Add Temporal-backed Java SDK release automation - #2986
Conversation
Orchestrate immutable sdk-java release candidates with transient GitHub Actions Workers, a no-input approval Update, privileged publication queues, and exact-state external reconciliation.
Make release progress explicitly staged and controllable, bind approval to a locked release-specific GitHub issue, and make Maven and GitHub publication reconciliation safe across ambiguous retries. Add a durable emergency handoff path, frozen Worker routing, prompt Activity cancellation, idempotent native builds, and focused local tests.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Harden the Temporal state machine, publication reconciliation, approval recovery, and transient Worker behavior. Add protected Maven generation authorization, draft-first exact asset handling, maintenance-branch recovery, and both automated and independent emergency paths.
Bind release workflows to the exact receipted Candidate run, separate candidate compilation from credentialed artifact storage, adopt fallback artifacts across reruns, and classify S3 absence without masking service failures.
| run: | | ||
| [[ ",${{ vars.RELEASE_AUTOMATION_REF }},${{ vars.RELEASE_AUTOMATION_COMPATIBLE_REFS }}," == \ | ||
| *",$AUTOMATION_COMMIT,"* ]] | ||
| [[ "$PHASE" != PUBLISHED ]] | ||
| if [[ '${{ inputs.do_publish_jars }}' == true && \ | ||
| '${{ steps.before.outputs.maven_started }}' == true ]]; then | ||
| echo "Automatic Maven publication already started. Do not hand off with Maven enabled." >&2 | ||
| exit 1 | ||
| fi | ||
| if [[ '${{ inputs.do_publish_jars }}' != true && \ | ||
| '${{ steps.before.outputs.maven_started }}' == true && \ | ||
| '${{ steps.before.outputs.maven_complete }}' != true ]]; then | ||
| echo "Automatic Maven publication is incomplete. Recover it in Temporal before handoff." >&2 | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
Opengrep — security.gha.run-shell-injection-inputs (WARNING)
A composite-action / reusable-workflow / workflow_dispatch inputs.* value is interpolated directly into this run/script block. Inputs are supplied by the caller, who may pass attacker-controlled data into them — e.g. a caller invoking this with version: ${{ github.event.pull_request.head.ref }} (a fork branch name). Because the input value is substituted before the shell runs, the callee cannot trust it. Defensive fix: copy the input into a step-level env: entry (e.g. VERSION: ${{ inputs.version }}) and reference the quoted environment variable in the script instead (echo "$VERSION"). This is advisory (WARNING): not every input carries untrusted data, but routing inputs through env: makes the component safe regardless of how callers use it. If an input appears only as a condition selecting between hard-coded string literals (e.g. ${{ inputs.flag && 'a' || 'b' }}), the emitted value is constant and that specific use is not exploitable — but hoist the condition into bash (set a boolean env: var and branch with if) so the run line carries no ${{ }} and the safety stays local and stable. Directly-untrusted github.* contexts are covered separately by security.gha.run-shell-injection.
Fixed in 97d0f67
Fixed in 950708b
Fixed in 8b9c351
Fixed in 07b1c23
1 participant
What changed?
temporalio/sdkmembers, durable pause/resume/handoff, and scheduled runner recovery.prepare-release.ymlas the only manual release procedure. It takes durable Temporal ownership and refuses to publish Maven after automatic Maven submission has started.Why?
The current Actions-only process loses orchestration state with its runner. Temporal keeps control state durable; GitHub Actions artifacts hold transient binary payloads so later jobs can resume the exact release.
Sonatype cannot atomically create a staging repository and persist its ID in Temporal. An ambiguous creation therefore stops for inspection and explicit authorization before another submission generation.
Breaking changes?
No SDK API changes. The automation remains inactive until its Temporal Cloud, GitHub environment, signing, and Maven Central settings are configured.
Server PR
None.
No release, test release, Maven publication, tag push, or GitHub release was performed while testing this change.