ci: opt-in Apache Trusted Releases (ATR) Alpha 3 automation

[jamesfredley]

Summary

Opt-in GitHub Actions for Apache Trusted Releases Alpha 3 plus one extra MANUAL step we found a TLP already automates. The default dist/dev + Nexus staging path is unchanged until the PMC sets ATR_ENABLED=true and configures Trusted Publishing.

This is not ATR Beta. Beta is not generally available (tooling-trusted-releases#1520 still open). Host remains release-test.apache.org. Actions are pinned to apache/tooling-actions@e8594ee9cc5ef5fbb48c367a9ab87042c0ccbbc5.

What this automates (with citations)

Step	How	Why we may
Compose (upload signed zips)	Release - ATR Upload (experimental) / optional atr_upload job	Official example: https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml — Pekko also uploads to ATR
Resolve vote	Release - ATR Resolve Vote (experimental)	https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml
One [ANNOUNCE] to announce@apache.org	Release - ATR Announce (experimental) (once; extra lists stay manual)	https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
Record Maven Central in ATR	Release - ATR Record Distribution (experimental) platform=MAVEN	https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml
Promote closed Nexus staging	Release - Promote Nexus Staging (environment: release)	Apache Polaris TLP already does this post-vote: https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml — same NEXUS_STAGE_DEPLOYER_* secrets Grails already uses to drop staging. Signing in GHA is allowed by https://www.apache.org/legal/release-policy.html

What stays manual (with citations)

• 72-hour PMC vote / vote start — no Tooling GHA; https://www.apache.org/legal/release-policy.html and https://tooling.apache.org/trusted-releases.html. If using ATR, discard the generated dist/dev [VOTE] email so there is only one thread.
• dist/release SVN — https://infra.apache.org/github-actions-policy.html forbids GHA writing official release data without Infra authorization. After the one ATR announce, a committer svn moves exactly dist/atr/grails/core/<version> → dist/release/grails/core/<version> (https://release-test.apache.org/docs/promoting-to-release). Polaris leaves the same svn mv manual. Do not run releaseDistributions.sh for an ATR candidate.
• ASF Reporter — login form, no documented public API, no TLP GHA precedent.
• Extra announce lists (dev@grails, users@grails, dev@groovy) — ATR rejects a second announce for the same version.

Vote-start must set download path suffix core/<version> (or core/{{VERSION}}); the announce path input is compatibility-only.

Setup

1. Configure Trusted Publishing on ATR for grails-core (workflow paths listed in RELEASE.md).
2. Optional repo var ATR_ENABLED=true to also upload from the main Release workflow.
3. Signing UID convention: Automated Release Signing <private@grails.apache.org>.

7.0.x can be cherry-picked later if wanted. Default line is 8.0.x.

Test plan

• YAML parses / validateActions allowlists the pinned apache/tooling-actions SHA
• Dry-read RELEASE.md Experimental ATR + "What GitHub Actions may automate"
• Confirm Release - Promote Nexus Staging is workflow_dispatch + environment: release and is not auto-triggered
• After Trusted Publishing is configured, dry-run ATR Upload on a milestone tag in a non-production pass

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.1488%. Comparing base (351652b) to head (ae4f3c4).

Additional details and impacted files

@@              Coverage Diff              @@
##                8.0.x     #16229   +/-   ##
=============================================
  Coverage     54.1488%   54.1488%           
+ Complexity      20258      20257    -1     
=============================================
  Files            2098       2098           
  Lines          100920     100920           
  Branches        17898      17898           
=============================================
  Hits            54647      54647           
  Misses          38484      38484           
  Partials         7789       7789           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[testlens-app]

🚨 TestLens detected 1 failed test 🚨

Here is what you can do:

1. Inspect the test failures carefully.
2. If you are convinced that some of the tests are flaky, you can mute them below.
3. Finally, trigger a rerun by checking the rerun checkbox.

Test Summary

CI / Functional Tests (Java 21, indy=false) > :grails-test-examples-scaffolding:integrationTest

Test	Runs	Flakiness
UserControllerSpec > User list	❌	2% 🟡

🏷️ Commit: ae4f3c4
▶️ Tests: 70110 executed
⚪️ Checks: 84/84 completed

Test Failures

UserControllerSpec > User list (:grails-test-examples-scaffolding:integrationTest in CI / Functional Tests (Java 21, indy=false))

geb.waiting.WaitTimeoutException: condition did not pass in 30 seconds (failed with exception)
	at geb.waiting.Wait.waitFor(Wait.groovy:128)
	at geb.waiting.DefaultWaitingSupport.doWaitFor(DefaultWaitingSupport.groovy:55)
	at geb.waiting.DefaultWaitingSupport.waitFor(DefaultWaitingSupport.groovy:41)
	at geb.Page.waitFor(Page.groovy:120)
	at com.example.pages.LoginPage.login(LoginPage.groovy:39)
	at com.example.UserControllerSpec.User list(UserControllerSpec.groovy:48)
Caused by: Assertion failed: 

title != pageTitle && $('input', name: 'username').empty
|     |  |         |
|     |  |         false
|     |  'Please sign in'
|     false
'Please sign in'

	at com.example.pages.LoginPage.login_closure1(LoginPage.groovy:39)
	at com.example.pages.LoginPage.login_closure1(LoginPage.groovy)
	at geb.waiting.Wait.waitFor(Wait.groovy:117)
	... 5 more

Rerun Controls

Select tests to mute in this pull request:

• UserControllerSpec > User list

Reuse successful test results:

• ♻️ Only rerun the tests that failed or were muted before

Click the checkbox to trigger a rerun:

• Rerun jobs

---

Learn more about TestLens at testlens.app/docs.