Repository navigation
ci: split release profile CI into two tiers - #972
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the RELEASE.md documentation to describe a new two-tier CI verification process for the release profile. Tier 1 runs on all PRs without secrets, while Tier 2 runs with secrets for allow-listed maintainers and specific branches. The review feedback suggests clarifying whether tests are executed during Tier 1; if they are, the documentation should explicitly mention test verification and failures under both the Tier 1 description and the workflow reference section.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
The previous version of the documentation verified No compilation or test failures. The updated Tier 1 list only mentions No compilation failures on line 88, and the Maven command on line 85 does not include -DskipTests.
- If Tier 1 still runs tests, we should keep the mention of test failures to accurately reflect what is verified.
- If Tier 1 is intended to skip tests for speed, we should explicitly add
-DskipTeststo the Maven command on line 85.
Assuming tests are still run, this suggestion restores the test verification mention.
| - ✅ Build succeeds with `-Prelease` profile (`-Dgpg.skip=true -Drelease.auto.publish=false`) | |
| - ✅ All JavaDoc generation succeeds | |
| - ✅ GPG signing works correctly | |
| - ✅ JBang version validation passes | |
| - ✅ No compilation or test failures | |
| - ✅ No compilation failures | |
| - ✅ Build succeeds with `-Prelease` profile (`-Dgpg.skip=true -Drelease.auto.publish=false`) | |
| - ✅ All JavaDoc generation succeeds | |
| - ✅ JBang version validation passes | |
| - ✅ No compilation or test failures |
| ### build-with-release-profile.yml (Tier 1 — Trigger) | ||
| - **Triggers**: All PRs, all pushes, manual dispatch | ||
| - **Purpose**: Build with `-Prelease` profile without secrets; upload PR info for Tier 2 | ||
| - **Catches**: Compilation, javadoc, plugin configuration issues |
There was a problem hiding this comment.
If Tier 1 runs tests (as it does not specify -DskipTests), it will also catch test failures. Consider adding test to the list of caught issues for completeness.
| - **Catches**: Compilation, javadoc, plugin configuration issues | |
| - **Catches**: Compilation, javadoc, test, plugin configuration issues |
There was a problem hiding this comment.
Hard-coding writers and allowed branches might not be maintainable on the long run.
It seems doable to have a check that only users with write permissions to the repository could run this job. (https://github.com/actions-cool/check-user-permission)
Another thing that might work is using environments with requested reviewers (https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/review-deployments#approving-or-rejecting-a-job)
Tier 1 (all PRs, no secrets): runs mvn install -Prelease with GPG and publishing skipped to catch compilation/javadoc issues early. Tier 2 (allow-listed actors + protected branch pushes, with secrets): adds actor allow-list, allow-unsafe-pr-checkout, and Sonatype credential validation. Fixes actions/checkout@v7 fork-checkout block. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 participants
Tier 1 (all PRs, no secrets): runs mvn install -Prelease with GPG and publishing skipped to catch compilation/javadoc issues early.
Tier 2 (allow-listed actors + protected branch pushes, with secrets): adds actor allow-list, allow-unsafe-pr-checkout, and Sonatype credential validation. Fixes actions/checkout@v7 fork-checkout block.