[Java] Replace maven-release-plugin with CI-friendly versions - #2603
[Java] Replace maven-release-plugin with CI-friendly versions#2603SandraAhlgrimm wants to merge 5 commits into
Conversation
Make the Java release pipeline a read-only consumer of the commit being
released, consistent with the other SDKs. A Java release now creates no
commits on `main`, requires no elevated repository token or ruleset
bypass, and publishes artifacts whose version and source SHA match the
other SDK artifacts in the same release.
- POMs: adopt ${revision} CI-friendly versions (single <revision>
property in java/pom.xml); remove maven-release-plugin.
- java-publish-maven.yml: drop preflight/prepare-release/rollback-release;
add resolve-source; build all classifiers + deploy from one immutable
SHA with -Drevision; contents: read only; no JAVA_RELEASE_TOKEN.
- publish.yml: publish-java contents: read + sourceSha; create the
java/vX.Y.Z traceability tag and trigger the site deploy in
github-release after publication succeeds.
- java/README.md: document the new versioning/release model.
Fixes #2579
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Release retryability, tag validation, unsafe documentation, and automated coverage need correction.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 1
New issues introduced by this change (4)
| Severity | Finding |
|---|---|
 |
.github/workflows/publish.yml — The new Java tag silently accepts any pre-existing java/vX.Y.Z tag without checking its target.… |
 |
.github/workflows/publish.yml — A transient failure while dispatching the site workflow is not retryable: this step now runs at the… |
|
java/pom.xml — The release-only ${revision} override and flattening path is not exercised by the existing… |
 |
java/README.md — This local-validation command runs deploy with the Central publishing extension configured with… |
What changed in this PR
Reworks Java releases to use Maven CI-friendly ${revision} versions and immutable source commits without mutating main.
Changes:
- Replaces Maven release-plugin versioning with
${revision}. - Makes Maven publication read-only and source-SHA pinned.
- Moves Java tagging and site deployment into the shared release workflow.
| File | Description |
|---|---|
java/pom.xml |
Defines the shared revision and removes the release plugin. |
java/sdk/pom.xml |
Inherits the CI-friendly parent version. |
java/copilot-native/pom.xml |
Inherits the CI-friendly parent version. |
java/README.md |
Documents the new release model. |
.github/workflows/java-publish-maven.yml |
Publishes from an immutable SHA without repository writes. |
.github/workflows/publish.yml |
Passes the source SHA and handles Java tagging/site deployment. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Guard existing Java tags against source mismatches and separate site dispatch into an independently retryable job. Exercise a synthetic release revision across classifier builds and both locally installed Java artifacts, validate flattened POM coordinates, and replace the README deployment example with a non-publishing build. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use Maven install for CI's local release assembly instead of invoking Central's deploy goal, and remove the ineffective skipPublishing profile. Disable dependency caching in the SHA-selectable release workflow, including automatic npm caching and the unnecessary cached CLI setup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Java tag failures cannot be retried after the non-idempotent GitHub Release creation succeeds.
Review tier: Balanced
Findings: None
Issues resolved since last review (4)
| Severity | Finding |
|---|---|
|
java/README.md — This local-validation command runs deploy with the Central publishing extension configured with… View resolved comment |
|
java/pom.xml — The release-only ${revision} override and flattening path is not exercised by the existing… View resolved comment |
|
.github/workflows/publish.yml — A transient failure while dispatching the site workflow is not retryable: this step now runs at the… View resolved comment |
|
.github/workflows/publish.yml — The new Java tag silently accepts any pre-existing java/vX.Y.Z tag without checking its target.… View resolved comment |
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
.github/workflows/publish.yml:511
- This tag operation is still placed after the non-idempotent
gh release createsteps. If the tag fetch or push fails transiently after the release has been created, rerunning the failedgithub-releasejob fails immediately because that release already exists, so the Java tag is never retried. Move Java tagging to its own downstream job (as done for the site dispatch), or make release creation safely idempotent before adding a later fallible step.
Bootstrap source validation from the trusted triggering commit and require main-branch publication. Accept only full commit SHAs reachable from main before checking out or executing the requested source. Pass only the validated source to every release build, preserve historical retries, and add source-trust regression coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
SDK Consistency ReviewI reviewed PR #2603 against the authoritative file list and diff from Changed files (all in
Assessment: This PR is entirely release/build-infrastructure work for the Java SDK — it switches the Maven release process to CI-friendly ( Since no feature, method, or behavior is added/changed in the SDK's public API surface, there is nothing to cross-reference for feature parity across languages here — this is a Java-specific release-tooling change and doesn't need to be mirrored in other language SDKs. ✅ No consistency issues found.
|
|
My understanding is that #2579 is a blocker to your plan to incorporate copilot-sdk into copilot-agent-runtime. Therefore, because I was busy on another task for my management, I sought and received help from fellow Berliner @SandraAhlgrimm . She has promptly delivered PR 2603 to fix this issue. I seek your review, in addition to the review I will provide. After this is merged, I intend to cut a preview release to test it out. But first, please take a close look. Thanks, Ed |
Remove the obsolete repository push token and associate the documentation deployment token with the shared publish workflow. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: da1e04ac-3079-4aa4-b495-4358cb3c6b04
roji
left a comment
roji
left a comment
There was a problem hiding this comment.
Two remaining release-workflow issues: the publication test-skipping behavior with current main, and retryability of Java tagging after GitHub release creation.
| "-Dmaven.repo.local=$LOCAL_REPOSITORY" | ||
| node copilot-native/scripts/validate-local-publication.mjs \ | ||
| "$LOCAL_REPOSITORY" copilot-sdk-java-runtime "$VERSION" .. --signatures | ||
| mvn -B -pl sdk install -Prelease -DskipTests \ |
There was a problem hiding this comment.
Please add -DskipITs here and to the actual Java release publication command, which also intends to skip tests. The CI merge includes main's Failsafe 3.6.0 upgrade; that version no longer honors -DskipTests for integration tests. This new SDK installation step therefore runs integration tests while CLI preparation is skipped, causing the current publication assembly failure and consequently Java required. I reproduced Failsafe 3.6.0 running an integration test despite -DskipTests and confirmed that adding -DskipITs skips it. This is a deterministic interaction with main, not a failure of ${revision} versioning or a transient CI issue.
| exit "$STATUS" | ||
| fi | ||
| git tag "$TAG_NAME" "$SOURCE_SHA" | ||
| git push origin "refs/tags/$TAG_NAME" |
There was a problem hiding this comment.
Please move Java tagging into its own downstream job and make deploy-java-site depend on it, as was already done for the site dispatch itself. This fetch/push still runs after the non-idempotent gh release create steps in the same github-release job. If fetching or pushing the Java tag fails after the release has been created, rerunning the failed job stops at the already-existing release before reaching this step. The tag's existing-target check is correct, but it cannot help if the retry never reaches it; Java tagging and the dependent site deployment remain incomplete.
There was a problem hiding this comment.
LGTM too - thanks @SandraAhlgrimm! - but @edburns is the Java authority here in any case.
@SandraAhlgrimm see my two comments above, one of these seems to explain why this PR is failing CI.
Fixes #2579
Summary
Make Java publication a read-only consumer of an immutable source commit. Remove release-plugin commits, direct pushes to
main, privileged repository tokens, and rollback machinery while retaining Maven Central publication and independent Java retries.Changes
CI-friendly Maven versions
<revision>1.0.14-SNAPSHOT</revision>and use${revision}throughout the POM hierarchy.maven-release-plugin; inject the shared release version with-Drevision=<version>.Trusted, immutable release sources
main.main.mainremain valid for independent retries with the original version and SHA.Post-publication tags and documentation
java/vX.Y.Zin the sharedgithub-releasejob after package publication succeeds. Existing lightweight or annotated tags must resolve to the original release SHA; mismatches fail without overwriting tags.mvn clean verify -Drevision=1.2.3example. Documentation version updates remain reviewed PR changes.Regression coverage
0.0.0-ci) across all native input jobs and the publication assembly.install, notdeploy, for both local artifact builds. Remove the ineffectiveskipPublishingprofile instead of relying on it to prevent Central access.${revision}, and no parent reference; preserve classifier, sources, Javadoc, and signature assertions.Verification
install.cc @edburns for review.