uranusjr commented on code in PR #69643: URL: https://github.com/apache/airflow/pull/69643#discussion_r3549632427
########## .github/workflows/java-sdk-release-verify.yml: ########## @@ -0,0 +1,164 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +# Runs the Java SDK reviewer checklist ("Verifying a release" in +# java-sdk/README.md) automatically, minus the GPG signature (only the release +# manager's key can satisfy that). +# +# * on a pull request touching java-sdk/ -> verify HEAD can produce a source +# release that is self-contained and builds from scratch. +# * on a `java-sdk/**` tag push -> the same check against the tagged commit +# (release readiness gate). +# * on manual dispatch -> verify the ACTUAL staged artifacts: the source +# package in dist/dev and the closed Nexus staging repo. Run this after +# staging, before sending the [VOTE] email. +--- +name: Java SDK release verification + +on: # yamllint disable-line rule:truthy + pull_request: + paths: + - "java-sdk/**" + - ".github/workflows/java-sdk-release-verify.yml" + push: + tags: + - "java-sdk/**" + workflow_dispatch: + inputs: + tag: + description: "Java SDK release tag (starts with 'java-sdk/') to verify" + required: true + type: string + nexus_repo_id: + description: "Nexus staging repo id (the NNNN in orgapacheairflow-NNNN)" + required: true + type: string + +permissions: + contents: read + +concurrency: + group: java-sdk-release-verify-${{ github.event_name }}-${{ github.ref }}-${{ inputs.tag }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +env: + JAVA_VERSION: "11" + +jobs: + source-release: + name: Source release builds cleanly + if: github.event_name != 'workflow_dispatch' + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.event_name == 'push' && github.ref || github.sha }} + fetch-depth: 0 + persist-credentials: false + - name: Set up JDK ${{ env.JAVA_VERSION }} + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 + with: + distribution: temurin + java-version: ${{ env.JAVA_VERSION }} + - name: Use an isolated Gradle home + run: echo "GRADLE_USER_HOME=${RUNNER_TEMP}/gradle-home" >> "$GITHUB_ENV" + - name: Resolve the ref to build the source release from + run: | + set -euo pipefail + if [ "${{ github.event_name }}" = "push" ]; then + echo "RELEASE_REF=${GITHUB_REF_NAME}" >> "$GITHUB_ENV" + else # A PR HEAD. + echo "RELEASE_REF=$(git rev-parse HEAD)" >> "$GITHUB_ENV" + fi + - name: Build the source tarball from the ref (project's wrapper) + working-directory: java-sdk + run: ./gradlew --no-daemon sourceTarball checksumSourceTarball -PgitRef="${RELEASE_REF}" + - name: Install the latest Gradle to bootstrap a new wrapper for the source extracted from the tarball + run: | + set -euo pipefail + meta=$(curl -fsSL https://services.gradle.org/versions/current) + ver=$(echo "$meta" | jq -r .version) + url=$(echo "$meta" | jq -r .downloadUrl) + sum=$(curl -fsSL "$(echo "$meta" | jq -r .checksumUrl)") + curl -fsSL -o /tmp/gradle.zip "$url" + echo "${sum} /tmp/gradle.zip" | sha256sum -c - + unzip -q -d "$HOME/gradle" /tmp/gradle.zip + echo "$HOME/gradle/gradle-${ver}/bin" >> "$GITHUB_PATH" Review Comment: I want to keep this separate so the script can more easily be tested on its own if Gradle is already available (it usually is). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
