ci(release): publish after manual dispatch without environment approval

Author: moonyue-w

.github/scripts/central_release.py

@@ -110,20 +110,6 @@ def check_ci(info):
             'Quality and all five Java CI jobs must succeed')
 
 
-def check_environment():
-    environment = gh('environments/release')
-    require(environment and any(rule.get('type') == 'required_reviewers' and rule.get('reviewers')
-                                for rule in environment.get('protection_rules', [])),
-            'Configure required reviewers on the release environment before publication')
-    policy = environment.get('deployment_branch_policy') or {}
-    require(policy.get('custom_branch_policies') and not policy.get('protected_branches'),
-            'Configure the release environment with a main-only branch policy')
-    branches = gh('environments/release/deployment-branch-policies')
-    entries = branches.get('branch_policies', []) if branches else []
-    require(len(entries) == 1 and entries[0].get('name') == 'main' and entries[0].get('type') == 'branch',
-            'release environment must allow only the main branch')
-
-
 def read_bundle(path, version):
     prefix = f'com/qoder/qca-sdk/{version}/qca-sdk-{version}'
     primary = {prefix + suffix for suffix in ('.pom', '.jar', '-sources.jar', '-javadoc.jar')}
@@ -162,7 +148,6 @@ def preflight(source, output):
         check_main(info)
         require(gh(f'git/ref/tags/{tag_name(info)}') is None, 'Tag already exists; use resume_run_id')
     check_ci(info)
-    check_environment()
     output.mkdir(parents=True, exist_ok=True)
     save(output / 'intent.json', info)
     (output / 'release-notes.md').write_text(notes)

.github/scripts/test_central_release.py

@@ -125,17 +125,42 @@ def test_tag_rejects_moved_sha_and_changed_bundle(self):
         with patch.object(release, 'gh', side_effect=[ref, tag]), self.assertRaisesRegex(ValueError, 'source differs'):
             release.check_tag(self.info)
 
-    def test_release_requires_reviewers_and_main_only_environment(self):
-        environment = dict(protection_rules=[dict(type='required_reviewers', reviewers=[dict(id=1)])],
-                           deployment_branch_policy=dict(custom_branch_policies=True, protected_branches=False))
-        branches = dict(branch_policies=[dict(name='main', type='branch')])
-        with patch.object(release, 'gh', side_effect=[environment, branches]):
-            release.check_environment()
-        with patch.object(release, 'gh', return_value=None), self.assertRaisesRegex(ValueError, 'required reviewers'):
-            release.check_environment()
-        branches['branch_policies'].append(dict(name='*', type='branch'))
-        with patch.object(release, 'gh', side_effect=[environment, branches]), self.assertRaisesRegex(ValueError, 'only the main'):
-            release.check_environment()
+    def test_preflight_without_environment_still_requires_current_main_and_ci(self):
+        source, candidate = self.output / 'source', self.output / 'candidate'
+        coordinates = '<groupId>com.qoder</groupId><artifactId>qca-sdk</artifactId><version>1.2.3</version>'
+        project = '<project xmlns="http://maven.apache.org/POM/4.0.0">{}</project>'
+        files = {
+            'pom.xml': project.format(coordinates),
+            'examples/pom.xml': project.format(
+                '<version>1.2.3</version><dependencies><dependency>' + coordinates + '</dependency></dependencies>'),
+            'src/main/resources/com/qoder/cloudagents/version.properties': 'version=${project.version}\n',
+            'CHANGELOG.md': '# Changelog\n\n## [Unreleased]\n\n## [1.2.3]\n\n### Added\n\n- Release example.\n',
+        }
+        for name, contents in files.items():
+            path = source / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(contents)
+        responses = {
+            'commits/main': dict(sha='a' * 40),
+            'git/ref/tags/v1.2.3': None,
+            'actions/workflows/ci.yml/runs?event=push&branch=main&head_sha=' + 'a' * 40:
+                dict(workflow_runs=[dict(id=10, head_sha='a' * 40, conclusion='success')]),
+            'actions/runs/10/jobs?per_page=100':
+                dict(jobs=[dict(name=name, conclusion='success') for name in release.CHECKS]),
+        }
+        # Any request for repository protections or an environment fails this test.
+        with patch.object(release, 'git', return_value='a' * 40), \
+                patch.object(release, 'gh', side_effect=responses.__getitem__):
+            release.preflight(source, candidate)
+            self.assertEqual(release.identity(), json.loads((candidate / 'intent.json').read_text()))
+            self.assertIn('Release example.', (candidate / 'release-notes.md').read_text())
+            responses['commits/main']['sha'] = 'c' * 40
+            with self.assertRaisesRegex(ValueError, 'main changed'):
+                release.preflight(source, candidate)
+            responses['commits/main']['sha'] = 'a' * 40
+            responses['actions/runs/10/jobs?per_page=100']['jobs'][0]['conclusion'] = 'failure'
+            with self.assertRaisesRegex(ValueError, 'all five'):
+                release.preflight(source, candidate)
 
     def test_recovery_cannot_upload(self):
         with patch.dict(os.environ, RESUME_RUN_ID='123'), patch.object(release, 'check_tag'), \

.github/workflows/release.yml

@@ -71,7 +71,7 @@ jobs:
           make quality
           make test
           cp target/package-check.json ../candidate/
-      - name: Show source and release notes for review
+      - name: Record source, release notes and candidate digests
         run: |
           printf '### Release source\n\nVersion: `%s`\n\nSHA: `%s`\n\nBatch: `%s`\n\n' "$RELEASE_VERSION" "$RELEASE_SHA" "$RELEASE_BATCH" >> "$GITHUB_STEP_SUMMARY"
           cat candidate/release-notes.md >> "$GITHUB_STEP_SUMMARY"
@@ -93,7 +93,6 @@ jobs:
     needs: preflight
     runs-on: ubuntu-latest
     timeout-minutes: 50
-    environment: release
     permissions:
       contents: write
       actions: read
@@ -127,7 +126,7 @@ jobs:
           MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_KEY }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
         run: |
-          test "$CENTRAL_NAMESPACE" = com.qoder || { echo 'Verify com.qoder in Central Portal and set CENTRAL_NAMESPACE in the release environment'; exit 1; }
+          test "$CENTRAL_NAMESPACE" = com.qoder || { echo 'Verify com.qoder in Central Portal and set the CENTRAL_NAMESPACE repository Actions variable'; exit 1; }
           test -n "$CENTRAL_USERNAME" && test -n "$CENTRAL_PASSWORD" || { echo 'Central Portal token secrets are missing'; exit 1; }
           if [[ -z "$RESUME_RUN_ID" ]]; then
             test -n "$MAVEN_GPG_KEY" && test -n "$MAVEN_GPG_PASSPHRASE" || { echo 'GPG signing secrets are missing'; exit 1; }

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 ### Validation
 
-- Manual Maven Central release workflow with source/CI checks, reviewed artifact digests, signing, retained deployment recovery, public package verification and matching GitHub Release notes. Publishing requires separate account and environment setup.
+- Manual Maven Central release workflow with source/CI checks, verified artifact digests, signing, retained deployment recovery, public package verification and matching GitHub Release notes. Publishing uses repository Actions secrets and proceeds after preflight without a separate environment approval.
 - Disposable-key signing checks verify the release bundle without uploading it to Maven Central.
 - Accept documented assistant-message projections in Realtime Work History while still checking Work IDs, terminal events and pagination.
 - Complete Schedule/Batch execution, Usage pagination/filtering, Identity SAT permissions/revocation and Realtime Work/History acceptance in CN and Global.

docs/maintaining.md

@@ -43,4 +43,4 @@ The current version remains `0.1.0-SNAPSHOT`. A SNAPSHOT can resolve to differen
 
 GitHub CI produces candidate JARs, sources, Javadoc, checksums and test reports. A successful CI run is not a Maven Central publication or a live-environment acceptance result. The default workflow uses mock services; run the opt-in checks in [live testing](live-testing.md) with separately supplied credentials and isolated resources when needed.
 
-See [release setup](releasing.md) for repository protection, Central registration and signing secrets, the manual publication workflow and deployment recovery. The workflow requires a configured, reviewed `release` environment; adding workflow files alone does not enable public publication.
+See [release setup](releasing.md) for optional repository protection, Central registration and repository Actions secrets, the manual publication workflow and deployment recovery. A manual dispatch from `main` proceeds after preflight without a separate environment approval. Central credentials and signing setup are still required; adding workflow files alone does not enable public publication.

docs/releasing.md

@@ -1,20 +1,22 @@
 # Java SDK release setup
 
-The development version is `com.qoder:qca-sdk:0.1.0-SNAPSHOT`. The manual [Release workflow](../.github/workflows/release.yml) implements publication, but cannot publish until the Central account, namespace, signing key and GitHub environment below are configured. The GitHub repository and internal Maven access do not grant Maven Central publishing access. No public release has been made by adding this workflow.
+The development version is `com.qoder:qca-sdk:0.1.0-SNAPSHOT`. The manual [Release workflow](../.github/workflows/release.yml) implements publication using repository Actions secrets. Dispatching it from `main` authorizes publication after all automated checks pass; there is no separate environment approval. The Central account, namespace, signing key and repository settings below must be configured first. The GitHub repository and internal Maven access do not grant Maven Central publishing access. No public release has been made by adding this workflow.
 
-## Activate GitHub protection
+## Optional GitHub protection
 
-After the first reviewed public source push, run CI and confirm all six checks described in [maintenance](maintaining.md) appear. A repository administrator can then apply the prepared payloads. Inspect existing rules first and update matching rules rather than creating duplicates:
+Branch/tag rules and a `release` environment are not prerequisites for this workflow. Its own checks require a manual dispatch from `main`, the intended source SHA and all six successful CI jobs described in [maintenance](maintaining.md).
+
+A repository administrator can optionally apply the prepared main and tag protection payloads later. Inspect existing rules first and update matching rules rather than creating duplicates:
 
 ```sh
 gh api repos/QoderAI/qoder-cloud-agents-sdk-java/rulesets
 gh api --method POST repos/QoderAI/qoder-cloud-agents-sdk-java/rulesets --input .github/config/main-ruleset.json
 gh api --method POST repos/QoderAI/qoder-cloud-agents-sdk-java/rulesets --input .github/config/tag-ruleset.json
-gh api --method PUT repos/QoderAI/qoder-cloud-agents-sdk-java/environments/release --input .github/config/release-environment.json
-gh api --method POST repos/QoderAI/qoder-cloud-agents-sdk-java/environments/release/deployment-branch-policies --input .github/config/release-branch.json
 ```
 
-The main and `v*` tag protection follows the Go repository baseline. The prepared `release` environment uses maintainer `moonyue-w` (GitHub user ID 300878504), permits `main`, and does not prevent self-review, matching the existing SDK setup. Check that reviewer membership and repository policy are still correct before activation. Applying these settings requires repository administrator access. Configuration files do not activate remote settings by themselves.
+The main and `v*` tag protection follows the Go repository baseline. Configuration files do not activate remote settings by themselves. Without tag protection, the workflow still rejects conflicting tags and never overwrites them, but GitHub does not prevent another authorized actor from changing them.
+
+The unused `release-environment.json` and `release-branch.json` files remain optional templates for adopting environment approval later. To use them, first review the named reviewer and policy, explicitly add `environment: release` to the publishing job, and configure its credentials in that environment. Creating an environment alone does not attach it to this workflow.
 
 ## Read-only release preflight
 
@@ -48,7 +50,7 @@ The release workflow uses this bundle-only mode, then uploads the retained bundl
 4. In the publisher's [account page](https://central.sonatype.com/account), generate a **User Token**. The generated username/password pair is used for publication; it is not the normal account login password.
 5. Prepare a team-owned, passphrase-protected GPG signing key. Retain its backup securely and make its public key discoverable as required by [Central's GPG guide](https://central.sonatype.org/publish/requirements/gpg/). The workflow expects an ASCII-armored exported OpenPGP secret key, compatible with Maven GPG Plugin's BC signer. Export only the intended signing key.
 
-In repository **Settings → Environments → release**, configure:
+In repository **Settings → Secrets and variables → Actions**, configure repository-level values:
 
 | Kind | Name | Value |
 | --- | --- | --- |
@@ -58,15 +60,15 @@ In repository **Settings → Environments → release**, configure:
 | Secret | `MAVEN_GPG_KEY` | ASCII-armored exported private signing key |
 | Secret | `MAVEN_GPG_PASSPHRASE` | Passphrase for that signing key |
 
-Do not put credentials in POMs, repository files, command-line arguments or chat. For example, `gh secret set CENTRAL_USERNAME --repo QoderAI/qoder-cloud-agents-sdk-java --env release` reads the value interactively; repeat for the password. An exported key file can be redirected to `gh secret set MAVEN_GPG_KEY ...` without printing it. The public signing key must be registered separately; configuring a private-key secret does not publish its public key.
+Do not put credentials in POMs, repository files, command-line arguments or chat. For example, `gh secret set CENTRAL_USERNAME --repo QoderAI/qoder-cloud-agents-sdk-java` reads the value interactively; repeat for the password and passphrase. An exported key file can be redirected to `gh secret set MAVEN_GPG_KEY ...` without printing it. Do not use `--env release`: environment-only secrets are unavailable to this workflow. The public signing key must be registered separately; configuring a private-key secret does not publish its public key.
 
-The namespace variable is a maintainer's setup confirmation, not an automatic ownership check. Portal enforces actual publishing permissions during upload. The workflow stops before signing/uploading when its required settings are absent. Use the prepared required-reviewer and main-only environment rules above before the first release.
+The namespace variable is a maintainer's setup confirmation, not an automatic ownership check. Portal enforces actual publishing permissions during upload. The workflow stops before signing/uploading when its required settings are absent. Configuring repository secrets is separate from setting branch/tag protections; a repository administrator may need to enter the credentials if the current maintainer lacks that permission.
 
 ## Prepare and publish a release
 
 Prepare a PR that updates the root POM, the example project's version and SDK dependency, plus the changelog version section. Keep an empty `Unreleased` section. Review any version-specific install examples. Merge only after `quality` and all five Java checks succeed. The workflow does not bump versions or merge the PR.
 
-Open **Actions → Release → Run workflow**, select **main**, and enter:
+Open **Actions → Release → Run workflow**, select **main**, and verify the following inputs before dispatch. Successful preflight automatically proceeds to signing and publication; it does not pause for an additional approval.
 
 | Input | First publication |
 | --- | --- |
@@ -78,12 +80,12 @@ Open **Actions → Release → Run workflow**, select **main**, and enter:
 
 The stages are:
 
-1. **preflight** checks input, POM/changelog, current main and the latest successful main CI run with all six required jobs. It re-runs quality, SDK tests and packaged consumer tests, then shows the notes and unsigned package hashes for approval.
-2. **publish** waits for the `release` environment reviewer. It rebuilds and signs with JDK 17, compares the JAR/POM/sources/Javadoc bytes to the reviewed candidate, and retains the exact signed bundle before any upload. It checks main again and creates an annotated `v<version>` tag binding the SHA, batch and bundle digest. It uploads once with `USER_MANAGED` publishing, immediately retains the deployment ID, waits for Central validation, requests publication, and waits for `PUBLISHED`.
-3. **verify** waits for the public Maven files and compares every payload, signature and checksum with the approved bundle. It then runs the independent example/consumer tests against Maven Central using empty Maven settings and a fresh local dependency cache; it never installs the SDK locally first.
+1. **preflight** checks input, POM/changelog, current main and the latest successful main CI run with all six required jobs. It re-runs quality, SDK tests and packaged consumer tests, then records the notes and unsigned package hashes in the run summary.
+2. **publish** starts automatically after preflight succeeds. It rebuilds and signs with JDK 17, compares the JAR/POM/sources/Javadoc bytes to the verified candidate, and retains the exact signed bundle before any upload. It checks main again and creates an annotated `v<version>` tag binding the SHA, batch and bundle digest. It uploads once with `USER_MANAGED` publishing, immediately retains the deployment ID, waits for Central validation, requests publication, and waits for `PUBLISHED`. `USER_MANAGED` separates Central validation from the publish API call; the workflow makes that call automatically.
+3. **verify** waits for the public Maven files and compares every payload, signature and checksum with the retained bundle. It then runs the independent example/consumer tests against Maven Central using empty Maven settings and a fresh local dependency cache; it never installs the SDK locally first.
 4. **release-notes** creates the matching GitHub Release only after verification succeeds. Existing notes must match exactly; the workflow does not overwrite conflicting releases.
 
-The `release-bundle` artifact contains the signed archive, file digests, source/batch/workflow identity and approved notes. `central-receipt` records the deployment ID. Retention is 90 days; keep a durable copy for longer recovery needs. The workflow does not include signing secrets in artifacts. Public download verification or consumer failures do not undo a Central publication.
+The `release-bundle` artifact contains the signed archive, file digests, source/batch/workflow identity and release notes. `central-receipt` records the deployment ID. Retention is 90 days; keep a durable copy for longer recovery needs. The workflow does not include signing secrets in artifacts. Public download verification or consumer failures do not undo a Central publication.
 
 ## Recover without replacing a published version