{{ message }}
Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The existing release workflow permits manual dispatch and checks out a mutable
target_commitishbefore running Maven with Central, signing and GitHub App credentials. Replace it with a release-only caller pinned to the published shared workflow at66a9a97773cc85395300f855935abc0e169a615bin PlaytikaOSS/playtika-workflows.The shared workflow resolves and verifies the exact release tag commit on the protected release branch, checks allowed actors and the protected Environment, builds without publication secrets, and attests the resulting bundle. After independent Environment approval, a separate job rechecks authorization and provenance, then signs and publishes through the official JReleaser action without executing caller build code. Manual publication and the GitHub App write token are removed.
.github/RELEASING.mddocuments the caller configuration and upgrade pins.Validation: the shared workflow's 17 policy/artifact regression tests passed locally and in GitHub Actions; actionlint and diff checks passed. A full feign-reactive Maven reactor staged 64 POM/JAR artifacts, and an official JReleaser 1.26.0 dry run signed and packaged them using a disposable test key. No live Central deployment was performed. Required Java CI must cover tests because this release caller uses
skip-tests: true.Before enabling releases, complete the caller onboarding settings:
RELEASE_ACTORS, protected branch and version tags, and amaven-centralEnvironment with independent reviewers, the tag-only policy and all five publication/signing secrets. Remove repository-level duplicates and exclude this repository from organization copies of those secrets. Publication fails closed until the required policy is configured. This PR remains a draft for that rollout.