[Java] Replace maven-release-plugin with CI-friendly versions - #2603
Conversation
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Release retryability, tag validation, unsafe documentation, and automated coverage need correction.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 1
New issues introduced by this change (4)
| Severity | Finding |
|---|---|
 |
.github/workflows/publish.yml — The new Java tag silently accepts any pre-existing java/vX.Y.Z tag without checking its target.… |
 |
.github/workflows/publish.yml — A transient failure while dispatching the site workflow is not retryable: this step now runs at the… |
|
java/pom.xml — The release-only ${revision} override and flattening path is not exercised by the existing… |
 |
java/README.md — This local-validation command runs deploy with the Central publishing extension configured with… |
What changed in this PR
Reworks Java releases to use Maven CI-friendly ${revision} versions and immutable source commits without mutating main.
Changes:
- Replaces Maven release-plugin versioning with
${revision}. - Makes Maven publication read-only and source-SHA pinned.
- Moves Java tagging and site deployment into the shared release workflow.
| File | Description |
|---|---|
java/pom.xml |
Defines the shared revision and removes the release plugin. |
java/sdk/pom.xml |
Inherits the CI-friendly parent version. |
java/copilot-native/pom.xml |
Inherits the CI-friendly parent version. |
java/README.md |
Documents the new release model. |
.github/workflows/java-publish-maven.yml |
Publishes from an immutable SHA without repository writes. |
.github/workflows/publish.yml |
Passes the source SHA and handles Java tagging/site deployment. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Java tag failures cannot be retried after the non-idempotent GitHub Release creation succeeds.
Review tier: Balanced
Findings: None
Issues resolved since last review (4)
| Severity | Finding |
|---|---|
|
java/README.md — This local-validation command runs deploy with the Central publishing extension configured with… View resolved comment |
|
java/pom.xml — The release-only ${revision} override and flattening path is not exercised by the existing… View resolved comment |
|
.github/workflows/publish.yml — A transient failure while dispatching the site workflow is not retryable: this step now runs at the… View resolved comment |
|
.github/workflows/publish.yml — The new Java tag silently accepts any pre-existing java/vX.Y.Z tag without checking its target.… View resolved comment |
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
.github/workflows/publish.yml:511
- This tag operation is still placed after the non-idempotent
gh release createsteps. If the tag fetch or push fails transiently after the release has been created, rerunning the failedgithub-releasejob fails immediately because that release already exists, so the Java tag is never retried. Move Java tagging to its own downstream job (as done for the site dispatch), or make release creation safely idempotent before adding a later fallible step.
This comment has been minimized.
This comment has been minimized.
|
My understanding is that #2579 is a blocker to your plan to incorporate copilot-sdk into copilot-agent-runtime. Therefore, because I was busy on another task for my management, I sought and received help from fellow Berliner @SandraAhlgrimm . She has promptly delivered PR 2603 to fix this issue. I seek your review, in addition to the review I will provide. After this is merged, I intend to cut a preview release to test it out. But first, please take a close look. Thanks, Ed |
roji
left a comment
roji
left a comment
There was a problem hiding this comment.
Two remaining release-workflow issues: the publication test-skipping behavior with current main, and retryability of Java tagging after GitHub release creation.
There was a problem hiding this comment.
LGTM too - thanks @SandraAhlgrimm! - but @edburns is the Java authority here in any case.
@SandraAhlgrimm see my two comments above, one of these seems to explain why this PR is failing CI.
Make the Java release pipeline a read-only consumer of the commit being
released, consistent with the other SDKs. A Java release now creates no
commits on `main`, requires no elevated repository token or ruleset
bypass, and publishes artifacts whose version and source SHA match the
other SDK artifacts in the same release.
- POMs: adopt ${revision} CI-friendly versions (single <revision>
property in java/pom.xml); remove maven-release-plugin.
- java-publish-maven.yml: drop preflight/prepare-release/rollback-release;
add resolve-source; build all classifiers + deploy from one immutable
SHA with -Drevision; contents: read only; no JAVA_RELEASE_TOKEN.
- publish.yml: publish-java contents: read + sourceSha; create the
java/vX.Y.Z traceability tag and trigger the site deploy in
github-release after publication succeeds.
- java/README.md: document the new versioning/release model.
Fixes #2579
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Guard existing Java tags against source mismatches and separate site dispatch into an independently retryable job. Exercise a synthetic release revision across classifier builds and both locally installed Java artifacts, validate flattened POM coordinates, and replace the README deployment example with a non-publishing build. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use Maven install for CI's local release assembly instead of invoking Central's deploy goal, and remove the ineffective skipPublishing profile. Disable dependency caching in the SHA-selectable release workflow, including automatic npm caching and the unnecessary cached CLI setup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Bootstrap source validation from the trusted triggering commit and require main-branch publication. Accept only full commit SHAs reachable from main before checking out or executing the requested source. Pass only the validated source to every release build, preserve historical retries, and add source-trust regression coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Remove the obsolete repository push token and associate the documentation deployment token with the shared publish workflow. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: da1e04ac-3079-4aa4-b495-4358cb3c6b04
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3677753e-fc35-436e-934b-33aa3d07c4e0
f91c7eb to
71aa04c
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3677753e-fc35-436e-934b-33aa3d07c4e0
SDK Consistency Review — PR #2603Scope of changes: This PR only touches Java release/build infrastructure and documentation — no SDK client API code is modified:
None of these files are under Conclusion: No cross-language API or feature-parity concerns were found. This PR is out of scope for the SDK consistency check.
|
Fixes #2579
Summary
Make Java publication a read-only consumer of an immutable source commit. Remove release-plugin commits, direct pushes to
main, privileged repository tokens, and rollback machinery while retaining Maven Central publication and independent Java retries.Changes
CI-friendly Maven versions
<revision>1.0.14-SNAPSHOT</revision>and use${revision}throughout the POM hierarchy.maven-release-plugin; inject the shared release version with-Drevision=<version>.Trusted, immutable release sources
main.main.mainremain valid for independent retries with the original version and SHA.Post-publication tags and documentation
java/vX.Y.Zin the sharedgithub-releasejob after package publication succeeds. Existing lightweight or annotated tags must resolve to the original release SHA; mismatches fail without overwriting tags.mvn clean verify -Drevision=1.2.3example. Documentation version updates remain reviewed PR changes.Regression coverage
0.0.0-ci) across all native input jobs and the publication assembly.install, notdeploy, for both local artifact builds. Remove the ineffectiveskipPublishingprofile instead of relying on it to prevent Central access.${revision}, and no parent reference; preserve classifier, sources, Javadoc, and signature assertions.Verification
install.cc @edburns for review.