[jiangxt2]

Pull request

What changes were proposed in this pull request?

• Set the candidate reactor revision to 2.5.0 and stamp the submission JAR with its version and source commit.
• Check approved source identity, reject dirty/snapshot/mismatched candidates, and package the runtime, tracked source, SBOM, provenance and portable checksums without overwriting a candidate.
• Preserve candidate validation logs and scan the exact packaged SBOM through the existing vulnerability workflow. Ordinary PR/nightly scans keep their source-based path.
• Document GitHub-only distribution, verified support boundaries, stable compatibility and the separate post-publication transition of master to 2.6.0-SNAPSHOT.

Why are the changes needed?

A first stable distribution needs an auditable connection between approved source, tested runtime and downloadable files. Candidate validation must check the actual packaged SBOM, and users need explicit compatibility, migration and development-version boundaries.

Related issues

None.

Does this PR introduce any user-facing change?

The candidate version is 2.5.0 for JDK 17, Scala 2.12.18 and Spark 3.5.8. Distribution is the complete GitHub Spark-submit JAR and source archive; Maven Central and PyPI publication are outside this scope. Streaming, Kyuubi and unverified Iceberg REST/storage combinations remain Experimental.

Candidate packaging requires an approved stable version and commit and matching JAR/source/SBOM metadata. The release guide preserves the documented Doris migration and reconciliation boundaries. A source version is not itself a published release. Master advances to 2.6.0-SNAPSHOT through a separate PR only after published-asset verification.

How was this patch tested?

• python -m pytest scripts/tests -q — 48 direct packaging and policy cases passed with Python 3.12.12/pytest 9.1.1.
• ruff check scripts and ruff format --check scripts — passed with Ruff 0.14.14.
• mvn -B -pl pista-assembly -am package -DskipTests -Dpista.source.revision="$(git rev-parse HEAD)" and python3 -B scripts/check_assembly.py — build and complete Assembly contract passed on Corretto 17.0.18/Maven 3.9.5; actual JAR version and source metadata were inspected. This command does not run JVM tests.
• scripts/generate_sbom.sh — actual project version 2.5.0 and generated SBOM passed both existing and candidate validation.
• Public-content, language, Markdown, licensing and whitespace checks passed using the repository scripts and git diff --check.

Unverified scope: end-to-end candidate workflow execution and downloaded-consumer smoke. These are required on a frozen approved source before publication. This preparation does not create tags, Releases, repository settings or new runtime consistency guarantees.