ppkarwasz opened a new pull request, #521: URL: https://github.com/apache/logging-parent/pull/521
`verify-reproducibility-reusable` checked out `github.ref`, i.e. the branch head, while `deploy-snapshot-reusable` builds `github.sha`. If another push lands before the check runs, the rebuilt artifacts differ from the deployed ones and `artifact:compare` fails. This happened in https://github.com/apache/logging-flume/actions/runs/34636594499: `deploy-snapshot` built 6a988319, but `verify-reproducibility-snapshot` checked out trunk, which had meanwhile moved to c90b93ec (a dependency bump). The flattened `flume-third-party-dependencies` BOM therefore differed from the deployed one. The "Checksum validation failed, no checksums available" warnings in that log are unrelated: `nexus-staging-maven-plugin` writes no checksum files in its deferred directory, and passing runs show the same warnings. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
