ci(release): reuse the signed jar for JVM images; skip re-test at tag - #247
Merged
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
…#243) The two JVM image jobs (GHCR + Docker Hub) each rebuilt every Maven module from source inside Docker, ignoring the GPG-signed jars sign-artifacts had already produced. They now download the signed-jars artifact and COPY the boot jar into a runtime-only Dockerfile.release, so the published image carries the byte-identical signed artifact. A smoke step runs the image and asserts it reaches Spring Boot startup. sign-artifacts drops the redundant full test run (-P release verify -DskipTests): the tag is cut from a main commit that already passed CI, now enforced by a guard step that fails unless the tagged SHA has a successful CI run. ktlint/detekt and GPG signing at the verify phase are unchanged. Stacked on the Phase A branch (#241) since both touch release.yml. Locally validated: Dockerfile.release builds from the prebuilt jar and the smoke command reaches 'Starting IdemApplicationKt'. Signed-off-by: ifsantana <flaubert165@gmail.com>
ifsantana
force-pushed
the
ci/release-pipeline-reuse-jar
branch
from
July 16, 2026 13:16
5a360bf to
a7c1d9f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #243. Phase C of the pipeline cost/speed plan. Stacked on #244 (Phase A) — base will retarget to
mainonce #244 merges. Review #244 first.Why
Each release ran ~45–60 billed job-minutes:
sign-artifactsre-ran the full test suite even though the tagged commit already passed CI on main, and the two JVM image jobs (GHCR + Docker Hub) each rebuilt all Maven modules from source inside Docker — ignoring the signed jarssign-artifactshad already uploaded.Changes
Reuse the signed jar (new
Dockerfile.release)publish-and-sign-imageandpublish-dockerhub-jvmnowdownload-artifactthesigned-jarsbundle,cpthe repackaged boot jar to./app.jar, and build a runtime-onlyDockerfile.release(FROM eclipse-temurin:21-jre+COPY app.jar). No JDK setup, noversions:set, no in-Docker Maven build in these jobs.Dockerfileis untouched for local/from-source users.Starting IdemApplicationbefore exiting — validated locally end-to-end (image built from the prebuilt jar boots toStarting IdemApplicationKt v0.1.0-SNAPSHOT).Skip re-test at tag, guarded (#243)
sign-artifacts:-P release clean verify→-P release verify -DskipTests.gh run list --commit "$GITHUB_SHA" --workflow CI). ktlint/detekt and GPG signing (bound toverify) still run; JaCoCo auto-skips on missing exec data.Impact
Release drops from ~45–60 to ~20–30 billed job-minutes (removes 2× full Maven build + 2× JDK setup, and ~10–15 min of redundant testing on the critical path).
Test plan
Dockerfile.releasebuilds from a prebuiltapp/target/app-*.jar;timeout 90 docker runreaches the Spring Boot startup banner (smoke assertion passes).v*.*.*tag. The guard step blocks a tag placed on an untested commit.gh workflow view.