build: update CI and release for native bundles and latest jreleaser#2473
Merged
Conversation
Contributor
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughAdds Gradle tasks and naming helpers to produce platform-specific native ZIP/TAR bundles, updates CI workflows to build/upload those bundles and run an optional JReleaser dry-run, integrates downloads into release/early-access jobs, updates JReleaser artifact globs, and adapts launcher scripts and tests for platform-named binaries. ChangesNative Bundle Distribution Pipeline
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tag-and-release.yml:
- Around line 72-78: The "Download native bundles" step currently uses
actions/download-artifact@v4 with a pattern but no run-id/workflow, so it tries
to fetch artifacts from the current workflow that never uploaded the native
bundles and will fail due to if-no-files-found: error; fix by either (a) adding
the native bundle build/upload earlier in this workflow so the artifact exists
before the "Download native bundles" step (ensure artifact name matches the
pattern from step shared-build.outputs.github-short-sha), or (b) change the
download step to target the producing run by supplying run-id and/or workflow
(and token) so it downloads artifacts from the step-ci-build.yml run for the
same short SHA, or (c) if missing bundles are acceptable, change
if-no-files-found from error to warn; update the step named "Download native
bundles" accordingly and keep pattern, path and merge-multiple as needed.
In `@build.gradle`:
- Around line 332-343: commonSpec currently checks file.exists() at
configuration time, so on clean runs the native binary isn't included; change
the copy spec to use a lazy/evaluated-at-execution provider (e.g., use from {
project.layout.buildDirectory.file("native-image/${nativeExecName}") } or
from(provider { project.file("build/native-image/${nativeExecName}") }) instead
of checking exists()), leaving the dependsOn('nativeImage') in
nativeDistZip/nativeDistTar so the native image is produced before packaging;
update the logic around commonSpec's inclusion of
build/native-image/<nativeExecName> to use that closure/provider so the file is
picked up when it actually exists.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2da9224f-4f30-4d83-b929-879e3f5d6cee
📒 Files selected for processing (4)
.github/workflows/step-ci-build.yml.github/workflows/tag-and-release.ymlbuild.gradlejreleaser.yml
maxandersen
force-pushed
the
ci-release-jreleaser-update
branch
from
76a2262 to
3a4d872
Compare
maxandersen
force-pushed
the
ci-release-jreleaser-update
branch
from
3a4d872 to
a8b6a58
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/step-ci-build.yml:
- Around line 305-307: The checkout step uses actions/checkout (the step with
"uses: actions/checkout@...") and currently leaves credential persistence
enabled; update that checkout step in the artifact-handling job to add the input
persist-credentials: false so git credentials are not stored for subsequent
steps, keeping the rest of the checkout inputs (like fetch-depth) as-is.
- Around line 298-303: The new job jreleaser-dry-run currently inherits broad
workflow token permissions; add an explicit least-privilege permissions block
under the jreleaser-dry-run job to restrict the GITHUB_TOKEN (for example set
"permissions: contents: read" and only add other specific permissions if this
job actually requires them) so the job no longer gets overly-broad default
rights; update the jreleaser-dry-run job definition to include that permissions
mapping and remove any unused scopes.
In @.github/workflows/tag-and-release.yml:
- Around line 25-31: The workflow currently relies on default token permissions
for the ci-build job that reuses ./.github/workflows/step-ci-build.yml; add an
explicit least-privilege permissions block (at the workflow root or the ci-build
job) that restricts scopes to only what the reusable workflow needs (for
example: contents: read and id-token: write if OIDC is required) and avoid broad
write permissions; if the reusable workflow requires any additional specific
scopes, enumerate them explicitly rather than using defaults or broad write
access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 16060fc6-3360-4039-ad12-7d9a6f947b11
📒 Files selected for processing (4)
.github/workflows/step-ci-build.yml.github/workflows/tag-and-release.ymlbuild.gradlejreleaser.yml
Comment on lines
+298
to
+303
| jreleaser-dry-run: | ||
| needs: [build-shared, build-test-native-image] | ||
| if: needs.build-shared.result == 'success' && needs.build-test-native-image.result == 'success' | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| JRELEASER_VERSION: 1.24.0 |
Contributor
There was a problem hiding this comment.
Scope token permissions for the new jreleaser-dry-run job.
Line 298 introduces a new job but no explicit permissions, so it inherits broad defaults. Please set least-privilege permissions at workflow/job scope.
🔧 Proposed hardening
jreleaser-dry-run:
+ permissions:
+ contents: read
needs: [build-shared, build-test-native-image]
if: needs.build-shared.result == 'success' && needs.build-test-native-image.result == 'success'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| jreleaser-dry-run: | |
| needs: [build-shared, build-test-native-image] | |
| if: needs.build-shared.result == 'success' && needs.build-test-native-image.result == 'success' | |
| runs-on: ubuntu-latest | |
| env: | |
| JRELEASER_VERSION: 1.24.0 | |
| jreleaser-dry-run: | |
| permissions: | |
| contents: read | |
| needs: [build-shared, build-test-native-image] | |
| if: needs.build-shared.result == 'success' && needs.build-test-native-image.result == 'success' | |
| runs-on: ubuntu-latest | |
| env: | |
| JRELEASER_VERSION: 1.24.0 |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 298-347: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/step-ci-build.yml around lines 298 - 303, The new job
jreleaser-dry-run currently inherits broad workflow token permissions; add an
explicit least-privilege permissions block under the jreleaser-dry-run job to
restrict the GITHUB_TOKEN (for example set "permissions: contents: read" and
only add other specific permissions if this job actually requires them) so the
job no longer gets overly-broad default rights; update the jreleaser-dry-run job
definition to include that permissions mapping and remove any unused scopes.
Comment on lines
+305
to
+307
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | ||
| with: | ||
| fetch-depth: 0 |
Contributor
There was a problem hiding this comment.
Disable persisted checkout credentials in artifact-handling job.
Line 305 checks out code with default credential persistence. For this job, set persist-credentials: false to reduce token exposure risk.
🔧 Proposed hardening
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 305-307: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/step-ci-build.yml around lines 305 - 307, The checkout
step uses actions/checkout (the step with "uses: actions/checkout@...") and
currently leaves credential persistence enabled; update that checkout step in
the artifact-handling job to add the input persist-credentials: false so git
credentials are not stored for subsequent steps, keeping the rest of the
checkout inputs (like fetch-depth) as-is.
Comment on lines
+25
to
+31
| ci-build: | ||
| needs: check-debug | ||
| uses: ./.github/workflows/step-ci-build.yml | ||
| with: | ||
| debug_enabled: ${{ needs.check-debug.outputs.debug_enabled == 'true' }} | ||
| debug_detached: true | ||
| skip_tests: false |
Contributor
There was a problem hiding this comment.
Add explicit least-privilege permissions for this workflow.
Line 25 adds the new reusable CI entrypoint, but the workflow still relies on default token permissions. Please declare explicit permissions to avoid unnecessary write scope.
🔧 Proposed hardening
on:
push:
tags:
- 'v*'
name: tag-and-release
+permissions:
+ contents: read
jobs:
check-debug:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| ci-build: | |
| needs: check-debug | |
| uses: ./.github/workflows/step-ci-build.yml | |
| with: | |
| debug_enabled: ${{ needs.check-debug.outputs.debug_enabled == 'true' }} | |
| debug_detached: true | |
| skip_tests: false | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| name: tag-and-release | |
| permissions: | |
| contents: read | |
| jobs: | |
| ci-build: | |
| needs: check-debug | |
| uses: ./.github/workflows/step-ci-build.yml | |
| with: | |
| debug_enabled: ${{ needs.check-debug.outputs.debug_enabled == 'true' }} | |
| debug_detached: true | |
| skip_tests: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 25-31: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tag-and-release.yml around lines 25 - 31, The workflow
currently relies on default token permissions for the ci-build job that reuses
./.github/workflows/step-ci-build.yml; add an explicit least-privilege
permissions block (at the workflow root or the ci-build job) that restricts
scopes to only what the reusable workflow needs (for example: contents: read and
id-token: write if OIDC is required) and avoid broad write permissions; if the
reusable workflow requires any additional specific scopes, enumerate them
explicitly rather than using defaults or broad write access.
3976db6 to
63c7537
Compare
CI (step-ci-build.yml): - Build native bundles (nativeDistZip/nativeDistTar) per platform - Upload native bundles as artifacts - Add jreleaser dry-run job to validate release process on PRs Release (tag-and-release.yml): - Reuse step-ci-build.yml as a called workflow for build/test/native bundles - Release job downloads artifacts from CI and runs JReleaser - Update jreleaser from 1.19.0 to 1.24.0 - Fix deprecated set-output to use GITHUB_OUTPUT Build (build.gradle): - Add nativeDistZip and nativeDistTar tasks - Add getNativeBundleOs/Arch/BaseName helpers for consistent naming - Fix commonSpec native image inclusion to be lazy (not config-time) JReleaser (jreleaser.yml): - Add native bundle artifacts (mac-aarch64, linux-x64, windows-x64) as optional release files (active: RELEASE, skipArtifact on missing) Split from #2467.
…apper and App IntegrationManager now resolves jbang.jar by directory instead of suffix replacement, so jbang-linux-x64.bin finds jbang.jar correctly. Wrapper and App checks now accept any .bin/.bin.exe suffix instead of hardcoded jbang.bin.
maxandersen
force-pushed
the
ci-release-jreleaser-update
branch
from
63c7537 to
a0e4a00
Compare
macOS uname -m returns 'arm64' but Gradle names the binary with 'aarch64'. Merge the two cases so the script finds jbang-mac-aarch64.bin.
Collaborator
Author
|
rebased and merged |
maxandersen
added a commit
to stalep/jbang
that referenced
this pull request
May 27, 2026
The native build (PR jbangdev#2473) now produces platform-suffixed binaries like jbang-linux-x64.bin / jbang-windows-x64.bin.exe. Match by suffix (.bin / .bin.exe) instead of exact file name so 'jbang wrapper install' works again when run from the native image.
maxandersen
added a commit
to stalep/jbang
that referenced
this pull request
May 27, 2026
The native build (PR jbangdev#2473) now produces platform-suffixed binaries like jbang-linux-x64.bin / jbang-windows-x64.bin.exe. Match by suffix (.bin / .bin.exe) instead of exact file name so 'jbang wrapper install' works again when run from the native image.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Flow (main)
PR Build
graph TD PR[PR opened/updated] --> CI[ci-build.yml] CI --> SCB[step-ci-build.yml] SCB --> FC[format-check] SCB --> BS[build-shared] BS --> NI[build-test-native-image<br/>3 OS] BS --> UT[unit-test-jvm<br/>3 OS × Java 11] BS --> IT[integration-test-jvm<br/>matrix] BS --> SM[smoke-test] NI --> |uploads| A1[jbang.bin per OS] UT --> MR[merge-test-reports] IT --> MR NI --> MRMain Build
graph TD PUSH[push to main] --> MB[main-build.yml] MB --> SCB["step-ci-build.yml<br/>(skip_tests: true ⚠️)"] SCB --> JR["jreleaser job<br/>(just tree -a build ⚠️)"]Release
graph TD TAG[push v* tag] --> BUILD["single ubuntu job<br/>⚠️ standalone, not reusing CI"] BUILD --> B1[gradle build + publish] B1 --> B2[integration-test Java 11 only] B2 --> B3["version extract<br/>⚠️ deprecated set-output"] B3 --> JR["JReleaser 1.19.0"]Problems
jbang.zip/jbang.tar, no platform-specific binariesskip_tests: true— never actually validates mainmain-build.ymlincomplete (justtree -a build)::set-outputProposed Flow (this PR)
PR Build — enhanced
graph TD PR["PR (version: 0.138.0.10-SNAPSHOT)"] --> CI[ci-build.yml] CI --> SCB[step-ci-build.yml] SCB --> FC[format-check] SCB --> BS[build-shared] BS --> NI[build-test-native-image<br/>3 OS] BS --> UT[unit-test-jvm<br/>3 OS] BS --> IT[integration-test-jvm<br/>matrix] BS --> SM[smoke-test] NI --> |uploads| A1[jbang.bin per OS] NI --> |NEW| A2["native bundles<br/>jbang-{os}-{arch}.tar/.zip"] BS --> DRY["NEW: jreleaser dry-run<br/>JReleaser 1.24.0"] NI -.-> |runs even if NI fails| DRY UT --> MR[merge-test-reports] IT --> MR NI --> MR style DRY fill:#9f9,stroke:#333 style A2 fill:#9f9,stroke:#333Main Build — full CI + earlyaccess
graph TD PUSH["push to main<br/>(version: 0.138.0.10-SNAPSHOT)"] --> MB[main-build.yml] MB --> SCB["step-ci-build.yml<br/>(full CI with tests)"] SCB --> |all jobs complete| EA[earlyaccess job] EA --> |downloads| A1[shared-build] EA --> |downloads| A2[native bundles] EA --> JR["JReleaser full-release<br/>SNAPSHOT → auto pre-release<br/>skips brew, sdkman, etc."] style EA fill:#9f9,stroke:#333Release — lean, validated
graph TD TAG["push v* tag<br/>(version: 0.139.0)"] --> CD[check-debug] TAG --> VAL[validate-release] VAL --> |verify on main| V1[git merge-base] VAL --> |verify CI passed| V2[gh api commit status] VAL --> BS[build-shared<br/>gradle build + publish] BS --> NI[build-native-image<br/>3 OS] BS --> SM[smoke-test] NI --> REL[release] SM --> REL CD --> REL REL --> JR["JReleaser 1.24.0<br/>non-SNAPSHOT → full release"] style VAL fill:#ff9,stroke:#333 style REL fill:#9f9,stroke:#333Version Strategy
Nisse plugin with
appendSnapshot = true:0.138.0.10-SNAPSHOT0.138.0.10-SNAPSHOTactive: RELEASEdistributors0.139.0Release Artifacts
jbang.zip/jbang.tarjbang-0.139.0-linux-x64.tarjbang-linux-x64.tarlatest/download/URLsPlatform bundles contain
jbang-<os>-<arch>.bin(e.g.jbang-linux-x64.bin).Scripts look for
jbang-<os>-<arch>.binfirst, thenjbang.binas fallback.Strictness
Improvements
jbang-linux-x64.bin— deterministic, no conflictsstep-ci-build.yml; release is leanGITHUB_OUTPUT, JReleaser 1.24.0Split from #2467.
Summary by CodeRabbit
New Features
Chores