Create stage-release-candidate.yml#1161
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow to automate staging Apache Pekko HTTP 1.4.0 release candidates (source artifacts to Apache dist/ATR, binary artifacts to Nexus staging, and generating a vote email template), aligning with the project’s documented release process.
Changes:
- Introduces a
workflow_dispatchworkflow with toggles to stage source tarballs (SVN + ATR) and jars (Nexus). - Automates source tarball creation/signing and SVN/ATR staging.
- Adds a job to generate a release vote email template by pulling context from ASF lists + GitHub.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| run: |- | ||
| sudo apt-get install graphviz | ||
|
|
||
| # We intentionally do not use the Coursier cache for release candiates, |
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 |
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 |
| REF: ${{ github.ref_name }} | ||
|
|
||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5.0.1 |
| # reducing attack surface, but this seems to be the state of the art: | ||
| - name: Build, sign and stage artifacts | ||
| run: |- | ||
| VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") |
| export RC_VERSION=$(echo $REF | tail -c +2) | ||
| export DIR="HTTP-$RC_VERSION" | ||
|
|
||
| mkdir $DIR | ||
| cp ../archive/* $DIR | ||
| svn add $DIR | ||
| svn commit --username "$PEKKO_SVN_DEV_USERNAME" --password "$PEKKO_SVN_DEV_PASSWORD" --message "Stage Pekko HTTP $RC_VERSION" $DIR |
| export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/") | ||
| export RC_VERSION=$(echo $REF | tail -c +2) |
| export DISCUSS=$(curl 'https://lists.apache.org/api/stats.lua?list=dev&domain=pekko.apache.org' | jq ".emails.[] | .subject, .mid" | grep -A1 "$MODULE $VERSION" | tail -1 | tr -d \") | ||
| echo "DISCUSS=$DISCUSS" | ||
| export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true" | jq .thread.mid | tr -d \") | ||
| echo "DISCUSS_THREAD=$DISCUSS_THREAD" |
| export RELEASE_NOTES=https://github.com/apache/pekko-http/pull/$(curl https://api.github.com/repos/apache/pekko-http/pulls?state=all | jq ".[] | .title, .number" | grep -A1 "Release notes for $VERSION" | tail -1) | ||
| echo "RELEASE_NOTES=$RELEASE_NOTES" | ||
|
|
||
| export SENDER=$(curl "https://api.github.com/users/$ACTOR" | jq .name | tr -d \") | ||
| echo "SENDER=$SENDER" |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
He-Pin
left a comment
He-Pin
left a comment
There was a problem hiding this comment.
Reviewing line by line. The workflow structure is solid and follows the established pattern from the pekko repo. A few findings below.
| echo "Trigger this workflow on an RC tag" | ||
| exit 1 | ||
| fi | ||
| export VERSION=$(echo $REF | sed -e "s/\(.*\)-.*/\\1/") |
There was a problem hiding this comment.
This sed pattern is missing the leading . that all the other jobs use. With tag v1.4.0-RC1:
# This step (line 194):
echo "v1.4.0-RC1" | sed -e "s/\(.*\)-.*/\1/" → v1.4.0 ← keeps the v prefix
# Other jobs (lines 61, 136, 248):
echo "v1.4.0-RC1" | sed -e "s/.\(.*\)-.*/\1/" → 1.4.0 ← correct
The "Build, sign and stage artifacts" step (line 230) uses the correct pattern, so artifacts are not mis-versioned — but this check step prints Version: v1.4.0 in the log, which is misleading when debugging. This same copy-paste bug also exists in apache/pekko line 193.
Suggest aligning with the other jobs:
export VERSION=$(echo $REF | sed -e "s/.\(.*\)-.*/\\1/")
| export DISCUSS_THREAD=https://lists.apache.org/thread/$(curl "https://lists.apache.org/api/thread.lua?id=$DISCUSS&find_parent=true" | jq .thread.mid | tr -d \") | ||
| echo "DISCUSS_THREAD=$DISCUSS_THREAD" | ||
|
|
||
| export RELEASE_NOTES=https://github.com/apache/pekko-http/pull/$(curl https://api.github.com/repos/apache/pekko-http/pulls?state=all | jq ".[] | .title, .number" | grep -A1 "Release notes for $VERSION" | tail -1) |
There was a problem hiding this comment.
The GitHub API default pagination is 30 items per page. This repo has 1000+ PRs, so if the "Release notes for $VERSION" PR isn't among the 30 most recently updated ones, this grep will fail silently and RELEASE_NOTES will be a broken URL.
Adding &per_page=100 helps but is still fragile. A more reliable approach would be the search API:
gh pr list --repo apache/pekko-http --state all \
--search "Release notes for $VERSION in:title" \
--json number --jq '"https://github.com/apache/pekko-http/pull/" + (.[0].number | tostring)'Minor concern since for 1.4.0 the release-notes PR will likely be recent enough, but worth hardening before this workflow is reused for future releases.
There was a problem hiding this comment.
this is a copy of a script we have in lots of places and it's been working ok - I'd prefer to keep the script as is since this PR does not target main and the improvements should go there first
The generated email is just a template, easily fixed by hand.
This CI script simply doesn't need to be bomb-proof.
part of releasing 1.4.0