HyukjinKwon opened a new pull request, #87:
URL: https://github.com/apache/spark-connect-rust/pull/87
### What changes were proposed in this pull request?
The release workflow runs in a committer's fork, but its tags and GitHub
Releases were being created on the **fork** (via the built-in `GITHUB_TOKEN`,
which can only write to the repo running the workflow). This redirects every
tag/release **write** to the canonical **`apache/spark-connect-rust`** repo:
- the RC tag push,
- the RC GitHub pre-release (`gh release create/upload/view`),
- the finalize check-out/download of the RC (now from apache),
- the permanent `v<version>` tag push,
- the RC pre-release/tag cleanup.
Cross-repo writes need a credential the built-in token can't provide, so
those operations now authenticate with a new **`RELEASE_GITHUB_TOKEN`** PAT
(write/`contents` access to `apache/spark-connect-rust`) stored as a fork
secret. The built-in `GITHUB_TOKEN` drops to `contents: read`. Release
**source** was already fetched from apache.
### Why are the changes needed?
The workflow only *runs* in a fork (for the publish tokens); the release
artifacts of record — tags and GitHub Releases — should live on the canonical
apache repo, not scattered across committer forks.
### Does this PR introduce _any_ user-facing change?
No change to released artifacts. It changes where the release tags / GitHub
Releases are created.
### How was this patch tested?
`release.yml` parses as valid YAML; verified no
`GITHUB_REPOSITORY`/`github.token` references remain in the tag/release paths,
`github.repository` appears only in the two dispatch guards, and every
tag/release op targets `${UPSTREAM_REPO}` with `RELEASE_GITHUB_TOKEN`.
### Setup required before a real release
Add a fork secret `RELEASE_GITHUB_TOKEN`: a PAT with write (`contents`)
access to `apache/spark-connect-rust` (a committer's classic PAT with
`public_repo` scope suffices, since the repo is public). Ensure no apache
tag-protection ruleset blocks the PAT from pushing `v*` tags.
> **Note (stacked):** this branch is based on the PR #84 branch (SPARK-59101
/ SPARK-59100), so until #84 merges this PR's diff also shows those commits.
Merge #84 first, then rebase this onto master.
This pull request and its description were written by Isaac.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
