jamesfredley commented on PR #15805: URL: https://github.com/apache/grails-core/pull/15805#issuecomment-4997825911
I dug into this, and the factual premise is correct for the PR **as written** - but there's a compliant path that still achieves the goal, so I don't think we have to abandon skill distribution. **Why the objection holds for the current approach:** the SkillsJars web service clones the repo, generates `com.skillsjars:apache__grails-core__...` coordinates, signs/bundles them, and uploads them to Maven Central *itself*. That's third-party publication of unvoted, commit-derived artifacts, outside the ASF Nexus / PMC release path. ASF release policy requires artifacts to be staged in ASF Nexus, approved by a PMC vote (>=3 binding +1, >72h), and promoted to Central through ASF infra ([release policy](https://www.apache.org/legal/release-policy.html#release-approval), [publishing guide](https://infra.apache.org/publishing-maven-artifacts.html)). So routing through the SkillsJars publisher does conflict with the voting rules. **The compliant alternative** (and I think what we actually want): build the skills jar in the `grails-core` build and publish it as a normal `org.apache.grails:*` artifact **as part of the standard Apache Grails release candidate** - staged, signed, and covered by the same PMC vote as every other `grails-*` jar. ASF policy [expressly permits](https://www.apache.org/legal/release-policy.html#compiled-packages) shipping binary jars alongside the voted source release when they're the same version and built from that release's source. That gives end users a Maven-Central-published skills artifact (closing the #15454 distribution blocker, on top of the already-merged skill content in #15798) with none of the direct-publish problem. So the fix is to swap the *distribution mechanism*: package + publish the skills through the ASF release pipeline (voted) rather than via the SkillsJars external publisher. I'll rework the PR along those lines. No prior dev@ thread found on this - I'll start one so the packaging/coordinates get consensus before we wire it into the release. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
