feat: improve graph publisher workflows

.github/workflows/check-publisher.yml

@@ -0,0 +1,41 @@
+name: Publisher CI checks
+
+# Publisher implementation regressions only; candidate validation belongs to Doc.
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/check-publisher.yml'
+      - '.github/workflows/release*.yml'
+      - '.github/workflows/scripts/*'
+      - 'tests/test_release_svn.py'
+      - 'tests/test_maven_deploy.py'
+  push:
+    branches: [master]
+    paths:
+      - '.github/workflows/check-publisher.yml'
+      - '.github/workflows/release*.yml'
+      - '.github/workflows/scripts/*'
+      - 'tests/test_release_svn.py'
+      - 'tests/test_maven_deploy.py'
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install check tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y subversion shellcheck
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+      - name: Check release workflows and script
+        run: |
+          "$(go env GOPATH)/bin/actionlint" .github/workflows/release*.yml .github/workflows/check-publisher.yml
+          bash -n .github/workflows/scripts/release-svn.sh
+          shellcheck .github/workflows/scripts/release-svn.sh
+          python3 -m py_compile .github/workflows/scripts/*.py
+      - name: Test local Maven deployment and SVN migration
+        run: python3 -m unittest discover -s tests -v

.github/workflows/release-ai.yml

@@ -4,58 +4,116 @@ on:
   workflow_dispatch:
     inputs:
       repository_url:
+        description: Source repository
         required: true
-        description: remote repository url
-        default: 'apache/incubator-hugegraph-ai'
+        default: 'apache/hugegraph-ai'
       repository_branch:
+        description: Source branch, tag, or full commit SHA
         required: true
-        description: remote repository branch
-        default: 'release-1.5.0'
+        default: 'release-1.8.0'
       release_version:
         required: true
-        description: release_version - only influence SVN
-        default: '1.5.0'
-      deploy_pip:
-        required: true
-        type: boolean
-        description: publish to pip repo (BETA)
-        default: false
+        default: '1.8.0'
       deploy_svn:
+        description: Upload signed source candidate to SVN dev
         required: true
         type: boolean
-        description: publish to apache svn
         default: false
-
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-ai-${{ inputs.release_version }}
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+        working-directory: source
+    env:
+      RELEASE_VERSION: ${{ inputs.release_version }}
     steps:
-#      - name: Install Python
-#        uses: actions/setup-python@v4
-#        with:
-#          cache: 'pip'
-#          python-version: '3.9'
-
-      - name: Import GPG key
-        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v5
+      - name: Checkout publisher
+        uses: actions/checkout@v4
         with:
-          # refer: github.com/crazy-max/ghaction-import-gpg#prerequisites
-          # MacOS: gpg --armor --export-secret-key joe@foo.bar | pbcopy
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          
-      - name: Checkout
+          ref: ${{ github.sha }}
+          path: publisher
+          persist-credentials: false
+
+      - name: Checkout release source
         uses: actions/checkout@v4
         with:
           repository: ${{ inputs.repository_url }}
           ref: ${{ inputs.repository_branch }}
-          fetch-depth: 5
+          path: source
+          persist-credentials: false
 
-#      - name: Package Only
-#        if: ${{ !inputs.deploy_pip }} # TODO: replace with pip settings
-#        run: |
-#          xxx
+      - name: Install SVN client
+        if: ${{ inputs.deploy_svn }}
+        working-directory: ${{ github.workspace }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends subversion
 
-      - name: Release to svn
+      - name: Validate source version and record SHA
+        run: |
+          python3 "$GITHUB_WORKSPACE/publisher/.github/workflows/scripts/check-ai-release.py"
+
+      - name: Check unsigned source archive
+        if: ${{ !inputs.deploy_svn }}
+        run: |
+          archive="$RUNNER_TEMP/apache-hugegraph-ai-$RELEASE_VERSION-src.tar.gz"
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          git archive --format=tar.gz --output="$archive" \
+            --prefix="apache-hugegraph-ai-$RELEASE_VERSION-src/" "$SOURCE_SHA"
+          tar -tzf "$archive" > "$RUNNER_TEMP/source-archive-files.txt"
+          test -s "$RUNNER_TEMP/source-archive-files.txt"
+          sha512sum "$archive" >> "$RUNNER_TEMP/release-context.txt"
+
+      - name: Save unsigned source prevalidation archive
+        if: ${{ !inputs.deploy_svn }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: unsigned-source-ai-${{ inputs.release_version }}
+          path: ${{ runner.temp }}/apache-hugegraph-ai-${{ inputs.release_version }}-src.tar.gz
+          if-no-files-found: error
+
+      - name: Import signing key for SVN upload
         if: ${{ inputs.deploy_svn }}
-        run: ./scripts/apache-release.sh ${{ inputs.release_version }} ${{ secrets.RELEASE_USERNAME }} ${{ secrets.RELEASE_PASSWORD }}
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@v5
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+
+      - name: Upload using the source repository release script
+        if: ${{ inputs.deploy_svn }}
+        env:
+          SVN_USERNAME: ${{ secrets.RELEASE_USERNAME }}
+          SVN_PASSWORD: ${{ secrets.RELEASE_PASSWORD }}
+        run: |
+          [[ -n $SVN_USERNAME && -n $SVN_PASSWORD ]]
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          git checkout --detach "$SOURCE_SHA"
+          git branch -f "release-$RELEASE_VERSION" "$SOURCE_SHA"
+          # Legacy AI refs enable tracing. Copy beside the original to preserve
+          # its dirname-based paths, removing only the known tracing option.
+          script=scripts/apache-release-ci.sh
+          trap 'rm -f "$script"' EXIT
+          sed 's/^set -exo pipefail$/set -eo pipefail/' scripts/apache-release.sh > "$script"
+          if grep -Eq '^set -[^[:space:]]*x|^set -o xtrace' "$script"; then
+            echo 'Unsupported tracing in native release script'; exit 1
+          fi
+          bash -e "$script" "$RELEASE_VERSION" "$SVN_USERNAME" "$SVN_PASSWORD"
+
+      - name: Summarize release context
+        if: ${{ always() }}
+        working-directory: ${{ github.workspace }}
+        run: |
+          if test -f "$RUNNER_TEMP/release-context.txt"; then
+            cat "$RUNNER_TEMP/release-context.txt" >> "$GITHUB_STEP_SUMMARY"
+          fi

.github/workflows/release-server.yml

@@ -7,65 +7,151 @@ on:
         required: true
         default: 'apache/hugegraph'
       repository_branch:
+        description: Source branch, tag, or full commit SHA
         required: true
-        default: 'release-1.7.0'
+        default: 'release-1.8.0'
       release_version:
         required: true
-        default: '1.7.0'
+        default: '1.8.0'
       deploy_maven:
+        description: Upload to Apache Maven staging (never promote)
         required: true
         type: boolean
-        description: publish to maven nexus
         default: false
       deploy_svn:
+        description: Upload signed candidate to SVN dev
         required: true
         type: boolean
-        description: publish to apache svn
         default: false
-
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-server-${{ inputs.release_version }}
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
+    defaults:
+      run:
+        shell: bash
+        working-directory: source
+    env:
+      RELEASE_VERSION: ${{ inputs.release_version }}
+      COMPONENT: server
     steps:
-      - name: Install JDK 11
+      - name: Checkout publisher
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          path: publisher
+          persist-credentials: false
+
+      - name: Checkout release source
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ inputs.repository_url }}
+          ref: ${{ inputs.repository_branch }}
+          path: source
+          persist-credentials: false
+
+      - name: Install SVN client
+        if: ${{ inputs.deploy_svn }}
+        working-directory: ${{ github.workspace }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends subversion
+
+      - name: Install JDK 17
         uses: actions/setup-java@v4
         with:
-          java-version: '11'
-          distribution: 'adopt'
-
-      - name: Import GPG key
+          java-version: '17'
+          distribution: temurin
+          overwrite-settings: false
+
+      - name: Validate source version and record SHA
+        run: |
+          python3 "$GITHUB_WORKSPACE/publisher/.github/workflows/scripts/check-maven-release.py" "$RELEASE_VERSION" pom.xml
+          echo "SOURCE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+          printf 'component=%s\nsource_sha=%s\nversion=%s\n' "$COMPONENT" "$(git rev-parse HEAD)" "$RELEASE_VERSION" \
+            | tee "$RUNNER_TEMP/release-context.txt"
+
+      - name: Prepare public Maven settings
+        run: |
+          printf '%s\n' '<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"/>' > "$RUNNER_TEMP/release-settings.xml"
+          chmod 600 "$RUNNER_TEMP/release-settings.xml"
+
+      - name: Configure Maven upload credentials
+        if: ${{ inputs.deploy_maven }}
+        env:
+          M2_SETTINGS: ${{ secrets.M2_SETTINGS }}
+        run: |
+          test -n "$M2_SETTINGS" || { echo 'M2_SETTINGS is required for Maven upload'; exit 1; }
+          printf '%s' "$M2_SETTINGS" > "$RUNNER_TEMP/release-settings.xml"
+          chmod 600 "$RUNNER_TEMP/release-settings.xml"
+
+      - name: Check effective Maven upload target and matching server id
+        if: ${{ inputs.deploy_maven }}
+        run: |
+          mvn -B -ntp -s "$RUNNER_TEMP/release-settings.xml" \
+            -Dmaven.repo.local="$RUNNER_TEMP/maven-repository" -Papache-release,stage \
+            help:effective-pom -Doutput="$RUNNER_TEMP/release-effective-pom.xml"
+          python3 "$GITHUB_WORKSPACE/publisher/.github/workflows/scripts/check-maven-release.py" \
+            "$RELEASE_VERSION" "$RUNNER_TEMP/release-effective-pom.xml" "$RUNNER_TEMP/release-settings.xml"
+
+      - name: Import signing key for uploads
+        if: ${{ inputs.deploy_maven || inputs.deploy_svn }}
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@v5
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ inputs.repository_url }}
-          ref: ${{ inputs.repository_branch }}
-          fetch-depth: 2
-
-      # - name: Cache Maven packages
-      #   uses: actions/cache@v3
-      #   with:
-      #     path: ~/.m2/repository
-      #     key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-      #     restore-keys: ${{ runner.os }}-m2
-
-      - name: Replace maven settings
-        run: mkdir -p ~/.m2 && echo '${{ secrets.M2_SETTINGS }}' > ~/.m2/settings.xml
-
-      - name: Package/Install Only
+
+      - name: Build without private credentials or signing
         if: ${{ !inputs.deploy_maven }}
         run: |
-          (echo "just building" && mvn clean install -Papache-release,stage -DskipTests -e) || exit
+          mvn -B -ntp -s "$RUNNER_TEMP/release-settings.xml" \
+            -Dmaven.repo.local="$RUNNER_TEMP/maven-repository" \
+            clean package -Pstage -DskipTests
 
-      - name: Package & Release to maven
+      - name: Upload full reactor to Maven staging
         if: ${{ inputs.deploy_maven }}
         run: |
-          echo "deploy to maven" && mvn clean deploy -Papache-release,stage -DskipTests -e || exit 
-
-      - name: Release to svn
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          mvn -B -ntp -s "$RUNNER_TEMP/release-settings.xml" \
+            -Dmaven.repo.local="$RUNNER_TEMP/maven-repository" \
+            clean deploy -Papache-release,stage -DskipTests -DdeployAtEnd=false
+
+      - name: Save built binary distribution
+        uses: actions/upload-artifact@v4
+        with:
+          name: binary-hugegraph-${{ inputs.release_version }}
+          path: source/target/apache-hugegraph-${{ inputs.release_version }}.tar.gz
+          if-no-files-found: error
+
+      - name: Upload using the source repository release script
         if: ${{ inputs.deploy_svn }}
-        run: install-dist/scripts/apache-release.sh ${{ inputs.release_version }} ${{ secrets.RELEASE_USERNAME }} ${{ secrets.RELEASE_PASSWORD }}
+        env:
+          SVN_USERNAME: ${{ secrets.RELEASE_USERNAME }}
+          SVN_PASSWORD: ${{ secrets.RELEASE_PASSWORD }}
+        run: |
+          [[ -n $SVN_USERNAME && -n $SVN_PASSWORD ]]
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          git checkout --detach "$SOURCE_SHA"
+          git branch -f "release-$RELEASE_VERSION" "$SOURCE_SHA"
+          bash -e install-dist/scripts/apache-release.sh "$RELEASE_VERSION" "$SVN_USERNAME" "$SVN_PASSWORD"
+
+      - name: Summarize release context
+        if: ${{ always() }}
+        working-directory: ${{ github.workspace }}
+        run: |
+          if test -f "$RUNNER_TEMP/release-context.txt"; then
+            cat "$RUNNER_TEMP/release-context.txt" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Remove personal Maven settings
+        if: ${{ always() }}
+        working-directory: ${{ github.workspace }}
+        run: rm -f "$RUNNER_TEMP/release-settings.xml" "$RUNNER_TEMP/release-effective-pom.xml"