Skip to content

Split release preparation from tag-scoped publication - #393

Merged
devopvoid merged 2 commits into
mainfrom
codex/validate-release-build-ref
Oct 16, 2026
Merged

devopvoid merged 2 commits into
mainfrom
codex/validate-release-build-ref

Conversation

@devopvoid

@devopvoid devopvoid commented Oct 16, 2026 •

Copy link
Copy Markdown
Owner

Platform builds accepted a caller-supplied checkout ref, which CodeQL flags as a cache-poisoning path in alerts #25–#27. Replacing it with github.sha inside the existing release run would build the pre-release commit rather than the tag created during preparation.

Split preparation from publication so the publishing run is triggered on the release tag itself:

  • Prepare release runs from main, atomically pushes the release commits and tag, then explicitly dispatches release-publish.yml on that tag. This uses GITHUB_TOKEN with actions: write because its tag pushes do not trigger push workflows.
  • Publish release accepts tag pushes or manual dispatch on a tag. It verifies the vX.Y.Z tag still matches the triggering SHA, the commit belongs to main, and the root pom matches the tag before starting builds.
  • Platform builds, native tests, and publishing check out github.sha directly; the reusable workflow no longer accepts a ref input.
  • Dry runs remain in preparation, build the dispatched SHA with the release version, and assemble a signed bundle using placeholder Central credentials with uploads disabled.
  • The build guide documents the new flow and retry procedure. No new secret is required.

Validation: actionlint passed across all workflows; 14 temporary-repository behavioral cases passed, including annotated tags, main advancing after release, branch dispatch rejection, moved or unmerged tags, version mismatch, and preparation input validation. Workflow structure checks verified fixed-SHA checkouts, dependency gates, dispatch permissions, and dry-run isolation. Whitespace checks passed. GitHub Actions and CodeQL results are pending; no release was run.

@devopvoid devopvoid changed the title Validate release refs before platform builds Split release preparation from tag-scoped publication Oct 16, 2026
@devopvoid
devopvoid merged commit ea12812 into main Oct 16, 2026
25 checks passed
@devopvoid
devopvoid deleted the codex/validate-release-build-ref branch October 16, 2026 22:05
SendableMetatype added a commit to EduGeyser/webrtc-java that referenced this pull request Oct 18, 2026
Ports upstream's split (devopvoid#391 to devopvoid#393) to the Gradle build. Prepare
release commits the changelog and the versions, pushes main and the tag
in one atomic push, and dispatches Publish release on the tag. Publish
release checks that the tag points to the triggering commit, that the
commit is on main and that its version matches gradle.properties, then
builds and tests every platform, publishes the Maven Central bundle and
drafts the GitHub release. A failed publication can be retried on the
same tag, without preparing a new version.

Every platform job builds the commit that triggered the caller, so the
ref input of the platform and test workflows is gone. A dry run builds,
tests and bundles with the release version, which -Pversion sets, so
the jars and the bundle are named as in a release. Unlike upstream's, a
dry run can check a branch other than main.
SendableMetatype added a commit to EduGeyser/webrtc-java that referenced this pull request Oct 18, 2026
Brings in the work upstream added from October 15 to 17: temporal
layers in the VA-API encoders and VP9 spatial layers in the VA-API
decoder (devopvoid#379 to devopvoid#381, devopvoid#383, devopvoid#388); a standalone voice activity
detector, and checks against using a disposed one (devopvoid#394); the removal
of Logging.logThreads (devopvoid#395); upstream's 0.20.0 release and its release
workflow changes (devopvoid#391 to devopvoid#393); and docs (devopvoid#378, devopvoid#382, devopvoid#384 to devopvoid#386,
devopvoid#389, devopvoid#390).

Fork-side adaptations:
- Logging keeps this fork's design, in which thread IDs and timestamps
  come from system properties read at load time. devopvoid#395's thread IDs that
  are always on and its runtime Logging.logTimestamps are left out. Its
  logging test change, which logs at INFO, is taken.
- The common WebRTC patches of devopvoid#394 are applied on every platform, as
  upstream does. The data channels desktop capture patch joins the patch
  list before it is recorded, so the build record covers it too.
- The data channels variant leaves out the standalone voice activity
  detector, and its test carries the media tag.
- The release workflow stays this fork's Gradle one. Upstream's
  Maven-based split into preparation and tag-scoped publication
  (release-publish.yml and the publish action) is left out, and so is
  its release notes link to jrtc.dev, which documents upstream's
  packages.
- The Maven files stay deleted, and the README and the docs' version
  stay this fork's own.
SendableMetatype added a commit to EduGeyser/webrtc-java that referenced this pull request Oct 18, 2026
Ports upstream's split (devopvoid#391 to devopvoid#393) to the Gradle build. Prepare
release commits the changelog and the versions, pushes main and the tag
in one atomic push, and dispatches Publish release on the tag. Publish
release checks that the tag points to the triggering commit, that the
commit is on main and that its version matches gradle.properties, then
builds and tests every platform, publishes the Maven Central bundle and
drafts the GitHub release. A failed publication can be retried on the
same tag, without preparing a new version.

Every platform job builds the commit that triggered the caller, so the
ref input of the platform and test workflows is gone. A dry run builds,
tests and bundles with the release version, which -Pversion sets, so
the jars and the bundle are named as in a release. Unlike upstream's, a
dry run can check a branch other than main.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant