refactor(release): align npm preflight with ASF practice - #3481
Conversation
fe93f5a to
1070be3
Compare
Treat source-RC npm builds as credential-free compatibility evidence and keep publication authority at the post-approval product tag. This removes the unsupported candidate handoff and signing model while retaining source identity, platform validation, staged publishing, and registry provenance controls. Publish the canonical DISCLAIMER-WIP text in the npm README, and record that the OpenDAL precedent supports—but does not settle—the explicit ASF naming confirmation required for Maka's first publication. Generated-by: OpenAI Codex
1070be3 to
78f82fe
Compare
jackwener
left a comment
jackwener
left a comment
There was a problem hiding this comment.
First-principles review of head 78f82fe.
-
Problem. The source-RC npm workflow was a second ASF artifact pipeline: unsigned handoff, SHA-512 sidecar, candidate record, and pre-vote byte identity. npm is a convenience binary, not the ASF release. That contract was extra domain.
-
Solution. Keep the useful preflight (annotated
v<version>-incubating-rc<n>tag, commit identity,mainancestry, product identity, one clean-source tarball, platform/Eval matrix) and delete the unsupported handoff. Publication stays on the post-approvalv<version>Stage/Finalize path. The packed English README receives the release commit'sDISCLAIMER-WIP; the file is still shipped next to LICENSE/NOTICE.maka-agentnaming is left open, with the OpenDAL precedent described as support for asking, not a decision. -
Occam. The remaining workflow is small and credential-free (
contents: read, noid-token, no publish, no dist-tag). Tag format is not lost: the resolve step still setsSOURCE_REFERENCE_TAG, andproduct-release-identity.mjsparsesv<version>-incubating-rc<n>and checks it against root/Desktop/CLI versions. Policy tests now assert the preflight contract instead of the deleted handoff.
Approve.
2 participants
English
Part of #3275.
Summary
mainancestry, shared product identity, one clean-source tarball, and the supported platform/Eval validation matrix.DISCLAIMER-WIPinto the published npm README, and retainApache Maka (Incubating)branding in generated package metadata.Release boundary
The ASF vote remains over the signed source artifact. The npm preflight runs from an RC tag without publishing. After both source votes approve the candidate, the product Release workflow creates the final
v<version>tag at the same commit; npm Stage then builds and validates the publication tarball from that tag, submits it through the protectednpm-releaseEnvironment and OIDC, and leaves public approval to a 2FA-protected maintainer. Finalize verifies the registry bytes, integrity, signature, provenance, and dist-tag.Apache OpenDAL used the same core pattern while incubating: RC tags validated the Node.js package without publication, final tags at the approved commit published npm, and the ASF distribution contained the signed source release rather than a separately signed npm tarball. Maka retains its stronger staged-publishing and post-publication controls.
The implementation currently retains
maka-agent, but the project must record explicit mentor or ASF Brand confirmation before its first compliant publication. OpenDAL published the unprefixedopendalpackage throughout incubation, but that package predates OpenDAL's incubation entry whereasmaka-agentdoes not. The precedent supports asking to retain the name; it does not settle Maka's naming decision.Validation
npm run format:checknpm run lintnpm run check:release— 88 tests passedmise exec go -- go run github.com/rhysd/actionlint/cmd/[email protected] .github/workflows/asf-npm-candidate.yml .github/workflows/ci.ymlnpm run release:cli:packDISCLAIMER-WIPexactly once and no template markernpm run release:cli:smoke— offline install and installed-product validation passedReferences
AI assistance
This change was prepared with OpenAI Codex. A human contributor must review the release-policy interpretation, implementation, and generated package evidence before merge. Release, branding, and legal conclusions remain with the PPMC, mentors, IPMC, ASF Brand, and ASF Legal Affairs as applicable.
简体中文
#3275 的一部分。
摘要
main祖先关系、统一产品 identity、一次 clean-source tarball 构建，以及支持平台/Eval 验证矩阵。DISCLAIMER-WIP注入发布到 npm 的 README，并在生成的 package metadata 中保留Apache Maka (Incubating)品牌。发布边界
ASF 投票对象仍是签名后的源码 artifact。npm 预检从 RC tag 运行，但不发布。两轮源码投票通过后，产品 Release workflow 在同一 commit 创建最终
v<version>tag；npm Stage 再从该 tag 构建并验证正式发布 tarball，通过受保护的npm-releaseEnvironment 与 OIDC 提交，由启用 2FA 的 maintainer 人工批准公开。Finalize 校验公共 registry 字节、integrity、signature、provenance 与 dist-tag。Apache OpenDAL 孵化期间采用了相同核心模式：RC tag 只验证 Node.js 包，最终 tag 在获批 commit 触发 npm 发布，ASF distribution 只包含签名源码 release，没有额外存放签名 npm tarball。Maka 同时保留更严格的 staged publishing 与发布后校验。
当前实现继续使用
maka-agent，但第一次合规发布前必须取得并记录 mentors 或 ASF Brand 的明确认可。OpenDAL 在孵化期间发布未加前缀的opendal，但该包早于 OpenDAL 进入孵化器，而maka-agent并非如此。这个先例支持提出保留请求，不能替 Maka 解决命名判断。验证
npm run format:checknpm run lintnpm run check:release——88 项测试通过mise exec go -- go run github.com/rhysd/actionlint/cmd/[email protected] .github/workflows/asf-npm-candidate.yml .github/workflows/ci.ymlnpm run release:cli:packDISCLAIMER-WIP，且没有残留模板 markernpm run release:cli:smoke——离线安装与安装态产品验证通过参考资料
AI 辅助说明
本变更由 OpenAI Codex 协助准备。合并前必须由人工贡献者审查发版政策解释、实现和生成包证据。发版、品牌与法律结论仍分别归 PPMC、mentors、IPMC、ASF Brand 和 ASF Legal Affairs 所有。