Skip to content

Create stage-release-candidate.yml #1161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pjfanning merged 2 commits into from
Jul 13, 2026
Merged

Create stage-release-candidate.yml #1161

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5d8137c
Create stage-release-candidate.yml
pjfanning Jul 13, 2026
133a132
Potential fix for pull request finding
pjfanning Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
354 changes: 354 additions & 0 deletions .github/workflows/stage-release-candidate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,354 @@
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.

name: Stage release candidate

on:
workflow_dispatch:
inputs:
source-tar-to-svn:
description: "Stage the source tarball to svn (old)"
default: true
type: boolean
source-tar-to-atr:
description: "Stage the source tarball to ATR (new)"
default: true
type: boolean
jars:
description: "Stage the binary jars to nexus"
default: true
type: boolean
email-template:
description: "Generate vote email template"
default: true
type: boolean

permissions:
contents: read

jobs:
# Automating the step at https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#build-the-source-release-candidate
# Partly based on https://github.com/apache/daffodil/blob/main/.github/workflows/release-candidate.yml
stage-release-candidate-to-svn:
runs-on: ubuntu-24.04
if: ${{ inputs.source-tar-to-svn }}
steps:
- name: Check version parameter
run: |-
# To be enabled after this workflow has been tested:
#if [[ "$REF" != "v"* ]]; then
# echo "Trigger this workflow on a version tag"
# exit 1
#fi
if [[ "$REF" != *"-RC"* ]]; then
echo "Trigger this workflow on an RC tag"
exit 1
fi
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
export RC_VERSION=$(echo $REF | tail -c +2)
echo "Version: $VERSION"
echo "RC Version: $RC_VERSION"
env:
REF: ${{ github.ref_name }}

- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1
with:
fetch-depth: 0
fetch-tags: true
persist-credentials: false

- name: Generate source archive
run: |-
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
PREFIX=apache-pekko-http-$VERSION
Comment on lines +77 to +78
DATE=$(git log -n1 --format=%cs | tr -d -)
TARBALL=$PREFIX-src-$DATE.tgz

mkdir archive
git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > archive/$TARBALL
cd archive
sha512sum $TARBALL > $TARBALL.sha512
env:
REF: ${{ github.ref_name }}

- name: Sign source archive
run: |-
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
gpg -ab archive/*.tgz
env:
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}

- name: Install Apache Subversion
run: |-
sudo apt-get update
sudo apt-get install -y subversion

- name: Upload source dist
run: |-
svn checkout https://dist.apache.org/repos/dist/dev/pekko dist
cd dist

export RC_VERSION=$(echo $REF | tail -c +2)
export DIR="HTTP-$RC_VERSION"

mkdir $DIR
cp ../archive/* $DIR
svn add $DIR
svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR
Comment on lines +106 to +112
env:
PEKKO_SVN_DEV_USERNAME: ${{ secrets.PEKKO_SVN_DEV_USERNAME }}
PEKKO_SVN_DEV_PASSWORD: ${{ secrets.PEKKO_SVN_DEV_PASSWORD }}
REF: ${{ github.ref_name }}

stage-release-candidate-to-atr:
permissions:
id-token: write
contents: read
runs-on: ubuntu-24.04
if: ${{ inputs.source-tar-to-atr }}
steps:
- name: Check version parameter
run: |-
# To be enabled after this workflow has been tested:
#if [[ "$REF" != "v"* ]]; then
# echo "Trigger this workflow on a version tag"
# exit 1
#fi
if [[ "$REF" != *"-RC"* ]]; then
echo "Trigger this workflow on an RC tag"
exit 1
fi
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
export RC_VERSION=$(echo $REF | tail -c +2)
echo "Version: $VERSION"
echo "RC Version: $RC_VERSION"
env:
REF: ${{ github.ref_name }}

- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1
with:
fetch-depth: 0
fetch-tags: true
persist-credentials: false

- name: Generate source archive
id: generate-source-archive
run: |-
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
echo "version=$VERSION" >> $GITHUB_OUTPUT
PREFIX=apache-pekko-http-$VERSION
Comment on lines +153 to +155
DATE=$(git log -n1 --format=%cs | tr -d -)
TARBALL=$PREFIX-src-$DATE.tgz

mkdir dist
git archive --format=tar --prefix=$PREFIX/ HEAD | gzip -6 -n > dist/$TARBALL
cd dist
sha512sum $TARBALL > $TARBALL.sha512
env:
REF: ${{ github.ref_name }}

- name: Sign source archive
run: |-
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
gpg -ab dist/*.tgz
env:
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}

- name: Upload source dist
uses: apache/tooling-actions/upload-to-atr@ca6ed9e095c40db61c42a90db2599bb2fbc2319f
with:
project: pekko-http
version: ${{ steps.generate-source-archive.outputs.version }}

stage-jars-to-nexus:
runs-on: ubuntu-24.04
if: ${{ inputs.jars }}
steps:
- name: Check version parameter
run: |-
# To be enabled after this workflow has been tested:
#if [[ "$REF" != "v"* ]]; then
# echo "Trigger this workflow on a version tag"
# exit 1
#fi
if [[ "$REF" != *"-RC"* ]]; then
echo "Trigger this workflow on an RC tag"
exit 1
fi
export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/")

@He-Pin He-Pin Jul 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sed pattern is missing the leading . that all the other jobs use. With tag v1.4.0-RC1:

# This step (line 194):
echo "v1.4.0-RC1" | sed -e "s/\(.*\)-.*/\1/"   → v1.4.0  ← keeps the v prefix

# Other jobs (lines 61, 136, 248):
echo "v1.4.0-RC1" | sed -e "s/.\(.*\)-.*/\1/"   → 1.4.0   ← correct

The "Build, sign and stage artifacts" step (line 230) uses the correct pattern, so artifacts are not mis-versioned — but this check step prints Version: v1.4.0 in the log, which is misleading when debugging. This same copy-paste bug also exists in apache/pekko line 193.

Suggest aligning with the other jobs:

export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")

export RC_VERSION=$(echo $REF | tail -c +2)
echo "Version: $VERSION"
echo "RC Version: $RC_VERSION"
env:
REF: ${{ github.ref_name }}

- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1
with:
fetch-depth: 0
fetch-tags: true
persist-credentials: false

- name: Setup Java 17
uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
with:
distribution: temurin
java-version: 17

- name: Install sbt
uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.5.0

- name: Install Graphviz
run: |-
sudo apt-get install graphviz
Comment thread
pjfanning marked this conversation as resolved.
Outdated

# We intentionally do not use the Coursier cache for release candiates,
# to reduce attack surface

# It would be better to split this into 3 steps, where only the first
# uses sbt and the signing/staging are done with well-known tools
# reducing attack surface, but this seems to be the state of the art:
- name: Build, sign and stage artifacts
run: |-
VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
echo "$PEKKO_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show

sbt "set ThisBuild / version := \"$VERSION\"; +publishSigned"
sbt "set ThisBuild / version := \"$VERSION\"; sonatypePrepare; set ThisBuild / version := \"$VERSION\"; sonatypeBundleUpload; sonatypeClose"
env:
REF: ${{ github.ref_name }}
PEKKO_GPG_SECRET_KEY: ${{ secrets.PEKKO_GPG_SECRET_KEY }}
SONATYPE_USERNAME: ${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}
SONATYPE_PASSWORD: ${{ secrets.NEXUS_STAGE_DEPLOYER_PW }}

email-template:
runs-on: ubuntu-24.04
if: ${{ inputs.email-template }}
steps:
- name: Generate vote email template
run: |-
export MODULE="Pekko HTTP"
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
export RC_VERSION=$(echo $REF | tail -c +2)
Comment on lines +248 to +249
if [[ "$VERSION" =~ ^1\.([0-9]+)\.[0-9]+$ ]]; then
export BRANCH="1.${BASH_REMATCH[1]}.x"
else
export BRANCH="main"
fi
echo "VERSION=$VERSION"
echo "RC_VERSION=$RC_VERSION"
echo "BRANCH=$BRANCH"

export DISCUSS=$(curl 'https://lists.apache.org/api/stats.lua?list=dev&domain=pekko.apache.org' | jq ".emails.[] | .subject, .mid" | grep -A1 "$MODULE $VERSION" | tail -1 | tr -d \")
echo "DISCUSS=$DISCUSS"
export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true" | jq .thread.mid | tr -d \")
echo "DISCUSS_THREAD=$DISCUSS_THREAD"
Comment on lines +259 to +262

export RELEASE_NOTES=https://github.com/apache/pekko-http/pull/$(curl https://api.github.com/repos/apache/pekko-http/pulls?state=all | jq ".[] | .title, .number" | grep -A1 "Release notes for $VERSION" | tail -1)

@He-Pin He-Pin Jul 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The GitHub API default pagination is 30 items per page. This repo has 1000+ PRs, so if the "Release notes for $VERSION" PR isn't among the 30 most recently updated ones, this grep will fail silently and RELEASE_NOTES will be a broken URL.

Adding &per_page=100 helps but is still fragile. A more reliable approach would be the search API:

gh pr list --repo apache/pekko-http --state all \
  --search "Release notes for $VERSION in:title" \
  --json number --jq '"https://github.com/apache/pekko-http/pull/" + (.[0].number | tostring)'

Minor concern since for 1.4.0 the release-notes PR will likely be recent enough, but worth hardening before this workflow is reused for future releases.

@pjfanning pjfanning Jul 13, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a copy of a script we have in lots of places and it's been working ok - I'd prefer to keep the script as is since this PR does not target main and the improvements should go there first

The generated email is just a template, easily fixed by hand.

This CI script simply doesn't need to be bomb-proof.

echo "RELEASE_NOTES=$RELEASE_NOTES"

export SENDER=$(curl "https://api.github.com/users/$ACTOR" | jq .name | tr -d \")
echo "SENDER=$SENDER"
Comment on lines +264 to +268

echo "This template can be used to start a vote, either via manual email or via https://release-test.apache.org/compose/pekko-http/$VERSION"
echo
cat <<EOF;
Subject: [VOTE] Release Apache $MODULE $RC_VERSION

Hello Pekko Community,

This is a call for a vote to release Apache $MODULE version $RC_VERSION

The discussion thread:

$DISCUSS_THREAD

The release candidate:

https://dist.apache.org/repos/dist/dev/pekko/HTTP-$RC_VERSION
https://release-test.apache.org/vote/pekko-http/$VERSION

This release has been signed with a PGP key available here:

https://downloads.apache.org/pekko/KEYS

Release Notes:

$RELEASE_NOTES

Git branch for the release:

https://github.com/apache/pekko-http/tree/v$RC_VERSION
Git commit ID: $COMMIT_SHA

Please download, verify, and test.

We have also staged jars in the Apache Nexus Repository. These were built with the same code
as appears in this Source Release Candidate. We would appreciate if users could test with these too.
If anyone finds any serious problems with these jars, please also notify us on this thread.

https://repository.apache.org/content/groups/staging/org/apache/pekko/

You can add this resolver to sbt with 'resolvers += Resolver.ApacheMavenStagingRepo'

The VOTE will pass if we have more positive votes than negative votes
and there must be a minimum of 3 approvals from Pekko PMC members.
Anyone voting in favour of the release, could you please provide a list of the checks you have done?
The vote will be left open for at least 72hrs.

[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove with the reason

To learn more about Apache Pekko, please see https://pekko.apache.org/

Checklist for reference:

[ ] Download links are valid.
[ ] Checksums and signatures.
[ ] LICENSE/NOTICE files exist
[ ] No unexpected binary files
[ ] All source files have ASF headers
[ ] Can compile from source
[ ] Can verify the binary build

To compile from the source, please refer to:

https://github.com/apache/pekko-http/blob/$BRANCH/README.md#building-from-source

To verify the binary build, please refer to:

https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#verifying-the-binary-build

Some notes about verifying downloads can be found at:

https://pekko.apache.org/download.html#verifying-downloads

You can vote on ATR at https://release-test.apache.org/vote/pekko-http/$VERSION
or manually by replying to this email.


Thanks,

$SENDER (Apache Pekko PMC member)
EOF
env:
REF: ${{ github.ref_name }}
COMMIT_SHA: ${{ github.sha }}
ACTOR: ${{ github.actor }}
Loading