_API_KEY` as `secrets.` - all six publish jobs carry `environment: release` - exactly the four trusted-publishing ones carry `id-token: write` - both degrading steps really do `exit 0` after their guard, with a `::warning::` and a step-summary block The table is 7 rows × 4 columns, well-formed, and the `#chocolatey` anchor resolves. JIRA: [THRIFT-6327](https://issues.apache.org/jira/browse/THRIFT-6327) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
