From 6dc99ab5115cc87e95501864cdd85c5d5f4614b0 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Thu, 13 Aug 2026 15:48:44 +0200 Subject: [PATCH 1/8] STAC-25549 Publish vavr to CodeArtifact via GitHub Actions --- .github/workflows/ci.yml | 182 +++++++++++++++++++++++++++++++++++++++ .gitlab-ci.yml | 32 ------- pom.xml | 48 ++++++++++- 3 files changed, 227 insertions(+), 35 deletions(-) create mode 100644 .github/workflows/ci.yml delete mode 100644 .gitlab-ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000000..4394e4fba0 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,182 @@ +name: CI + +on: + pull_request: + types: + - opened + - reopened + - synchronize + - ready_for_review + push: + branches: + - stackstate-master + workflow_dispatch: + +permissions: + contents: read + +defaults: + run: + shell: bash --noprofile --norc -euo pipefail {0} + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + build-and-test: + name: Build and test + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Set up Java + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + with: + distribution: temurin + java-version: '8' + cache: maven + + - name: Authenticate to the package registry proxy + uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@d41829a184b01ef45f13e8dfa13cfb64ed548b75 # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges + with: + username: ${{ vars.PACKAGE_REGISTRY_PROXY_USER }} + token: ${{ secrets.PACKAGE_REGISTRY_PROXY_TOKEN }} + + - name: Write Maven settings.xml + run: | + proxy_user="$(grep '^user=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" + proxy_password="$(grep '^password=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" + settings_file="${RUNNER_TEMP}/settings.xml" + install -m 600 /dev/null "${settings_file}" + cat > "${settings_file}" < + + + central + ${proxy_user} + ${proxy_password} + + + packages-snapshot-proxy + ${proxy_user} + ${proxy_password} + + + + SETTINGS_EOF + + - name: Build and test + run: mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" clean test + + zizmor: + name: zizmor + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@b572f7b1a1c2d41efaab43d504f68d215c3cd727 # v0.5.4 + with: + advanced-security: false + + publish: + name: Publish release + needs: + - build-and-test + - zizmor + if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/stackstate-master' + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + id-token: write + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Set up Java + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + with: + distribution: temurin + java-version: '8' + cache: maven + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + role-to-assume: ${{ vars.CODEARTIFACT_MAVEN_RELEASE_ROLE_ARN }} + aws-region: ${{ vars.CODEARTIFACT_REGION }} + + - name: Authenticate to CodeArtifact + uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@2a4f7ede3d9e9cec1a50c2a139473295889dfd47 # v1.0.0 + with: + domain: ${{ vars.CODEARTIFACT_DOMAIN }} + domain-owner: ${{ vars.CODEARTIFACT_DOMAIN_OWNER }} + region: ${{ vars.CODEARTIFACT_REGION }} + repository: packages + + - name: Authenticate to the package registry proxy + uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@d41829a184b01ef45f13e8dfa13cfb64ed548b75 # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges + with: + username: ${{ vars.PACKAGE_REGISTRY_PROXY_USER }} + token: ${{ secrets.PACKAGE_REGISTRY_PROXY_TOKEN }} + + - name: Write Maven settings.xml + run: | + proxy_user="$(grep '^user=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" + proxy_password="$(grep '^password=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" + codeartifact_password="$(grep '^password=' "${CODEARTIFACT_CREDENTIALS_DIR}/codeartifact-packages.credentials" | cut -d= -f2-)" + settings_file="${RUNNER_TEMP}/settings.xml" + install -m 600 /dev/null "${settings_file}" + cat > "${settings_file}" < + + + packages + aws + ${codeartifact_password} + + + central + ${proxy_user} + ${proxy_password} + + + + SETTINGS_EOF + + - name: Publish release to CodeArtifact + env: + PACKAGE_REGISTRY_MAVEN_URL: ${{ vars.CODEARTIFACT_MAVEN_RELEASE_URL }} + run: mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" -Dpackage.registry.maven.url="${PACKAGE_REGISTRY_MAVEN_URL}" deploy + + ci-success: + name: ci-success + if: ${{ always() }} + needs: + - build-and-test + - zizmor + - publish + runs-on: ubuntu-latest + steps: + - name: Evaluate workflow results + env: + NEEDS_RESULT: ${{ join(needs.*.result, ',') }} + run: | + echo "$NEEDS_RESULT" + if [[ "$NEEDS_RESULT" =~ failure|cancelled ]]; then + exit 1 + fi diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml deleted file mode 100644 index a6ded2a5f7..0000000000 --- a/.gitlab-ci.yml +++ /dev/null @@ -1,32 +0,0 @@ -stages: - - build - -build-and-publish: - image: ${REGISTRY_DOCKER_URL}/maven:3.6.3-openjdk-8-slim - stage: build - variables: - USER_HOME: "/var/maven" - MAVEN_CONFIG: "${USER_HOME}/.m2" - rules: - - when: manual - tags: - - sts-k8s-m-runner - before_script: - - mkdir -p "$MAVEN_CONFIG" - - | - cat > "$MAVEN_CONFIG/settings.xml" < - - - - gitlab-packages-registry - ${GITLAB_PACKAGE_REGISTRY_USER} - ${GITLAB_PACKAGE_REGISTRY_TOKEN} - - - - EOF - script: mvn -Dgitlab_registry_url="${GITLAB_PACKAGE_REGISTRY_MAVEN_URL}" -Duser.home="${USER_HOME}" deploy diff --git a/pom.xml b/pom.xml index 685ac36c57..2159784b9d 100644 --- a/pom.xml +++ b/pom.xml @@ -84,7 +84,43 @@ We use these goals frequently to keep the dependencies and plugins up-to-date: 3.4.4 2.10.6 2.10 + https://please-set-PACKAGE-REGISTRY-MAVEN-URL-to-publish + https://please-set-PACKAGE-REGISTRY-MAVEN-SNAPSHOT-URL-to-publish + + + central + https://packages.tooling.stackstate.io/maven/releases/ + + true + + + false + + + + packages-snapshot-proxy + https://packages.tooling.stackstate.io/maven/snapshots/ + + false + + + true + + + + + + central + https://packages.tooling.stackstate.io/maven/releases/ + + true + + + false + + + @@ -323,11 +359,17 @@ We use these goals frequently to keep the dependencies and plugins up-to-date: + - gitlab-packages-registry - GitLab Packages Registry - ${gitlab_registry_url} + packages + StackState CodeArtifact Maven releases + ${package.registry.maven.url} + + packages-snapshot + StackState CodeArtifact Maven snapshots + ${package.registry.maven.snapshot.url} + From 776a6047939428ed327f9746488ed64da9ca0090 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Thu, 13 Aug 2026 15:53:58 +0200 Subject: [PATCH 2/8] STAC-25549 Exclude vavr-benchmark from CI, its capsule dependency is HTTP-only --- .github/workflows/ci.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4394e4fba0..3c775397de 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -71,7 +71,10 @@ jobs: SETTINGS_EOF - name: Build and test - run: mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" clean test + run: | + # vavr-benchmark is excluded: its only source for io.usethesource:capsule is a plain-HTTP + # repo that Maven blocks by default, and the artifact is on no HTTPS registry. + mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" -pl '!vavr-benchmark' clean test zizmor: name: zizmor @@ -161,7 +164,11 @@ jobs: - name: Publish release to CodeArtifact env: PACKAGE_REGISTRY_MAVEN_URL: ${{ vars.CODEARTIFACT_MAVEN_RELEASE_URL }} - run: mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" -Dpackage.registry.maven.url="${PACKAGE_REGISTRY_MAVEN_URL}" deploy + run: | + # vavr-benchmark excluded for the same reason as in build-and-test; it is a JMH harness, + # not a consumed artifact. + mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" -pl '!vavr-benchmark' \ + -Dpackage.registry.maven.url="${PACKAGE_REGISTRY_MAVEN_URL}" deploy ci-success: name: ci-success From 4036036150f198c89da62ccb1eabe5bf181424b6 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Thu, 13 Aug 2026 16:43:54 +0200 Subject: [PATCH 3/8] STAC-25549 Let the auth actions write the Maven settings.xml --- .github/workflows/ci.yml | 60 ++++++---------------------------------- 1 file changed, 8 insertions(+), 52 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3c775397de..a3ea599c7f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,39 +42,17 @@ jobs: cache: maven - name: Authenticate to the package registry proxy - uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@d41829a184b01ef45f13e8dfa13cfb64ed548b75 # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges + uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges with: username: ${{ vars.PACKAGE_REGISTRY_PROXY_USER }} token: ${{ secrets.PACKAGE_REGISTRY_PROXY_TOKEN }} - - - name: Write Maven settings.xml - run: | - proxy_user="$(grep '^user=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" - proxy_password="$(grep '^password=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" - settings_file="${RUNNER_TEMP}/settings.xml" - install -m 600 /dev/null "${settings_file}" - cat > "${settings_file}" < - - - central - ${proxy_user} - ${proxy_password} - - - packages-snapshot-proxy - ${proxy_user} - ${proxy_password} - - - - SETTINGS_EOF + maven-settings: 'true' - name: Build and test run: | # vavr-benchmark is excluded: its only source for io.usethesource:capsule is a plain-HTTP # repo that Maven blocks by default, and the artifact is on no HTTPS registry. - mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" -pl '!vavr-benchmark' clean test + mvn --batch-mode -s "${MAVEN_SETTINGS_FILE}" -pl '!vavr-benchmark' clean test zizmor: name: zizmor @@ -124,42 +102,20 @@ jobs: aws-region: ${{ vars.CODEARTIFACT_REGION }} - name: Authenticate to CodeArtifact - uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@2a4f7ede3d9e9cec1a50c2a139473295889dfd47 # v1.0.0 + uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges with: domain: ${{ vars.CODEARTIFACT_DOMAIN }} domain-owner: ${{ vars.CODEARTIFACT_DOMAIN_OWNER }} region: ${{ vars.CODEARTIFACT_REGION }} repository: packages + maven-settings: 'true' - name: Authenticate to the package registry proxy - uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@d41829a184b01ef45f13e8dfa13cfb64ed548b75 # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges + uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges with: username: ${{ vars.PACKAGE_REGISTRY_PROXY_USER }} token: ${{ secrets.PACKAGE_REGISTRY_PROXY_TOKEN }} - - - name: Write Maven settings.xml - run: | - proxy_user="$(grep '^user=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" - proxy_password="$(grep '^password=' "${PACKAGE_REGISTRY_PROXY_CREDENTIALS_FILE}" | cut -d= -f2-)" - codeartifact_password="$(grep '^password=' "${CODEARTIFACT_CREDENTIALS_DIR}/codeartifact-packages.credentials" | cut -d= -f2-)" - settings_file="${RUNNER_TEMP}/settings.xml" - install -m 600 /dev/null "${settings_file}" - cat > "${settings_file}" < - - - packages - aws - ${codeartifact_password} - - - central - ${proxy_user} - ${proxy_password} - - - - SETTINGS_EOF + maven-settings: 'true' - name: Publish release to CodeArtifact env: @@ -167,7 +123,7 @@ jobs: run: | # vavr-benchmark excluded for the same reason as in build-and-test; it is a JMH harness, # not a consumed artifact. - mvn --batch-mode -s "${RUNNER_TEMP}/settings.xml" -pl '!vavr-benchmark' \ + mvn --batch-mode -s "${MAVEN_SETTINGS_FILE}" -pl '!vavr-benchmark' \ -Dpackage.registry.maven.url="${PACKAGE_REGISTRY_MAVEN_URL}" deploy ci-success: From 349ff2423abe5a79bf343417bea12eebee046588 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Thu, 13 Aug 2026 17:15:48 +0200 Subject: [PATCH 4/8] STAC-25549 Use normal maven central for dependencies --- .github/workflows/ci.yml | 16 +--------------- pom.xml | 34 ---------------------------------- 2 files changed, 1 insertion(+), 49 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a3ea599c7f..d64a74d5b5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,18 +41,11 @@ jobs: java-version: '8' cache: maven - - name: Authenticate to the package registry proxy - uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges - with: - username: ${{ vars.PACKAGE_REGISTRY_PROXY_USER }} - token: ${{ secrets.PACKAGE_REGISTRY_PROXY_TOKEN }} - maven-settings: 'true' - - name: Build and test run: | # vavr-benchmark is excluded: its only source for io.usethesource:capsule is a plain-HTTP # repo that Maven blocks by default, and the artifact is on no HTTPS registry. - mvn --batch-mode -s "${MAVEN_SETTINGS_FILE}" -pl '!vavr-benchmark' clean test + mvn --batch-mode -pl '!vavr-benchmark' clean test zizmor: name: zizmor @@ -110,13 +103,6 @@ jobs: repository: packages maven-settings: 'true' - - name: Authenticate to the package registry proxy - uses: StackVista/package-registry-actions/.github/actions/package-registry-proxy-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges - with: - username: ${{ vars.PACKAGE_REGISTRY_PROXY_USER }} - token: ${{ secrets.PACKAGE_REGISTRY_PROXY_TOKEN }} - maven-settings: 'true' - - name: Publish release to CodeArtifact env: PACKAGE_REGISTRY_MAVEN_URL: ${{ vars.CODEARTIFACT_MAVEN_RELEASE_URL }} diff --git a/pom.xml b/pom.xml index 2159784b9d..f142d91308 100644 --- a/pom.xml +++ b/pom.xml @@ -87,40 +87,6 @@ We use these goals frequently to keep the dependencies and plugins up-to-date: https://please-set-PACKAGE-REGISTRY-MAVEN-URL-to-publish https://please-set-PACKAGE-REGISTRY-MAVEN-SNAPSHOT-URL-to-publish - - - central - https://packages.tooling.stackstate.io/maven/releases/ - - true - - - false - - - - packages-snapshot-proxy - https://packages.tooling.stackstate.io/maven/snapshots/ - - false - - - true - - - - - - central - https://packages.tooling.stackstate.io/maven/releases/ - - true - - - false - - - From 9ba77e229aa6dfb444a987b0cdfc5abd3542c2f7 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Fri, 14 Aug 2026 13:50:37 +0200 Subject: [PATCH 5/8] STAC-25549 Publish branch snapshots to CodeArtifact with the commit sha in the version --- .github/workflows/ci.yml | 58 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d64a74d5b5..941d4d836c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -112,6 +112,63 @@ jobs: mvn --batch-mode -s "${MAVEN_SETTINGS_FILE}" -pl '!vavr-benchmark' \ -Dpackage.registry.maven.url="${PACKAGE_REGISTRY_MAVEN_URL}" deploy + publish-snapshot: + name: Publish snapshot + needs: + - build-and-test + - zizmor + if: >- + (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) || + (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/stackstate-master') + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + id-token: write + steps: + - name: Check out repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Set up Java + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + with: + distribution: temurin + java-version: '8' + cache: maven + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + role-to-assume: ${{ vars.CODEARTIFACT_MAVEN_SNAPSHOT_ROLE_ARN }} + aws-region: ${{ vars.CODEARTIFACT_REGION }} + + - name: Authenticate to CodeArtifact + uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges + with: + domain: ${{ vars.CODEARTIFACT_DOMAIN }} + domain-owner: ${{ vars.CODEARTIFACT_DOMAIN_OWNER }} + region: ${{ vars.CODEARTIFACT_REGION }} + repository: packages-snapshot + maven-settings: 'true' + + - name: Publish snapshot to CodeArtifact + env: + PACKAGE_REGISTRY_MAVEN_SNAPSHOT_URL: ${{ vars.CODEARTIFACT_MAVEN_SNAPSHOT_URL }} + COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }} + run: | + # -SNAPSHOT is what routes the deploy to snapshotRepository; a `+` separator would + # 404 on upload, so the sha is appended with a dash. + base_version="$(mvn --batch-mode -q org.apache.maven.plugins:maven-help-plugin:3.4.0:evaluate \ + -Dexpression=project.version -DforceStdout)" + mvn --batch-mode org.codehaus.mojo:versions-maven-plugin:2.16.2:set \ + -DnewVersion="${base_version%-SNAPSHOT}-${COMMIT_SHA:0:7}-SNAPSHOT" \ + -DprocessAllModules=true -DgenerateBackupPoms=false + # vavr-benchmark excluded for the same reason as in build-and-test. + mvn --batch-mode -s "${MAVEN_SETTINGS_FILE}" -pl '!vavr-benchmark' \ + -Dpackage.registry.maven.snapshot.url="${PACKAGE_REGISTRY_MAVEN_SNAPSHOT_URL}" deploy + ci-success: name: ci-success if: ${{ always() }} @@ -119,6 +176,7 @@ jobs: - build-and-test - zizmor - publish + - publish-snapshot runs-on: ubuntu-latest steps: - name: Evaluate workflow results From a311adfb3e6917f23f9da09d8893bd1605399fb1 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Fri, 14 Aug 2026 13:54:14 +0200 Subject: [PATCH 6/8] STAC-25549 Gate the snapshot job on head repo identity, not the fork flag --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 941d4d836c..b49c3b519d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -118,7 +118,7 @@ jobs: - build-and-test - zizmor if: >- - (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) || + (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/stackstate-master') runs-on: ubuntu-latest timeout-minutes: 20 From a09b7fbf63a761a9ac0ee83ab52cac239b6f5144 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 17 Aug 2026 14:11:35 +0200 Subject: [PATCH 7/8] STAC-25549 re-pin package-registry-actions to v1.1.0 --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b49c3b519d..9b0f818030 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -95,7 +95,7 @@ jobs: aws-region: ${{ vars.CODEARTIFACT_REGION }} - name: Authenticate to CodeArtifact - uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges + uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@f0b17a56f77589c578ac916c04876432aec4aa91 # v1.1.0 with: domain: ${{ vars.CODEARTIFACT_DOMAIN }} domain-owner: ${{ vars.CODEARTIFACT_DOMAIN_OWNER }} @@ -145,7 +145,7 @@ jobs: aws-region: ${{ vars.CODEARTIFACT_REGION }} - name: Authenticate to CodeArtifact - uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@9af41cd4af9374a664bb1afd836f7b903b11bfea # STAC-25549-package-registry-proxy-auth, re-pin to a release tag after that PR merges + uses: StackVista/package-registry-actions/.github/actions/codeartifact-auth@f0b17a56f77589c578ac916c04876432aec4aa91 # v1.1.0 with: domain: ${{ vars.CODEARTIFACT_DOMAIN }} domain-owner: ${{ vars.CODEARTIFACT_DOMAIN_OWNER }} From b930361d8838715aa1e14c56b09fc30e0d09fab2 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Mon, 17 Aug 2026 16:34:40 +0200 Subject: [PATCH 8/8] STAC-25549 Never cancel a dispatch-triggered publish A push to stackstate-master shared the release dispatch's concurrency group, so it could cancel a multi-module mvn deploy midway and leave a partial release in CodeArtifact. Recovery is not a rerun: CodeArtifact returns 409 for an existing asset with different content. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9b0f818030..5aacefb148 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,8 +20,8 @@ defaults: shell: bash --noprofile --norc -euo pipefail {0} concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }} jobs: build-and-test: