Skip to content

固定发布工作流使用 Maven 3.9.16 #4136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
binarywang merged 4 commits into from
Oct 9, 2026
Merged

固定发布工作流使用 Maven 3.9.16 #4136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7696b24
Initial plan
Copilot Oct 9, 2026
d3be86b
固定发布工作流使用 Maven 3.9.16
Copilot Oct 9, 2026
17f435e
移除未使用的 Windows Maven Wrapper
Copilot Oct 9, 2026
8d80f80
Update Maven wrapper properties for version 3.9.16
binarywang Oct 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/maven-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,13 +93,13 @@ jobs:
fi
echo "Final version: $VERSION"
echo "VERSION=$VERSION" >> $GITHUB_ENV
mvn versions:set -DnewVersion=$VERSION --no-transfer-progress
./mvnw versions:set -DnewVersion=$VERSION --no-transfer-progress
env:
TZ: Asia/Shanghai

- name: Publish to Maven Central
run: |
mvn clean deploy -P release \
./mvnw clean deploy -P release \
-Dmaven.test.skip=true \
-Dgpg.args="--batch --yes --pinentry-mode loopback" \
--no-transfer-progress
Expand Down
4 changes: 4 additions & 0 deletions .mvn/wrapper/maven-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
wrapperVersion=3.3.4
distributionType=only-script
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge 为下载的 Maven 发行包配置校验和

当 Maven Wrapper 缓存未命中时，该 URL 对应的压缩包会被直接下载、解压并执行；由于未设置 distributionSha256Sum，新增脚本中的校验分支会被跳过。发布作业同时持有 Maven Central 凭据和已导入的 GPG 私钥，因此下载源或传输链路一旦返回被篡改的归档，就可能执行任意代码并窃取发布凭据或伪造制品；请在此处固定 Apache 官方公布的 SHA-256 值，使校验失败时终止发布。

AGENTS.md reference: AGENTS.md:L104-L106

Useful? React with 👍 / 👎.

Comment thread
Copilot marked this conversation as resolved.
distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce
295 changes: 295 additions & 0 deletions mvnw
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading