EmryZhang opened a new pull request, #537:
URL: https://github.com/apache/casbin-jcasbin/pull/537
The current release routes can publish rebuilt Maven files through Central
without an ASF Nexus review repository. The existing Java8 Javadoc also
bundles
resources whose precise licensing was not established during release review.
This consolidated correction prepares the source for a replacement candidate
after #535 and the cancelled RC2.
## Changes
- Keep Java8 compilation, runtime, Java sources and runtime/test dependency
versions unchanged. Generate release Javadoc with pinned Temurin OpenJDK
25.0.4.1+1, retain its resource notices, and bundle the complete UPL, MIT
and
DejaVu terms. Ordinary Java8 development builds remain available;
reproducing
the release documentation additionally uses the pinned SDK and Python3.
- Add a checked candidate-build entry point, a distinct PR documentation job
and RC verification before source packaging. Reject the wrong doclet,
incompatible class files, missing licenses and unknown documentation
assets.
- Replace the Central autoPublish extension with Deploy Plugin3.2.0 and the
ASF
staging/snapshot endpoints. Document deploy-file upload of already reviewed
and signed files, with separate repository close/review/promotion.
- Remove the independent Central publishing workflow and final-tag Maven
rebuild. Final GitHub releases continue to verify and reuse promoted ASF
source originals. Update BUILDING and RELEASING for the complete route.
The change affects 13 files (+946/-198); 523 added lines are legal material
and
207 are the two build/check scripts. No Java business implementation changes.
## Validation
- Clean source extraction: 338 Java8 tests passed, with no
failures/errors/skips;
11 existing release-helper tests passed.
- Final 224-file tar.gz/ZIP contents match the proposal; the patch applies to
the #535 baseline. Final workflow-only adjustments were rechecked; build,
Java/POM and legal inputs are identical to the full test run.
- All 94 main class files are major52 and byte-identical to the preceding
RC2-source local build; all 80 Java sources match. Actual Java8 allow/deny
consumer passed. Whole JAR/POM hashes change and require new signatures.
- Main/sources/Javadoc legal files and flattened/embedded POM checked;
43 actual documentation resources mapped and 9,936 local references
resolve.
Four mutated/wrong-toolchain cases are rejected.
- Ordinary Java8 build and the separate documentation CI entry point passed
locally. Both workflows pass actionlint with shellcheck disabled.
- Deploy-file preserves all eight files and their layout in a local file
repository; its four `.asc` attachments are explicit probe data, not real
signatures or an ASF permission test.
RAT 0.16.1 scans all 224 files without exclusions. It reports two
unrecognized
files: `src/main/javadoc/legal/UPL-1.0.txt` and `dejavufonts.md`. These are
complete
third-party legal documents, checked against the Oracle UPL text and the
verified SDK legal file respectively. Their full content and original notices
are retained; no false ASF headers or RAT exclusions were added.
These are Windows local checks; hosted Linux CI remains to run on this PR.
Runtime dependencies are unchanged, with no new IDs in the scoped advisory
refresh; existing assessed Jackson matches are not represented as fixed.
Actual merged-candidate checks, named source/binary review, fresh signing,
source and closed Maven staging, and new project/PPMC and IPMC votes remain
required before publication. No old votes or signatures carry over.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
