ci: opt-in Apache Trusted Releases (ATR) Alpha 3 automation

[jamesfredley]

Summary

Opt-in GitHub Actions for Apache Trusted Releases Alpha 3 plus one extra MANUAL step we found a TLP already automates. The default dist/dev + Nexus staging path is unchanged until the PMC sets ATR_ENABLED=true and configures Trusted Publishing.

This is not ATR Beta. Beta is not generally available (tooling-trusted-releases#1520 still open). Host remains release-test.apache.org. Actions are pinned to apache/tooling-actions@e8594ee9cc5ef5fbb48c367a9ab87042c0ccbbc5.

What this automates (with citations)

Step	How	Why we may
Compose (upload signed zips)	Release - ATR Upload (experimental) / optional atr_upload job	Official example: https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/build-and-rsync-to-atr.yaml — Pekko also uploads to ATR
Resolve vote	Release - ATR Resolve Vote (experimental)	https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/resolve-vote-on-atr.yaml
One [ANNOUNCE] to announce@apache.org	Release - ATR Announce (experimental) (once; extra lists stay manual)	https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/announce-release-on-atr.yaml
Record Maven Central in ATR	Release - ATR Record Distribution (experimental) platform=MAVEN	https://github.com/apache/tooling-asf-example/blob/main/.github/workflows/record-distribution-on-atr.yaml
Promote closed Nexus staging	Release - Promote Nexus Staging (environment: release)	Apache Polaris TLP already does this post-vote: https://github.com/apache/polaris/blob/7866ce5c009d64e4c1454b47bca3df9873c6c0b2/.github/workflows/release-4-publish-release.yml — same NEXUS_STAGE_DEPLOYER_* secrets Grails already uses to drop staging. Signing in GHA is allowed by https://www.apache.org/legal/release-policy.html

What stays manual (with citations)

• 72-hour PMC vote / vote start — no Tooling GHA; https://www.apache.org/legal/release-policy.html and https://tooling.apache.org/trusted-releases.html. If using ATR, discard the generated dist/dev [VOTE] email so there is only one thread.
• dist/release SVN — https://infra.apache.org/github-actions-policy.html forbids GHA writing official release data without Infra authorization. After the one ATR announce, a committer svn moves exactly dist/atr/grails/core/<version> → dist/release/grails/core/<version> (https://release-test.apache.org/docs/promoting-to-release). Polaris leaves the same svn mv manual. Do not run releaseDistributions.sh for an ATR candidate.
• ASF Reporter — login form, no documented public API, no TLP GHA precedent.
• Extra announce lists (dev@grails, users@grails, dev@groovy) — ATR rejects a second announce for the same version.

Vote-start must set download path suffix core/<version> (or core/{{VERSION}}); the announce path input is compatibility-only.

Setup

1. Configure Trusted Publishing on ATR for grails-core (workflow paths listed in RELEASE.md).
2. Optional repo var ATR_ENABLED=true to also upload from the main Release workflow.
3. Signing UID convention: Automated Release Signing <private@grails.apache.org>.

7.0.x can be cherry-picked later if wanted. Default line is 8.0.x.

Test plan

• YAML parses / validateActions allowlists the pinned apache/tooling-actions SHA
• Dry-read RELEASE.md Experimental ATR + "What GitHub Actions may automate"
• Confirm Release - Promote Nexus Staging is workflow_dispatch + environment: release and is not auto-triggered
• After Trusted Publishing is configured, dry-run ATR Upload on a milestone tag in a non-production pass

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.8258%. Comparing base (5670a65) to head (a0f3e50).
⚠️ Report is 103 commits behind head on 8.0.x.

Additional details and impacted files

@@                Coverage Diff                 @@
##                8.0.x     #16229        +/-   ##
==================================================
+ Coverage     54.8238%   54.8258%   +0.0020%     
  Complexity      20521      20521                
==================================================
  Files            2104       2104                
  Lines          101102     101102                
  Branches        17932      17932                
==================================================
+ Hits            55428      55430         +2     
+ Misses          37787      37784         -3     
- Partials         7887       7888         +1     

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[testlens-app]

✅ All tests passed ✅

🏷️ Commit: a0f3e50
▶️ Tests: 66044 executed
⚪️ Checks: 90/90 completed

---

Learn more about TestLens at testlens.app/docs.