Fix release signing gate; bump next version shape; refresh Maven badge#1781
Merged
Conversation
The Sign task `onlyIf` and `signing.required` predicates referenced
`gradle.taskGraph.hasTask("publishAllPublicationsToCentralPortal")`, but
hasTask compares against `task.getPath()` which for a root-project task
is `:publishAllPublicationsToCentralPortal` (with leading colon). The
name-only string never matched, so signing was permanently disabled
for every release task. Drop the redundant task-graph check entirely;
`-Drelease=true` already gates the release flow via the pre-flight
checks above (HEAD on a clean semver tag), so gating signing purely on
`isRelease` is the right intent.
Set `nextVersionBump = "x.x.x"` so snapshot builds compute 5.0.1 as the
next planned release, ahead of an expected 5.0.x point release.
Replace the dead `maven-badges.herokuapp.com` Maven Central badge
(Heroku free tier shut down in late 2022) with an `img.shields.io`
equivalent, and point the click-through at the current Sonatype Central
artifact page instead of the defunct `search.maven.org` hash-fragment
URL.
…ions. The "Install Samtools" step was running `apt-get upgrade` with no package list, which upgrades every package on the runner — including the firefox transitional `.deb` that bootstraps the Firefox snap. When the snap store is unreachable (an intermittent failure mode), the upgrade blocks for ~50 minutes and then fails the job, even though htsjdk needs nothing from firefox. Drop the upgrade entirely; the only packages this script needs are the three -dev libs already installed explicitly. Bump samtools to 1.23.1 and cache the built binary keyed on version + OS, so subsequent runs skip the ~3-5 min compile. Move the install prefix to /usr/local since /usr is reserved for the distro package manager and is the conventional location for locally-built software. Bump actions/checkout and actions/setup-java to v4 (v3 ran on Node 16, which is end-of-life on the Actions runtime), and switch the JDK distribution from `adopt` to its current name `temurin`.
The previous setup relied on actions/setup-java's `cache: gradle` option, which caches `~/.gradle/caches` (resolved dependencies) but NOT `~/.gradle/wrapper/dists/`. Every CI run was therefore re-downloading the ~150 MB Gradle distribution zip on top of its own cold dependency resolution. Gradle publishes an official action that handles both: the wrapper distribution and the dependency cache, with smarter cache-key heuristics than setup-java's basic option. Drop `cache: gradle` from setup-java and add `gradle/actions/setup-gradle@v4` after it in each job.
We've been seeing intermittent `OutOfMemoryError: Java heap space` in CI test runs. With TestNG `parallel = "classes"` running availableProcessors() threads in a single JVM, peak heap demand scales with concurrency, and 12G was right at the edge on the 16G GitHub runner. Bump test JVM `maxHeapSize` to 14G. To make that safe, pin the gradle daemon's own footprint via gradle.properties (-Xmx512m + Metaspace cap) so it doesn't compete for the same physical RAM. Combined budget on a 16G runner: ~14G test heap + ~1G test non-heap + ~1G daemon + OS headroom.
The previous test asserted a substring match against a hardcoded version string, which broke any time CI bumped samtools (just happened: 1.21 → 1.23.1). htsjdk only cares that the local samtools is at least the version the tests were written against, not that it's exactly that version, so do a numeric semver comparison instead. Adds two small package-private helpers to SamtoolsTestUtils: - parseSamtoolsVersion(String) extracts the version from `samtools --version` output via a single regex. - compareVersions(a, b) compares two dotted-numeric version strings component-by-component, treating missing trailing components as zero. The version test now parses the running samtools version and asserts it is >= minimumSamtoolsVersion (renamed from expectedSamtoolsVersion to reflect the new semantics, bumped to 1.23.1 to match the version CI installs). Adds small unit tests for the parser and comparator covering typical output, two-component versions, missing version line, equality with implicit trailing zero, ordering across major/minor/patch, and the 1.10 vs 1.9 numeric-not-lexical case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SigntaskonlyIf(andsigning.required) gated ongradle.taskGraph.hasTask(\"publishAllPublicationsToCentralPortal\").TaskExecutionGraph.hasTask(String)matches ontask.getPath(), which for a root-project task is:publishAllPublicationsToCentralPortal(with leading colon). The name-only string never matched, so signing was silently disabled for every release task — the 5.0.0 dry-run produced no.ascfiles, and the upload would have shipped unsigned artifacts had we not worked around it with an init script. Drop the redundant task-graph check;-Drelease=truealready gates the entire release flow via the pre-flight checks (HEAD on a clean semver tag), so gating purely onisReleaseis the right intent.nextVersionBumpto\"x.x.x\"so snapshot builds compute 5.0.1 as the next planned release, in line with an expected 5.0.x point release.maven-badges.herokuapp.comURL (Heroku free tier shut down late 2022) with animg.shields.ioequivalent, and the defunctsearch.maven.orghash-fragment click-through with the currentcentral.sonatype.comartifact page.Test plan